Some details on the Tanktaler

Introduction

The company ThinxNet GmbH from Munich offers the product TankTaler. It is an OBD-II compatible device that you can plug into your car. For people living in Stuttgart, Germany the device used to be free. It offers the following key features towards the user:

  • Find my car
  • Electronic journey log
  • Follow me (Glympse-like functionality)
  • Status information about your car (e.g. battery voltage, milage, fuel level)

Furthermore, you are collecting points for fueling your car at partner gas stations that you can get refunded in the form of amazon gift cards.

Tanktaler from the user perspective

Users interact with Tanktaler exclusively via the free app for iOS an Android. The installation process is simple: Plug the OBD-II adapter into your car, activate it via the app and you are done. It will now transmit information about the position and status of your car as well as your movements to the Tanktaler server.

In the app you can always see where your car is currently located (in case you forgot where you parked it), what your trips were and where you stopped for fuel. The log of a trip contains the duration, distance, average speed as well as events with high acceleration or deceleration. Optionally you will receive push notifications after each trip. After each stop for fuel you are motivated to enter the amount of fuel you took on and the price, because you will get points for this.

Interestingly, the app will notify you almost immediately, when you unplug the OBD-II adapter from the car.

Internals

Since getting the device I always wanted to investigate some more what the hardware actually is capable of. Finding information was easy enough: The label on the device (underneath the Tanktaler sticker) reveals, that the hardware is in fact a 3rd party product: CalAmp LMU30G600-G1000.IMG_0394

Resources

Hardware Features

  • Connectivity
    • Cellular: GPRS, CDMA, HSPA and LTE Cat 1 options
      • Internal standard SIM card
    • OBD-II Connection
    • Optional: Bluetooth
    • Optional: RS232
  • Sensors
    • GPS with Taoglas Antenna
    • 3-axis Axelerometer
  • Other
    • LED
    • 200 mAh Backup Battery

Solution Overview

CalAmp offers two ways of customizing the LMU-3030:

  • Programmable Event Generator
  • LM Direct

Programmable Event Generator

The Programmable Event Generator (PEG) is the means by which a user can customize the LMU to perform a specific task, or a series of tasks. This can be something as simple as creating a report every time the vehicle moves 1 kilometer or as complicated as managing messages and behaviors of peripheral devices such as card readers, cameras or messaging terminals. It may be easiest to think of PEG as a type of programming language, though it is really not that complicated.

(Source: http://www.mcielectronics.cl/website_MCI/static/documents/PEG_Guia_de_programacion_v1.1.4.pdf)

LM Direct

Bildschirmfoto 2017-09-17 um 11.59.45

(Source: https://fccid.io/APV-4230HBT/Users-Manual/User-Manual-I-2534464)

Next Steps

It seems that the device can be programmed either via SMS or via a serial connection. In a quick glance in the documentation linked above I could not find any security mechanisms – I hence suspect, that having a serial connection would allow to dump all the relevant information from the device. The cable for the serial connection is part of the CalAmp Developers Kits, but the 1000 $ are a bit too expensive for me.

I would like to find a way to dump the configuration of the device and then investigate, what data is actually sent to the Tanktaler server. Help is appreciated.

Leave a Comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.