TPMS CONTINUES TO FAIL... [RANT] And they are gonna send people the mars?

[ML Auto]

The front antenna is just as easy to get at as the rear. Just drop the pan connected to the front bumper-almost exactly like the rear. The unit is in the middle about a foot back from the front and even looks identical. I'd be willing to try one out if you want.

 

[nsxpert]

Yes this is the real solution. Is there any way to just disable the damm TPMS?
I just had to pay $800 to Tesla for 4 new sensors

I just want the warnings to go away. I am quite handy with a tire pressure gauge, thank you.

 

[scotty2541]

Last step. I covered it with epoxy to help prevent the parts form vibrating loose, and will seal it up.

I honestly, fully expect it to have a short lifetime, but it's my first attempt and something for a hostile automotive environment.

Addresses are: (These are based off of mine, I altered the most significant digit, mine was 08, not 0e)
0e 06 66 2f
0e 06 66 2e
0e 06 66 2d
0e 66 06 2c


Pressure replies are:
52 44 53 44 6d 45 6d 45
52 = 28 PSI
6d = 37 PSI
44 = 68 degrees
45 = 69 degrees

Again, consult That TPMS issue, summarized for more details of the data in these messages.

 

[strider]

Yes this is the real solution. Is there any way to just disable the damm TPMS?
I just had to pay $800 to Tesla for 4 new sensors

No. It's a Federal mandate so Tesla can't do it. Nor did they add a knob in the Diagnostic area to do it (likely due to aforementioned Federal mandate). It would take hacking the VDS code itself to disable it.

So @scotty2541 did the next best thing. He built an emulator that listens for the polls from the computer and always reports happiness (pressure and temp).

 

[strider]

I honestly, fully expect it to have a short lifetime, but it's my first attempt and something for a hostile automotive environment.

Should still be a good proof of concept. If it fails in 6 months or a year that's still 6-12 months of peace I wouldn't otherwise have enjoyed

 

[scotty2541]

The front antenna is just as easy to get at as the rear. Just drop the pan connected to the front bumper-almost exactly like the rear. The unit is in the middle about a foot back from the front and even looks identical. I'd be willing to try one out if you want.

Unit # 1 is headed to strider... Unless I try it on my car first now that I know where to get to the front antenna. I don't have the ability to jack up the car except with one little scissor jack on one side. I haven't tried to get under the front.

I could send you unit #2 as soon as I build it. Seriously, carving out the side of the enclosure to accommodate the connector is more work than assembling the circuit board. I use a dremel tool, and it melts more than it cuts. I could probably have another one ready next weekend. PM me if you are willing to try.

I reiterate: These are beta (or even alpha really). I'm concerned about code errors (won't damage the system, just would stop responding) or the solder joints vibrating loose.

I've addressed the code errors with the build in MCU watchdog reset monitor, and the vibration issues with epoxy. These are the best I prevention methods have come up with so far.

 

[scotty2541]

Okay guys, I regret to inform you that my test failed.

I disconnected the front antenna, which was a pain to do without a ramp or lift. Then I disconnected the rear antenna and attached my emulator. I got no result.

I then attached my sniffer, and monitored the data traffic. The traffic I was was exactly as I expected.
I also expected the VDM display to show the tire data immediately since the antennas were not waiting 1-3 minutes for a message from the tire sensors. But nothing ever appeared.
I re-attached the original antennas and it resumed working.

Thew conclusion is that I was wrong... somewhere the system still cares what the tire sensor addresses are. Therefore, my emulator will have to be programmed with the correct addresses (Customize each one, as it were). So I see only a few possibilities:
1. Got to a local tire shop, and see if they can read the sensor addresses.
2. Beg the Telsa guy to read them when he visits your car
3. Beg the Tesla guy to program the TPMS with the phony addresses I used (least best choice)

I will have to reprogram the device with my addresses and repeat my test to confirm. But I'm not feeling up to that right now

-Scott

 

[strider]

Argh. I was afraid of that. Ranger is coming to my house on Wednesday to replace our Model S screen. I will ask to borrow his TPMS tool to read the addresses. Let us know if updating the emulator with the correct addresses fixes the issue.

Having used the Roadster TPMS tool once, I'm not sure #3 is a valid option. The tool has a wizard-like interface where it steps you through reading each sensor and then has you plug in the tool to the car to push the addresses. I don't recall a point at which I could manually enter or modify the addresses.

 

[scotty2541]

Sorry... another failure. I have no idea why.
I set the addresses to my existing tires, and even used the same values from data on the good antennas. So if there were any buried checksums in those values that I didn't know what they were, they still are exactly the same.

I can't see any difference. But after 5+ minutes, the VDM never showed any tire data.

Maybe there was noise or ringing on the wire at the front antenna, because it wasn't terminated. But my sniffer didn't have any problem.
Maybe the main unit needs to see a load or signal on the line from the front antenna.

I am out of ideas for now. Unless I build another unit, and reprogram them to be different front/back units.

But at least I had an easier time getting at the unit. I piled three 2"X12" boards on the floor staggered, and drove the car up like going up steps. The extra 6" of lift left me use my cordless drill with a socket attachment.

But it was quite a learning experience, anyway.

 

[hcsharp]

I have parts and boards for a total of three units. I was hoping to hear from "hcsharp" about milling the boxes to fit the plugs, but he hasn't responded to the thread. My manual cutting job is pretty sloppy.

Sorry I've been out of town and not on the board. Happy to cut a few boxes on the milling machine as soon as you send me some. Just mark where you want the cutout. Sending you a PM.

 

[strider]

@scotty2541 sent me the emulator prototype programmed to my sensor addresses late last week. I went about installing it this afternoon. Unfortunately it didn't work. I installed it in the front as it was easier to mount up there vs the rear. I plugged the emulator in, unplugged the rear antenna, and drove about a mile with the TPMS screen up on the VDS. No values appeared. Scott also sent 2 different resistors with the thought that the unterminated rear plug was causing signal reflections. I went for a short drive in turn with each of the resistors in the rear plug. No dice there either.

Before we go back to the drawing board I may not be a valid test case. Tesla believes that my TPMS ECU is malfunctioning (they have replaced both antennas and they swear that the sensors are ok). Since this hack still requires the TPMS ECU to report into the main computer/VDS, if the TPMS ECU is malfunctioning this emulator won't help that. But for someone who's tire sensors or antennas have malfunctioned it should work fine.

I wonder if it's possible to spoof the communications between the TPMS ECU and the VDS? Though we'd probably have to figure out a way to unplug the TPMS ECU which I understand is quite buried in the dash.

I'll send the unit back to Scott. Perhaps he could try it on his car (programmed with his car's sensor values) for a proper POC.

 

[scotty2541]

I think the next one to try should be ML Auto. I can send it with the addresses from Strider, I can put my addresses back in, or if he sends me his tire sensors addresses, I can program it with them.

 

[markwj]

I wonder if it's possible to spoof the communications between the TPMS ECU and the VDS? Though we'd probably have to figure out a way to unplug the TPMS ECU which I understand is quite buried in the dash.

Do you have a CAN bus data logger? If so, can you try to log the instrumentation bus @1Mhz, and look for CAN ID #0x343, 0x344, and 0x345. The main data is on 0x344. It is trivial to send out that data. But, the question is if your existing TPMS ECU is sending it out as well.

 

[scotty2541]

That's the next step... To build a K line or CAN bus emulator that pretends to be the TPMS ECU. And I don't have any devices that read those protocols.

For me, it's starting over from scratch, since I reverse engineered the LIN traffic.

 

[markwj]

The CAN bus messages (IDs #0x343, 0x344, and 0x345) are pretty well understood. We've only ever used 0x344 in OVMS. Sending them from a device like OVMS is trivial (we already do that at a high rate to spoof the digital speedo stuff). The issue is what the existing ECU would do and how the VDS would behave.

I've always assumed that these 0x34[345] messages come from the TPMS ECU but never verified that (as it would require either ripping apart the dashboard, or unplugging the VMS). They could be coming from the VMS. Wiring diagrams for Roadster show the VMS, VDS, InstrumentCluster and TPMS ECU on that CAN bus - not much point for the TPMS ECU to be there if it wasn't outputting anything.

 

[strider]

Hi Mark,

Interesting idea about doing it w/ OVMS. I believe there is a ~20 minute timer on TPMS messages - after which the car throws a TPMS error. So if the goal is to just silence the alarm, the OVMS won't have to win every time to keep the alarm quiet. But if the VMS gets conflicting messages that could also cause it to throw an error...

I'm still using my Tesla Tattler so don't have an OVMS. But this would push me into getting one. Any word on when the v3 hardware will be ready? I could beta test it for you if interested.

Can I help w/ decoding? Would this logger work?
CANLogger1000
or do I need the real-time clock of the 2000 model?

I assume the OVMS Data cable would also work on that logger?

 

[BartJ]

no tmps on EU roadsters luckily

 

[markwj]

Interesting idea about doing it w/ OVMS. I believe there is a ~20 minute timer on TPMS messages - after which the car throws a TPMS error. So if the goal is to just silence the alarm, the OVMS won't have to win every time to keep the alarm quiet. But if the VMS gets conflicting messages that could also cause it to throw an error...

The 0x344 message is sent about once every second (presumably from the TPMS ECU). Sure, we can easily send that message but my concern is if we send 'here are the tyre pressures' and the TPMS ECU sends 'TPMS broken', we'll conflict. The VMS/VDS will typically pickup the last transmission.

Unplugging the TPMS ECU would solve that but involves ripping apart the dash.

I'm still using my Tesla Tattler so don't have an OVMS. But this would push me into getting one. Any word on when the v3 hardware will be ready? I could beta test it for you if interested.

I should have first v3 boards with me late next week, and the first very limited development board run should happen late this month. Production boards in the summer.

Can I help w/ decoding? Would this logger work?
CANLogger1000
or do I need the real-time clock of the 2000 model?

I assume the OVMS Data cable would also work on that logger?

OVMS v3 will include data logging capability, so you won't need one of these CAN-USB adaptors at all in future.

I haven't used the CANLogger1000 product at all. The CAN-USB I currently use is this:

CANUSB

About €90.20 (excluding VAT). Very simple and basic. Cable pinouts here:

CANUSB

That one is compatible with the OVMS vehicle cable (surprise, surprise, it is the one I use).

 

[Stefan T]

no tmps on EU roadsters luckily

I have no TPMS but after Power drop in 12V system VMS restared and i have hardwere fault and data error on TPMS
on my roadster, but i have get one posetive thing after the power drop the brake light work with regenrating brake too

And tesla kcan fix the problem but the want me go to Copenhagen but it is to far to drive with out manny houres of charging for get home

 

[scotty2541]

Overall the system never fails to set new lows in what I think of it.
I started a new thread, based on what just happened yesterday.

TMPS - Major Defect. Doubt Tesla will fix it...