logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl

p.kaczmarek2 1362 4

TL;DR

  • Bosch IVS SLIM is a self-contained car-sharing telemetry module for detecting bumps, aggressive driving, smoke, and other fleet events.
  • Inside it uses a Sierra Wireless WP7607 Linux 4G platform, Qualcomm MDM9207 modem, Sensirion SPS30 particle sensor, two MEMS microphones, and a Taoglas flex antenna.
  • The unit is glued to the windscreen and powered only from 12 V DC, with the article noting about 20 mA draw when powered.
  • After power-up, the device appears on USB as QHSUSB__BULK, but the expected virtual COM port driver could not be made to work.
Generated by the language model.
ADVERTISEMENT
This content has been translated flag-pl » flag-en View the original version here
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    The cloud for vehicles? Today we're taking a look inside the Bosch IVS SLIM, the tiny module responsible for detecting bumps, aggressive driving style and smoke in fleet vehicles from Car Sharing, short term car rental systems where the lack of direct (human) supervision of the vehicle necessitates the use of precise automated telemetry.
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    According to the official instructions, this telemetry module is trivially easy to install - it is glued directly to the windscreen of the car and only the power and ground are connected. There is no plugging into the vehicle's CAN bus. The device is 100% self-contained and draws its power from the 12 V DC installation (current consumption approx. 500 mA).
    [The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    The schematic, seen above, already lifts the lid on what might be inside. The main SoC with CPU, communications and SIM card and GPS, LTE and GPS antennas, power section, smoke detector, IMU (accelerometer+gyroscope etc) and two microphones.
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    Using publicly available documentation, we can still show what the product looks like just before assembly:
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    And after mounting on the glass, one version of the power supply:
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    Then all you have to do is register the device in the dedicated app:
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    And this is what the control panel of such a fleet looks like. I couldn't find screenshots directly, only what's on the video:
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    Source: https://www.bosch-mobility.com/en/solutions/software-and-services/ridecare/

    That's how much information I was able to find about this device on the web, now we look inside. The box was inconspicuous and I almost overlooked it in the scrap. One side of it was covered in dirt, presumably the area that adhered to the glass. It wasn't encouraging, but I looked inside nonetheless....
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    Made in Germany - inside you can also see some sort of module, a SIM card, a micro USB connector and a damaged power plug, probably 12 volts. I did not connect it to the power supply, I immediately decided to dismantle it.
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    The distinctive Sensirion module is immediately recognisable as the SPS30, which is a dust/air pollution sensor/PM1, PM2.5, PM4, PM10 with UART+I2C communication. Not a bad deal for scrap hardware. Polish shops sell it for 150-300 PLN, although it can be imported from China several times cheaper.
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    We look further afield. The two seals are from the microphones - according to the specification. The IPEX connector is from the antenna.
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    The antenna is a Taoglas FXUB89 2312 in flex format, it is glued around the case, 700 MHz to 8 GHz.
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    The board is glued with its underside to the case. There are no components on there, although you can see the test pads. I guess the manufacturer of this product likes glue, it was hard to peel off.
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    At the heart of the product is the Sierra Wireless WP7607 module, a Linux platform with secure 4G cellular communications (with 3G/2G support), based on an ARM® Cortex™- A7 core (1.3GHz) with rich peripherals including 1 USB, 2 UART, 1 I2C, 4 ADC ports, 189 GPIOs, one SPI and a SIM card interface.
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    SIM card slot, USB connector:
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    I see an ADC3142 chip here, which is probably the TLV320ADC3140. An external ADC module for microphones, that would fit. Application: monitoring.
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    This is what the microphone itself looks like:
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    I then examined the section under one of the screens. I removed it with hot air:
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    The LM73606R is the controller for the voltage step-down converter. You can tell by the fact that it's right next to the power connector, and by this inductor and capacitors. It converts the 12 V input into (I'm betting) 3.3 V for the communication module.
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    I wasn't planning on running this, so in the end I removed the screen of the module itself - the heart of the device:
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    Qualcomm MDM9207 LTE modem. JSFCBB3YH3FBG from Jeju Semiconductor is an LPDDR2+NAND MCP (4Gb SLC NAND + 2Gb LPDDR2 DRAM). 77661-11 is a multiband GSM/LTE/itd repeater from SkyWorks. PMD9607

    This was supposed to be a destructive teardown, I assumed that since the hardware was scrap, it was for disposal anyway, but out of curiosity I plugged the unit into the power supply, removing the SIM card beforehand. At 12 volts, about 20 mA is drawn. Behind the inverter it is 3.7 V. The device is seen via USB:
    Code: text Expand Select all Copy to clipboard
        Name:       QHSUSB__BULK
    InstanceId: USB\VID_05C6&PID_9008\5&16BDD27B&0&2
    Class:      USBDevice
    Status:     OK

    The interior of the Bosch IVS SLIM module, i.e. telemetry and fender detection in Car Sharing vehicl
    A web search suggests that there should be a virtual COM port driver for this, but I have not been able to get this to work. The matter remains open.


    In summary , this inconspicuous box is sending quite a lot of telemetry from the rental car. I was perhaps most surprised by the two MEMS microphones. The particle sensor I already understand more. By the way, I'm sure it'll come in handy - you can easily run it from an Arduino. I also tried to run the main module itself here, but couldn't find drivers for it, although I have to admit I didn't look for long. Maybe in the next part? Undoubtedly the SOC itself is quite strong there and there is something to fight for.

    Cool? Ranking DIY
    Helpful post? Buy me a coffee.
    About Author
    p.kaczmarek2
    Moderator Smart Home  
    Offline 
    p.kaczmarek2 wrote 14604 posts with rating 12620, helped 654 times. Been with us since 2014 year.
  • ADVERTISEMENT
  • #2 21905640
    ArturAVS
    Moderator  
    Posts: 26230
    Help: 2296
    Rate: 7771
    I dread to think how many devices are tracking us. In theory they are supposed to improve security, but in practice....
  • ADVERTISEMENT
  • #3 21906122
    MiG25
    Level 23  
    Posts: 538
    Help: 35
    Rate: 97
    This 9008 mode of the modem means that it waits for the loader, and then you can rip fw or upload new.... there.
    So either it's software corrupted (or also hardware corrupted, if for example it has a corrupted flash), or this is how it reacts when plugged into USB.... Somehow it behaves differently under power alone (without USB)? Maybe some LED lights up (suggesting no SIM...)....
    Or maybe it needs to be powered first and then (after some time) plugged in to USB once it has "taken off"....
  • ADVERTISEMENT
  • #4 21908139
    aadeer
    Level 17  
    Posts: 266
    Help: 11
    Rate: 162
    An interesting device. In this panel you can see, among other things, the mileage before and after the return. Does it also read something after the OBD from the car? Because according to a piece of diagram, only the battery power is connected? How does it detect "harsh" driving style? Because you didn't show the accelerometer, and it should be somewhere on the board. By the way, I once got a warning from one of the operators on the app along the lines of: "It's obvious that you are a dynamic driver..." - after 3 they threatened to suspend my account, but I didn't get as far as that ;)

    I have these SPS sensors installed in the house and outside the window, but I need to see how it reacts to a cigarette ;)

    I also wonder what these microphones record, as I guess recording everything in the cabin according to EU regulations would not be very correct.
  • #5 21910211
    sq3evp
    Level 39  
    Posts: 6528
    Help: 219
    Rate: 868
    >>21908139
    Oh there - the EU is recording for the benefit of the citizen. If you say something that catches on in hate speech (e.g. someone has pulled over), there will be a fine.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law
Today's popular

FAQ

TL;DR: For fleet operators and teardown readers, Bosch IVS SLIM is a self-contained car-sharing telemetry module that runs from 12 V at about 500 mA and, as the teardown puts it, "sends quite a lot of telemetry" without any CAN-bus connection. It combines LTE, GPS, microphones, an IMU, and a particulate sensor in one windscreen-mounted unit. [#21905360]

Why it matters: This FAQ explains how a rental-car monitoring module can be installed fast, collect rich vehicle and cabin telemetry, and still remain largely independent of the vehicle network.

Feature Bosch IVS SLIM CAN-bus-based telematics unit
Installation point Glued to the windscreen Connects to vehicle CAN bus
Wiring named in thread 12 V power + ground only CAN connection required
Vehicle integration 100% self-contained in the thread description Deeper vehicle-network access implied by CAN
Deployment effort Trivially easy installation in the thread More involved than power-only mounting

Key insight: Bosch IVS SLIM gets broad telemetry from its own sensors, not from the car's CAN bus. That design trades deep vehicle integration for much easier installation in shared or short-term rental fleets.

Quick Facts

  • The module is described as 100% self-contained, mounted directly on the windscreen, and powered from the car's 12 V DC system at about 500 mA. [#21905360]
  • The teardown identifies a Sensirion SPS30 particulate sensor for PM1, PM2.5, PM4, and PM10, showing that cabin air-quality monitoring is built into the unit. [#21905360]
  • The main communications core is a Sierra Wireless WP7607 Linux platform with 4G, 3G/2G fallback, an ARM Cortex-A7 at 1.3 GHz, and interfaces including USB, UART, I2C, ADC, SPI, GPIO, and SIM. [#21905360]
  • The antenna named in the teardown is a Taoglas FXUB89 2312 flex antenna covering 700 MHz to 8 GHz, attached through an IPEX connector. [#21905360]
  • After teardown and power-up, the damaged unit drew only about 20 mA at 12 V, measured 3.7 V behind the converter stage, and enumerated over USB as QHSUSB__BULK with VID_05C6 PID_9008. [#21905360]

1. How is the Bosch IVS SLIM module installed in a car sharing vehicle if it does not connect to the CAN bus?

It is glued directly to the windscreen and wired only to power and ground. The thread says installation is trivially easy because the unit is self-contained, draws about 500 mA from the 12 V DC system, and does not need a CAN-bus connection. That makes it suitable for car sharing and short-term rental vehicles where fast deployment matters. [#21905360]

2. What components are inside the Bosch IVS SLIM telemetry module, and what does each one do?

The module combines sensors, radio, and power electronics in one enclosure. The thread names a Sierra Wireless WP7607 communications module, SIM slot, GPS and LTE antennas, a Sensirion SPS30 particulate sensor, an IMU for motion sensing, two microphones, a microphone ADC, and a buck converter near the 12 V input. Together, these parts support telemetry, positioning, cabin monitoring, cellular data transfer, and onboard power conversion. [#21905360]

3. Why does the Bosch IVS SLIM include two MEMS microphones, and how might they be used in fleet telemetry?

The two MEMS microphones expand cabin monitoring beyond motion and location data. The teardown notes two microphone seals and identifies an external microphone ADC used for monitoring, which suggests Bosch wanted audio-related event detection inside the vehicle. The author says the microphones were the most surprising part because they imply richer telemetry than simple bump logging. [#21905360]

4. How does the Sensirion SPS30 sensor work, and why would Bosch use it in a rental car monitoring device?

The Sensirion SPS30 is a particulate-matter sensor that measures PM1, PM2.5, PM4, and PM10 over UART or I2C. Bosch would use it to monitor cabin air quality or smoke-related events in shared vehicles, which matches the thread's mention of smoke detection in fleet cars. The teardown also notes the salvaged SPS30 alone can be valuable, with local prices cited at 150-300 PLN. [#21905360]

5. What is an IMU in the Bosch IVS SLIM, and how does it help detect bumps or aggressive driving?

"IMU is a motion-sensing module that combines accelerometer and gyroscope functions, measuring movement and rotation in real time." In Bosch IVS SLIM, the IMU helps detect bumps and aggressive driving because those events create clear acceleration and rotation changes that the module can log without reading the vehicle CAN bus. The thread explicitly lists the IMU among the core sensors. [#21905360]

6. What is an IPEX antenna connector, and why is it used with the Taoglas FXUB89 flex antenna?

"IPEX is a miniature RF connector that links a PCB radio stage to an external antenna, using a very small snap-on format for compact devices." Bosch uses it here because the Taoglas FXUB89 is a flex antenna glued around the case, so a small board-to-antenna connector suits the tight packaging of a windscreen-mounted module. The thread names both the IPEX connector and the FXUB89 2312 antenna. [#21905360]

7. Why would a Bosch IVS SLIM draw only about 20 mA at 12 V after teardown and show up as QHSUSB__BULK over USB?

That behavior points to a damaged or non-booting state rather than normal operation. The intact device is described at about 500 mA from 12 V, but the torn-down unit drew only about 20 mA, measured 3.7 V behind the converter, and appeared over USB as QHSUSB__BULK after the SIM card was removed. That combination suggests the modem subsystem still enumerated, while the full application stack did not start normally. [#21905360]

8. How do you troubleshoot a Sierra Wireless WP7607 or Qualcomm MDM9207 device that appears in Windows as USB VID_05C6 PID_9008?

Start by confirming the hardware state before chasing software. 1. Power the unit from 12 V and verify current draw; the thread saw about 20 mA in the damaged state. 2. Check the downstream rail; the author measured 3.7 V behind the converter. 3. Confirm Windows enumeration as QHSUSB__BULK with VID_05C6 PID_9008, then compare that result with the expected normal operating behavior. This sequence quickly separates power issues from deeper boot problems. [#21905360]

9. Which drivers or tools are usually needed to access the virtual COM port or recovery mode of a Qualcomm-based Bosch telemetry module?

The thread only says a virtual COM port driver should exist, but the author could not get it working. That means the practical requirement here is Windows USB driver support for the detected Qualcomm-style device, identified as VID_05C6 PID_9008, before any serial or recovery access is possible. No working toolchain, package name, or successful driver installation is provided in the post. [#21905360]

10. What is QHSUSB__BULK mode, and what does it indicate about the state of the Qualcomm modem inside the device?

"QHSUSB__BULK is a Qualcomm USB bulk-enumeration state that exposes the modem over USB when the normal high-level interface is not available." In this teardown, it indicates the Qualcomm-based core still responds electrically over USB, but the device is not presenting the expected application or virtual COM interface. The thread shows that exact state after destructive disassembly and a 12 V power-up test. [#21905360]

11. How do you identify the power supply section in a teardown, such as the LM73606R buck converter stage near the 12 V input?

Look for the controller IC beside the power connector, then follow the inductor and nearby capacitors. The thread identifies the LM73606R that way and places it under a screen near the 12 V input, which is a classic buck-converter layout. The author concludes this stage steps the input down for the communications module, making it the most likely primary power section. [#21905360]

12. Bosch IVS SLIM vs a CAN-bus-based telematics unit: which approach is better for rental fleet monitoring and easier installation?

Bosch IVS SLIM is easier to install, while a CAN-bus unit offers deeper vehicle integration. The thread says Bosch mounts on the windscreen, uses only 12 V and ground, and stays fully self-contained, which reduces installation effort in rental fleets. A CAN-bus-based design would need vehicle-network access, so it is less convenient for fast, repeatable deployment across shared cars. [#21905360]

13. What is an LPDDR2 plus NAND MCP chip like the JSFCBB3YH3FBG, and why is it paired with the Qualcomm MDM9207?

"LPDDR2 plus NAND MCP is a combined memory package that integrates DRAM and flash storage in one chip, saving board space and simplifying modem design." In this unit, the JSFCBB3YH3FBG is identified as 4 Gb SLC NAND plus 2 Gb LPDDR2 DRAM, paired with the Qualcomm MDM9207 so the modem platform has both working memory and non-volatile storage in a compact layout. [#21905360]

14. How can you reuse a salvaged Sensirion SPS30 particulate sensor with Arduino or another microcontroller after recovering it from scrap hardware?

You can reuse it by treating it as a standalone UART or I2C particulate sensor. 1. Identify the SPS30 on the board; the teardown recognizes it immediately. 2. Recover it carefully from the scrap unit without damaging the sensor body. 3. Wire it to a microcontroller such as Arduino over UART or I2C and use it for PM1, PM2.5, PM4, and PM10 measurement. The author explicitly says it can be run easily from Arduino. [#21905360]

15. What safety precautions should you follow when powering up or dismantling a glued automotive telemetry module with LTE, GPS, microphones, and a SIM card?

Remove the SIM card first, use a controlled 12 V supply, and expect strong adhesive and shielded sections. The teardown shows the board was glued to the case, one power plug was already damaged, and a screen was removed with hot air, so mechanical and thermal care both matter. A practical limit also appears here: destructive disassembly can leave the modem stuck in a reduced-function USB state instead of normal operation. [#21905360]
Generated by the language model.
ADVERTISEMENT