Taycan 4S tuning - hypothetically

[WasserGKuehlt]

You’re right that it’s not just the power levels that are different. There are definitely more standard and stylized interior and exterior features that go along with the tiers. But for the performance parts, of battery/inverter/motors, there is substantial reuse across the models. 2 battery variants, 2 rear motor variants, 1 front motor variant, 2 inverter variants.

Right, that's what I meant about sharing: if motors are the same, the power electronics or the battery would differ; if the latter would be shared, the motors would not. As in, you know, combinations of n choose k. The GTS was always an esthetics-only type of model. Anyway, seems like I completely missed the memo of the 4 vs 4S (wouldn't have made a difference in my decision to go with the base model - quite the opposite).

And why wouldn’t Porsche reuse components and utilize software to further differentiate tiers? Hardware variation adds expense, especially in a constrained supply chain.

Lol, I think you're looking at it backwards; before, extracting more money meant having to provide more - different/larger engine, or some tuning (the X50 kits?) or "slapping a turbo on" (and the 1k associated parts and modifications for that). It did cost more to provide that upper/next trim, and customers were willing to pay the difference.

Now, though, the implication seems to be that the 'more' being provided is a 'if (got$17kFromCx) { releaseMoarHP(); }. There is no variation here, except a different code path.

Sponsored

 

[WasserGKuehlt]

Unfortunately, flash counters are not the only way to detect software changes. There are also check sums that can detect any change in any portion of the software, including lookup tables. So I wouldn’t assume there is absolutely no chance of Porsche detecting these modifications.

Agreed, and if indeed the PIWIS doesn't "see" this mod it's perhaps just a matter of time. (I'm still kinda angry it's that easy. For your enjoyment, and with apologies for the bad form of quoting myself: What would a battery swap cost? | Page 3 | TaycanForum -- Porsche Taycan Owners, News, Discussions, Forums - and it goes into the weeds from there. A few posts back is where the topic was set.)

 

[tchavei]

Agreed, and if indeed the PIWIS doesn't "see" this mod it's perhaps just a matter of time. (I'm still kinda angry it's that easy. For your enjoyment, and with apologies for the bad form of quoting myself: What would a battery swap cost? | Page 3 | TaycanForum -- Porsche Taycan Owners, News, Discussions, Forums - and it goes into the wees from there. A few posts back is where the topic was set.)

I remember that thread.

Btw, I'm 99% sure the on board certificates for "perpetual" options we have chosen on our cars are good for 100 years. I found the expiry dates buried in myporsche http traffic. Mines are set to expire Dec 22nd 2123

I'll be long dead before that

 

[whitex]

Any modification is a risk to have your warranty denied. I did get this response from them though when I asked how easily it would be to detect:
"We correct flash counters... The Porsche tester doesn't see that it's tuned."

So how do they prevent OTA from flashing a newer, unmodified version?

PS> I'm surprised these guys were able to do it. Evidently Porsche does not sign their firmwares, or have a poor chain of trust, or just insecure implementation. This was the main reason why hacking Tesla requires man-in-the-middle type attacks using extra hardware inserted between components (something Tesla has over time cracked down on too, by authenticating and sometimes encrypting communications).

 

[whitex]

I wonder if Porsche does any parts binning based on yield, like in chip production - all chips come off the same production, but then they are tested and a max speed is programmed on each based on the test. You can "overclock/overvoltage" such chips, which will make them run faster, BUT they will produce a lot more heat (so require more cooling) and/or corrupt data when running at those higher speeds. Not sure how that would work for mechanical parts - oh, this transmission gear tolerances are ok for Taycan 4 power levels but not for Turbo S for sure?

 

[WasserGKuehlt]

Btw, I'm 99% sure the on board certificates for "perpetual" options we have chosen on our cars are good for 100 years. I found the expiry dates buried in myporsche http traffic. Mines are set to expire Dec 22nd 2123

I'll be long dead before that

In principle there is nothing wrong with a 'base'/standard feature which just needs to plug into a secured framework to carry a forever cert - it's just mechanics, and the consequences of compromising that cert are probably nil. The problems would occur if that cert could be used for something else.

But to be clear, I'm fairly certain that their PCM/"entertainment" or other car operations-related software is different, and in a separate security world from the car's system software. Those certs would be short lived, and might even be on demand.

But given the revelations in this thread, the reality might be closer to what you observed than what I'm imagining.

 

[tchavei]

In principle there is nothing wrong with a 'base'/standard feature which just needs to plug into a secured framework to carry a forever cert - it's just mechanics, and the consequences of compromising that cert are probably nil. The problems would occur if that cert could be used for something else.

But to be clear, I'm fairly certain that their PCM/"entertainment" or other car operations-related software is different, and in a separate security world from the car's system software. Those certs would be short lived, and might even be on demand.

But given the revelations in this thread, the reality might be closer to what you observed than what I'm imagining.

Well, this thread just proves what I said

The Reverse Engineers always wins

 

[tchavei]

But given the revelations in this thread, the reality might be closer to what you observed than what I'm imagining.

I'm not surprised. I deal with encrypted code or better, we have to encrypt/decrypt it. The problem is that it's encrypted in real time and sent to the client on boot and unencrypted in memory in real time so the code actually runs. This means that mitm is possible no matter how strong the encryption is because it has to be decrypted at some point by the app itself. You can obfuscate it and make someone's life miserable but adding heavy encryption is just a shot in your foot because it lags the execution.

Then again, I know a certain multi billion software company that shall not be named that encrypted one of their apps with a cheap $50 off the shelf commercial encryption. Needless to say it took an evening to defeat it.

Never assume big companies live up to their reputation.

 

[bsclywilly]

I wonder if Porsche does any parts binning based on yield, like in chip production - all chips come off the same production, but then they are tested and a max speed is programmed on each based on the test. You can "overclock/overvoltage" such chips, which will make them run faster, BUT they will produce a lot more heat (so require more cooling) and/or corrupt data when running at those higher speeds. Not sure how that would work for mechanical parts - oh, this transmission gear tolerances are ok for Taycan 4 power levels but not for Turbo S for sure?

Overclocking is actually a pretty good analogy for batteries and motors. You discharge a battery faster, more heat. You run more current through the motor and inverters, more heat. The one problem with running more current through the motor is that your losses start to increase so for a 4/4S (smaller rear motor) running the same continuous power as a T/TS you would be consuming more energy and more heat. But these things are all time dependent so if it’s the average road going car it’s not likely you’ll reach those limits.

 

[Electron]

So how do they prevent OTA from flashing a newer, unmodified version?

I’m not even sure that module can be reflashed OTA. It could be PIWIS only.

But to be clear, I'm fairly certain that their PCM/"entertainment" or other car operations-related software is different, and in a separate security world from the car's system software.

I agree. There’s most likely a security gateway between the infotainment/telematics domain and the safety-critical realtime controllers.

Tesla did a fantastic job consolidating numerous ECUs into a few high-performance domain control modules. The Taycan is no where close to that. Maybe in the next-gen architecture…but that has experienced continual delays and it seems it won’t be ready in time for the next generation Taycan.

 

[WasserGKuehlt]

I'm not surprised. I deal with encrypted code or better, we have to encrypt/decrypt it. The problem is that it's encrypted in real time and sent to the client on boot and unencrypted in memory in real time so the code actually runs. This means that mitm is possible no matter how strong the encryption is because it has to be decrypted at some point by the app itself. You can obfuscate it and make someone's life miserable but adding heavy encryption is just a shot in your foot because it lags the execution.

Then again, I know a certain multi billion software company that shall not be named that encrypted one of their apps with a cheap $50 off the shelf commercial encryption. Needless to say it took an evening to defeat it.

Never assume big companies live up to their reputation.

It’s doable. Confidential compute, mate. (I figured a facial expression was necessary for tone.)

 

[whitex]

Overclocking is actually a pretty good analogy for batteries and motors. You discharge a battery faster, more heat. You run more current through the motor and inverters, more heat. The one problem with running more current through the motor is that your losses start to increase so for a 4/4S (smaller rear motor) running the same continuous power as a T/TS you would be consuming more energy and more heat. But these things are all time dependent so if it’s the average road going car it’s not likely you’ll reach those limits.

Well, overclocking is relative. For example, the very same chip in automotive is ran slower and cooler in order to prolong its life to 12 years for example, while in a tablet it will be allowed to run faster because the lifespan is 2-4 years. Similar power derating is done to engines in aviation, where engines are rated significantly lower than what the same engine in another application would do. So I guess the question is, is drawing more than what Porsche rated to motor is going to shorten its life?

 

[bsclywilly]

Well, overclocking is relative. For example, the very same chip in automotive is ran slower and cooler in order to prolong its life to 12 years for example, while in a tablet it will be allowed to run faster because the lifespan is 2-4 years. Similar power derating is done to engines in aviation, where engines are rated significantly lower than what the same engine in another application would do. So I guess the question is, is drawing more than what Porsche rated to motor is going to shorten its life?

In my opinion, not for most people. From what I read, the expected lifespan for these motors is already considerably longer than any ICE vehicle. The extra stress for short durations is something electric motors handle very well. But for the few people that will be putting a lot of demand on their vehicle, at the track or whatever you’ll see premature wear just like in any other vehicle if driven aggressively. My perspective is that Porsche originally marketed the Taycan’s ability to lap and launch repeatedly with little to no performance degradation. That requires a significant design factor that frankly most all owners will never subject their cars to.
In any case, if you wear out your motor you can just replace it for less than 10k. If you have a 4/4S you can upgrade it to a turbo rear motor at the same time… I bet it will be plug and play!

 

[Raphie]

So what’s the upside for this mod outside more boost in launch mode? Nothing? Then why even bother?

 

[WuffvonTrips]

If Porsche have been clever, the presence of significant power "upgrades" could be detected indirectly by other modules and their sensors, e.g. traction control. My use of "if" was slightly sarcastic, but- when max power output levels are a key differentiator underpinning large price differences across the range, there's a lot of incentive for them to make the effort to be clever.

Sponsored