Teardown: Vehicle Tracking Device / Fleet Management / Insurance

[Stonent]

I recently changed car insurance companies and they offered that if we put these little tracking devices in our cars that they would drop our rate by up to 30% based on how we drove.

Some of the parameters it gave us for how it would determine if we could save money is:
1. Vehicles were not being operated above 70MPH (110KM/h-ish)
2. No hard braking
3. No hard accelerating
4. Commuting distances matched what we told them

With another insurance company I checked they also said with these devices they will also check if you're operating your vehicle after 1:00AM which might indicate you've been out drinking. 

Apparently after 3 months they will give us a link to a website where we can track the vehicle's location as well in case it gets lost or stolen

Anyway here's the pictures. Sorry for not taking the battery out, I didn't want to "tamper" with it too much.



Modus LMU30C5S0-MDS01.  I googled the LMU30C5S0 and it is sold by a number of brands, mainly used for Fleet Management and remote vehicle diagnostics.  Since mine has an ESN and MDN, it must be the CDMA version which appears to all run on Sprint.



The insides, not a whole bunch to see.  The battery was stuck down so tight I thought it was going to damage something removing it, so I didn't.  The FCC ID indicates it's a Lisa-C200 1xRTT 144kbps CDMA modem.
http://www.u-blox.com/en/wireless-modules/cdma/lisa-c200.html

The LISA-C2 series provides dual-band CDMA2000 1xRTT data and voice communication in a compact SMT form factor. They are fully qualified and certified modules, featuring extremely low power consumption and a rich set of Internet protocols.

LISA-C2 modules are ideally suited to M2M and automotive applications such as: Fleet management, Automatic Meter Reading (AMR), people and asset tracking, surveillance and security and Point of Sales (PoS) terminals.

This appears to be the cellular antenna. Sprint operates CDMA over the 1900MHz band.




Side View, not much to see.



GPS Antenna: http://www.taoglas.com/antennas/GPS-GLONASS_Antennas/Internal_GPS_-_Passive_Ceramic_Patch_Antennas/



Not a very good back view, I might take this again.  The Winbond chip is a  25q32fv16 4Mx8 SPI Flash.

Above that is what appears to be an ADS8326 ADC http://www.ti.com/product/ads8326 (Well it says 8326 on it, rather)

So unfortunately the right angle boards are soldered to the pin headers so I can't peek more. I will follow up if I get better pictures, or if anyone can find another teardown with more info, I'd be interested.  I suppose some of those chips I couldn't identify might be a MCU and a MEMS accellerometer.

I have a clone ELM327 OBDII code reader that I would be interested in splicing in to see if I can see what data is going to this device, apparently they can share the same bus with a splitter cable.

These tracking devices seem to be referred to as LMU-3030 as well.  I have found several links for them being sold under a variety of brand names as Vechicle Trackers and Fleet Managment.  The price range is 120-140 dollars.

Here's a site selling one and he explains its capabilities.

http://shop.gpstrackingtracker.com/obd-ii-gps-vehicle-tracker.html

[electr_peter]

Hi, Stonent

Nice small teardown you have done there. Device seems to be combination of GPS receiver, CDMA network capability and most likely some sort of accelerometer. Nice unit, seems to be well designed and easy to operate.

I recently changed car insurance companies and they offered that if we put these little tracking devices in our cars that they would drop our rate by up to 30% based on how we drove.

Some of the parameters it gave us for how it would determine if we could save money is:
1. Vehicles were not being operated above 70MPH (110KM/h-ish)
2. No hard braking
3. No hard accelerating
4. Commuting distances matched what we told them

With another insurance company I checked they also said with these devices they will also check if you're operating your vehicle after 1:00AM which might indicate you've been out drinking. 

Apparently after 3 months they will give us a link to a website where we can track the vehicle's location as well in case it gets lost or stolen

But wait a minute. Do I read correctly that it was installed not by you but by your insurance company? So insurance company tracks where, when and how you drive? I don't know about you, but I would not sign to be in such arrangement for a personal car.

[Rick Law]

Hi, Stonent

Nice small teardown you have done there
... ... ...
But wait a minute. Do I read correctly that it was installed not by you but by your insurance company? So insurance company tracks where, when and how you drive? I don't know about you, but I would not sign to be in such arrangement for a personal car.

On Star and many other similar service will not be happy to hear your view; nor would Tom Tom.  They sold your driving habits to governments.  In fact, I think the Netherlands use Tom Tom's info on your speed to issue you your speeding ticket(s). <<< this according to a documentary called "Terms and Conditions May Apply."

But, I agree with you.  I don't like the idea of having some employee of unknown origin knowing exactly where I am, how fast I am driving, and have the ability to disable my engine and unlock my car at a push of a button at their end.

[Stonent]

Yeah, well it is voluntary.  You get a small percentage off your insurance to start with and then up to 30% additional later.
The device itself plugs into the OBDII port under your dash.

[electr_peter]

Hi, Stonent

Nice small teardown you have done there
... ... ...
But wait a minute. Do I read correctly that it was installed not by you but by your insurance company? So insurance company tracks where, when and how you drive? I don't know about you, but I would not sign to be in such arrangement for a personal car.

On Star and many other similar service will not be happy to hear your view; nor would Tom Tom.  They sold your driving habits to governments.  In fact, I think the Netherlands use Tom Tom's info on your speed to issue you your speeding ticket(s). <<< this according to a documentary called "Terms and Conditions May Apply."

I don't care if they are happy or not. I won't buy GPS device that is "too smart for its own good". Dumb receiver with some maps is what I use in a car.
Tom Tom GPS devices seem to be way overpriced in the area I live.
There is an old NYTimes article on road taxes http://www.nytimes.com/2011/08/11/science/earth/11meter.html

But, I agree with you.  I don't like the idea of having some employee of unknown origin knowing exactly where I am, how fast I am driving, and have the ability to disable my engine and unlock my car at a push of a button at their end.

Insurance company means something around these lines: "Look, we do not have enough good data to estimate risk of our customers. But we know great idea - by tracking our customers we can estimate their behaviour and future risk. We don't have such data, so we will give 0.01% discount for users that have GPS tracker in a car." It is all fine, except that insurance company mostly benefits from this arrangement (not you) while you have to give up your privacy for a few $.

[Stonent]

30% is a pretty good discount I think.

[electr_peter]

30% is a pretty good discount I think.

If 30% percent is "good" depends on total insurance costs. YMMV, it may be significact saving in your case.

Anyway, I don't think it is great idea to give private companies both technical capability and legal pretext to track their customers' movement in real or semi-real time. Mobile operators can easily track cellphones (via gsm standard specific, no gps sensor needed), but their are at least limited (should be limited) in legal terms.

[Stonent]

30% is a pretty good discount I think.

If 30% percent is "good" depends on total insurance costs. YMMV, it may be significact saving in your case.

Anyway, I don't think it is great idea to give private companies both technical capability and legal pretext to track their customers' movement in real or semi-real time. Mobile operators can easily track cellphones (via gsm standard specific, no gps sensor needed), but their are at least limited (should be limited) in legal terms.

It might be around $100 a month if we all drive safely.

[dr.diesel]

It might be around $100 a month if we all drive safely.

Huh?  I only pay $250/month for homeowners, 3-cars, 1-truck, 1-motorcycle, 2-trailers and an ATV.  Not sure I'd even notice 30% off one car!  All vehicles are full coverage, not the min, no insurance, underinsured etc.

Statefarm, good drivers discount, multi car/vehicle discounts, married and over 25 years old.

[w2aew]

Huh?  I only pay $250/month for homeowners, 3-cars, 1-truck, 1-motorcycle, 2-trailers and an ATV.  Not sure I'd even notice 30% off one car!  All vehicles are full coverage, not the min, no insurance, underinsured etc.

Statefarm, good drivers discount, multi car/vehicle discounts, married and over 25 years old.

Well, you certainly don't live in NJ!!!  Home of the highest auto insurance rates in the US.  Over 25, married, homeowner, multi-car discounts, clean driving record, no points/accidents, etc. and it's not uncommon to pay over $100/mo for *each* vehicle for full coverage. 

[Rerouter]

One very obvious downside with the unit is that its OBD2 based, which generally means its left poking down at a right angle of the drivers or passengers foot well, in what is generally a very bad place for GPS reception (firewall and metal body structures)

There is an insurance company in aus that use a company called bigmate for units, (they swap the units supplier every bloody month or two) which were designed a bit more smartly, they where waterproof, had 6mm eyelets to go onto your battery (with an inline fuse) and was made to be tucked away under the plastic part of the air-con intake below the windscreen,

There are literally hundreds of these units floating around, most of them have a serial debug header for changing settings and ublox seems to be a favored provider,

as for logging on the canbus, yes its very possible, as most car manufacturers isolate the diagnostics port a bit from the main canbus meaning most of the requests you see will be from the device itself, at a guess it will be taking in RPM, vehicle wheel speed (on some cars each wheel has a sensor), Ignition status, possibly throttle percentage, and possibly ABS / Airbag events (depending a bit on what the car reports). I'm not actually certain if the brake switch status is reported on many pre-2005 cars :/

[Stonent]

When we received these there was a note in the box that you should send it back if you find the device interferes with your driving or movement of your leg.

In the US, the OBDII port is almost always directly to the left or right of the steering column and tucked back about 3 or 4 inches.

[diyaudio]

I recently changed car insurance companies and they offered that if we put these little tracking devices in our cars that they would drop our rate by up to 30% based on how we drove.

Some of the parameters it gave us for how it would determine if we could save money is:
1. Vehicles were not being operated above 70MPH (110KM/h-ish)
2. No hard braking
3. No hard accelerating
4. Commuting distances matched what we told them

With another insurance company I checked they also said with these devices they will also check if you're operating your vehicle after 1:00AM which might indicate you've been out drinking. 

Apparently after 3 months they will give us a link to a website where we can track the vehicle's location as well in case it gets lost or stolen

Anyway here's the pictures. Sorry for not taking the battery out, I didn't want to "tamper" with it too much.



Modus LMU30C5S0-MDS01.  I googled the LMU30C5S0 and it is sold by a number of brands, mainly used for Fleet Management and remote vehicle diagnostics.  Since mine has an ESN and MDN, it must be the CDMA version which appears to all run on Sprint.



The insides, not a whole bunch to see.  The battery was stuck down so tight I thought it was going to damage something removing it, so I didn't.  The FCC ID indicates it's a Lisa-C200 1xRTT 144kbps CDMA modem.
http://www.u-blox.com/en/wireless-modules/cdma/lisa-c200.html

The LISA-C2 series provides dual-band CDMA2000 1xRTT data and voice communication in a compact SMT form factor. They are fully qualified and certified modules, featuring extremely low power consumption and a rich set of Internet protocols.

LISA-C2 modules are ideally suited to M2M and automotive applications such as: Fleet management, Automatic Meter Reading (AMR), people and asset tracking, surveillance and security and Point of Sales (PoS) terminals.

This appears to be the cellular antenna. Sprint operates CDMA over the 1900MHz band.




Side View, not much to see.



GPS Antenna: http://www.taoglas.com/antennas/GPS-GLONASS_Antennas/Internal_GPS_-_Passive_Ceramic_Patch_Antennas/



Not a very good back view, I might take this again.  The Winbond chip is a  25q32fv16 4Mx8 SPI Flash.

Above that is what appears to be an ADS8326 ADC http://www.ti.com/product/ads8326 (Well it says 8326 on it, rather)

So unfortunately the right angle boards are soldered to the pin headers so I can't peek more. I will follow up if I get better pictures, or if anyone can find another teardown with more info, I'd be interested.  I suppose some of those chips I couldn't identify might be a MCU and a MEMS accellerometer.

I have a clone ELM327 OBDII code reader that I would be interested in splicing in to see if I can see what data is going to this device, apparently they can share the same bus with a splitter cable.

These tracking devices seem to be referred to as LMU-3030 as well.  I have found several links for them being sold under a variety of brand names as Vechicle Trackers and Fleet Managment.  The price range is 120-140 dollars.

Here's a site selling one and he explains its capabilities.

http://shop.gpstrackingtracker.com/obd-ii-gps-vehicle-tracker.html

Sounds like a project I was interested in.

Many thanks for the tear down

[Rick Law]

Huh?  I only pay $250/month for homeowners, 3-cars, 1-truck, 1-motorcycle, 2-trailers and an ATV.  Not sure I'd even notice 30% off one car!  All vehicles are full coverage, not the min, no insurance, underinsured etc.

Statefarm, good drivers discount, multi car/vehicle discounts, married and over 25 years old.

Well, you certainly don't live in NJ!!!  Home of the highest auto insurance rates in the US.  Over 25, married, homeowner, multi-car discounts, clean driving record, no points/accidents, etc. and it's not uncommon to pay over $100/mo for *each* vehicle for full coverage.

Don't feel too bad w2aew...  I am in NJ.  A few years back, while standing in the check out line at the local quick-check, the kid working at the cash register was commenting it costs him over $20,000/year to insure his used Mustang...  More than twice what he paid for the car (according to his rant)

His QuickCheck cashier job certainly wont be able to his car insurance.  Worst case scenario: young driver, male, sport car...  Given the math skill of kids today (and then), I am not sure he added it up yet.

[saturation]

Thanks for the teardown.  One can emulate this device by getting a Garmin eTrex type unit that tracks movement continuously.  It has limited set of datapoints so you have to reset it eventually but it can give you a picture of your driving habits and patterns.  A key difference is a sender unit that is cell based versus the eTrex which uses USB.

I'd think it essential to integrate independent movement sensors to cross check the GPS data.

Now are far as using such a device, that's another story. 

Another issue is security, given the limited amount of encryption in ECU and other microcontroller driven components in most vehicles, any method to remotely access the OBDII port provides a wide open door to hacking, with serious consequences to occupants and reduces owner control for property one paid for. 


http://www.extremetech.com/extreme/132526-hack-the-diagnostics-connector-steal-yourself-a-bmw-in-3-minutes

http://www.autosec.org/publications.html

[Richard Crowley]

When I did this (2-3 years ago), the insurance company only wanted a couple of months "sample" to qualify for the discount. And then sent back the "dongle".  I would not feel comfortable with continuous monitoring.  Does OnStar (et.al.) do surreptitious monitoring?

My TomTom GPS asks for confirmation of photo-enforced traffic signals, presumably uploaded when you update the map database. Unfortunately, my unit is never recognized by any computer, so I am unable to update the map data. Every time I turn it on, it natters at me "Your map data is 26 months old, you should update it." I wish I could.

[Wilksey]

Nice teardown,
I have seen many applications with no micro, I wonder if they can use a Java engine in the module to do their dirty work?

Anyway, I am wondering if they use the OBD2 port for the CAN bus as they can get speed, brake force etc from GPS and Accel, the OBD port might just be a handy, non intrusive way of supplying power, as a cigarette lighter / accessory socket might already be in use?  What do you think?

[Rick Law]

...  Does OnStar (et.al.) do surreptitious monitoring? ...

Since they monitor you even AFTER you cancel the service, I would suspect they do "surreptitious monitoring".  For me, if I purchased a car with OnStar, I would want to personally witness it being ripped out of the vehicle and smashed before driving the car off the lot.

----------------------------------------------------------------------------
Below are quotes:

Adam Denison, a spokesman for the General Motors subsidiary, said ... “What’s changed [is that if] you want to cancel your OnStar service, we are going to maintain a two-way connection to your vehicle...” Denison said in a telephone interview ... The connection will continue, he said, to make it “easier to re-enroll” in the program ...

... Denison said, adding that the policy reinforces the company’s right to sell anonymized data...Collecting location and speed data via GPS might also create a treasure trove of data that could be used in criminal and civil cases...

Jonathan Zdziarski, an Ohio forensics scientist, blogged ... In a telephone interview ... He said the new privacy policy goes too far... “They added a bullet point allowing them to collect any data for any purpose,” he said....

http://www.wired.com/2011/09/onstar-tracks-you/
----------------------------------------------------------------------------

While I am a Physicist by training, a technology manager by profession, but I am a history bluff by interest.  Understanding how information, political correctness, and people's own apathy (and fear) are used against them through history, I would not ever feel so comfortable, as most young kids do, with others knowing my every move and thought.