TPMS CONTINUES TO FAIL... [RANT] And they are gonna send people the mars?

[scotty2541]

The 0x344 message is sent about once every second (presumably from the TPMS ECU). Sure, we can easily send that message but my concern is if we send 'here are the tyre pressures' and the TPMS ECU sends 'TPMS broken', we'll conflict. The VMS/VDS will typically pickup the last transmission.

Unplugging the TPMS ECU would solve that but involves ripping apart the dash.

Ripping apart the dash is a pain... the first or second time. After that, it becomes routine. I replaced the radio, then commenced to eliminate all the rattles and squeaks coming from the dash. They told me mine was one of the quietest roadster dash boards they every heard (except when the TMPS alert is going off I suppose).
Eventually you learn to not even bother replacing the passenger airbag clips. Mine is held on with Velcro.

I should have first v3 boards with me late next week, and the first very limited development board run should happen late this month. Production boards in the summer.

What is a "Tesla Tattler" and "OVM"? Can you provide some details?

 

[strider]

Ripping apart the dash is a pain... the first or second time. After that, it becomes routine. I replaced the radio, then commenced to eliminate all the rattles and squeaks coming from the dash. They told me mine was one of the quietest roadster dash boards they every heard (except when the TMPS alert is going off I suppose).
Eventually you learn to not even bother replacing the passenger airbag clips. Mine is held on with Velcro.

In my case I'm staring down Tesla labor to R&R the TPMS ECU anyway so I could have my Ranger do the tear down, I could unplug the ECU, then have the Ranger put it back together. I'd still be money ahead.

What is a "Tesla Tattler" and "OVMS"? Can you provide some details?

The Tesla Tattler and OVMS are devices that plug into the Tesla Diagnostic port in the passenger footwell and allow you to send and receive CAN bus messages via text messages from your phone (OVMS also has a fancy app).

The Tattler was developed by @scott451 and Richard Jones in late 2011. I don't think they're making/selling them any more though I can give you their e-mail addresses. Here's a picture of Scott and the Tattler:

And it's homepage:
tattler_v2

Around the same time, @markwj was working on a similar device (OVMS) that would not only use SMS but also a real-time data connection to a server that would send/receive data to an iOS or Android app on your phone. This project is still in active development and info can be found here:
Open Vehicles | Open Vehicle Monitoring System

The modem on my Tattler just died (it's been intermittent for a few months now) so I'm planning to order an OVMS when the v3 units are ready. Hopefully I can help decode the messages and then talk Mark and the other developers into spoofing the TPMS ECU to the VMS.

 

[scotty2541]

Here's a picture of Scott and the Tattler:

.

OMG That's my blue! Except his is a 1.5.

It doesn't look like the tattler will let us do anything to fool the TPMS system.

I agree that the next step is to disconnect the ECU, and create an emulator for that. Software, micro controllers, and embedded programming are my passion. I could also reverse it, but if people already know what messages to impersonate, could write the code and build a mini unit, like this project.

 

[strider]

I agree that the next step is to disconnect the ECU, and create an emulator for that. Software, micro controllers, and embedded programming are my passion. I could also reverse it, but if people already know what messages to impersonate, could write the code and build a mini unit, like this project.

I know the OVMS can display the tire pressures and temps so @markwj (likely with help from folks like @tomsax) has at least decoded some of the messages.

 

[scotty2541]

I know the OVMS can display the tire pressures and temps so @markwj (likely with help from folks like @tomsax) has at least decoded some of the messages.

I am convinced there is rotational and acceleration data as well. I don't know if it makes it all the way to the car computer. Or if the antenna even forwards it.

We already know the output of the TPMS ECU goes to the "K-Line". But that's not the CAN bus, is it? K-Line isn't the same protocol as Controller Area Network.

 

[strider]

We already know the output of the TPMS ECU goes to the "K-Line". But that's not the CAN bus, is it? K-Line isn't the same protocol as Controller Area Network.

I think that the K-line is the Tesla diagnostic port in the passenger footwell. There's also the OBDII port in the driver's footwell. When the Tesla Ranger came out to read my addresses he hooked his tool into the OBDII port, not the Tesla port. But both of those plugs contain multiple wires so there could be a common wire between them.

Here's a (very old) snippet from @scott451 : "Most of these OBDII devices use the ELM327 or a variant. The ELM series does not support the CAN bus at 1Mbps and cannot be used with the Tesla OBDII port. There are at least two busses on the Tesla OBDII connector: A 1Mbps CAN bus (aka CAN3) for firmware download and a (k-line) bus used by the SRS and ABS systems."

Also, this cable:
$7.50 OVMS Data Cable for Tesla Roadster 1.x/2.x - Official OVMS Parts at FastTech - Worldwide Free Shipping
plugs into the Tesla diag port. Pinouts on the DB9 are in post 118 on this thread.

 

[markwj]

I am convinced there is rotational and acceleration data as well. I don't know if it makes it all the way to the car computer. Or if the antenna even forwards it.

We already know the output of the TPMS ECU goes to the "K-Line". But that's not the CAN bus, is it? K-Line isn't the same protocol as Controller Area Network.

The K-line on the OBDII port is only used to talk between the TPMS ECU and the diagnostic tool, for re-programming the ECU with new sensors.

The instrument CAN bus is on the DIAG connector in the passenger footwell. It runs at 1Mhz. This is where OVMS (and Tattler) sits.

We've decoded a good portion of those instrumentation CAN bus messages, including TPMS. You can find details here:

Open-Vehicle-Monitoring-System/vehicle/Car Module/TeslaRoadster at master · openvehicles/Open-Vehicle-Monitoring-System · GitHub

 

[scotty2541]

Okay, I am understanding this more. Slowly

One thing about creating a CAN emulator to send fake messages is that it will use the same ID, and if they collide, they have the same bus arbitration priority. So they will both believe they successfully grabbed the bus, then commence to corrupt each others data. So it would be vital to disable the ECU.

I assume CAN is not a "polled" protocol, it is simply a form of CSMA (carrier sense multiple access) where anyone can blurt out any message they want at any time.

MicroChip makes devices specifically for CAN, with built in controllers. That would actually make this an easier project than the LIN bus, once I figure out the protocol. The LIN bus uses an 11 bit sync, so I had to code bit detection and auto baud timing in my own code.

As to the LIN bus antenna emulators, if the "unknown" data is some kid of rotation or acceleration, and the VMS knows what the cars speed is and compares it to the data (to issue a fault), there is no way the emulator can know if the car is moving. If it's only the ECU, does it know (or care) if the car is moving?

Marks said there are three which are suspected as being TPMS.
Do we (the thread watchers here ) know the CAN message from the TPMS, and what each byte means? A CAN message is only up to 8 byes, which matches the antenna, maybe they are the same for one of them: ?
1) LF-Press 2) LF-Temp 3) RF-Press 4) RF-Temp 5) LR-Press 6) LR-Temp 7) RR-Press 8) RR-Temp


-Scott

 

[markwj]

In general, CAN messages are sent according to a fixed schedule. Say once every 100ms. To address collision, we have successfully used a technique where we listen for the originator to send his message, then immediately follow it up with our own (spoofed) version. We do this in OVMS, for example, to override the AMPS message to the instrument cluster and replace it with SPEED.

A large number of modern MCUs contain CAN bus controllers. All that is needed is an external transceiver.

The primary CAN bus message for TPMS is CAN ID #0x344. It appears to be sent approximately once per second.

        TPMS status
                B1=f-l psi*2.755
                B2=f-l temp+40Celcius
                B3=f-r psi/2.755
                B4=f-r temp+40Celcius
                B5=r-l psi*2.755
                B6=r-l temp+40Celcius
                B7=r-r psi*2.755
                B8=r-r temp+40Celcius

Here is a sample:

1328947432.120 R11 343 0 0 4 0 0 B 20 F0
1328947432.121 R11 344 4F 39 4F 39 6A 39 6A 38
1328947432.122 R11 345 0 0 1 1 0 0 0 0

A log from vehicle startup for a few minutes driving shows the reading start to come in:

1329528709.951 R11 343 0 0 0 0 0 0 0 8
1329528709.952 R11 344 0 0 0 0 0 0 0 0
1329528709.953 R11 345 0 0 0 0 0 0 0 0
1329528711.024 R11 343 0 0 0 0 0 0 0 8
1329528711.025 R11 344 0 0 0 0 0 0 0 0
1329528711.026 R11 345 0 44 0 0 0 0 0 0
1329528712.199 R11 343 0 0 0 0 0 0 0 8
1329528712.200 R11 344 0 0 0 0 0 0 0 0
1329528712.201 R11 345 0 44 0 0 0 0 0 0
1329528713.373 R11 343 0 0 0 0 0 0 0 8
1329528713.374 R11 344 0 0 0 0 0 0 0 0
1329528713.375 R11 345 0 44 0 0 0 0 0 0
1329528714.547 R11 343 0 0 0 0 0 0 0 8
1329528714.548 R11 344 0 0 0 0 0 0 0 0
1329528714.549 R11 345 0 44 0 0 0 0 0 0
1329528715.721 R11 343 0 0 0 0 0 0 0 8
1329528715.722 R11 344 0 0 0 0 0 0 0 0
1329528715.723 R11 345 0 44 0 0 0 0 0 0
1329528716.895 R11 343 0 0 0 0 0 0 0 8
1329528716.896 R11 344 0 0 0 0 0 0 0 0
1329528716.897 R11 345 0 44 0 0 0 0 0 0
1329528718.069 R11 343 0 0 0 0 0 0 0 8
1329528718.070 R11 344 0 0 0 0 0 0 0 0
1329528718.071 R11 345 0 44 0 0 0 0 0 0
1329528719.242 R11 343 0 0 0 0 0 0 0 8
1329528719.244 R11 344 0 0 0 0 0 0 0 0
1329528719.245 R11 345 0 44 0 0 0 0 0 0
1329528720.416 R11 343 0 0 0 0 0 0 0 8
1329528720.417 R11 344 0 0 0 0 0 0 0 0
1329528720.418 R11 345 0 44 0 0 0 0 0 0
1329528721.590 R11 343 0 0 0 0 0 0 0 8
1329528721.591 R11 344 0 0 0 0 0 0 0 0
1329528721.592 R11 345 0 44 0 0 0 0 0 0
1329528722.763 R11 343 0 0 0 0 0 0 0 8
1329528722.764 R11 344 0 0 0 0 0 0 0 0
1329528722.765 R11 345 0 44 0 0 0 0 0 0
1329528723.936 R11 343 0 0 0 0 0 0 0 8
1329528723.937 R11 344 0 0 0 0 0 0 0 0
1329528723.938 R11 345 0 44 0 0 0 0 0 0
1329528725.109 R11 343 0 0 0 0 0 0 0 8
1329528725.110 R11 344 0 0 0 0 0 0 0 0
1329528725.111 R11 345 0 44 0 0 0 0 0 0
1329528726.282 R11 343 0 0 0 0 0 0 0 8
1329528726.283 R11 344 0 0 0 0 0 0 0 0
1329528726.284 R11 345 0 44 0 0 0 0 0 0
1329528727.455 R11 343 0 0 0 0 0 0 0 8
1329528727.456 R11 344 0 0 0 0 0 0 0 0
1329528727.457 R11 345 0 44 0 0 0 0 0 0
1329528728.628 R11 343 0 0 0 0 0 0 0 8
1329528728.629 R11 344 0 0 0 0 0 0 0 0
1329528728.631 R11 345 0 44 0 0 0 0 0 0
1329528729.801 R11 343 0 0 0 0 0 0 0 8
1329528729.802 R11 344 0 0 0 0 0 0 0 0
1329528729.803 R11 345 0 44 0 0 0 0 0 0
1329528730.974 R11 343 0 0 0 0 0 0 0 8
1329528730.975 R11 344 0 0 0 0 0 0 0 0
1329528730.977 R11 345 0 44 0 0 0 0 0 0
1329528732.147 R11 343 0 0 0 0 0 0 0 8
1329528732.148 R11 344 0 0 0 0 0 0 0 0
1329528732.149 R11 345 0 44 0 0 0 0 0 0
1329528733.320 R11 343 0 0 0 0 0 0 0 8
1329528733.321 R11 344 0 0 0 0 0 0 0 0
1329528733.322 R11 345 0 44 0 0 0 0 0 0
1329528734.493 R11 343 0 0 0 0 0 0 0 8
1329528734.494 R11 344 0 0 0 0 0 0 0 0
1329528734.495 R11 345 0 44 0 0 0 0 0 0
1329528735.666 R11 343 0 0 0 0 0 0 0 8
1329528735.667 R11 344 0 0 0 0 0 0 0 0
1329528735.668 R11 345 0 44 0 0 0 0 0 0
1329528736.839 R11 343 0 0 0 0 0 0 0 8
1329528736.840 R11 344 0 0 0 0 0 0 0 0
1329528736.841 R11 345 0 44 0 0 0 0 0 0
1329528738.011 R11 343 0 0 0 0 0 0 0 8
1329528738.013 R11 344 0 0 0 0 0 0 0 0
1329528738.014 R11 345 0 44 0 0 0 0 0 0
1329528739.184 R11 343 0 0 0 0 0 0 0 8
1329528739.185 R11 344 0 0 0 0 0 0 0 0
1329528739.186 R11 345 0 44 0 1 0 0 0 0
1329528740.357 R11 343 0 0 0 0 0 0 0 8
1329528740.358 R11 344 0 0 0 0 0 0 0 0
1329528740.359 R11 345 0 44 0 1 0 0 0 0
1329528741.530 R11 343 0 0 0 0 0 0 0 8
1329528741.531 R11 344 0 0 0 0 0 0 0 0
1329528741.532 R11 345 0 44 0 0 0 0 0 0
1329528742.703 R11 343 0 0 0 0 0 0 0 8
1329528742.704 R11 344 0 0 0 0 0 0 0 0
1329528742.705 R11 345 0 44 0 0 0 0 0 0
1329528743.876 R11 343 0 0 0 0 0 0 0 8
1329528743.877 R11 344 0 0 0 0 0 0 0 0
1329528743.878 R11 345 0 44 0 0 0 0 0 0
1329528745.048 R11 343 0 0 0 0 0 1 0 8
1329528745.049 R11 344 0 0 0 0 0 0 0 0
1329528745.050 R11 345 0 44 1 1 0 0 0 0
1329528746.221 R11 343 0 0 0 0 0 1 20 8
1329528746.222 R11 344 0 0 0 0 0 0 0 0
1329528746.223 R11 345 0 44 0 0 0 0 0 0
1329528747.394 R11 343 0 0 0 0 0 1 20 8
1329528747.395 R11 344 0 0 0 0 0 0 0 0
1329528747.396 R11 345 0 44 0 0 0 0 0 0
1329528748.566 R11 343 0 0 0 0 0 1 20 8
1329528748.567 R11 344 0 0 0 0 0 0 0 0
1329528748.568 R11 345 0 44 0 0 0 0 0 0
1329528749.739 R11 343 0 0 0 0 0 1 20 8
1329528749.740 R11 344 0 0 0 0 0 0 0 0
1329528749.741 R11 345 0 44 0 0 0 0 0 0
1329528750.911 R11 343 0 0 0 0 0 1 20 8
1329528750.912 R11 344 0 0 0 0 0 0 0 0
1329528750.914 R11 345 0 44 0 0 0 0 0 0
1329528752.084 R11 343 0 0 0 0 0 1 20 8
1329528752.085 R11 344 0 0 0 0 0 0 0 0
1329528752.086 R11 345 0 44 0 0 0 0 0 0
1329528753.256 R11 343 0 0 0 0 0 1 20 8
1329528753.257 R11 344 0 0 0 0 0 0 0 0
1329528753.258 R11 345 0 44 0 0 0 0 0 0
1329528754.532 R11 343 0 0 0 0 0 1 20 8
1329528754.533 R11 344 0 0 0 0 0 0 0 0
1329528754.534 R11 345 0 44 0 0 0 0 0 0
1329528755.601 R11 343 0 0 0 0 0 1 20 8
1329528755.602 R11 344 0 0 0 0 0 0 0 0
1329528755.603 R11 345 0 44 0 0 0 0 0 0
1329528756.774 R11 343 0 0 0 0 0 1 20 8
1329528756.775 R11 344 0 0 0 0 0 0 0 0
1329528756.776 R11 345 0 44 0 0 0 0 0 0
1329528757.946 R11 343 0 0 0 0 0 1 20 8
1329528757.947 R11 344 0 0 0 0 0 0 0 0
1329528757.948 R11 345 0 44 0 0 0 0 0 0
1329528759.118 R11 343 0 0 0 0 0 1 20 8
1329528759.119 R11 344 0 0 0 0 0 0 0 0
1329528759.120 R11 345 0 44 0 0 0 0 0 0
1329528760.290 R11 343 0 0 0 0 0 1 20 8
1329528760.291 R11 344 0 0 0 0 0 0 0 0
1329528760.292 R11 345 0 44 0 0 0 0 0 0
1329528761.462 R11 343 0 0 0 0 0 1 20 8
1329528761.464 R11 344 0 0 0 0 0 0 0 0
1329528761.465 R11 345 0 44 0 0 0 0 0 0
1329528762.635 R11 343 0 0 0 0 0 1 20 8
1329528762.636 R11 344 0 0 0 0 0 0 0 0
1329528762.637 R11 345 0 44 1 0 0 0 0 0
1329528763.806 R11 343 0 0 0 0 0 1 20 8
1329528763.808 R11 344 0 0 0 0 0 0 0 0
1329528763.809 R11 345 0 44 1 0 0 0 0 0
1329528764.979 R11 343 0 0 0 0 0 1 20 8
1329528764.980 R11 344 0 0 0 0 0 0 0 0
1329528764.981 R11 345 0 44 0 0 0 0 0 0
1329528766.151 R11 343 0 0 0 0 0 1 20 8
1329528766.152 R11 344 0 0 0 0 0 0 0 0
1329528766.153 R11 345 0 44 0 0 0 0 0 0
1329528767.323 R11 343 0 0 0 0 0 1 20 8
1329528767.324 R11 344 0 0 0 0 0 0 0 0
1329528767.325 R11 345 0 44 0 0 0 0 0 0
1329528768.495 R11 343 0 0 0 0 0 1 20 8
1329528768.496 R11 344 0 0 0 0 0 0 0 0
1329528768.497 R11 345 0 44 0 0 0 0 0 0
1329528769.667 R11 343 0 0 0 0 0 1 20 8
1329528769.668 R11 344 0 0 0 0 0 0 0 0
1329528769.670 R11 345 0 44 1 0 0 0 0 0
1329528770.839 R11 343 0 0 0 0 0 1 20 8
1329528770.840 R11 344 0 0 0 0 0 0 0 0
1329528770.841 R11 345 0 44 1 0 0 0 0 0
1329528772.011 R11 343 0 0 0 0 0 1 20 8
1329528772.012 R11 344 0 0 0 0 0 0 0 0
1329528772.014 R11 345 0 44 0 0 0 0 0 0
1329528773.183 R11 343 0 0 0 0 0 1 20 8
1329528773.184 R11 344 0 0 0 0 0 0 0 0
1329528773.185 R11 345 0 44 0 0 0 0 0 0
1329528774.356 R11 343 0 0 0 0 0 1 20 8
1329528774.357 R11 344 0 0 0 0 0 0 0 0
1329528774.358 R11 345 0 44 0 0 0 0 0 0
1329528775.528 R11 343 0 0 0 0 0 1 20 8
1329528775.529 R11 344 0 0 0 0 0 0 0 0
1329528775.530 R11 345 0 44 0 0 0 0 0 0
1329528776.700 R11 343 0 0 0 0 0 1 20 8
1329528776.701 R11 344 0 0 0 0 0 0 0 0
1329528776.702 R11 345 0 44 0 0 0 0 0 0
1329528777.872 R11 343 0 0 0 0 0 1 20 8
1329528777.873 R11 344 0 0 0 0 0 0 0 0
1329528777.874 R11 345 0 44 0 0 0 0 0 0
1329528779.044 R11 343 0 0 0 0 0 1 20 18
1329528779.045 R11 344 0 0 0 0 0 0 68 34
1329528779.046 R11 345 0 42 0 0 0 0 0 0
1329528780.216 R11 343 0 0 0 0 0 2 20 18
1329528780.217 R11 344 0 0 0 0 0 0 68 34
1329528780.218 R11 345 0 42 1 1 0 0 0 0
1329528781.388 R11 343 0 0 0 0 0 2 20 18
1329528781.389 R11 344 0 0 0 0 0 0 68 34
1329528781.390 R11 345 0 40 0 0 0 0 0 0
1329528782.560 R11 343 0 0 0 0 0 2 20 18
1329528782.561 R11 344 0 0 0 0 0 0 68 34
1329528782.562 R11 345 0 40 0 0 0 0 0 0
1329528783.732 R11 343 0 0 0 0 0 2 20 18
1329528783.733 R11 344 0 0 0 0 0 0 68 34
1329528783.735 R11 345 0 40 0 0 0 0 0 0
1329528784.904 R11 343 0 0 0 0 0 2 20 18
1329528784.905 R11 344 0 0 0 0 0 0 68 34
1329528784.906 R11 345 0 40 0 0 0 0 0 0
1329528786.076 R11 343 0 0 0 0 0 2 20 18
1329528786.077 R11 344 0 0 0 0 0 0 68 34
1329528786.078 R11 345 0 40 0 0 0 0 0 0
1329528787.248 R11 343 0 0 0 0 0 2 20 18
1329528787.249 R11 344 0 0 0 0 0 0 68 34
1329528787.250 R11 345 0 40 0 0 0 0 0 0
1329528788.419 R11 343 0 0 0 0 0 2 20 18
1329528788.421 R11 344 0 0 0 0 0 0 68 34
1329528788.422 R11 345 0 40 0 0 0 0 0 0
1329528789.591 R11 343 0 0 0 0 0 2 20 18
1329528789.593 R11 344 0 0 0 0 0 0 68 34
1329528789.594 R11 345 0 40 0 0 0 0 0 0
1329528790.763 R11 343 0 0 0 0 0 2 20 18
1329528790.765 R11 344 0 0 0 0 0 0 68 34
1329528790.766 R11 345 0 40 0 0 0 0 0 0
1329528791.935 R11 343 0 0 0 0 0 2 20 18
1329528791.936 R11 344 0 0 0 0 0 0 68 34
1329528791.938 R11 345 0 40 0 0 0 0 0 0
1329528793.118 R11 343 0 0 0 0 0 2 20 18
1329528793.119 R11 344 0 0 0 0 0 0 68 34
1329528793.120 R11 345 0 40 0 1 0 0 0 0
1329528794.279 R11 343 0 0 0 0 0 2 20 18
1329528794.280 R11 344 0 0 0 0 0 0 68 34
1329528794.281 R11 345 0 40 0 1 0 0 0 0
1329528795.451 R11 343 0 0 0 0 0 2 20 18
1329528795.452 R11 344 0 0 0 0 0 0 68 34
1329528795.453 R11 345 0 40 0 0 0 0 0 0
1329528796.623 R11 343 0 0 0 0 0 2 20 18
1329528796.624 R11 344 0 0 0 0 0 0 68 34
1329528796.625 R11 345 0 40 0 0 0 0 0 0
1329528797.795 R11 343 0 0 0 0 0 2 20 18
1329528797.796 R11 344 0 0 0 0 0 0 68 35
1329528797.797 R11 345 0 42 0 0 0 0 0 0
1329528798.967 R11 343 0 0 0 0 0 2 20 18
1329528798.968 R11 344 0 0 0 0 0 0 68 35
1329528798.969 R11 345 0 42 0 0 0 0 0 0
1329528800.138 R11 343 0 0 0 0 0 2 20 D8
1329528800.139 R11 344 4D 32 4C 33 0 0 68 35
1329528800.140 R11 345 0 20 0 1 0 0 0 0
1329528801.310 R11 343 0 0 0 0 0 2 20 D8
1329528801.311 R11 344 4D 32 4C 33 0 0 68 35
1329528801.312 R11 345 0 20 0 1 0 0 0 0
1329528802.482 R11 343 0 0 0 0 0 2 20 D8
1329528802.483 R11 344 4E 33 4C 33 0 0 69 34
1329528802.484 R11 345 0 22 0 0 0 0 0 0
1329528803.653 R11 343 0 0 0 0 0 2 20 D8
1329528803.654 R11 344 4E 33 4C 33 0 0 69 34
1329528803.655 R11 345 0 22 0 0 0 0 0 0
1329528804.825 R11 343 0 0 0 0 0 2 20 D8
1329528804.826 R11 344 4E 33 4C 33 0 0 69 34
1329528804.827 R11 345 0 20 0 0 0 0 0 0
1329528805.996 R11 343 0 0 0 0 0 2 20 D8
1329528805.997 R11 344 4E 33 4C 33 0 0 69 34
1329528805.998 R11 345 0 20 0 0 0 0 0 0
1329528807.168 R11 343 0 0 0 0 0 2 20 D8
1329528807.169 R11 344 4E 33 4C 33 0 0 69 34
1329528807.170 R11 345 0 0 0 0 0 0 0 0
1329528808.339 R11 343 0 0 0 0 0 2 20 D8
1329528808.340 R11 344 4E 33 4C 33 0 0 69 34
1329528808.341 R11 345 0 0 0 0 0 0 0 0
1329528809.511 R11 343 0 0 0 0 0 2 20 D8
1329528809.512 R11 344 4E 33 4C 33 0 0 69 34
1329528809.513 R11 345 0 0 0 0 0 0 0 0
1329528810.682 R11 343 0 0 0 0 0 2 20 D8
1329528810.683 R11 344 4E 33 4C 33 0 0 69 34
1329528810.684 R11 345 0 0 0 0 0 0 0 0
1329528811.854 R11 343 0 0 4 0 0 A 20 F0
1329528811.855 R11 344 4E 33 4C 33 6A 34 69 34
1329528811.856 R11 345 0 22 0 0 0 0 0 0
1329528813.025 R11 343 0 0 4 0 0 A 20 F0
1329528813.026 R11 344 4E 33 4C 33 6A 34 69 34
1329528813.027 R11 345 0 22 0 0 0 0 0 0

 

[scotty2541]

Well, 344 is easy. It matches the LIN data. Front and rears.
4E 33 4C 33 6A 34 69 34
28 Psi 52F 27 Psi 52F 38 Psi 53F 38 Psi 53 F

Message 345 is a different animal. The antennas send out all zeros until they hear something. Which can take a few minutes.
This log shows a "44" sent is about 1 second. Too quick to be from the Antennas. If that ECU is saying something, I don't know what...

As a pure SWAG, 0x44 = 0100 0100 (binary) It might be bits, indicating which antenna has NOT given good data yet. Because when all four tire data is present, it changes to 0x22 = 0010 0010 Maybe a "data valid" flag representing each antenna?

As for message 343... no clue.

 

[markwj]

The 0x343 B8 is definitely a binary indicator of validity of the data. Here is one of my drives:

1329528777.872 R11 343 0 0 0 0 0 1 20 8
1329528777.873 R11 344 0 0 0 0 0 0 0 0
...
1329528779.044 R11 343 0 0 0 0 0 1 20 18
1329528779.045 R11 344 0 0 0 0 0 0 68 34
..
1329528800.139 R11 344 4D 32 4C 33 0 0 68 35
1329528801.310 R11 343 0 0 0 0 0 2 20 D8
...
1329528811.855 R11 344 4E 33 4C 33 6A 34 69 34
1329528813.025 R11 343 0 0 4 0 0 A 20 F0

0x08 = 0000 1000binary
Ignore the last four bits (....1000)

Now, the r-r wheel comes alive and we get:
0x18 = 0001 1000

Then, the f-l and f-r wheels come alive and we get:
0xD8 = 1101 1000

Finally, the last wheel comes alive and we get:
0xF0 = 1111 0000

There really doesn't seem to be much useful information in the 343 and 345 messages, at least for OVMS purposes. We just treat a 00 00 for pressure and temperature as an indication that the sensor is not reporting.

 

[scotty2541]

So.. assume that byte 7 (counting from 0) when 0x08 (0000 1000) that bit means any/all data not valid..? Eventually, all wheels are valid with 0xf0 (1111 0000)

I wonder what bytes 05 and 06:
0000 0001, 0010 0000 and
0000 0010, 0010 0000 and
0000 1010, 0010 0000, mean?
(ID 343, as the data reception progresses)

the value of 0010 0000 (20) never changes. But byte 5 advances from 0001 to 0010 to 1010.
And a new bit shows up in byte 2...

What fun!

 

[markwj]

So.. assume that byte 7 (counting from 0)

Convention for CAN is to number them 1 through 8 (B1 .. B8). What can we say - automotive engineers vs computer scientists.

 

[markwj]

What fun!

The real fun part is to see what you learn when you have a broken sensor / antenna. Or break stuff on purpose and see what results you get.

 

[int32_t]

Yeah, those are called "lemons"

I find it difficult to see how some cross talk corrupted it. See my summary up a few posts. It takes a precise address, and valid checksum. Not impossible, but unlikely.

I'm not going to read the whole thread to figure out if this was suggested (sorry). I work as an electronics technologist for a company that's worked through problems like memory corruption in small battery powered products which can be subjected to several gs of mechanical shock.

I don't know if the Roadster TPMS sensors are battery operated or not, but if the tire sensors are battery operated, it's highly likely that vibration from the road causes the battery to disconnect from its contacts for periods ranging from fractions of a millisecond to tens of milliseconds, maybe more if the contact design is flawed. If long enough, these disconnect events could theoretically cause the TPMS in the tire to "brown out" (look it up if necessary), which can cause bad things to happen to flash memory -- especially if the flash was being accessed at that moment. So scrambled/erased bytes are quite possible in that situation (I would rule out any conspiracy theories myself). If you're into fixing small electronic devices, adding extra "bulk capacitance" in the range of a couple microfarads (uF) across the battery rail inside the unit would almost certainly help sustain the circuitry through these disconnects, eliminating the brownout issue. Make sure you use a cap with low leakage current (or you'll kill the sensor's battery life) and high vibration tolerance (so NOT electrolytic!). Maybe ceramic, somebody smarter please correct me if I'm wrong.

 

[markwj]

I don't know if the Roadster TPMS sensors are battery operated or not, but if the tire sensors are battery operated, it's highly likely that vibration from the road causes the battery to disconnect from its contacts for periods ranging from fractions of a millisecond to tens of milliseconds, maybe more if the contact design is flawed. If long enough, these disconnect events could theoretically cause the TPMS in the tire to "brown out"

The TPMS sensors have batteries in them, and are sealed. I think such an issue would affect a single sensor (perhaps random). A fault symptom of two sensors together is related to the antenna not the sensor.

Neither the antennas nor the ECU module have batteries in them. But, they are supplied with 12V via a plug-in connector which could conceivably have a loose connection.

Personally, I'll go with the 'wheels were swapped, which caused the ECU to pick up on this and try to reprogram things, but a code bug caused it to handle that reprogramming incorrectly and corrupt the values in one antenna'.

 

[scotty2541]

I don't know if the Roadster TPMS sensors are battery operated or not, but if the tire sensors are battery operated, it's highly likely that vibration from the road causes the battery to disconnect from its contacts for periods ranging from fractions of a millisecond.

I "fidgeted" with some of them at the tire store... Demo units. They are sealed tight. Vibrations may make the tuned circuits mess up, but the batteries are really tight. Then the battery doesn't have the instant power to transmit anyway, so I'm sure there is a capacitor to absorb supply spikes. Finally, they only transmit every few minutes. A lost unit for a minute or two is insignificant.

The antennas store their "listening" addresses in EEPROM or flash. When I bench analyzed a unit, I could reprogram it, and remove power, then test it later, and the addresses remain.

 

[scotty2541]

So, can we inject a CAN message that is phony and good data, right after the original one from the ECU?

Also, since Strider is reporting that the ECU itself is bad, do any CAN messages from the ECU aver show up, or it is completely dead?

If this looks like a viable second option, it's time to start collecting data

 

[strider]

So, can we inject a CAN message that is phony and good data, right after the original one from the ECU?

The OVMS can do that. They are doing it with the small LCD display in the instrument cluster. They are able to replace the AMPS value with the car's speed by doing exactly what you suggested, sending their data right after the real data. But the TPMS is more complicated than the LCD display with it's valid sensor messages and all. I don't know what the VMS would do if the TPMS ECU sent a message with the invalid sensor data bits sent, then we send another message with the bits cleared, then the TPMS ECU repeats its invalid sensor data message, etc. I agree w/ Mark that unless one's TPMS ECU has failed completely, we'll probably have to unplug it from the bus before enabling the spoofed messages.

Also, since Strider is reporting that the ECU itself is bad, do any CAN messages from the ECU aver show up, or it is completely dead?

If this looks like a viable second option, it's time to start collecting data

My statement of the ECU itself being bad is based on Tesla's determination (by declaring the sensors to be ok and replacing both antennas plus the fact that your emulator didn't work), not on any of my own diagnostics.

I don't have a CAN bus logger at the moment. I was ready to buy one but since the next OVMS will have one built in I was planning to wait for that (and just deal with the beeping until then). Once I get it I will definitely take traces to see if my ECU has gone completely silent, is sending bad data, or what. I will also be happy to load and test code that tries to spoof the messages.

 

[allanfridstrom]

that's just funny