1. Attachments are working again! Check out this thread for more details and to report any other bugs.

Hacking the Prius computers

Discussion in 'Gen 2 Prius Accessories & Modifications' started by aeronaut, Jun 30, 2007.

Page 1 of 3
  1. aeronaut

    aeronaut New Member

    Joined:
    May 19, 2007
    29
    1
    0
    Location:
    Evanston, Il
    Greetings,

    Just got my '07 Touring edition, package #2, in Silver Pine Mica.

    Here's the $64,000 question. Can anyone hack the code in the Prius's computer? There's a number of things that one might consider modifying:

    1) From what I understand, the Prius keeps the battery somewhere between 40% and 70% charged all the time. While this is done to conserve battery life, it might be useful to use a little more of the capacity built into the Ni-Mh cells in the car.

    From basic principles, all the energy in the battery comes from gas (as presently configured,) so it doesn't really matter if one uses the middle 30% or the middle 60% of the capacity - all the electricity was made by burning gas.

    The stock batteries and EV mode have a range of about a mile. If one were to use more of the Ni-Mh cells capacity, one could get 2-3 miles out of the cells. And of course, if one had empty batteries, and could charge them from the plug, one could get about the same effective MPG as the Tesla roadster when using this tech for short trips.

    But the first step to all of this is to be able to change the way the Prius manages the Ni-Mh battery. Without that, there's no point in working on the rest.

    2) The display has several limitations. For example, it can't handle fuel effencies of better than 99.9 MPG. Why not give it a little smarts and be able to display up to 200 MPG. That way, the pulse glide people would be able to see exactly what they are getting. I'd like to get more of the consumption info onto the energy screen. It would be great if Toyota could use the people out here to tweak and tinker with the interface so that they can take the results and incorporate them into future Priora (plural of Prius.)

    3) Driving characteristics - with my foot off the gas and brake, my Prius slows down a little bit, drawing a small amount of current into the battery (via regen.) Braking draws more, and pushing a little on the gas puts the car into glide mode. From a stop, removing my foot from the brake starts me moving slowly forward. Why not be able to play with these parameters? I'd love to have the default position of no gas no brake be a glide position, and watch the car speed up a bit on downhills, slow up more on uphills, and let air resistance and internal friction be the only things slowing me down on level ground. Change the name of the brake and gas to the accelerator and decelerator. Perhaps set up a screen where one can choose between several different settings for the pedals, so that someone borrowing the car won't run into someone ahead of them at a stoplight because they don't understand how I have my pedals configured. Allow people to have personal options for the pedal functions, and choose from among stock sets and custom sets.

    Bottom line - I'm a devotee of the GNU open source model, allowing the "marketplace" of people who can write code to make changes, and the "marketplace" of consumers decide which ones are the best. This model has worked great for things like Apache; why can't we mess around with the Prius code?

    Sure, one can argue that bad programming could cause a big accident. That's a risk, and I would hope that only people who know what they are doing would attempt this kind of work. And please spare the jokes about making the Prius crash as often as windows does, with worse effect. Clearly Toyota won't open the gates and hand out source code and programming tools. Has anyone tried this? Does anyone have any leads or info about how to get into the computer? So far, what I understand is that the people doing plug-in conversions are basically "tricking" the computer, and controlling it externally with their own electronics, so it sounds like they aren't really inside it's head, just controlling it's inputs. Heck, that's the same thing that's happening in Darylldd's mod to show the rear view camera anytime - we trick the car into thinking we're in reverse, but hide the info from the reverse lights with the diode. Not that this is a bad thing - far from it. Darylldd (and whoever worked before/with him on this,) did a fine job of doing what they wanted to do. I'm looking for something deeper - even if it's for something as flippant as putting a crosshairs on the rear display that can be controlled with a joystick (next step, paintball gun in the rear, ....)

    Anyone got the goods on the computer?

    Regards,
    aeronaut
     
    #1 aeronaut, Jun 30, 2007
  2. slair

    slair Ubër Senior Member

    Joined:
    May 11, 2007
    404
    0
    0
    Location:
    Lafayette, IN
    Vehicle:
    2005 Prius
    <div class='quotetop'>QUOTE(aeronaut @ Jun 30 2007, 03:09 PM) [snapback]470680[/snapback]</div>
    YES sweet!. Finally someone I can get along with. :lol: I dont run die hard GNU but I do run linux as my main OS. ya ya, G.N.U. Gnu not unix, ./whatever, your just a cousin :p

    If you find an apache interface for the Pri, I want in on it. I'm not too worried about getting that far into my pri and I really dont wanna screw something up since it is my only car and my daily driver. I'd rather leave it up to someone else to figure it out and I'll just tag along. :)
     
    #2 slair, Jul 1, 2007
  3. aeronaut

    aeronaut New Member

    Joined:
    May 19, 2007
    29
    1
    0
    Location:
    Evanston, Il
    Slair,

    Sure. It's my only ride too, but I'm pretty cautious about backups and sensibility. First off, learn how to save all the code and go back to the original if needed.

    But before that, I need to figure out where the coding happens, what language it's in, how to interface with it, and so forth. I bet there's an ethernet plug somewhere behind the dash, and some funky protocol. No reason for Toyota to reinvent microprogramming from scratch when they can use something stock that someone else has already written, tested, debugged, and published specs for. But what is it?

    Regards,
     
    #3 aeronaut, Jul 1, 2007
    CiCi 77 likes this.
  4. Bill Merchant

    Bill Merchant absit invidia

    Joined:
    May 3, 2005
    4,096
    82
    13
    Location:
    USA | Oregon | Portland area | 97004 |
    Vehicle:
    2007 Prius
    Two words: Warranty and Liability.

    These prevent Toyota from helping you. In addition, you're not talking about one computer, you're dealing with a cluster, all running real-time code. There's an SKS computer, just for lock and unlock capability. ECU for battery, ECU for brakes, ECU for ICE, ECU for HSD... Then there is also the superfluous code that runs the AV LAN and the MFD. Climate control??? VSC??? Traction???

    If you search here on PC you can find references to the manufacturers of the ECUs. From there you can probably find the assembler code that controls them. Unix/Linux/Mac OS X/Windows are all very high level abstractions, and none real-time, compared to the low-level code that runs your Prius.
     
    #4 Bill Merchant, Jul 1, 2007
  5. Pegasus_

    Pegasus_ New Member

    Joined:
    Jun 24, 2007
    41
    1
    0
    Location:
    Spangdahlem, Germany
    Vehicle:
    2007 Prius
    I want in on this too!

    But I have limited high-level programming ability and don't want to disassemble my dash beyond repair (or even driveability,) since this too is my daily driver (and only car at the moment, until I get the motor shaft on my EV fixed.) However, assembly language is my preference! (I've been programming on the Commodore 64 for YEARS in ML.)

    My list of desired tweaks:
    1) Use more of the battery (as you state)
    2) Adjust regen amount/ramp curve/pedal travel parameters for both brake pedal & accelerator pedal (I can do this in my EV now since I upgraded it with a tweakable inverter. ;) )
    3) Change the refresh rate on the energy flow diagram to 0.5s or so. (It's currently 3s according to the manual.)

    So my suggestions:
    1) Pick up a copy of the repair/service manual and study the dash disassembly sections. (Look in the back page of your Owner's manual. It tells you where to get the Service manual (Dealer or call the toll-free number listed.))
    2) Check out TIS, the info system for dealers/servicepeople. You can apparently order one of many J2534 programming tools ($1200~$1600...how seriously do you want to do this?) to flash the system's code for various vendors' cars, and can order a Calibration CD with the Prius code from Toyota. I'm sure it's in some encrypted binary format, so we'll need a seasoned cracker. Aside from that, it at least offers a measure of protection if you screw something up real bad since you can go back to the factory image.

    Go to http://techinfo.toyota.com/ then click Vehicle Reprogramming under Valuable Resources.

    <div class='quotetop'>QUOTE(Bill Merchant @ Jun 30 2007, 11:53 PM) [snapback]470888[/snapback]</div>
    Good! Modularity helps prevent big screwups! ;) Seems we'd only want to mess with the battery, brakes and HSD ECUs. Once we tweak 'em up nice, then we tackle the MFD code to add soft buttons to access the added goodies! Muhahaha...
     
    #5 Pegasus_, Jul 1, 2007
  6. aeronaut

    aeronaut New Member

    Joined:
    May 19, 2007
    29
    1
    0
    Location:
    Evanston, Il
    Pegasus,

    Thanks for the info. However, my first hack will be to modify the display on the screen. The reason is that's a hack that won't affect the driveability of the car, and if it fails somehow, I won't wrap my Prius around a tree or a semi's rear axle. This will probably take some months to get right (including getting the interfacing right, proper backup of the old code, and so forth.)

    Regards,
     
    #6 aeronaut, Jul 1, 2007
  7. aeronaut

    aeronaut New Member

    Joined:
    May 19, 2007
    29
    1
    0
    Location:
    Evanston, Il
    <div class='quotetop'>QUOTE(Bill Merchant @ Jun 30 2007, 11:53 PM) [snapback]470888[/snapback]</div>
    Bill,

    Thanks for the info. I expected to find some low level code - that's not a problem for me. Could you spell out some of the acronyms? ECU is probably electronic control unit. ICE I get. But SKS, HSD??? If they are all modular, but all run on the same interface, that would be great, as then I can't screw up the battery ECU while modifying the screen's ECU, etc.

    However, the one thing that I'm not totally sure about is that there isn't higher level code or tools involved. The amount of man hours required to produce the nice graphic displays we see on the screen would be cost and time prohibitive without higher level tools. They may not be publicly available, but I'm sure that the ECU coders at Toyota didn't spend several tens of thousands of man hours working to get the energy screen to look just like it does. That's the work of abstractions delivering low level code, if not abstractions running in near real time.

    Anyway, I'm gonna start with baby steps, and only put a little time into this - I'm also finishing up my PhD thesis, and can't lose momentum on that.

    Regards,
     
    #7 aeronaut, Jul 1, 2007
  8. aeronaut

    aeronaut New Member

    Joined:
    May 19, 2007
    29
    1
    0
    Location:
    Evanston, Il
    <div class='quotetop'>QUOTE(Bill Merchant @ Jun 30 2007, 11:53 PM) [snapback]470888[/snapback]</div>
    Bill,

    Thanks for the info. I expected to find some low level code - that's not a problem for me. Could you spell out some of the acronyms? ECU is probably electronic control unit. ICE I get. But SKS, HSD??? If they are all modular, but all run on the same interface, that would be great, as then I can't screw up the battery ECU while modifying the screen's ECU, etc.

    However, the one thing that I'm not totally sure about is that there isn't higher level code or tools involved. The amount of man hours required to produce the nice graphic displays we see on the screen would be cost and time prohibitive without higher level tools. They may not be publicly available, but I'm sure that the ECU coders at Toyota didn't spend several tens of thousands of man hours working to get the energy screen to look just like it does. That's the work of abstractions delivering low level code, if not abstractions running in near real time.

    Anyway, I'm gonna start with baby steps, and only put a little time into this - I'm also finishing up my PhD thesis, and can't lose momentum on that.

    Regards,
     
    #8 aeronaut, Jul 1, 2007
  9. Bill Merchant

    Bill Merchant absit invidia

    Joined:
    May 3, 2005
    4,096
    82
    13
    Location:
    USA | Oregon | Portland area | 97004 |
    Vehicle:
    2007 Prius
    I should have congratulated you on your new car and welcomed you to PriusChat, aeronaut, instead of just jumping right in on an answer of sorts. Congratulations and welcome!

    There's a thread on acronyms here. SKS is Smart Key System which is how the fob and the car know each other and communicate. HSD is Hybrid Synergy Drive which is Toyota's name for the collection of technology that is the Prius.

    You will probably want to search on here for CAN View, which is a method and equipment to read the low level Controller Area Network. This LAN carries most of the vital communications. You seem to want to play with the AVC-LAN. It touches: Audio Head Unit, MFD Multi Function Display, Navigation ECU, and Gateway ECU. It's the Gateway that connects the various LANs.


    <div align="center">[attachmentid=9342] </div>
     

    Attached Files:

    #9 Bill Merchant, Jul 1, 2007
  10. Ichabod

    Ichabod Artist In Residence

    Joined:
    Jul 21, 2006
    1,794
    19
    0
    Location:
    Newton, MA
    Vehicle:
    2006 Prius
    <div class='quotetop'>QUOTE(aeronaut @ Jun 30 2007, 03:09 PM) [snapback]470680[/snapback]</div>
    Welcome! Forgive me if I duplicate some responses, I scanned the rest of the thread quickly, but might have missed some of it:

    1. The Prius battery back is much less efficient in the low range of SoC (State of Charge), and the life of the battery would be reduced if it were allowed to run down like that. In terms of both performance and longevity, it would not be a good hack to change those limits. What would be a good hack is to add more batteries, and/or make it plug-in capable.

    2. Software... it always has limitations, or bugs, or things you just wish would be different. Have you checked out CAN-view? You sound like a good candidate for purchasing that. Most people don't care about the nitty-gritty, and frankly it would be distracting and dangerous to present them with all the info you want. For the chosen few, there are toys like CAN-view (although I'd still argue in favor of a nice graphical front-end for it).

    3. All those funny driving characteristics are there to make people feel safe and comfortable. Your average Joe wants it to drive like your average car, and Toyota is smart to not overstep here. People would flip out if the thing drove like the future car we all want. And some people would undoubtedly crash the car if it had some of the traits you want. I don't know if anyone has successfully modded their car to do that though... I think that's embedded behavior that would be difficult to change without risking some very serious damage to your car.

    Fortunately for us, you can still feather the pedal to get a good glide. And it makes you feel like you have some special s00per-sekrit knowledge when you do it too!

    Enjoy the car, and if you successfully hack the ECU's, let us know and post tutorials :D
     
    #10 Ichabod, Jul 1, 2007
    1 person likes this.
  11. apriusfan

    apriusfan New Member

    Joined:
    Apr 8, 2007
    6,050
    205
    0
    Location:
    S.F. Bay Area
    Vehicle:
    2007 Prius
    <div class='quotetop'>QUOTE(aeronaut @ Jun 30 2007, 12:09 PM) [snapback]470680[/snapback]</div>
    I guess my immediate comment is that Toyota has not put the Prius' code into the open source community. Absent that happening, you are pretty much reliant on your ability to crack the code. And then if Toyota finds out about the cracking, you have the problem of contending with enforcement actions that Toyota may take to protect their intellectual property. They did after all, put a non-trivial amount of effort into developing the software.
     
    #11 apriusfan, Jul 1, 2007
  12. FL_Prius_Driver

    FL_Prius_Driver Senior Member

    Joined:
    Jun 17, 2007
    4,319
    1,527
    0
    Location:
    Tampa Bay
    Vehicle:
    2010 Prius
    Model:
    I
    Think this through.

    If you get past all the hurdles, make your modifications to the accelerator and deaccelerator, then how do you test it? Load the code and head out past the elementary school and then get on the interstate at rush hour? How have you proven your accelerator gain is 5 mph/sec instead of 500 mph/sec? Do you plan on writing a Prius simulation model to validate what you are doing? What safety or shutoff systems are you going to install prior to leaving the test track?

    I like curiosity and trying to improve things, but this is big time. I have no problem with it being done right (i.e. no one put at risk) and if your create some expensive repairs in the process then that is the price of learning. .... but a 3000 pound high energy machine is probably not the best place to start learning hacking skills, 500 Volt inverter control, and power plant PID feedback loops.
     
    #12 FL_Prius_Driver, Jul 1, 2007
  13. forrest_fire1

    forrest_fire1 Junior Member

    Joined:
    Jul 1, 2007
    27
    4
    0
    Location:
    Oregon, Roseburg
    Vehicle:
    2011 Prius
    Model:
    V
    This is top secret stuff here. People have been x'd out for being nosey. You may own your car, but that doesn't mean you own the secrets. If Toyota wanted us to be able to adjust our cars they would have installed a retractable 2.0 usb cord under the dash.

    PM if you want to know about the ***THSynDCC***
     
    #13 forrest_fire1, Jul 1, 2007
  14. hobbit

    hobbit Senior Member

    Joined:
    Mar 23, 2005
    4,089
    468
    0
    Location:
    Bahstahn
    Vehicle:
    2004 Prius
    Model:
    N/A
    Heh... you expect a web-based management interface into the prius??
    Well, while many people have gotten used to embedded widgets with
    mini-webservers built in, the prius ain't one of them. It's not the
    cable modem on your desk.
    .
    _H*
     
    #14 hobbit, Jul 2, 2007
  15. Bill Merchant

    Bill Merchant absit invidia

    Joined:
    May 3, 2005
    4,096
    82
    13
    Location:
    USA | Oregon | Portland area | 97004 |
    Vehicle:
    2007 Prius
    CAN is an industry standard, with options for vehicle specific data which Toyota uses extensively. CAN View makes use of this feature.

    BEAN and AVC-LAN are Toyota proprietary. Get out your data logger, hack the wiring harness, and good luck reverse engineering...
     
    #15 Bill Merchant, Jul 2, 2007
  16. samiam

    samiam Antipodean Prius Poster

    Joined:
    Jun 11, 2007
    2,442
    29
    14
    Location:
    Enn Zed
    Vehicle:
    2004 Prius
    <div class='quotetop'>QUOTE(forrest_fire1 @ Jul 2 2007, 03:25 PM) [snapback]471292[/snapback]</div>
    As it happens, my BMW does have two USB 2.0 ports (but its an older model, when I re-do it I may use fire-wire). Here's a pic

    [attachmentid=9367]
    BYA, I haven't tried any Prius-specific simulations as I haven't updated the vehicle dynamics model I use to incorporate all of the prius oddities.

    PS I bet my electric car is quieter than daniel's B)
     

    Attached Files:

    #16 samiam, Jul 2, 2007
  17. TheAnnoyingOne

    TheAnnoyingOne New Member

    Joined:
    Mar 16, 2007
    318
    3
    0
    Location:
    -118.15476, 34.112134
    Vehicle:
    2008 Prius
    <div class='quotetop'>QUOTE(aeronaut @ Jun 30 2007, 12:09 PM) [snapback]470680[/snapback]</div>
    Congratulations for your new Prius and welcome to the PC.

    After you crack and change the Prius firmware keep handy the following: :lol:

    A Evanston Northwestern Hlthcr www.enh.org
    2650 Ridge Ave, Evanston, 60201 - (847) 570-2000

    B NW University Health Services www.northwestern.edu
    633 Emerson St, Evanston, 60208 - (847) 491-8100

    C Evanston Hospital www.enh.org
    2650 Ridge Ave, Evanston, 60201 - (847) 570-2000
     
    #17 TheAnnoyingOne, Jul 2, 2007
  18. apriusfan

    apriusfan New Member

    Joined:
    Apr 8, 2007
    6,050
    205
    0
    Location:
    S.F. Bay Area
    Vehicle:
    2007 Prius
    <div class='quotetop'>QUOTE(Bill Merchant @ Jul 1 2007, 10:18 PM) [snapback]471346[/snapback]</div>
    It is going to take more than a data logger.... What if the data are transmitted in a proprietary format? You don't have to encrypt the data, just change its format slightly and the level of effort to reverse engineer just grew by a couple of factors.
     
    #18 apriusfan, Jul 2, 2007
  19. dmckinstry

    dmckinstry New Member

    Joined:
    May 4, 2006
    1,034
    4
    0
    Location:
    Cheney, WA (Near Spokane)
    Vehicle:
    2005 Prius
    <div class='quotetop'>QUOTE(Bill Merchant @ Jul 1 2007, 10:18 PM) [snapback]471346[/snapback]</div>
    Right on.

    Lots of luck on that. I've reversed engineered hardware before, but it's been a relatively simple "computer/arcade toy" (the Vectrex) with a known cpu (Motorola 6809), with known machine code etc. That required removing the ROM, disassembling the code (I wrote a 6809 disassembler for my TRS-80), wire-wrapping an interface card to test what changes in the code did, and then writing a replacement ROM(hand coded, since I didn't have an assembler at the time). A case in point: I discovered a line of code that had no recognizable purpose. The results weren't used anywhere else, so it was effectively a NOP. It was part of a raster emulation. When removed, the the text flopped over sideways. With that bit of observation, it was obvious that the instruction was a timing delay, and the timing was critical.

    Without already knowing the machine and/or assembly code for the processor, you'd have to be a computer genius and have the guts/stupidity to risk breaking a very expensive piece of equipment. Norm is a lot smarter on this sort of thing than I have, but he's working on the CAN bus, which is at least partially documented.

    As others have already noted, it's likely that success even without any other damage, HV battery life would be shortened, and Toyota wouldn't be stupid enough to honor the warranty with a hack like that installed.

    Dave M.
     
    #19 dmckinstry, Jul 2, 2007
  20. douglas001001

    douglas001001 smug doug

    Joined:
    Mar 2, 2007
    222
    5
    0
    Location:
    Chicago
    Vehicle:
    2007 Prius
    What might get you more "wow"s is to attempt to make a glide/warp stealth button. Figure out the signal that gets sent when feathering the pedal and make a button (or use one already on the steering wheel)/pedal to send that signal.
     
    #20 douglas001001, Jul 2, 2007
(You must log in or sign up to post here.)
Page 1 of 3