Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Let the hacking begin... (Model S parts on the bench)

This site may earn commission on affiliate links.
I wrote a program to capture CAN data, save in log files, and load logs for
later examination. It allows one to easily graph data from bytes in the messages,
in an attempt to understand the data. The program is called CAN-DO and is
a work in progress (in Visual Basic), but a number of serious investigators
worldwide have used it to examine their CAN data.

We made a CAN capture card using the AVR-CAN board, passively listening
to the LEAF's 500k CAN bus on the OBD connector. We wanted to find a value
for "remaining fuel", which would be more helpful than the "tank fullness"
data that was displayed in 12 coarse steps on the dash.

We were successful, and we created an energy meter that was known as
the SOC-Meter, but more accurately became known as the GID-Meter.
Eventually it displayed Energy, SoC, pack Voltage, Amps, and Power,
and tire pressures, all of which were not available on the LEAF's dashboard.

We could use CAN-DO to investigate the Tesla data. See
GaryG's CAN-Do Program Page for more info.

If I had some Tesla logs, preferably in my 12-byte per message
format, I could do some testing. The 1st 2 bytes contain
second and millisecond, the next two are the msgid and
data length, and then 8 data bytes.

If you are interested, I will provide the exact format of the
SS MS MM LM D1 ... D8 bytes.

Oh well, ...

The time stamp:
MS is the low 8 bits of the 10-bit milliseconds (0 to 999 values),
and the two low bits of SS are the two high bits of the milliseconds.
The top 6 bits of SS are seconds (0 to 59) of the current minute.

The LMMM two bytes is one nibble (L) for the data length (0 to 8)
and the remaining 3 nibbles (MMM) for the hex MessageID (usually
0 through 7FF hex values).

I use MMM 800 to FFF and L > 8 for some special uses
in the log file, like a date-time message at the zero second,
zero millisecond point (so, once a minute, helpful, but optional).

Merry Christmas to all, wishing for a miracle of communication,
understanding, sharing, and peace worldwide. What is the
alternative, just continued war, and perhaps extinction.
 
Last edited:
If you wish to try CAN-DO, you are welcome to do so as long as
you are willing to share your results with the rest of us.

Download it along with a log file or two,
and a Recipe file, which holds the decoding details for
discovered or suspected one-byte or two-byte data.

Sharing Recipe files allow others to easily graph data
values that have been discovered.

There are at least 6 sources of CAN type data in the Tesla.
Perhaps someone can post pictures of their access points,
give a link to compatible connectors, and specify the details
of each pin in the connector?

Also, a description of the type of data found on the connection,
along with a list of MsgIDs and data byte locations (D1 - D8)
that have been identified, or are suspected.

If you can send me some logs, please Message me.
 
My bits are based on a Freescale 32 bit device (running at over 50 MHz IIRC). The CAN engine is integrated but autonomous including address screening. It can handle CAN bus rates up to 1M and would have zero problem filtering, parsing and logging traffic from a 1/2M bus. I'll have to check but I seem to remember 8 Mbyte of on board flash. One of my older designs used an SD card but these particular boards were meant to be potted in epoxy and had onboard flash parts.

Here is some diagnostics stuff from a man in the middle voltage (potentiometer) based suspension module. The wheel speeds are CAN data (from a 1/2M bus) while the wheel heights are local a/d and d/a data.
New Page 1

I normally use IXXAT for my logging and have found my hardware often catches stuff that the IXXAT does not. It is the benefit of a dedicated processor and no Windows overhead.

I think I have a pile of boards still laying around. I'd put them into a project at cost if we could come up with a plug and play Model S harness and some good data viewing software.


I'm all up for a project like this!

Never done any CAN stuff, though I certainly have done reverse engineering of wire protocols, and more than happy to help with front end viewing or statistical analysis.
 
Game over.

2015-12-18%2022.39.52-1920.jpg


2015-12-18%2023.01.33-1920.jpg


2015-12-18%2023.18.43-crop.jpg


Please do not ask me how to do this just yet... while Tesla isn't patching my bench setup, I'm sure they'll patch cars in an OTA if I released how to do it publicly.
 
  • Like
Reactions: APotatoGod
Worth noting this is a dismantle-the-car exploit...... so not super useful for non-bench stuff. I'm not taking my car apart to do this on my own vehicles... lol. But I can play CAN data to my bench and let it decode it for me. :)
 
Game over.







Please do not ask me how to do this just yet... while Tesla isn't patching my bench setup, I'm sure they'll patch cars in an OTA if I released how to do it publicly.
You Sir, Have won the Internet.


Just be aware, that Tesla does now have a fleet of vehicles that "Could" autonomously drive. You won't hear them knock, but they will silently sneak up and get you when your sleeping.

- - - Updated - - -

Would have been awesome if the battery was full to 100% and recorded the info before the accident. I'd like to see what Voltage Limit Tesla is putting on the cells (or in other words, what they call "FULL". Or on the other end of the spectrum, what they consider "Empty". Seems that pack was a bit out of balance before the pull.
 
You Sir, Have won the Internet.


Just be aware, that Tesla does now have a fleet of vehicles that "Could" autonomously drive. You won't hear them knock, but they will silently sneak up and get you when your sleeping.

- - - Updated - - -

Would have been awesome if the battery was full to 100% and recorded the info before the accident. I'd like to see what Voltage Limit Tesla is putting on the cells (or in other words, what they call "FULL". Or on the other end of the spectrum, what they consider "Empty". Seems that pack was a bit out of balance before the pull.

Oh, I'm going to figure all of that out now. Only a matter of time. :)
 
Game over.

*snip*

Please do not ask me how to do this just yet... while Tesla isn't patching my bench setup, I'm sure they'll patch cars in an OTA if I released how to do it publicly.
wow, I've been "fearing" that I already had a somewhat disturbing/geeky man-crush in the making towards you before this thread, but now there exists no doubt anymore. You are my new Tesla Sith Lord :love:

The force is strong with this one!

PS! Sorry for the maybe lame SW-references, but its way to easy these days with "The force awakens"-euphoria:)