User avatar
FalconFour
Gold Member
Posts: 323
Joined: Wed Sep 19, 2012 12:07 pm
Delivery Date: 14 Sep 2012
Leaf Number: 008681
Location: San Jose, CA
Contact: Website Facebook

Hacking the VSP Box (Noise Maker)

Tue Aug 11, 2015 7:33 pm

I hate that dang thing. :lol:

It sucks that the 2013+ LEAFs don't have the VSP Off button. Regulations, whatever. People have eyes - pedestrians and drivers should both be responsible for avoiding one another. Not the job of the vehicle manufacturer. That petite dandelion "ding, ding, ding" backup sound is awful, as is the cutesy "whoosh" it makes, and the Japanese Utopia set of sounds embedded as "effects" in the control panel. That's my position on it.

So, in setting out to add "VSP Off" back to my 2013 LEAF, I found - spoiler alert - you just ground pin #5 of the VSP plug, which is where the button used to reside on 2011-2012 LEAFs. Just a momentary ground, and you'll get the "VSP Off" light on the center console (where the "passenger airbag" indicator is). One more momentary ground, and VSP is back on. It's a toggle button. So, just wire that up, and you've got a VSP Off button again. You're welcome. :)

But that's never enough for a hacker. 8-)

I took the VSP box apart, and found a MX25L8006E 8mbit (1MByte) SPI flash ROM chip on there. "That's an awful big chip for runtime parameters or code...", I thought.

So I dug into it with a Raspberry Pi and the "flashrom" program. I wired everything up, but found I had to pull the "HOLD#" pin high as well. Sure enough, Flashrom extracted the full contents of the ROM chip and placed it into a flat binary ROM file.

Image
That file is here. Go at it!
https://onedrive.live.com/redir?resid=4 ... file%2crom

I've been playing with methods to get the audio data out of the ROM. Best way to go about modifying something is to recreate it first. So, I fired up Audacity and took a stab at some RAW import parameters.

Seems like VOX ADPCM, 22050hz, but even that coding comes out a bit warbled. That also only seems to be the encoding for the interior sounds (startup sounds). The others - the beeps and the "whoosh" sounds - seem to be encoded differently, which makes sense, since the whooshing sound varies a LOT based on the speed of the car.

So far, I've found this structure:
(Lots of silence - 0xFF)
Default power-button chime
(silence)
Default startup sound -- update: these may be Yamaha ADPCM format, since the chip is a Yamaha YMF827B
(silence)
Effect 2(?) power-button chime
Whooshing effect base (encoded differently)
(silence)
Effect 2(?) startup sound
(silence)
Effect 3(?) power-button chime
(silence)
Effect 3(?) startup sound
(silence)
Series of beep/ding tones (encoded differently) -- update: these are also Yamaha ADPCM, 10 tones total

I think the whooshing effects and the beep/ding tones are used programmatically, hence they're stored with a different encoding.

With Flashrom, since the chip is one of their many supported chips, I can also write back this raw data directly onto the chip, so once we establish how the sounds are encoded, they can be modified, patched into the ROM (likely in place of the original sounds, exactly the same duration is required), and then flashed back onto the board. If all else fails, I still have the ROM backup that I can flash back, and it's like nothing ever changed. :geek:

Anyone want to try their hand at tearing that ROM apart? :mrgreen:
Last edited by FalconFour on Tue Aug 11, 2015 11:10 pm, edited 1 time in total.
100% gas-free since September 2012
2011 LEAF SL - Sep 2012~Sep 2014 - 35,737 miles
2013 LEAF S+Charge - Jan 2014-Feb 2017 - 68,065 miles
2014 LEAF SV+Premium+QC - Feb 2017-present

User avatar
FalconFour
Gold Member
Posts: 323
Joined: Wed Sep 19, 2012 12:07 pm
Delivery Date: 14 Sep 2012
Leaf Number: 008681
Location: San Jose, CA
Contact: Website Facebook

Re: Hacking the VSP Box (Noise Maker)

Tue Aug 11, 2015 8:31 pm

Already made some great progress here! It appears that the effects are encoded as - naturally - Yamaha ADPCM format. By extracting a section and giving it the extension ".YADPCM", a little piece of software called Awave Studio (shareware) was able to open it up and play it 100% perfectly.

Image

For your listening pleasure, here it is in WAV format:
https://onedrive.live.com/redir?resid=4 ... file%2cwav

Now that we know what the format is supposed to be, we can replace sounds! :mrgreen:

update: Also, looking at the ROM file, it looks like the effect sounds line up quite clean with the boundaries of 0x10000 segments - which means that a replacement sound may not necessarily need to be the same size! It may be perfectly fine with a shorter sound being padded with 0xFF at the end, or a longer sound extending into the existing 0xFF padding. I think it just cares about the start address...
100% gas-free since September 2012
2011 LEAF SL - Sep 2012~Sep 2014 - 35,737 miles
2013 LEAF S+Charge - Jan 2014-Feb 2017 - 68,065 miles
2014 LEAF SV+Premium+QC - Feb 2017-present

User avatar
TickTock
Posts: 1701
Joined: Sat Jun 04, 2011 10:30 pm
Delivery Date: 31 May 2011
Leaf Number: 3626
Location: Queen Creek, Arizona
Contact: Website

Re: Hacking the VSP Box (Noise Maker)

Tue Aug 11, 2015 8:51 pm

Very cool. Nice work! Is one of the wires into the VSP a speed indicator or does CANbus go there and it just snoops? Was the ROM socketed or did you have to unsolder it? Be interesting to try programming a new ROM with a minor tweak to see if there is a checksum protection. Don't know why they would bother for the sound bytes (bites?) except, perhaps, out of habit.

User avatar
FalconFour
Gold Member
Posts: 323
Joined: Wed Sep 19, 2012 12:07 pm
Delivery Date: 14 Sep 2012
Leaf Number: 008681
Location: San Jose, CA
Contact: Website Facebook

Re: Hacking the VSP Box (Noise Maker)

Tue Aug 11, 2015 9:43 pm

This is the diagram for 2011-2012 - which is basically identical to 2013+ (except that 2013 has the VSP OFF switch just removed from the diagram, pin position and all - though it still works!).

Image

I think it listens to the CAN bus. It almost seems like the module just listens for specific commands, and has a fair bit of its own (non-persistent) memory. Example - it forgot that I set the Effect to "off" after unplugging the module, so when I plugged it back in, it went back to the default sound-set. I tried changing the effect while it was unplugged, and the dash was happy to navigate, but to no effect (it defaulted back to the normal sounds when plugged back in). Finally, if I plug the VSP module back in *just* after pressing the power button, but before it'd typically play the startup sound, it'll actually play only the startup sound, right on time. I think it's based on a CAN command set.

As for the ROM, I just hacked it in-place, no soldering needed. I used one of these (exact items, actually), and a Raspberry Pi using this guide for installing & configuring flashrom on the Pi with a clean Raspbian base. The circuit was totally cool with being given 3.3V, it seems. The board still works perfect in the car after various attempts at getting the ROM out of it. Holding "HOLD#" high (actually just shorting it to VCC pin) was the key to getting it working in the end.
100% gas-free since September 2012
2011 LEAF SL - Sep 2012~Sep 2014 - 35,737 miles
2013 LEAF S+Charge - Jan 2014-Feb 2017 - 68,065 miles
2014 LEAF SV+Premium+QC - Feb 2017-present

User avatar
JeremyW
Posts: 1518
Joined: Sun Nov 13, 2011 12:53 am
Delivery Date: 23 Jun 2012
Leaf Number: 19136
Location: San Gabriel, CA

Re: Hacking the VSP Box (Noise Maker)

Wed Aug 12, 2015 12:04 am

Only the 2011's have the VSP off button, btw. US 2012's didn't have it either. All other markets have it regardless of year I think.
Former 2012 SL leasee 6/23/12 - 9/23/15
Now driving Honda Fit EV, License plate: CHADEMO
2000 Honda Insight for long trips

User avatar
drees
Moderator
Posts: 6204
Joined: Fri Apr 23, 2010 3:51 pm
Location: San Diego

Re: Hacking the VSP Box (Noise Maker)

Wed Aug 12, 2015 12:16 am

Nice work, FalconFour!
'11 LEAF SL Powered By 3.24 kW Enphase Solar PV

cwerdna
Gold Member
Posts: 7201
Joined: Fri Jun 03, 2011 4:31 pm
Delivery Date: 28 Jul 2013
Location: SF Bay Area, CA

Re: Hacking the VSP Box (Noise Maker)

Wed Aug 12, 2015 12:26 am

JeremyW wrote: All other markets have it regardless of year I think.

Interesting, if that's the case.

Personally, (now that I have an owned Leaf) I'd only really only want a clean switch/button to toggle the VSP off. The only time I'd want to turn it off when backing out of my driveway @ home, after no sound or a just a few reverse chimes. I'd otherwise want all the noises whenever they normally sound. I don't want to disconnect the module and lose all those sounds.

I just don't want to alert bad guys that I'm leaving home. And yes, my house was burglarized for the 1st time ever in January 2015. I'll never know if the Leaf noises helped w/them determining my coming/going patterns, but they broke in on a weeknight while I wasn't on vacation (but wasn't home either). This house (built in 1979) has never been burglarized nor has any place I've lived, until now.

It really irks me Nissan removed the toggle on the '12+ Leafs. I've been meaning to officially contact Nissan (no, not via a dealer) to have them bring it back in future models and also sell a supported mod w/a disable switch for ones w/o it. I'm 99% sure the latter won't happen but the former could happen, if enough people complain.

'13 blue Leaf SV w/premium package (owned)
'13 blue Leaf SV w/QC + LED & premium packages (lease over, car returned)
'06 Prius

User avatar
jhm614
Forum Supporter
Posts: 907
Joined: Fri Apr 23, 2010 7:48 pm
Delivery Date: 30 Mar 2011
Leaf Number: 000493
Location: Arlington, TX

Re: Hacking the VSP Box (Noise Maker)

Wed Aug 12, 2015 4:50 am

Great work! I'm looking forward to the Jetson's Car Sound mod!
2011 Brilliant Silver SL - 110,000 gasoline free miles so far.
4BL: 06/29/13 @ 27 months, 43,520 miles, 42.56 Ahr. New 12 bar battery: 09/09/13
4BLx2:12/31/16 @ 69 months, 99,475 miles, 42.99 Ahr.

desiv
Posts: 594
Joined: Tue Jan 06, 2015 1:10 pm
Delivery Date: 04 Jan 2015
Leaf Number: 018850
Location: Lincoln City, Oregon

Re: Hacking the VSP Box (Noise Maker)

Wed Aug 12, 2015 8:06 am

jhm614 wrote:Great work! I'm looking forward to the Jetson's Car Sound mod!

That was my first thought! ;-)

JeremyW wrote: The only time I'd want to turn it off when backing out of my driveway @ home,

I would think, with people/kids in neighborhoods, that's a time I'd want it on more than some others..
As for the crime aspect, I would think any criminal so close that they can hear a backup beep can also see your car driving away.
But that's just me.. ;-)

desiv
2012 Leaf SL - Silver (gone - traded in)
2017 Bolt LT - Red

KillaWhat
Posts: 866
Joined: Thu Feb 23, 2012 5:15 pm
Delivery Date: 15 Mar 2012
Location: Southeast Pennsylvania

Re: Hacking the VSP Box (Noise Maker)

Wed Aug 12, 2015 5:08 pm

jhm614 wrote:Great work! I'm looking forward to the Jetson's Car Sound mod!


If you can change my VSP sound to the Jetson's sound, I'll buy this right NOW,

Image
Black SL Delivered 3/14/2012
7.2Kw Charging w/Brusa
Leather Interior
Rosewood Dash
JUKE 17" Wheel Upgrade w/225-45-17 Michelin MXM4 Tires
Horn Upgrade
Infinity 63.9i Speaker Upgrade
WattsLeft Meter System
LED High Beams
Carkit NAV Override

Return to “Accessories / Mods”