CAN buses & access

[nick]

Has it been figured out how many CAN buses are present in the Roadster, and good ways to access each bus? (figure the OBDII port will give access to 1 or maybe 2 of them).

My first interest is the battery monitoring system (BMS) from the battery - goal being to monitor a battery charging from a 400V bench power supply (battery not installed in a car).

If I can tap the BMS CAN bus on my driving Roadster I can get captures.

 

[nick]

Starting with the OBD2 port...

Looks like there is only one CAN bus present on the OBD2 port - bitrate of 1Mbps (pins 6 and 14).

There are 4 pins I can't identify...

Pins 1 and 9 appear to be connected together, not seeing any signaling.

Pins 7 and 12 read +5.33V, not seeing any signaling.

 

[gregd]

Mmm, not sure about having a CAN bus on the OBD2 port. I think I tried listening to it there, and got nothing. The belief is that the port there is only used for programming the TPMS system. What are you seeing?

The Roadster's Instrument CAN bus is picked up by the OVMS module on the car's "diagnostic" connector, which is located on a pigtail in the passenger foot well.

You might check the threads regarding the OVMS module, and the resources on Github (openvehicles) for what the car reports, and what others have been able to decode from it. There is some charging information present on that bus, but it may not be the detail you are looking for (or it has not been decoded as yet).

 

[petergrub]

Perfect question; my time to shine!

I have been doing extensive work on the Roadster CAN buses lately. There are four buses—Body FT/ESS, Chassis/PEM, PT/IP, and Body/ODBII. The Body/ODBII is the only bus accessible from the ODBII port. On pins 7 and 14, there is serial/K-line for the SRS, ABS, and TPMS modules. Pins 1 and 9 are in fact connected and are the emergency power sense for the switchpack. The latter come from a splice that is separated from the 12V APS rail with two Schottky Diodes.

1) Body FT
Includes the HVAC and ESS (Energy Storage System) or high-voltage battery. The Switchpack can be found on this bus in 1.5 Roadsters.

2) Chassis
Includes the GS (Gear Selector for 2.X Roadsters), Switchpack, ABS, PEM, and TCM (Transmission Control Module)

3) PT (Powertrain)
- Includes the IP (Instrument Panel), TPMS, and VDS (Vehicle Display System)
- Requires ignition to be on

4) ODBII
Includes only the ODBII data coming form the VMS

All the buses are accessible from the CAN Diagnostics connector in the passenger foot well. It hangs down near the VMS. The pinout for that connector is as follows.

PT - Pins 1 and 6
Body FT - Pins 2 and 7
Chassis - Pins 4 and 11
ODBII - Pins 5 and 12
GND - Pin 9
12V - Pin 10
Serial/K-line - Pin 3

Now the icing on the cake, CAN header and data decoding. The high-voltage battery voltage comes from the 10 bit ADC (Analog to Digital Converter) in the BSM (Battery Safety Monitor). The upper 8 bits are in the high byte, while the lower 2 bits are in the low byte. The header is x200, byte 0 is x14, high is byte 1, and low is byte 6 bits 0-1. Multiply the result by 5/1024 * 100 to properly adjust the scale.

Also interestingly, the 4-way breakout cable that Tesla uses to connect to the Roadster diagnostic connector is the same one they use to connect to the early Model Ss before the diagnostic connector was changed to the blue Sumitomo.

 

[nick]

Awesome info!

I have a CAN bus USB dongle arriving this week... would you happen to know if the diagnostic connector-plug is available for purchase anywhere?

 

[gregd]

Awesome info!

I have a CAN bus USB dongle arriving this week... would you happen to know if the diagnostic connector-plug is available for purchase anywhere?

The one we've been using for the OVMS module is:

$7.50 OVMS Data Cable for Tesla Roadster 1.x/2.x - Official OVMS Parts at FastTech - Worldwide Free Shipping

However, it only picks up the one CAN bus from the end two pins (not sure the pin numbering), along with +12 and ground from the two in the middle. Note that the signaling on the Roadster's CAN bus is at 1 megabit, where the standard dongles only do 500k (the fastest OBDII standard bus rate), and the frames aren't in OBDII format. So, if you're looking to use an ELM 327 tool like OBDWiz, Torque, or similar, it's not going to connect. I'm using a Raspberry Pi with a PiCAN2 hat from Copperhilltech.com to monitor stuff with Wireshark.

@petergrub, what is the pin numbering on the Diagnostic port connector?

 

[nick]

The dongle I have on order claims to support 1Mbps.

Thought... for attempting to recover a bricked battery, I wonder if injecting 12V would be enough for the battery to respond to a CAN bus message to engage the HV contactors. If the contactors can be engaged then a 400V bench power supply could charge the battery.

Will do a capture on my working Roadster when the dongle arrives.

 

[petergrub]

would you happen to know if the diagnostic connector-plug is available for purchase anywhere?

Not that I'm aware of. I built mine with scrap 20AWG wire I twisted together, and four female DB9 connectors—one for each bus. The connector is a TE AMP 173851-1 and the terminals are TE AMP 173631-1.

what is the pin numbering on the Diagnostic port connector?

Here's a visual representation of the TE connector I just mentioned with the locking tab and blanks oriented up and the mating section facing towards you.
__________-------___________
|..[1][2][3]...[x][xx]...[ 4 ][ 5 ]...|
|..[6][7][8]..[9][10]...[11][12]..|
------------------------------------------
Here's the connector in the vehicle with the locking tab and blanks oriented up and the mating section facing towards you.
------------------------------------------
|...[ 5 ][ 4 ]...[xx][x]...[3][2][1]..|
|..[12][11]...[10][9]..[8][7][6]..|
------------------------------------------

Thought... for attempting to recover a bricked battery, I wonder if injecting 12V would be enough for the battery to respond to a CAN bus message to engage the HV contactors.

I recall the BSM in the battery looking for the capacitance in the PEM before giving the okay to close contactors. I don't believe there is a CAN signal to override that functionality. You can however inject 12V to wake up the BSM and read CAN data from the battery logic connector on the left side of the high-voltage battery.

 

[nick]

How does the CAN bus from the battery connect to the car?

I have the cover off the PEM and I can see some light weight wires alongside the heavy battery cables... they still look more like power cables.

Wondering if there is an easy way to separate the battery CAN bus from the car so I can talk to the battery.

 

[ML Auto]

How does the CAN bus from the battery connect to the car?

I have the cover off the PEM and I can see some light weight wires alongside the heavy battery cables... they still look more like power cables.

Wondering if there is an easy way to separate the battery CAN bus from the car so I can talk to the battery.

The CAN terminals are pin numbers 5 and 6 on the 8 pin connector underneath the orange disconnect.

 

[nick]

The CAN terminals are pin numbers 5 and 6 on the 8 pin connector underneath the orange disconnect.

On the battery itself?

Hoping to find the other end of the CAN bus wiring so I can isolate the battery but still have wires I can easily attach to.

v1.5, battery is in the car.

 

[ML Auto]

The ESS CAN is connected to terminals #7 and #2 of the CAN diagnostic connector, but that is spliced to the HVAC and goes into the VMS. If you need to isolate and and connect to the ESS, you will need to unplug both the VMS and HVAC control module. Or connect directly to the 8 pin ESS connector underneath the disconnect (on the ESS itself).

 

[nick]

The HVAC system should be harmless, but I would like to unplug the VMS for this test.

Where might the VMS control module be mounted?

Going to be a busy day tomorrow

 

[ML Auto]

The VMS is located in the passenger footwell attached to the bottom of the dash.

 

[Rotarypower]

Some reference material that might help out. J4 connector may be what you need.