Telematics Control Unit (TCU): Difference between revisions - Nissan Leaf

(46 intermediate revisions by 2 users not shown)

Line 1:

~~== Introduction ==~~

The Telematics Control Unit (TCU) provides connectivity to the Nissan Leaf. It is a 2G, 3G, 4G or 5G modem, depending on the year and region, with additional functionality. The TCU provides internet connectivity to the [[AV Control Unit]] via USB, while also communicating with Nissan's servers in its own right to provide CarWings / Nissan Connect functionality such as remote climate control.

~~The Telematics Control Unit (TCU) provides connectivity to the Nissan Leaf. It is a 2G, 3G, 4G or 5G modem, depending on the year and region, with additional functionality.~~

[[File:Tcu gen2 4g.webp|thumb|4G TCU from a 2019 Nissan Leaf, attached to its mounting bracket]]

[[File:Tcu gen2 4g.webp|thumb|4G TCU from a ~~2nd-generation~~ Nissan Leaf]]

== Location and access ==

The TCU is located on the right-hand side of the vehicle in all models. It is attached to a metal bracket, which has the [[Around View Monitor Control Unit]] on the other side, if equipped. Once access is achieved, the entire bracket can be removed with the TCU, [[Around View Monitor Control Unit]] and wiring harness all still attached (there's a good amount of slack), and then once pulled forward the TCU can be disconnected.

~~The TCU is located behind the glove box in both LHD and RHD models of all generations. Access is achieved by removing the glove box.~~

=== Left-hand drive ===

== Connections ==

The TCU is located behind the glove box. Access is achieved by removing the glove box.

=== Right-hand drive ===

The TCU is located above the pedals. Access is achieved by removing the panel above the pedals, then removing the lower instrument panel (the panel below the steering wheel, with the bonnet release latch and the panel of buttons (open charge door, etc). Refer to the service manual for more detail on removing this panel.

== Variants ==

=== 2G ===

Known part numbers:

* 283B0 3NM0A

=== 3G ===

=== 4G ===

Known part numbers:

* 28275 5SA0A

* 28275 5SA0B

* 28275 5ZA0D

* 28275 6FL0B

These are found on some 2nd-generation Nissan Leafs. The one pictured below (p/n 28275 5SA0B) includes a Sierra Wireless AirPrime AR7554 modem module, a chip labelled R7F7010259 (possibly part of the Renesas RH850/F1L family), a small PIC16LF1518 chip, an A1051/3 CAN transceiver chip, an A1043 CAN interface chip (this list is not exhaustive). An examination and probe of the board while powered on did not reveal any obvious UART terminals, however it does emit CAN data while powered on on a bench.

It does not contain a physical SIM slot.

The unit photographed below is not detected as a USB device when connected to a computer. It may be faulty, or in some kind of disabled mode, or a non-standard USB protocol, I am not sure.

In vehicles which have had an English conversion done by EVs Enhanced, the [[AV Control Unit]] may not function while the TCU is disconnected (complaining about a missing or invalid key file).

File:Gen 2 4G TCU - top view.jpg|External view

File:Gen 2 4G TCU Circuit Board Side A.jpg|Circuit board side A

File:Gen 2 4G TCU Circuit Board Side B.jpg|Circuit board side B

</gallery>

==== Connections ====

{| class="wikitable"

|+

Line 15:

Line 53:

!Purpose

|-

|M67

|[[M67]]

|TH40FB-NH (40-pin connector)

|Power, Microphone, CANBUS

{| class="wikitable"

|-

|[[File:CTH40F05HS.svg|frameless]]

|}

|Power, Microphone, CANBUS ([[IT-CAN]] and [[M-CAN]])

|-

|M173

|[[M173]]

|USCAR30-MD-M (USB)

|USB connection to ~~head unit~~

|USB connection to [[AV Control Unit]]

|-

|M174

|[[M174]]

|FAKRA CODE H 4003 (Pink)

|GSM antenna

|-

|M175

|[[M175]]

|3FA1ANCSJ-C02W0 (Blue)

|GPS antenna

|}

==== M67 ([[NAM]]) ====

==== M173 ====

==== M174 ====

==== M175 ====

=== 5G ===

Part numbers:

* 28275 6HL9B

File:5G TCU.webp|External view

File:Nissan Leaf 5G TCU Board SIde A.jpg|Circuit board side A

File:Nissan Leaf 5G TCU Board Side B.jpg|Circuit board side B

</gallery>

== Open-source Telematics ==

Owners who cannot use Nissan Connect (e.g. because it is not offered in their country), or don't want to use it, have a couple of options.

[https://www.openvehicles.com/ OVMS] is an open-source module that can provide all sorts of telematics functionality such as GPS positioning, remote climate control, remote lock/unlock, battery monitoring, etc. In Gen 1 Leafs it can be installed via a simple plug into the OBDII port. In Gen 2 Leafs, a custom adaptor cable can be made to tap into the power and CAN buses at the [[CAN Gateway]].<ref>https://docs.openvehicles.com/en/latest/components/vehicle_nissanleaf/docs/index.html#models-ze1</ref> It is also necessary to disable the TCU, either by disconnecting the CAN BUS wires on its connector, or by removing it completely and replacing it with a couple of bridging wires and a 5V regulator to keep the [[AV Control Unit]] powered, power the microphone and pass its signal through.

For 2G TCUs, it is possible to replace the SIM and configure the TCU to connect to a server of one's choosing.<ref>https://mynissanleaf.com/threads/reverse-engineering-telematics-unit.36889/</ref>

== External Links ==

* [https://mynissanleaf.com/threads/reverse-engineering-telematics-unit.36889/ Reverse engineering Telematics Unit - My Nissan Leaf Forum]

* [https://www.youtube.com/watch?v=5QBOmr_ZyLo&ab_channel=DEFCONConference DEF CON 25 - Mickey Shkatov, Jesse Michael, Oleksandr Bazhaniuk - Driving down the rabbit hole]

* [https://mynissanleaf.com/threads/2018-tcu-decoding-and-emulating.34628/ (2018+) TCU Decoding and Emulating] - My Nissan Leaf Forum

* https://github.com/developerfromjokela/nissan-leaf-tcu

* [https://www.youtube.com/watch?v=5QBOmr_ZyLo&ab_channel=DEFCONConference DEF CON 25 - Mickey Shkatov, Jesse Michael, Oleksandr Bazhaniuk - Driving down the rabbit hole - YouTube]

== References ==

@@ Line 1: / Line 1: @@
-== Introduction ==
+The Telematics Control Unit (TCU) provides connectivity to the Nissan Leaf. It is a 2G, 3G, 4G or 5G modem, depending on the year and region, with additional functionality. The TCU provides internet connectivity to the [[AV Control Unit]] via USB, while also communicating with Nissan's servers in its own right to provide CarWings / Nissan Connect functionality such as remote climate control.
-The Telematics Control Unit (TCU) provides connectivity to the Nissan Leaf. It is a 2G, 3G, 4G or 5G modem, depending on the year and region, with additional functionality.
+[[File:Tcu gen2 4g.webp|thumb|4G TCU from a 2019 Nissan Leaf, attached to its mounting bracket]]
-[[File:Tcu gen2 4g.webp|thumb|4G TCU from a 2nd-generation Nissan Leaf]]
 == Location and access ==
+The TCU is located on the right-hand side of the vehicle in all models. It is attached to a metal bracket, which has the [[Around View Monitor Control Unit]] on the other side, if equipped. Once access is achieved, the entire bracket can be removed with the TCU, [[Around View Monitor Control Unit]] and wiring harness all still attached (there's a good amount of slack), and then once pulled forward the TCU can be disconnected.
-The TCU is located behind the glove box in both LHD and RHD models of all generations. Access is achieved by removing the glove box.
+=== Left-hand drive ===
-== Connections ==
+The TCU is located behind the glove box. Access is achieved by removing the glove box.
+=== Right-hand drive ===
+The TCU is located above the pedals. Access is achieved by removing the panel above the pedals, then removing the lower instrument panel (the panel below the steering wheel, with the bonnet release latch and the panel of buttons (open charge door, etc). Refer to the service manual for more detail on removing this panel.
+== Variants ==
+=== 2G ===
+Known part numbers:
+* 283B0 3NM0A
+=== 3G ===
+=== 4G ===
+Known part numbers:
+* 28275 5SA0A
+* 28275 5SA0B
+* 28275 5ZA0D
+* 28275 6FL0B
+These are found on some 2nd-generation Nissan Leafs. The one pictured below (p/n 28275 5SA0B) includes a Sierra Wireless AirPrime AR7554 modem module, a chip labelled R7F7010259 (possibly part of the Renesas RH850/F1L family), a small PIC16LF1518 chip, an A1051/3 CAN transceiver chip, an A1043 CAN interface chip (this list is not exhaustive). An examination and probe of the board while powered on did not reveal any obvious UART terminals, however it does emit CAN data while powered on on a bench.
+It does not contain a physical SIM slot.
+The unit photographed below is not detected as a USB device when connected to a computer. It may be faulty, or in some kind of disabled mode, or a non-standard USB protocol, I am not sure.
+In vehicles which have had an English conversion done by EVs Enhanced, the [[AV Control Unit]] may not function while the TCU is disconnected (complaining about a missing or invalid key file).
+<gallery widths="160" heights="160">
+File:Gen 2 4G TCU - top view.jpg|External view
+File:Gen 2 4G TCU Circuit Board Side A.jpg|Circuit board side A
+File:Gen 2 4G TCU Circuit Board Side B.jpg|Circuit board side B
+</gallery>
+==== Connections ====
 {| class="wikitable"
 |+
@@ Line 15: / Line 53: @@
 !Purpose
 |-
-|M67
+|[[M67]]
 |TH40FB-NH (40-pin connector)
-|Power, Microphone, CANBUS
+{| class="wikitable"
+|-
+|[[File:CTH40F05HS.svg|frameless]]
+|}
+|Power, Microphone, CANBUS ([[IT-CAN]] and [[M-CAN]])
 |-
-|M173
+|[[M173]]
 |USCAR30-MD-M (USB)
-|USB connection to head unit
+|USB connection to [[AV Control Unit]]
 |-
-|M174
+|[[M174]]
 |FAKRA CODE H 4003 (Pink)
 |GSM antenna
 |-
-|M175
+|[[M175]]
 |3FA1ANCSJ-C02W0 (Blue)
 |GPS antenna
 |}
+==== M67 ([[NAM]]) ====
+{{:M67}}
+==== M173 ====
+{{:M173}}
+==== M174 ====
+{{:M174}}
+==== M175 ====
+{{:M175}}
+=== 5G ===
+Part numbers:
+* 28275 6HL9B
+<gallery widths="160" heights="160">
+File:5G TCU.webp|External view
+File:Nissan Leaf 5G TCU Board SIde A.jpg|Circuit board side A
+File:Nissan Leaf 5G TCU Board Side B.jpg|Circuit board side B
+</gallery>
+== Open-source Telematics ==
+Owners who cannot use Nissan Connect (e.g. because it is not offered in their country), or don't want to use it, have a couple of options.
+[https://www.openvehicles.com/ OVMS] is an open-source module that can provide all sorts of telematics functionality such as GPS positioning, remote climate control, remote lock/unlock, battery monitoring, etc. In Gen 1 Leafs it can be installed via a simple plug into the OBDII port. In Gen 2 Leafs, a custom adaptor cable can be made to tap into the power and CAN buses at the [[CAN Gateway]].<ref>https://docs.openvehicles.com/en/latest/components/vehicle_nissanleaf/docs/index.html#models-ze1</ref> It is also necessary to disable the TCU, either by disconnecting the CAN BUS wires on its connector, or by removing it completely and replacing it with a couple of bridging wires and a 5V regulator to keep the [[AV Control Unit]] powered, power the microphone and pass its signal through.
+For 2G TCUs, it is possible to replace the SIM and configure the TCU to connect to a server of one's choosing.<ref>https://mynissanleaf.com/threads/reverse-engineering-telematics-unit.36889/</ref>
 == External Links ==
 * [https://mynissanleaf.com/threads/reverse-engineering-telematics-unit.36889/ Reverse engineering Telematics Unit - My Nissan Leaf Forum]
-* [https://www.youtube.com/watch?v=5QBOmr_ZyLo&ab_channel=DEFCONConference DEF CON 25 - Mickey Shkatov, Jesse Michael, Oleksandr Bazhaniuk - Driving down the rabbit hole]
+* [https://mynissanleaf.com/threads/2018-tcu-decoding-and-emulating.34628/ (2018+) TCU Decoding and Emulating] - My Nissan Leaf Forum
+* https://github.com/developerfromjokela/nissan-leaf-tcu
+* [https://www.youtube.com/watch?v=5QBOmr_ZyLo&ab_channel=DEFCONConference DEF CON 25 - Mickey Shkatov, Jesse Michael, Oleksandr Bazhaniuk - Driving down the rabbit hole - YouTube]
+== References ==