Introduction
The company ThinxNet GmbH from Munich offers the product TankTaler. It is an OBD-II compatible device that you can plug into your car. For people living in Stuttgart, Germany the device used to be free. It offers the following key features towards the user:
- Find my car
- Electronic journey log
- Follow me (Glympse-like functionality)
- Status information about your car (e.g. battery voltage, milage, fuel level)
Furthermore, you are collecting points for fueling your car at partner gas stations that you can get refunded in the form of amazon gift cards.
Tanktaler from the user perspective
Users interact with Tanktaler exclusively via the free app for iOS an Android. The installation process is simple: Plug the OBD-II adapter into your car, activate it via the app and you are done. It will now transmit information about the position and status of your car as well as your movements to the Tanktaler server.
In the app you can always see where your car is currently located (in case you forgot where you parked it), what your trips were and where you stopped for fuel. The log of a trip contains the duration, distance, average speed as well as events with high acceleration or deceleration. Optionally you will receive push notifications after each trip. After each stop for fuel you are motivated to enter the amount of fuel you took on and the price, because you will get points for this.
Interestingly, the app will notify you almost immediately, when you unplug the OBD-II adapter from the car.
Internals
Since getting the device I always wanted to investigate some more what the hardware actually is capable of. Finding information was easy enough: The label on the device (underneath the Tanktaler sticker) reveals, that the hardware is in fact a 3rd party product: CalAmp LMU30G600-G1000.
Resources
- Device Information
- How to buy
- Amazon CalAmp LMU-3030-HSPA-dual UMTS/HSPA yes Asset Tracker AT+T, T-mo, Vodafone (no affiliate link!)
-
DCS MARKETPLACE CalAmp LMU-3000 Series (LMU-3030) (no affiliate link!)
- EmbeddedWorks CalAmp LMU-3030 Verizon-CDMA Asset Tracker (no affiliate link!)
- Official Documentation
Hardware Features
- Connectivity
- Cellular: GPRS, CDMA, HSPA and LTE Cat 1 options
- Internal standard SIM card
- OBD-II Connection
- Optional: Bluetooth
- Optional: RS232
- Cellular: GPRS, CDMA, HSPA and LTE Cat 1 options
- Sensors
- GPS with Taoglas Antenna
- 3-axis Axelerometer
- Other
- LED
- 200 mAh Backup Battery
Solution Overview
CalAmp offers two ways of customizing the LMU-3030:
- Programmable Event Generator
- LM Direct
Programmable Event Generator
The Programmable Event Generator (PEG) is the means by which a user can customize the LMU to perform a specific task, or a series of tasks. This can be something as simple as creating a report every time the vehicle moves 1 kilometer or as complicated as managing messages and behaviors of peripheral devices such as card readers, cameras or messaging terminals. It may be easiest to think of PEG as a type of programming language, though it is really not that complicated.
(Source: http://www.mcielectronics.cl/website_MCI/static/documents/PEG_Guia_de_programacion_v1.1.4.pdf)
LM Direct
(Source: https://fccid.io/APV-4230HBT/Users-Manual/User-Manual-I-2534464)
Next Steps
It seems that the device can be programmed either via SMS or via a serial connection. In a quick glance in the documentation linked above I could not find any security mechanisms – I hence suspect, that having a serial connection would allow to dump all the relevant information from the device. The cable for the serial connection is part of the CalAmp Developers Kits, but the 1000 $ are a bit too expensive for me.
I would like to find a way to dump the configuration of the device and then investigate, what data is actually sent to the Tanktaler server. Help is appreciated.