The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl

p.kaczmarek2 18 May 2026 10:48 4 1461 Cool? (+7)

📢 Listen (AI):

TL;DR

Bosch IVS SLIM is a self-contained car-sharing telemetry module for detecting bumps, aggressive driving, smoke, and other fleet events.
Inside it uses a Sierra Wireless WP7607 Linux 4G platform, Qualcomm MDM9207 modem, Sensirion SPS30 particle sensor, two MEMS microphones, and a Taoglas flex antenna.
The unit is glued to the windscreen and powered only from 12 V DC, with the article noting about 20 mA draw when powered.
After power-up, the device appears on USB as QHSUSB__BULK, but the expected virtual COM port driver could not be made to work.

Summary generated by AI based on the discussion content.

The cloud for vehicles? Today we're taking a look inside the Bosch IVS SLIM, the tiny module responsible for detecting bumps, aggressive driving style and smoke in fleet vehicles from Car Sharing, short term car rental systems where the lack of direct (human) supervision of the vehicle necessitates the use of precise automated telemetry.

According to the official instructions, this telemetry module is trivially easy to install - it is glued directly to the windscreen of the car and only the power and ground are connected. There is no plugging into the vehicle's CAN bus. The device is 100% self-contained and draws its power from the 12 V DC installation (current consumption approx. 500 mA).
[

The schematic, seen above, already lifts the lid on what might be inside. The main SoC with CPU, communications and SIM card and GPS, LTE and GPS antennas, power section, smoke detector, IMU (accelerometer+gyroscope etc) and two microphones.

Using publicly available documentation, we can still show what the product looks like just before assembly:

And after mounting on the glass, one version of the power supply:

Then all you have to do is register the device in the dedicated app:

And this is what the control panel of such a fleet looks like. I couldn't find screenshots directly, only what's on the video:

Source: https://www.bosch-mobility.com/en/solutions/software-and-services/ridecare/

That's how much information I was able to find about this device on the web, now we look inside. The box was inconspicuous and I almost overlooked it in the scrap. One side of it was covered in dirt, presumably the area that adhered to the glass. It wasn't encouraging, but I looked inside nonetheless....

Made in Germany - inside you can also see some sort of module, a SIM card, a micro USB connector and a damaged power plug, probably 12 volts. I did not connect it to the power supply, I immediately decided to dismantle it.

The distinctive Sensirion module is immediately recognisable as the SPS30, which is a dust/air pollution sensor/PM1, PM2.5, PM4, PM10 with UART+I2C communication. Not a bad deal for scrap hardware. Polish shops sell it for 150-300 PLN, although it can be imported from China several times cheaper.

We look further afield. The two seals are from the microphones - according to the specification. The IPEX connector is from the antenna.

The antenna is a Taoglas FXUB89 2312 in flex format, it is glued around the case, 700 MHz to 8 GHz.

The board is glued with its underside to the case. There are no components on there, although you can see the test pads. I guess the manufacturer of this product likes glue, it was hard to peel off.

At the heart of the product is the Sierra Wireless WP7607 module, a Linux platform with secure 4G cellular communications (with 3G/2G support), based on an ARM® Cortex™- A7 core (1.3GHz) with rich peripherals including 1 USB, 2 UART, 1 I2C, 4 ADC ports, 189 GPIOs, one SPI and a SIM card interface.

SIM card slot, USB connector:

I see an ADC3142 chip here, which is probably the TLV320ADC3140. An external ADC module for microphones, that would fit. Application: monitoring.

This is what the microphone itself looks like:

I then examined the section under one of the screens. I removed it with hot air:

The LM73606R is the controller for the voltage step-down converter. You can tell by the fact that it's right next to the power connector, and by this inductor and capacitors. It converts the 12 V input into (I'm betting) 3.3 V for the communication module.

I wasn't planning on running this, so in the end I removed the screen of the module itself - the heart of the device:

Qualcomm MDM9207 LTE modem. JSFCBB3YH3FBG from Jeju Semiconductor is an LPDDR2+NAND MCP (4Gb SLC NAND + 2Gb LPDDR2 DRAM). 77661-11 is a multiband GSM/LTE/itd repeater from SkyWorks. PMD9607

This was supposed to be a destructive teardown, I assumed that since the hardware was scrap, it was for disposal anyway, but out of curiosity I plugged the unit into the power supply, removing the SIM card beforehand. At 12 volts, about 20 mA is drawn. Behind the inverter it is 3.7 V. The device is seen via USB:

    Name:       QHSUSB__BULK
    InstanceId: USB\VID_05C6&PID_9008\5&16BDD27B&0&2
    Class:      USBDevice
    Status:     OK

A web search suggests that there should be a virtual COM port driver for this, but I have not been able to get this to work. The matter remains open.

In summary , this inconspicuous box is sending quite a lot of telemetry from the rental car. I was perhaps most surprised by the two MEMS microphones. The particle sensor I already understand more. By the way, I'm sure it'll come in handy - you can easily run it from an Arduino. I also tried to run the main module itself here, but couldn't find drivers for it, although I have to admit I didn't look for long. Maybe in the next part? Undoubtedly the SOC itself is quite strong there and there is something to fight for.

About Author

p.kaczmarek2 wrote 14699 posts with rating 12743 , helped 656 times. Been with us since 2014 year.

Comments

Add a comment

ArturAVS 18 May 2026 17:27

I dread to think how many devices are tracking us. In theory they are supposed to improve security, but in practice.... [Read more]

MiG25 19 May 2026 12:00

This 9008 mode of the modem means that it waits for the loader, and then you can rip fw or upload new.... there. So either it's software corrupted (or also hardware corrupted, if for example it has a... [Read more]

aadeer 22 May 2026 12:08

An interesting device. In this panel you can see, among other things, the mileage before and after the return. Does it also read something after the OBD from the car? Because according to a piece of diagram,... [Read more]

sq3evp 26 May 2026 09:47

Oh there - the EU is recording for the benefit of the citizen. If you say something that catches on in hate speech (e.g. someone has pulled over), there will be a fine. [Read more]

FAQ

TL;DR: For fleet operators and teardown readers, Bosch IVS SLIM is a self-contained car-sharing telemetry module that runs from 12 V at about 500 mA and, as the teardown puts it, "sends quite a lot of telemetry" without any CAN-bus connection. It combines LTE, GPS, microphones, an IMU, and a particulate sensor in one windscreen-mounted unit. [#21905360]

Why it matters: This FAQ explains how a rental-car monitoring module can be installed fast, collect rich vehicle and cabin telemetry, and still remain largely independent of the vehicle network.

Feature	Bosch IVS SLIM	CAN-bus-based telematics unit
Installation point	Glued to the windscreen	Connects to vehicle CAN bus
Wiring named in thread	12 V power + ground only	CAN connection required
Vehicle integration	100% self-contained in the thread description	Deeper vehicle-network access implied by CAN
Deployment effort	Trivially easy installation in the thread	More involved than power-only mounting

Key insight: Bosch IVS SLIM gets broad telemetry from its own sensors, not from the car's CAN bus. That design trades deep vehicle integration for much easier installation in shared or short-term rental fleets.

Quick Facts

The module is described as 100% self-contained, mounted directly on the windscreen, and powered from the car's 12 V DC system at about 500 mA. [#21905360]
The teardown identifies a Sensirion SPS30 particulate sensor for PM1, PM2.5, PM4, and PM10, showing that cabin air-quality monitoring is built into the unit. [#21905360]
The main communications core is a Sierra Wireless WP7607 Linux platform with 4G, 3G/2G fallback, an ARM Cortex-A7 at 1.3 GHz, and interfaces including USB, UART, I2C, ADC, SPI, GPIO, and SIM. [#21905360]
The antenna named in the teardown is a Taoglas FXUB89 2312 flex antenna covering 700 MHz to 8 GHz, attached through an IPEX connector. [#21905360]
After teardown and power-up, the damaged unit drew only about 20 mA at 12 V, measured 3.7 V behind the converter stage, and enumerated over USB as QHSUSB__BULK with VID_05C6 PID_9008. [#21905360]

1. How is the Bosch IVS SLIM module installed in a car sharing vehicle if it does not connect to the CAN bus?

It is glued directly to the windscreen and wired only to power and ground. The thread says installation is trivially easy because the unit is self-contained, draws about 500 mA from the 12 V DC system, and does not need a CAN-bus connection. That makes it suitable for car sharing and short-term rental vehicles where fast deployment matters. [#21905360]

2. What components are inside the Bosch IVS SLIM telemetry module, and what does each one do?

The module combines sensors, radio, and power electronics in one enclosure. The thread names a Sierra Wireless WP7607 communications module, SIM slot, GPS and LTE antennas, a Sensirion SPS30 particulate sensor, an IMU for motion sensing, two microphones, a microphone ADC, and a buck converter near the 12 V input. Together, these parts support telemetry, positioning, cabin monitoring, cellular data transfer, and onboard power conversion. [#21905360]

3. Why does the Bosch IVS SLIM include two MEMS microphones, and how might they be used in fleet telemetry?

The two MEMS microphones expand cabin monitoring beyond motion and location data. The teardown notes two microphone seals and identifies an external microphone ADC used for monitoring, which suggests Bosch wanted audio-related event detection inside the vehicle. The author says the microphones were the most surprising part because they imply richer telemetry than simple bump logging. [#21905360]

4. How does the Sensirion SPS30 sensor work, and why would Bosch use it in a rental car monitoring device?

The Sensirion SPS30 is a particulate-matter sensor that measures PM1, PM2.5, PM4, and PM10 over UART or I2C. Bosch would use it to monitor cabin air quality or smoke-related events in shared vehicles, which matches the thread's mention of smoke detection in fleet cars. The teardown also notes the salvaged SPS30 alone can be valuable, with local prices cited at 150-300 PLN. [#21905360]

5. What is an IMU in the Bosch IVS SLIM, and how does it help detect bumps or aggressive driving?

"IMU is a motion-sensing module that combines accelerometer and gyroscope functions, measuring movement and rotation in real time." In Bosch IVS SLIM, the IMU helps detect bumps and aggressive driving because those events create clear acceleration and rotation changes that the module can log without reading the vehicle CAN bus. The thread explicitly lists the IMU among the core sensors. [#21905360]

6. What is an IPEX antenna connector, and why is it used with the Taoglas FXUB89 flex antenna?

"IPEX is a miniature RF connector that links a PCB radio stage to an external antenna, using a very small snap-on format for compact devices." Bosch uses it here because the Taoglas FXUB89 is a flex antenna glued around the case, so a small board-to-antenna connector suits the tight packaging of a windscreen-mounted module. The thread names both the IPEX connector and the FXUB89 2312 antenna. [#21905360]

7. Why would a Bosch IVS SLIM draw only about 20 mA at 12 V after teardown and show up as QHSUSB__BULK over USB?

That behavior points to a damaged or non-booting state rather than normal operation. The intact device is described at about 500 mA from 12 V, but the torn-down unit drew only about 20 mA, measured 3.7 V behind the converter, and appeared over USB as QHSUSB__BULK after the SIM card was removed. That combination suggests the modem subsystem still enumerated, while the full application stack did not start normally. [#21905360]

8. How do you troubleshoot a Sierra Wireless WP7607 or Qualcomm MDM9207 device that appears in Windows as USB VID_05C6 PID_9008?

Start by confirming the hardware state before chasing software. 1. Power the unit from 12 V and verify current draw; the thread saw about 20 mA in the damaged state. 2. Check the downstream rail; the author measured 3.7 V behind the converter. 3. Confirm Windows enumeration as QHSUSB__BULK with VID_05C6 PID_9008, then compare that result with the expected normal operating behavior. This sequence quickly separates power issues from deeper boot problems. [#21905360]

9. Which drivers or tools are usually needed to access the virtual COM port or recovery mode of a Qualcomm-based Bosch telemetry module?

The thread only says a virtual COM port driver should exist, but the author could not get it working. That means the practical requirement here is Windows USB driver support for the detected Qualcomm-style device, identified as VID_05C6 PID_9008, before any serial or recovery access is possible. No working toolchain, package name, or successful driver installation is provided in the post. [#21905360]

10. What is QHSUSB__BULK mode, and what does it indicate about the state of the Qualcomm modem inside the device?

"QHSUSB__BULK is a Qualcomm USB bulk-enumeration state that exposes the modem over USB when the normal high-level interface is not available." In this teardown, it indicates the Qualcomm-based core still responds electrically over USB, but the device is not presenting the expected application or virtual COM interface. The thread shows that exact state after destructive disassembly and a 12 V power-up test. [#21905360]

11. How do you identify the power supply section in a teardown, such as the LM73606R buck converter stage near the 12 V input?

Look for the controller IC beside the power connector, then follow the inductor and nearby capacitors. The thread identifies the LM73606R that way and places it under a screen near the 12 V input, which is a classic buck-converter layout. The author concludes this stage steps the input down for the communications module, making it the most likely primary power section. [#21905360]

12. Bosch IVS SLIM vs a CAN-bus-based telematics unit: which approach is better for rental fleet monitoring and easier installation?

Bosch IVS SLIM is easier to install, while a CAN-bus unit offers deeper vehicle integration. The thread says Bosch mounts on the windscreen, uses only 12 V and ground, and stays fully self-contained, which reduces installation effort in rental fleets. A CAN-bus-based design would need vehicle-network access, so it is less convenient for fast, repeatable deployment across shared cars. [#21905360]

13. What is an LPDDR2 plus NAND MCP chip like the JSFCBB3YH3FBG, and why is it paired with the Qualcomm MDM9207?

"LPDDR2 plus NAND MCP is a combined memory package that integrates DRAM and flash storage in one chip, saving board space and simplifying modem design." In this unit, the JSFCBB3YH3FBG is identified as 4 Gb SLC NAND plus 2 Gb LPDDR2 DRAM, paired with the Qualcomm MDM9207 so the modem platform has both working memory and non-volatile storage in a compact layout. [#21905360]

14. How can you reuse a salvaged Sensirion SPS30 particulate sensor with Arduino or another microcontroller after recovering it from scrap hardware?

You can reuse it by treating it as a standalone UART or I2C particulate sensor. 1. Identify the SPS30 on the board; the teardown recognizes it immediately. 2. Recover it carefully from the scrap unit without damaging the sensor body. 3. Wire it to a microcontroller such as Arduino over UART or I2C and use it for PM1, PM2.5, PM4, and PM10 measurement. The author explicitly says it can be run easily from Arduino. [#21905360]

15. What safety precautions should you follow when powering up or dismantling a glued automotive telemetry module with LTE, GPS, microphones, and a SIM card?

Remove the SIM card first, use a controlled 12 V supply, and expect strong adhesive and shielded sections. The teardown shows the board was glued to the case, one power plug was already damaged, and a screen was removed with hot air, so mechanical and thermal care both matter. A practical limit also appears here: destructive disassembly can leave the modem stuck in a reduced-function USB state instead of normal operation. [#21905360]

Summary generated by AI based on the discussion content.