The cloud for vehicles? Today we're taking a look inside the Bosch IVS SLIM, the tiny module responsible for detecting bumps, aggressive driving style and smoke in fleet vehicles from Car Sharing, short term car rental systems where the lack of direct (human) supervision of the vehicle necessitates the use of precise automated telemetry.
According to the official instructions, this telemetry module is trivially easy to install - it is glued directly to the windscreen of the car and only the power and ground are connected. There is no plugging into the vehicle's CAN bus. The device is 100% self-contained and draws its power from the 12 V DC installation (current consumption approx. 500 mA).
[
The schematic, seen above, already lifts the lid on what might be inside. The main SoC with CPU, communications and SIM card and GPS, LTE and GPS antennas, power section, smoke detector, IMU (accelerometer+gyroscope etc) and two microphones.
Using publicly available documentation, we can still show what the product looks like just before assembly:
And after mounting on the glass, one version of the power supply:
Then all you have to do is register the device in the dedicated app:
And this is what the control panel of such a fleet looks like. I couldn't find screenshots directly, only what's on the video:
Source: https://www.bosch-mobility.com/en/solutions/software-and-services/ridecare/
That's how much information I was able to find about this device on the web, now we look inside. The box was inconspicuous and I almost overlooked it in the scrap. One side of it was covered in dirt, presumably the area that adhered to the glass. It wasn't encouraging, but I looked inside nonetheless....
Made in Germany - inside you can also see some sort of module, a SIM card, a micro USB connector and a damaged power plug, probably 12 volts. I did not connect it to the power supply, I immediately decided to dismantle it.
The distinctive Sensirion module is immediately recognisable as the SPS30, which is a dust/air pollution sensor/PM1, PM2.5, PM4, PM10 with UART+I2C communication. Not a bad deal for scrap hardware. Polish shops sell it for 150-300 PLN, although it can be imported from China several times cheaper.
We look further afield. The two seals are from the microphones - according to the specification. The IPEX connector is from the antenna.
The antenna is a Taoglas FXUB89 2312 in flex format, it is glued around the case, 700 MHz to 8 GHz.
The board is glued with its underside to the case. There are no components on there, although you can see the test pads. I guess the manufacturer of this product likes glue, it was hard to peel off.
At the heart of the product is the Sierra Wireless WP7607 module, a Linux platform with secure 4G cellular communications (with 3G/2G support), based on an ARM® Cortex™- A7 core (1.3GHz) with rich peripherals including 1 USB, 2 UART, 1 I2C, 4 ADC ports, 189 GPIOs, one SPI and a SIM card interface.
SIM card slot, USB connector:
I see an ADC3142 chip here, which is probably the TLV320ADC3140. An external ADC module for microphones, that would fit. Application: monitoring.
This is what the microphone itself looks like:
I then examined the section under one of the screens. I removed it with hot air:
The LM73606R is the controller for the voltage step-down converter. You can tell by the fact that it's right next to the power connector, and by this inductor and capacitors. It converts the 12 V input into (I'm betting) 3.3 V for the communication module.
I wasn't planning on running this, so in the end I removed the screen of the module itself - the heart of the device:
Qualcomm MDM9207 LTE modem. JSFCBB3YH3FBG from Jeju Semiconductor is an LPDDR2+NAND MCP (4Gb SLC NAND + 2Gb LPDDR2 DRAM). 77661-11 is a multiband GSM/LTE/itd repeater from SkyWorks. PMD9607
This was supposed to be a destructive teardown, I assumed that since the hardware was scrap, it was for disposal anyway, but out of curiosity I plugged the unit into the power supply, removing the SIM card beforehand. At 12 volts, about 20 mA is drawn. Behind the inverter it is 3.7 V. The device is seen via USB:
Name: QHSUSB__BULK
InstanceId: USB\VID_05C6&PID_9008\5&16BDD27B&0&2
Class: USBDevice
Status: OK
A web search suggests that there should be a virtual COM port driver for this, but I have not been able to get this to work. The matter remains open.
In summary , this inconspicuous box is sending quite a lot of telemetry from the rental car. I was perhaps most surprised by the two MEMS microphones. The particle sensor I already understand more. By the way, I'm sure it'll come in handy - you can easily run it from an Arduino. I also tried to run the main module itself here, but couldn't find drivers for it, although I have to admit I didn't look for long. Maybe in the next part? Undoubtedly the SOC itself is quite strong there and there is something to fight for.
Cool? Ranking DIY Helpful post? Buy me a coffee.
