Let the hacking begin... (Model S parts on the bench)

[smac]

It looks like there are only a few pins in the blue socket. Can you count how many? Is it possible to get a close-up of just the pins so we can see where they are located?

After a cheeky request to one of the UK guys for a better daylight shot:

Tesla Plug - Album on Imgur

(Big thanks to Mike if he reads this!)

- - - Updated - - -

It's 20 according to the schematics and connector datasheet, if I remember pins 1-20 are 12V&GND

Looking at the physical connector I count 11 pin positions actually filled (including the 2 larger bladed ones which I presume are +12v / GND)

The original diag port had 13 pin locations, so (at least on the Model S) it could have coped. Of course this may be future proofing, or the X has more connected up.

On top of this there is also a white 4* pin, bundled with the loom and left hanging in the same spot. No idea what that is for. Maybe a connector for some future feature (thinking a lit premium console)

* IIRC

 

[Turbo3]

Ok, I see two large pins probably voltage and ground at each end. Two groups of four and one pin in the middle for a total of 9 signal pins.

That is the same number of wires as the current 12 pin connector which only uses 11 pins total. Makes sense if all they did was change the connector and not the wiring harness in the Model S. Perhaps the Model X uses a few more pins.

The single pin in the middle is probably K Line which was pin 3 on the 12 pin connector.

The other four groups of 2 are the CAN buses with all the + lines on one side and the - lines on the other side.

 

[obrien28]

After a cheeky request to one of the UK guys for a better daylight shot:

Tesla Plug - Album on Imgur

(Big thanks to Mike if he reads this!)

- - - Updated - - -



Looking at the physical connector I count 11 pin positions actually filled (including the 2 larger bladed ones which I presume are +12v / GND)

The original diag port had 13 pin locations, so (at least on the Model S) it could have coped. Of course this may be future proofing, or the X has more connected up.

On top of this there is also a white 4* pin, bundled with the loom and left hanging in the same spot. No idea what that is for. Maybe a connector for some future feature (thinking a lit premium console)

* IIRC

that four pin cable would be the Ethernet diagnostics port, now bundled with the can bus on the newer cars (starting at something like the 60k vins) there was some extensive discussion on connector sources and pinouts back on page 60 or so.

 

[obrien28]

I managed to trace out what the pinout of the new (2015 or so) Model S is, whether this applies to the MX I don't know, still can't access service documents (or a physical car), but I hope this helps for now.

2015 Tesla Diagnostic Connector pinout (connec ref# X437A)


1 = 12V/5A (F219)
2 = CAN4+ Body Fault
3 = CAN4- Body Fault
7 = K/Serial
9 = CAN2 Body +
10 = CAN2 Body-
13 = CAN6+ Chassis
14 = CAN6 Chassis-
18 = CAN3 Powertrain+
19 = CAN3 Powertrain-
20 = GND

 

[pupik]

I managed to trace out what the pinout of the new (2015 or so) Model S is, whether this applies to the MX I don't know, still can't access service documents (or a physical car), but I hope this helps for now.

2015 Tesla Diagnostic Connector pinout (connec ref# X437A)


1 = 12V/5A (F219)
2 = CAN4+ Body Fault
3 = CAN4- Body Fault
7 = K/Serial
9 = CAN2 Body +
10 = CAN2 Body-
13 = CAN6+ Chassis
14 = CAN6 Chassis-
18 = CAN3 Powertrain+
19 = CAN3 Powertrain-
20 = GND

I think that K/Serial is pin 6 :wink:

 

[garygid]

Question:
Is CAN6 on pins 11 and 12 (across from pins 2 and 3) instead of on 13 and 14 as listed above?

Are the pins in the connector arranged like this?
-- 1 --
2 --- 11
3 --- 12
4 --- 13
5 --- 14
6 --- 15
7 --- 16
8 --- 17
9 --- 18
10 --- 19
-- 20 --

If so, in the previous pictures, it looked like a block of 4 signal pins 2, 3, 11, 12 were used, pin 6 was used,
and another block of 4 pins ... 9, 10, 18, and 19 were used, right?

Then, power and ground on the big pins 1 and 20 as shown in the wiring diagram above.
Apparently the power is from a 5 amp fuse?

It would be helpful to see X437A:CAN DIAG, if possible, please.

Just asking, thanks.

 

[pupik]

Question:
Is CAN6 on pins 11 and 12 (across from pins 2 and 3) instead of on 13 and 14 as listed above?

Are the pins in the connector arranged like this?
-- 1 --
2 --- 11
3 --- 12
4 --- 13
5 --- 14
6 --- 15
7 --- 16
8 --- 17
9 --- 18
10 --- 19
-- 20 --

If so, in the previous pictures, it looked like a block of 4 signal pins 2, 3, 11, 12 were used, pin 6 was used,
and another block of 4 pins ... 9, 10, 18, and 19 were used, right?

Then, power and ground on the big pins 1 and 20 as shown in the wiring diagram above.
Apparently the power is from a 5 amp fuse?

It would be helpful to see X437A:CAN DIAG, if possible, please.

Just asking, thanks.

I think that logically in this way... :smile:

5 amp fuse for +12V is correct.
Unfortunately I do not have original detail X437A:CAN DIAG now :redface:

 

[garygid]

Thanks, that pin assignment makes sense:

1 --- 12 (big pins)
2 --- 13
3 --- 14
4 --- xx (keyway)
5 --- 15
6 --- 16
7 --- 17
8 --- xx (keyway)
9 --- 18
10 --- 19
11 --- 20 (big pins)

Great picture, Cheers.

I think that logically in this way... :smile:
View attachment 113003
5 amp fuse for +12V is correct.
Unfortunately I do not have original detail X437A:CAN DIAG now :redface:

 

[garygid]

No good sources for this "2016 TDC" connector yet?

Where is this new connector located in the late 2015 and 2016 Model S?

Where is it located, and how is it accessed in the Model X?

------------
In the meantime, does anybody know the MsgID for the Tire Pressures
from both the old (VIN pre 50000 roughly), and the new TPMS sensors?

Thanks for any help, Gary.

 

[lolachampcar]

An Open Source Car Hacking Device That Easily Hacks Cars
Interesting but lacking Wk's skills

On the "blue connector" issue, I've been trolling for an X owner willing to do some logging. I've used insulated sockets to pick up discrete pins on connectors before. This should work in this case until a mating connector can be sourced.

 

[TheBlackKnight]

An Open Source Car Hacking Device That Easily Hacks Cars
Interesting but lacking Wk's skills

On the "blue connector" issue, I've been trolling for an X owner willing to do some logging. I've used insulated sockets to pick up discrete pins on connectors before. This should work in this case until a mating connector can be sourced.

Yeah, I'm pretty sure that I mentioned the CANTact / CANard stuff before. Eric Evenchick got a very large amount of publicity for that stuff but really I'm not aware of too much coming of it. I don't know of any really good open source tools that are written for it. However, it does support SocketCAN so you can use any socketcan compatible tool on LINUX. Really, the CANtact isn't a hacking device that easily hacks cars. It's just a capture device. The hacking is entirely up to you.

 

[zax123]

@wk, is your tweet to Tesla about the actual battery capacity of 85s? Care to clue us in?

 

[LuckyLuke]

Probably about some future S/X functionality, hardware, options, etc.
Like adaptive cruise etc were once "discovered" in early dev mode.

 

[Johan]

P100D

(a reverse lookup of the hash posted above yields this)

 

[zax123]

Well done! You just tried a bunch of stuff?

 

[Johan]

Well done! You just tried a bunch of stuff?

CrackStation - Online Password Hash Cracking - MD5, SHA1, Linux, Rainbow Tables, etc.

 

[LuckyLuke]

Sweet!!! [emoji2]

 

[llavalle]

(a reverse lookup of the hash posted above yields this)

LOL.

- - - Updated - - -

LOL.

Crap, I stand corrected. P100D, hashed actually works.

 

[zax123]

Wow, it's weird that "P100D" was in their reverse hash table...

But -- cool!

 

[llavalle]

Wow, it's weird that "P100D" was in their reverse hash table...

That's why I initially thought it as a joke...