
Exploring the Tesla Model S CAN Bus - dmmalam
http://www.instructables.com/id/Exploring-the-Tesla-Model-S-CAN-Bus/?ALLSTEPS
======
AceJohnny2
Many cars, especially the smarter kind, have multiple CAN buses. A CAN bus is
relatively low bandwidth by today's standards, so manufacturers have had to
resort to splitting them up to increase effective utilization, (which also
leads to its own problems when a device on Bus 1 needs to talk to a device on
Bus 2).

I would expect this user-accessible (give-or-take the connector) bus is only
the monitor/dashboard bus, to avoid possibly fucking up the timings on the
more loaded and critical buses.

~~~
antoinealb
Apparently busses are connected via gateways:
[https://www.youtube.com/watch?v=7h7LWeET1fI](https://www.youtube.com/watch?v=7h7LWeET1fI)

~~~
Matthias247
They are - but they don't forward all messages. All gateways are configured in
detail which signals should be forwarded from Bus A to B and which
transformation functions should be applied.

This means you won't get access to any signal from any bus.

~~~
AceJohnny2
Yeah, I know of at least one company who spec'd their gateway module for
something like 20% message bridging, but expanded use mean they're way beyond
that and facing the limitations of their original design. :)

------
coin
The physical connector is J1962, not the "OBDII" port. OBDII encompasses
multiple network layers (datalink, physical, etc). Prior to the J1962
connector there were other physical connector allowed.

~~~
obrien28
According to Wikipedia (and other research I did) "The OBD-II specification
provides for a standardized hardware interface—the female 16-pin (2x8) J1962
connector." OBD-II mandates the J1962 connector, so I wasn't so much wrong as
slightly vague. In my case, I was referring to the whole system, meaning the
connector and what passes through it, so I lumped everything together under
one moniker.

Thanks for pointing out the difference though. I'll update the Instructable to
reflect that.

~~~
mojoe
The Instructable is awesome, thanks for writing it up! Do you have a guess as
to what higher-layer protocol Tesla uses (like CANOpen
[http://en.wikipedia.org/wiki/CANopen](http://en.wikipedia.org/wiki/CANopen))?
I used to work on devices with ECUs that communicated via j1939, and I'd be
curious if Tesla uses a known standard on top of CAN, or their own thing.

~~~
obrien28
No, thank you! I nearly hit the roof when I saw it had over 14K views on
Instructables (I thought it was an April fools prank) when I checked earlier
this evening. In fact it's now up to 16K+, thats 2K views in only a few hours,
it took me 2+ weeks to get that kind of viewership when I originally posted
it.

As for the protocol, so far Tesla isn't using much standard stuff, everything
from the connector to the codes is proprietary, not surprising considering
that they aren't starting from a legacy platform (like Chevy, Ford, Toyota).
Frankly I'm more of a hardware guy then an infosec expert, so the
communication protocols seem a bit abstract to me (got to do some more
reading), however, from what I've gathered based on jobs postings and forum
chatter on TMC (Tesla Motors Club) Tesla might have worked with Vector group
to implement CANOpen, but thats purely speculation at this point.

If you are interested in helping decode the bus or getting a closer look at
the protocols used, just let me know and I will send you an email with more
details. Many hands make light work as they say.

~~~
mojoe
I would be interested in taking a closer look, although I can't guarantee I'll
have time to help decode. If you feel like it you can shoot me an email at the
address in my profile! Thanks again.

------
personjerry
Aw man I read this and thought they were getting into public transportation.

Then I thought about it, and it seems feasible to me. Since the lines are
predictable and buses tend to end up at the bus terminal we can just put a
charging station there. Since we're doing hybrid buses anyway might as well go
all the way?

------
Animats
If the Model S has all the sensors and actuators for automatic driving, those
should be accessible. The cameras might not be on CANbus (it's too slow) but
the brakes, steering, powertrain, and radars probably are.

~~~
AceJohnny2
I certainly hope those aren't accessible! That's safety-critical hardware, I
don't want some overconfident geek messing up their car's driving systems.

~~~
Too
Everything is accessible, it's just a question of how many layers of plastic
you have to remove to get there. I wouldn't call the bus he found in this
article user accessible but he still found it by removing some cover.

------
zachalexander
Was slightly disappointed it wasn't about a Tesla bus :) I have been secretly
hoping they produce a VW-style camper van.

~~~
butwhy
I want to hear a Tesla bus when it makes this sound:
[https://youtu.be/LqFWvAplIKc?t=2m9s](https://youtu.be/LqFWvAplIKc?t=2m9s)

~~~
anonymfus
There are many trolleybuses with bigger torque.

~~~
butwhy
But muni is slow and shitty; not actually exhibiting large torque.

------
skoocda
The fact that you can access the HV BMS directly is definitely concerning, but
it's tough to make any comment on how big a security risk that is without
poking around myself. That said, I really want to try this out with CANtact +
CANard: [http://cantact.io](http://cantact.io)

Is anyone willing to lend me their Model S, possibly permanently?

------
synaesthesisx
Tried this, bricked my car. :(

~~~
butwhy
You can rent out your bricked car on airbnb:
[https://www.airbnb.com.au/rooms/4182729](https://www.airbnb.com.au/rooms/4182729)

~~~
jkestner
The question is, is Uber going to swallow AirBnB, or AirBnB Uber? Distributed
roving cities of the future.

