Let the hacking begin... (Model S parts on the bench)

[garygid]

... any active node has no choice. ACK is part of the message acceptance algorithm. If you receive a frame and accept it then you will set ACK. Listen only mode just disconnects the TX line so that your ACK goes nowhere. Thus, your choices are to be in listen only mode and only receive traffic or be in normal mode and be able to send when you want to and always ACK anything you receive.
...
working with ...
- Model S, Think City, Nissan Leaf, custom cars. Not a one of them ever had a problem with my attaching a listener device that wasn't in listen only mode. A lot of other people have used the same tools on various cars.
...
never heard of any issues that can be traced to being in normal mode. Allowing a device to send ACK is only really a problem either if you have the wrong bus speed set or if the bus is in very bad shape. So, I find myself agreeing that listen only mode is the proper way to go for absolute safety.

But, I also find the proposed danger to really not exist. In practice I have never once had a single issue with just leaving my tools in normal mode and going about my business.
...
In practice you won't go wrong if you use tools in listen only mode when you are doing straight captures. Sometimes you need to do a capture while also poking a stick into the beehive to see what happens. Then you can't be in listen only mode but, from my experience, nothing bad will happen due to being in normal mode. Just sharing my experience which seems to be different from some other people's experience. This could come down to hardware. I use the EVTV hardware and Kvaser hardware, not cheap $5 boards or anything like that. If you are using a kazoo and a can of silly string to monitor your canbus then perhaps you should use listen only mode for safety.

We also had no problems with the LEAF when we accidently used the Regular Receive mode (with ACK).

Perhaps our one-time problem with the Model S was with something other than the ACK.
When I am able to Log again, I will first get it working with listen mode, since my AVR-CAN
boards now have the TX solder jumper removed. Then I will try the same hardware and
software in the proper Receive Mode (with the TX solder jumper replaced).

Thanks for sharing your very helpful experience with us.
Cheers, Gary

 

[vitaliy]

I don't want to derail my own thread here, but in all honesty (and I just posted this in another thread) I now have zero trust for Tesla. I no longer believe any published spec or advertisement/announcement is truthful. If there was any trust left at all, figuring out the real "85" kWh capacity wiped out whatever was left. When they released the P85D, Tesla used (read: abused) the trust I did have previously to basically swindle me into a pricey trade-up for very little real gain and a promoted feature set that was essentially paid for but unusable until a year later. The way I see it I paid for 691 HP, 285 miles of range, autopilot before summer '15, and an 85 kWh battery. The reality is that I received 463 HP, 247 miles of range, autopilot a year after purchase, and a 77 kWh battery. Sorry Tesla, not falling for your crap ever again. As my own protest I sold off 100% of my rather long TSLA position several months ago (nearly ~3k shares all together). I no longer even own a single share of TSLA because I have no longer have any faith in the company to be honest with customers. That's a surefire way to drive a company into the ground, and I'd have to be an idiot to keep a large investment in such a company.

Now, here's the funny thing. As a 463 HP, 247 miles of range, 77 kWh, AWD EV with autopilot.... it's an amazing damn car. There was absolutely zero need to promote fake specs and lie about the car when the real specs are already the best the market has to offer. It just makes no sense to me whatsoever that Tesla has decided to just promote false and misleading key specifications in order to get more sales in the short term while people slowly work out the truth.

You nailed it. Couldn't agree more.

 

[Andyw2100]

Andy, be careful mentioning the words horsepower and P85D in the same sentence without adding an asterisk somewhere. :biggrin:

Awesome!

 

[hans]

I thought I was buying a very expensive but extremely cool 17" touchscreen Software Development Kit with some lighted visors ;-)

 

[MsElectric]

I thought I was buying a very expensive but extremely cool 17" touchscreen Software Development Kit with some lighted visors ;-)

The lighted visors are optional...

 

[SUPRKAR]

I thought I was buying a very expensive but extremely cool 17" touchscreen Software Development Kit with some lighted visors ;-)

We were promised lighted visors..Never got them!!! Promises, promises.

 

[dhanson865]

We were promised lighted visors..Never got them!!! Promises, promises.

Naked Eyes - Promises Promises - YouTube

 

[garygid]

With the Nissan LEAF, we investigated its 4 CAN buses, and found some useful data,
and others discovered how to Request Data (like the 96 cell voltages) and interpret
the results. They made an excellent Leaf Spy Android app, to run on a smartphone
and connect via bluetooth locally to a CAN-to-Bluetooth dongle attached to the LEAF's
Diagnostics connector.

This app was programmed for Android using B2A, and LeafSpy had a free LeafSpy Lite
to test out your dongle and phone (showing a vertical bar graph of the 96 cell voltages)
before buying the $10 LeafSpy app. Then, a LeafSpy Pro was created, offered for $15,
that would read the Diagnostic Trouble Codes, etc. Eventually there was even a twin app
that supports iOS phones.

Sense you have located some useful "hidden" data on the 4 Model S CAN buses, it might
be possible to get a copy of the LeafSpy B2A-based program, and modify it for use with the
Model S (and X). I will be speaking to the program owner soon about this.

Perhaps there us someone here who has the time, talent, and temperment for this
programming project to help out the MS and upcoming MX community?

If you are capable, or want to learn, and seriously interested, please send me
a Private Message with your contact information and I will email or call.

 

[llavalle]

Quick one for you guys : to access the CAN connector behind the MCU, you have to remove the cubby right? Lets say you have the premium center console installed... Do you need to remove it?

 

[wk057]

Quick one for you guys : to access the CAN connector behind the MCU, you have to remove the cubby right? Lets say you have the premium center console installed... Do you need to remove it?

Dunno about the console. To access the connector I just pull down on the front of the cubby until the front two clips pop out, then I can fetch the connector without actually removing it.

 

[llavalle]

Dunno about the console. To access the connector I just pull down on the front of the cubby until the front two clips pop out, then I can fetch the connector without actually removing it.

Yeah, ok... Well, it means the center console needs to be removed.. meh.. I can get the cubby to go down about 1/4in to 1/2in but then it's sitting firmly on the console... and I can't even see a gap at the top.


Well, well, well...

 

[MikeBur]

Easter Egg discovery?

Wk, et al. Have you attempted to find any additional Easter eggs with your level of access, eg 007, 42, etc?

Perhaps these are encrypted in the image, though hopefully not... ;-)

 

[zdre]

I finally made a cable and logged data with CANtact. I have a 40kWh so may have some interesting numbers.
Got it working pretty quickly thanks to @Obrien28 's can-utils and @wk057 's decoding. I'm working on enhancing the script to parse more data. You may see a pull request soon

 

[smac]

Yeah, ok... Well, it means the center console needs to be removed.. meh.. I can get the cubby to go down about 1/4in to 1/2in but then it's sitting firmly on the console... and I can't even see a gap at the top.


Well, well, well...

These are the clips:

I'd say they are slightly over 1/2" (from memory), so it sounds like clearance will be tight.

 

[Cyclone]

Quick one for you guys : to access the CAN connector behind the MCU, you have to remove the cubby right? Lets say you have the premium center console installed... Do you need to remove it?

These are the clips:
View attachment 110892

I'd say they are slightly over 1/2" (from memory), so it sounds like clearance will be tight.

What would the service center do if they needed to connect to diagnostics for a repair?

 

[wk057]

What would the service center do if they needed to connect to diagnostics for a repair?

I was actually curious about that myself. Surely they're not going to remove the center console every time.

I suppose they could fetch the car's 16 character security token and just use the diagnostics on the CID that way, but that doesn't work for everything.

 

[smac]

What would the service center do if they needed to connect to diagnostics for a repair?

Well in my case hopefully vacuum the carpets first :redface::tongue:

 

[NOLA_Mike]

They may very well have to take the console out (note that I don't know, just speculating). The original Model S had the diagnostics connector behind the left (driver's side) panel of the dash near the door. It's possible when they moved it to behind the cubby in the center console they did it without thinking about cars that had the center console.

 

[obrien28]

I finally made a cable and logged data with CANtact. I have a 40kWh so may have some interesting numbers.
Got it working pretty quickly thanks to @Obrien28 's can-utils and @wk057 's decoding. I'm working on enhancing the script to parse more data. You may see a pull request soon

Great to hear, I wrote those scripts out of frustration because I needed something to do serious logging/saving, all Eric had at the time was some 5 line python snippets that showed you the bare minimum to connect to the CANtact and log a frame. Now I just recently added command line arguments to run the program and as part of that added some special flags to enable decoding of the motor and battery data (only the rear DU since I don't have a D) thank you wk057!

That all said I am definitely not a software guy, so any help to improve functionality is much appreciated. If you want to PM me your git email/username then I can add you as a contributor.

Just so everyone is on the same page these are the scripts he is referring to, I'm planning on maybe doing a forum post about logging data using the CANtact, at $60 and fully open HW/SW it makes a nice cheap and cheerful device that even non techno-genius owners can use and not have to take out a loan to pay for.

 

[llavalle]

Surely they're not going to remove the center console every time.

I'll try it out tonight. Removing the sides of the console is pretty easy : you just pull them on each side. I just hope I don't have to unscrew the console's center part (4 screws) to access the connector.

One thing for sure, I retested this morning and with the console installed, there is now way the cubby can be pulled down enough to get to the connector.