I am having a go at the can-bus injection method mentioned above. I am using the VDS from a salvaged car and an OVMS-module for the investigation.
First I toyed around issuing "can can1 tx standard 100 93 01 B3 B4 00 00 00 00" to raise an alert and "can can1 tx standard 100 93 00 B3 B4 00 00 00 00" to clear it. B4B3 represents the alert ID. I find that ID <= 3500 either results in the alert message "Unrecognized Alert ID" or something else meaningful (or at least less generic), while for 3500 < ID < 65535(=0xFFFF) I observe the message "Alert ID out of range". I have only probed the latter range near its boundaries and at a small handful of IDs in between. The message text suggests that this range is void of anything interesting, but that is only a hypothesis for now. ID=65535 does not raise an alert. There seems to be no response to that ID.
The above finding suggests that any new messages should be sought in the interval from 0 to 3500 inclusive. I have done that. I have automated (somewhat) the procedure of raising and clearing alerts. For this purpose I raise an alert by "can can1 tx standard 100 93 05 B3 B4 00 00 00 00" as that causes the alert window to disappear without tapping the display after it is cleared.
Known alerts are documented in
This is a stub article Roadster VDS Messages A list of the VDS messages which can appear and if possible, some advice to the owner who sees them. The VDS can operate in Standard or Debug mode. You enter Debug mode either by tapping the VDS six times and entering a special code, or by letting...
teslamotorsclub.com
Repository for Open Vehicles server code. Contribute to openvehicles/Open-Vehicle-Server development by creating an account on GitHub.
github.com
A list of Tesla Roadster error codes. You can search and filter this table to find your error code and what it means. Contact us for service at (623)433-8500.
grubermotors.com
There are 748 known ID codes. The latter source contains them all.
I have checked the other 2753 IDs in the interesting range.
The following IDs result in orange message "Unrecognized Alert ID" both in enduser and debug mode:
11-12, 15, 17-18, 20, 22, 24, 26, 33-42, 44-49, 64-89, 109-256, 289-397, 417-419, 421-427, 431-499, 505-524, 540-546, 548-559, 562-599, 614-699, 704-719, 736, 738, 740-879, 890, 892-900, 1157-1159, 1168, 1175-1199, 1224-1399, 1436-1439, 1445-1446, 1449, 1454, 1476-1489, 1498-1521, 1523-1531, 1566-1639, 1672-1899, 1909-2002, 2043-2046, 2049, 2052-2060, 2063-2064, 2067-2069, 2082-2085, 2097, 2100-2399, 2401-2409, 2424-3000, 3034-3077, 3079-3142, 3145, 3147-3500
The procedure was mindbogglingly boring making it a bit difficult to keep focus. Hence I can not totally rule out that I have overlooked a deviant message, but I believe that I haven't.
The remaining IDs are (id, colour, enduser, debug):
5, orange. Debug-Only Message, "VMS Watchdog"
3033, blue , ",", "("
3078, blue, "Unrecognized Alert ID", "" (Saying Debug-Only Msg)
3143, blue, "", "Unrecognized Alert ID"
3144, blue, "", "Unrecognized Alert ID"
3146, blue, "", "Unrecognized Alert ID"
For ID 3033, the characters appearing were not entirely repeatable. I provoked a yellow 2418 "Memory allocation below the heap" while investigating.
I experienced spontaneous reset and a yellow ID 2412 "VDS: Data abort exception" while investigating 3143. I don't know if there is a bug, if I just took the VDS too far outside its intendend use or if there is something wrong with it.
Next steps could be
- verifying known codes
- investigating IDs with results suggesting that the alert screen is intended for modification by subsequent can messages, i.e. the blank(ish) screens and some already known messages with incomplete sentences
- trying to understand more about the can-bus messages to the VDS
