So Tesla use
UDS over CAN BUS to handle ECU diagnostics.
Tesla have multiple buses which can be accessed from the diagnostic connector under the middle screen. For this we want CAN BUS 3 (the drivetrain CAN) at a speed of 500kbps
You can use any cheap CAN BUS analyser to send and read these messages.
They have a login procedure for UDS which is the same seed and key for all cars luckily.
Below is an example of the CAN frames required to clear the BMS stress on a Model S, I've included a comment to show what is going on too...
Direction | Can ID | Data | Comment |
you send to car | 0x602 | 02 10 03 00 00 00 00 00 | Tell the car to start diag session, note the 10 value for UDS Session Start |
car responds with | 0x612 | 02 50 03 AA AA AA AA AA | Response contains 50 (10 + 40) |
you send to car | 0x602 | 02 27 05 00 00 00 00 00 | start a secured session, note value 27 |
car responds with | 0x612 | 10 12 67 05 00 01 02 03 | all good, note 67 (27 + 40). Start of seed |
you send to car | 0x602 | 30 00 00 00 00 00 00 00 | flow control message, meaning ok ready for more data |
car responds with 2 frames, 1st | 0x612 | 21 04 05 06 07 08 09 0A | more of the seed |
2nd frame from car | 0x612 | 22 0B 0C 0D 0E 0F AA AA | final part of seed |
you send to car | 0x602 | 10 12 27 06 35 34 37 36 | thanks for seed, here is the key |
car responds with | 0x612 | 30 00 00 AA AA AA AA AA | flow control, car is ready for more data |
you send to car | 0x602 | 21 31 30 33 32 3D 3C 3F | first part of key |
you send to car | 0x602 | 22 3E 39 38 3B 3A 00 00 | second part of key |
car responds with | 0x612 | 02 67 06 AA AA AA AA AA | All good, note the 67 (27 + 40), logged in basically |
you finally send | 0x602 | 04 31 01 04 06 00 00 00 | the thing you actually want to do, 06 means reset contactor stress. |
car responds with | 0x612 | 05 71 01 04 06 01 AA AA | Car completed the task, note the 71 (31 + 40) and the 01 confirmed completed. |
So that is one example of a BMS stress reset, below are the others that I know (just replace the final send with these)...
Clear stress | 04 31 01 04 06 00 00 00 |
Reset WOT | 04 31 01 04 07 00 00 00 |
f163 | 04 31 01 04 02 00 00 00 |
f153 | 04 31 01 04 05 00 00 00 |
f152 | 04 31 01 04 04 00 00 00 |
Open Positive Contactor Reset | 04 31 01 04 02 00 00 00 |
f026 | 04 31 01 04 0A 00 00 00 |
w026 | 04 31 01 04 01 00 00 00 |
? w023 | 04 31 01 04 02 00 00 00 |
If anyone knows anymore then please add to this list to help the community out.
Hopefully this helps people out without the need to spend thousands on diag equipment.