Tesla CAN Bus - Quick Exploration 

That's because I had already shot it, and just needed to do the editing which took forever and I screwed it up in several places too. =)

If you want to dabble with CAN on a microcontroller, I suggest something like one of these to start with: www.macchina.cc/catalog/a0-boards/a0-under-dash www.olimex.com/Products/IoT/ESP32/ESP32-EVB/open-source-hardware copperhilltech.com/esp32-wifi-bluetooth-classic-ble-can-bus-module/ www.tindie.com/products/voltlog/canlite-esp32-can-development-board/ All of these use the Espressif ESP32 which is supported by the Arduino IDE, so it's easy to get started. (Also supports wifi!)

@@Ingineerix Thanks! Edit: Oh, I've used those. Thinking of developing a CAN controlled HVAC system for an industrial application, but avoiding the costly over-featured products I have encountered on the market. Still under a non-compete for a bit, but getting ready :)

It's coming!

Coming!

Thanks!

Coming soon!

No, but suggestions help!

Yeah, I would have added more, but YT has a limit!

I tried to find the original quote, but IIRC, JB Straubel referred to CANbus as “the most advanced technology of 1987” or something along those lines. I’ll post the original if I find it.

Except heavy trucks, everyone does their own.

Heavy truck uses the SAE J1939 standard. Marine uses the NMEA2000 standard. All based on CAN.

And on top of what's included in the CAN spec, manufacturers also like to encode aditional protocols that would otherwise be outside the standard. Like VW has TP = transport protocol running on the CAN bus.

No, there is not for passenger cars/trucks/SUVs, etc. Manufacturers do their own thing, and the CAN definitions are considered "secret". They do not ever release them, even to authorized service centers.

An advantage of Ethernet is the higher data rate. CAN generally has a lower data rate.

10BASE2 ethernet (10 MBit/s) would be the same: 2 wires (in 1 coaxial cable), devices tapping into it in a bus like fashion, one collision domain. You are referring to 10BASE-T or 100BASE-T (star structure, 2 pairs=4wires) and 1000BASE-T (4 pairs=8 wires) as used in desktop or data center environments. Industrial ethernet standards however (like BroadR Reach, also used in Tesla vehicles) in contrast reduce the need for wiring (single twisted pair) and increase robustness at the expense of data rate. Still it's way faster than CAN bus.

Cost is the main driver. It would be cost-prohibitive to implement ethernet on all the small devices inside a modern car. There's no need for the speed requirement, and ethernet does not have a priority mechanism like CAN. Same with adding wireless transceivers to every device. You still need to send power, so why not add one more wire or 2 and not have to worry about the extra cost and unreliability of wireless? Doesn't make sense, and imagine what happens when the RF noise floor gets untenable?

Cost. Adding a full ethernet stack to run something simple like a power window motor doesn't make sense. The BoM cost of that motor controller would go up by 3000%, and reliability would go down. BroadRreach is only used where that kind of bandwidth is needed, and only to/from complex systems, usually running a full OS stack.

Agreed, later on I thought about ‘if wireless all you need to run is a power wire’…but then if you do that you can just use LIN over power and maintain that simplicity I wonder if there are instances where the cost equation tilts the other way of taken into account labor cost of manufacturing

I am an EE. I have had an Engineering Consulting business for over 30 years, and more recently I am also part of a startup making electric vans: maxwellvehicles.com/

A quick web search will show this.

No, it does not. SavvyCAN supports a lot of devices, but not all.

Yeah, I should have mentioned that. I often use Wagos now for temp connections, but it's hard to beat a wirenut on these thin wires!

Tesla doesn't use light bulbs.

@@Ingineerixthey have puddle lights on the bottom of the doors, lights on each side of the trunk. All these are on can bus and Tesla has told me the replacements don’t report to the system. The mobile mechanic suggested saving the old lights ( in my glove box) as they are $35 each.

@@frankdelao4067 Firs off these are not "light bulbs", these are LED based. They shouldn't fail for the life of the car unless there is a defect. They are also NOT on the CAN bus. They are driven from a body controller. I looked in the parts catalog, and they are part number 1007151-00-E listed for $17.

@@Ingineerix the price I got was mentioned by the tech. Since there is a charge for Tesla to change them might explain the price difference. We had a G35, Infiniti wanted $20 to replace the right front turn bulb, only held in place by a single Phillips screw. For years I have heard how LEDs are supposed to last years. Our house has all LEDs. None has lasted 5 years. Our G35 had multiple LEDs in the high center stop light, several in the unit went bad.

@@frankdelao4067 Most low-power LEDs have lifetimes in the 100,000 hour range. High power is in the 10,000 hours range. Both types depend on proper engineering of the power supply and thermal system to get those numbers. Most LEDs don't fail, but it's usually the power supply.

There are a lot of open source projects around CAN and cars so I am sure there are resources out there to find, for example I use a CAN adaptor to diagnose issues with my car

​@@backacheache My question is not on CAN and cars in general. It is specifically about resources to decode the CAN frames (physical addresses, CAN identifiers, data bytes) in Tesla vehicles. This decoding is manufacturer specific and gives meaning to these bits and bytes. They are either leaked from manufacturer (i.e. Tesla) sources or the result of intensive reverse engineering work and can be treated like industry secrets and "gem stones", once they are complete or near complete. It is relatively easy to reverse engineer a few IDs and data bytes here and there for some car, but the decode that Ingeneerix showed in this video for this steering wheel control module on his bench looks basically perfect with very high quality.

There are some public efforts, but my work is from many total years of reverse engineering work.

There are multiple separate CAN busses on a Tesla, of course, not just a single big omnibus. Traditionally, in other brands there are at least: powertrain CAN, chassis CAN, body CAN, infotainment CAN, diagnostics CAN. So that somehow separates critical ones from less critical ones. Teslas add Ethernet / Broad R-Reach connections and still has likely even more CAN busses when counted across the whole vehicle.

@koeniglicher is correct. Even early Model S in 2012 had 4 CAN buses, now some models have over 12. CAN is also pretty fault tolerant by design.

Sorry, I do not use windows. In Linux it just works with SocketCAN, nothing else needed. My only suggestion is to look for SocketCAN drivers for windows.

@@Ingineerix brilliant. Let me explore. Thank you for your reply

No, Generally not possible with CAN hardware. Lowest ID wins. (built in priority)

It has been used in aviation since the '70's. I can't imagine that Toyota would implement a system with such obvious safety possibilities (read: law suits) without making sure that it's plenty robust.

Tesla doesn't use drive-by-wire steering (yet). The redundancy is mainly for autopilot.

It's not CAN, it uses a special digital Audio bus called A2B. Without config set in the Gateway that only Tesla (or Tesla hackers like me) can do, the ICE (MCU) will not output the correct digital audio. www.analog.com/en/landing-pages/001/a2b.html There are also different speakers and major wiring harnesses, it's not just the sub/amp.

@@Ingineerix ok thanks - I’ll have a look into that 👍🏻

I’d be interested to know this too. I have one of there units and I’d like to experiment. I believe CAN give out 2.5 and 5 v but I’m I bit reluctant to start prodding the pins wigg to h an avo 🤣🤣🤣

There is no standard connector. You have to tell me what you are trying to connect from/to. If it's a Tesla, what model/Year?

@@Ingineerix it is a tesla just learing gathering tools so help me get better at diagnoses. The connector you are using with the interface that is what I am referring to

@@waqasazmat81 That's just a standard DB-9, So this will connect to the CAN dongle: amzn.to/3T2Iz4c

sorry to bug you, I can use that connector to other devices on tesla and read the data on the open source @@Ingineerix

Yeah, besides expensive multi-CAN dongles, there are boards that use 3xCAN of popular STM32 chips. It is common to split powertrain, chasis, ADAS networks, etc..

Yes it is common to have multiple CAN busses for different purposes. On Teslas, there is a proprietary diagnostic connector in the console area that exposes a number of CAN busses and some Ethernet networks. For diagnostics there can either be a CAN gateway device that then transmits diagnostic requests to the appropriate busses. Or in case multiple CAN busses do not have a gateway and are all exposed to a diagnostic connector, then the external diagnostics hardware (vehicle communication interface) typically contains a multiplexer. This multiplexer then switches to the right bus first, and does its diagnostics jobs. For this to work, the diagnosis application needs to know beforehand which ECU (electronic control unit) is on which bus. So, instead of listening to all of them for diagnostics in parallel, the multiplexer first talks to the first CAN bus, then the second, then third in an all ECU scan. In diagnostics, a certain focus is required, otherwise you will be just flooded with messages and data from all sorts of ECUs and sub-systems.

That depends on the Model. Some only have 5, some have more than 10. Some are dedicated for important applications, such as supercharging.

I would absolutely love to, but it will probably be a long time until I can get my hands on one.

For simplicity, I only demonstrated one node, the SCCM, so it's the only thing talking. There are hundreds of IDs active on most of the CAN buses in the car. It would pretty much be overwhelming to show them all, and that's not the point. It's like trying to learn a new language: Would you rather hear only one person talk, or a whole room full of people at once? If you want more, take a look at my "Secret Signals" video: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-CLOEGFtFIPA.html

@@Ingineerix I totally understand that, I was just wondering if a device can send commands to the CAN bus instead of simply broadcasting internal states.

@@jendib All can transmits are broadcasts. Any device on CAN can receive or send (broadcast).

@@Ingineerix Thanks for the clarification and for making those videos, it's super interesting!

On board charger is here: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-lXokJEzXwaI.html Overall charging is covered here: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-0lxxOsLcNQQ.html

@@Ingineerix Thanks for taking the time to respond! I meant the can sniffing of what is going from the onboard charger to the charging station, similar to what you read here from the steering module on the CAN Bus.

@@wagnerbrochini3892 Sorry, I am not going to make that information public, as it would likely result in a bunch of people trying to connect unsafe stuff to the charging network. Also, Tesla would likely change it if this happened, thus making all the time I spent learning it a waste.

Well, it was all for the sake of knowledge, but I understand your position. Either way, I don't think it would make a difference if they changed it, stations would still have to talk with "legacy" chargers, so no point in changing; it would be of huge interest to DIYers like myself to have an insight on what's happening during a charge, best regards!

@@wagnerbrochini3892 The basic flow is the Supercharger is a dumb device. Basically The BMS in the car sends voltage and current commands to the supercharger, and it does it's best to obey them. It's very similar to CHAdeMO. Billing/authorization is handled in the car.

By changing only a single input at a time. Combined with some trial and error, guessing and luck. If someone can do Sudoku, then reverse engineering is basically the same. I guess, there is also a Tesla hacker community that exchange their findings in reverse engineering.

I have created one by many hours of painstaking reverse-engineering.

not often. Even on the some car makers, they keep can ids for decade...

The Tesla CAN frames are constantly changing, sometimes several times in one month. Some stay the same for a long time, but others get updated often.

Yes, but without the software changes, there is no way to use it.

@@Ingineerix What do you think the chances are that Tesla would allow a retrofit and enable the software? They are supposedly going to be offering it for the PWS speaker system for cars that were built without the speaker, but still have the wiring harness (I need to see if mine has the harness, March '18).

@@Kingkoopa00 Based on prior history, I'd say very low. Tesla service is pretty horrible IMO, and most often the employees seem to treat customers as something offending they found stuck to the bottom of their shoe. Historically Tesla concentrates on the newest models and doesn't seem to give much priority for their customers of even slightly older cars.

@@Ingineerix Huh. My experience has been very different. At least in my local service department. They've ordered me parts several times, like the redesigned rear and mid diffuser, with no problem. Or things they added to later models, that I wanted to add to mine. I've heard it's very hit and miss though for service quality, and all based on the specific service center.

@@Kingkoopa00 Yeah, YMMV. I used to know a nice parts guy at one of the SCs close to me, but he didn't last long. Based on what I've seen first hand and been told, I'd say at least 75% of the SCs are hostile to customers in general.

Well "MIA" stands for "Missing in Action", just means it's not reporting in (no frames received when they are supposed to be). Irrational means that it's probably sending data that is out-of-bounds or doesn't make sense. Some causes of irrationality are frame counters out of sequence, checksums that don't prove out, encoded values that can't be true, such as a percentage value over 100, etc.

@@Ingineerix my 2021 Tesla model 3 autopilot ECU is in fallback mode and service mode is saying DAS CAN NODE irrational / MIA… I’m outside my warranty so I’m trying to fix it myself

@@joshmills7368 First off, a 2021 car should still be in warranty. Secondly this is probably something you can't fix yourself. DAS is a microcontroller inside the Autopilot ECU. If you've powered down the car completely for 5 minutes and restarted, and it's still there, then it's probably something you can't fix internally. When I say power down, I mean both HV and LV, not just pressing the shutdown button on the screen.

@@Ingineerix I commute 162 miles per day to and from work.. I’m at $61,000 miles.. I did the power Down for 12 hours and still nothing.. I didn’t see anything obvious on the AP board.. but I didn’t use my multimeter.. it’s acting like an IC microcontroller fried itself.. you’re saying I can’t replace the IC and it start working again?

@@joshmills7368 No, because you have no way to flash the correct firmware on it. The best you could do is replace the whole APE board with one from Ebay, which should work, but you'd lose the ability to update the software as Tesla won't have the correct certificate matches. Sadly you'll probably have to pay Tesla for a new ICE. (They won't replace just the APE board) You can't replace the ICE yourself either, the GW config won't match your car.

Send me one!

@@Ingineerix you can tear mine down I already took out the rear seats it’s my service van 2020 long range plus

@@Ingineerix I have both seat modules connected and no error message on the screen removed from seats

@@bencrilly209 I can't promise a teardown won't damage something. While I try to not destroy stuff if at all possible, there is still significant risk.

@@Ingineerix where else in the world can you get a work truck that’s fully loaded with my tools and I’m avg 310 watts a mile….I would like to see anyone get to beat that

Yes, sorry. Editing mistake. You are talking about the DB-9 pins, yes it's 2 and 7. If you scroll down on the Amazon link, they provide the pinout. You don't need a ground reference is there is galvanic isolation, it's optional.

@@Ingineerix ah, thanks, but it sounds like you also have a 120k ohm resistor somewhere on there too?

@@Ryukachoo It's not 120k, it's 120 ohms. And you can clearly see it in the beginning of the video, it's connected using the 2 blue wire nuts. The other termination is inside the CAN to USB adapter, which is enabled by a jumper.

No.

Even early Model S in 2012 had 4 CAN buses, now some models have over 12. CAN is also pretty fault tolerant by design. Separation helps ensure more reliability and safety.

only issue with this i spose would be the airbag lmao

i wonder if also the CRC data is designed as a means to avoid people from going and tampering with the can bus data for steering angle without tampering with the crc data (wonder what the car would do if that check failed too)

No, Tesla does not use FD or FT. All Tesla CAN is 500k standard boring CAN, except supercharger communications, which is 33.3k, single-wire.

2nd

Actually, I was first. =)

By reverse engineering the whole system, it took many years of work in total.

Sorry, I use Linux and SocketCAN, so it just works, no drivers needed. Can't advise on Windows because I don't use it.