Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Information about power train CAN communications?

This site may earn commission on affiliate links.
Hi guys,

we are facing an exciting duty: We are trying to run the drive unit of a Model S stand-alone outside the car. Emulating the analog signals shouldn't be that big problem - what makes us worry about is the CAN communication. For gathering some messages we installed a measuring box directly to the drive unit. As a first approach we will gather some data on an ordinary ride where we try to minimize all kind of determining factors. Then the difficult task - decoding the messages. We expect this to be rather complex but we are willing to face this challenge.

Did anyone of you already gain experiences in this area? Or is someone maybe interested in working together at this question?

Best regards from Germany!
 
I would be surprised if the CAN bus is not encrypted. I work with CAN every day, but we don't bother with encryption and our systems don't support it. If it's not encrypted, I would think it would be possible to use a can bus sniffer and decipher the traffic. I hope you succeed and share your results.
 
The Model S definitely uses at least four different CAN networks.


If we read the CAN communication, how can we recognize encrypted traffic? Will the frames be completly different to the ordinary structure or are just the identifier or data fields modified somehow for example?
 
The Model S definitely uses at least four different CAN networks.


If we read the CAN communication, how can we recognize encrypted traffic? Will the frames be completly different to the ordinary structure or are just the identifier or data fields modified somehow for example?

If you are at least able to see the CAN frames and their respective IDs, that is a important start. At that point it takes a bit of study to analyze the messages as you change certain conditions (go from park to drive or reverse, etc.). Obviously it would be very important and helpful to get a lot of data logged for analysis with a complete and working vehicle. Things like pre-charging the capacitors are very important to keep from frying components.

The hardware I work with is not capable of encryption (at the hardware level), so other tricks must be used on the software side. I have no idea what Tesla's hardware is capable of. If it is anything like what I work with then it should be possible to figure this out. I know where Tesla was using a LIN bus (suspension position sensors, radiator flap position sensors and controllers, etc.), there was no special encryption going on (see Otmar's work on the Vanagon).
 
Last edited: