TMC is an independent, primarily volunteer organization that relies on ad revenue to cover its operating costs. Please consider whitelisting TMC on your ad blocker or making a Paypal contribution here: paypal.me/SupportTMC

Let the hacking begin... (Model S parts on the bench)

Discussion in 'Model S' started by wk057, Dec 14, 2015.

  1. smac

    smac Active Member

    Joined:
    Aug 4, 2013
    Messages:
    1,121
    Location:
    Nottinghamshire
    After a cheeky request to one of the UK guys for a better daylight shot:

    Tesla Plug - Album on Imgur

    (Big thanks to Mike if he reads this!)

    - - - Updated - - -

    Looking at the physical connector I count 11 pin positions actually filled (including the 2 larger bladed ones which I presume are +12v / GND)

    The original diag port had 13 pin locations, so (at least on the Model S) it could have coped. Of course this may be future proofing, or the X has more connected up.

    On top of this there is also a white 4* pin, bundled with the loom and left hanging in the same spot. No idea what that is for. Maybe a connector for some future feature (thinking a lit premium console)

    * IIRC
     
  2. Turbo3

    Turbo3 Member

    Joined:
    Feb 10, 2016
    Messages:
    162
    Location:
    San Jose, CA
    #1022 Turbo3, Feb 25, 2016
    Last edited: Feb 25, 2016
    Ok, I see two large pins probably voltage and ground at each end. Two groups of four and one pin in the middle for a total of 9 signal pins.

    That is the same number of wires as the current 12 pin connector which only uses 11 pins total. Makes sense if all they did was change the connector and not the wiring harness in the Model S. Perhaps the Model X uses a few more pins.

    The single pin in the middle is probably K Line which was pin 3 on the 12 pin connector.

    The other four groups of 2 are the CAN buses with all the + lines on one side and the - lines on the other side.
     
  3. obrien28

    obrien28 Midnight Engineer

    Joined:
    Jan 17, 2014
    Messages:
    76
    Location:
    NW CT
    that four pin cable would be the Ethernet diagnostics port, now bundled with the can bus on the newer cars (starting at something like the 60k vins) there was some extensive discussion on connector sources and pinouts back on page 60 or so.
     
  4. obrien28

    obrien28 Midnight Engineer

    Joined:
    Jan 17, 2014
    Messages:
    76
    Location:
    NW CT
    I managed to trace out what the pinout of the new (2015 or so) Model S is, whether this applies to the MX I don't know, still can't access service documents (or a physical car), but I hope this helps for now.

    2015 Tesla Diagnostic Connector pinout (connec ref# X437A)


    1 = 12V/5A (F219)
    2 = CAN4+ Body Fault
    3 = CAN4- Body Fault
    7 = K/Serial
    9 = CAN2 Body +
    10 = CAN2 Body-
    13 = CAN6+ Chassis
    14 = CAN6 Chassis-
    18 = CAN3 Powertrain+
    19 = CAN3 Powertrain-
    20 = GND
     
  5. pupik

    pupik Member

    Joined:
    Sep 13, 2015
    Messages:
    62
    Location:
    Czech Republic

    I think that K/Serial is pin 6 :wink:

    Snímek obrazovky 2016-02-27 v 14.40.57.png
     
  6. garygid

    garygid Member

    Joined:
    Aug 11, 2014
    Messages:
    609
    Location:
    Laguna Hills, Orange County, CA
    #1026 garygid, Feb 27, 2016
    Last edited: Feb 27, 2016
    Question:
    Is CAN6 on pins 11 and 12 (across from pins 2 and 3) instead of on 13 and 14 as listed above?

    Are the pins in the connector arranged like this?
    -- 1 --
    2 --- 11
    3 --- 12
    4 --- 13
    5 --- 14
    6 --- 15
    7 --- 16
    8 --- 17
    9 --- 18
    10 --- 19
    -- 20 --

    If so, in the previous pictures, it looked like a block of 4 signal pins 2, 3, 11, 12 were used, pin 6 was used,
    and another block of 4 pins ... 9, 10, 18, and 19 were used, right?

    Then, power and ground on the big pins 1 and 20 as shown in the wiring diagram above.
    Apparently the power is from a 5 amp fuse?

    It would be helpful to see X437A:CAN DIAG, if possible, please.

    Just asking, thanks.
     
  7. pupik

    pupik Member

    Joined:
    Sep 13, 2015
    Messages:
    62
    Location:
    Czech Republic
    #1027 pupik, Feb 27, 2016
    Last edited: Feb 27, 2016
    I think that logically in this way... :smile:
    x437a.jpg
    5 amp fuse for +12V is correct.
    Unfortunately I do not have original detail X437A:CAN DIAG now :redface:
     
  8. garygid

    garygid Member

    Joined:
    Aug 11, 2014
    Messages:
    609
    Location:
    Laguna Hills, Orange County, CA
    Thanks, that pin assignment makes sense:

    1 --- 12 (big pins)
    2 --- 13
    3 --- 14
    4 --- xx (keyway)
    5 --- 15
    6 --- 16
    7 --- 17
    8 --- xx (keyway)
    9 --- 18
    10 --- 19
    11 --- 20 (big pins)

    Great picture, Cheers.
     
  9. garygid

    garygid Member

    Joined:
    Aug 11, 2014
    Messages:
    609
    Location:
    Laguna Hills, Orange County, CA
    No good sources for this "2016 TDC" connector yet?

    Where is this new connector located in the late 2015 and 2016 Model S?

    Where is it located, and how is it accessed in the Model X?

    ------------
    In the meantime, does anybody know the MsgID for the Tire Pressures
    from both the old (VIN pre 50000 roughly), and the new TPMS sensors?

    Thanks for any help, Gary.
     
  10. lolachampcar

    lolachampcar Active Member

    Joined:
    Nov 26, 2012
    Messages:
    4,342
    Location:
    WPB Florida
    An Open Source Car Hacking Device That Easily Hacks Cars
    Interesting but lacking Wk's skills :)

    On the "blue connector" issue, I've been trolling for an X owner willing to do some logging. I've used insulated sockets to pick up discrete pins on connectors before. This should work in this case until a mating connector can be sourced.
     
  11. TheBlackKnight

    Joined:
    Dec 20, 2015
    Messages:
    42
    Location:
    Michigan
    Yeah, I'm pretty sure that I mentioned the CANTact / CANard stuff before. Eric Evenchick got a very large amount of publicity for that stuff but really I'm not aware of too much coming of it. I don't know of any really good open source tools that are written for it. However, it does support SocketCAN so you can use any socketcan compatible tool on LINUX. Really, the CANtact isn't a hacking device that easily hacks cars. It's just a capture device. The hacking is entirely up to you.
     
  12. zax123

    zax123 CDN Model S P308

    Joined:
    Jun 4, 2012
    Messages:
    903
    Location:
    Candiac, QC, CAN
    @wk, is your tweet to Tesla about the actual battery capacity of 85s? Care to clue us in? :)
     
  13. LuckyLuke

    LuckyLuke Model S P85DL

    Joined:
    Dec 14, 2011
    Messages:
    2,091
    Location:
    Eindhoven, The Netherlands
    Probably about some future S/X functionality, hardware, options, etc.
    Like adaptive cruise etc were once "discovered" in early dev mode.
     
  14. Johan

    Johan Took a TSLA bear test. Came back negative.

    Joined:
    Feb 9, 2012
    Messages:
    6,675
    Location:
    Drammen, Norway
    P100D

    (a reverse lookup of the hash posted above yields this)
     
    • Informative x 1
  15. zax123

    zax123 CDN Model S P308

    Joined:
    Jun 4, 2012
    Messages:
    903
    Location:
    Candiac, QC, CAN
    Well done! You just tried a bunch of stuff?
     
  16. Johan

    Johan Took a TSLA bear test. Came back negative.

    Joined:
    Feb 9, 2012
    Messages:
    6,675
    Location:
    Drammen, Norway
    • Informative x 2
  17. LuckyLuke

    LuckyLuke Model S P85DL

    Joined:
    Dec 14, 2011
    Messages:
    2,091
    Location:
    Eindhoven, The Netherlands
    Sweet!!! [emoji2]

    ImageUploadedByTapatalk1457103334.116920.jpg
     
  18. llavalle

    llavalle Member

    Joined:
    Sep 9, 2013
    Messages:
    548
    Location:
    Somewhere around Montreal in Quebec, Canada
    LOL.

    - - - Updated - - -

    Crap, I stand corrected. P100D, hashed actually works.
     
  19. zax123

    zax123 CDN Model S P308

    Joined:
    Jun 4, 2012
    Messages:
    903
    Location:
    Candiac, QC, CAN
    Wow, it's weird that "P100D" was in their reverse hash table...

    But -- cool! :)
     
  20. llavalle

    llavalle Member

    Joined:
    Sep 9, 2013
    Messages:
    548
    Location:
    Somewhere around Montreal in Quebec, Canada
    That's why I initially thought it as a joke...
     

Share This Page