Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register
  • Want to remove ads? Register an account and login to see fewer ads, and become a Supporting Member to remove almost all ads.
  • The final cut of TMC Podcast #27 is available now with topics time-stamped. We discussed: Consolidation in LiDAR manufacturers; Volvo EX90 shipping with LiDAR; FSD Beta Full Release in N.A.; FSD detecting autopilot cheats, Gwen Shotwell directly overseeing SpaceX Starship; and more. You can watch it now on YouTube. We should have it published to podcast networks shortly.

TPMS disable / delete on Model S 2012 to late 2014 "Baolong"

jammi

12/2013 Model S P85
Nov 25, 2021
11
6
Finland
Hello, this is a topic about disabling TPMS or producing a fake signal to fake "always good" TPMS info on CANBUS.

This is not a topic about US legal implications or legal implications in the other areas where TPMS is required by law, so please don't sidetrack this with that.
At least Finland, Canada and Sweden are confirmed as countries without TPMS requirements.

There are also other topics for discussing replacing TPMS sensors and/or topics about upgrading the system from Baolong to Continental, so please don't sidetrack with that either.

I'm creating this new thread since the other topics on this subject were long ago in the Roadster forums and they're pretty much buried and/or sidetracked. Apparently, the 2008-2012 Roadster does use the exact same Baolong system, though. The location of the module is different though.

I have a late 2013 Model S with the Baolong system, and since TPMS is not a legal requirement in Finland, TPMS is just purely a continuous source of unnecessary problems. Therefore, I'd rather have it deleted from my car. Tesla however won't co-operate regarding such service requests, and I don't want to invest in the Continental system either, because it'd just be another money pit, gets pretty expensive with all 8 required TPMS sensors and tire work for 8 wheels (we are required to have a set of winter and summer tires and to use them in the corresponding seasons).

So, according to my research notes on this forum, the Baolong box uses something called LIN for communicating with the front and back antenna computer modules (they work on a 3-wire principle of proprietary serial over a single wire, and +12V and GND). This could just be some dumb 9600N1 serial data indicated by the fourth unused wire which is apparently unused in this application.

The data they send to the Baolong box resembles raw TPMS sensor data, including unique sensor IDs, and of course pressure and temperature. Faking this would mean leaving the ageing Baolong box itself in the car, which isn't desirable. It's also more complex to fake than the CANBUS signal the Baolong box sends forward.

This is the pin-out of the relevant pins of the Baolong box itself:
1: GND 2: +12V ("ignition" power) 15: CAN Hi 31: CAN Lo 5: K-Line (to the OBD-II connector) 20: RS-232 Rx (to the OBD-II connector) 21: RS-232 Tx (to the OBD-II connector) 17: Front antenna +12V 22: Front antenna GND 18: Front antenna LIN (serial) 16: Rear antenna +12V 14: Rear antenna GND 30: Rear antenna LIN (serial)

So, the relevant pins of the Baolong box are the pins 15 and 31, they'll need to be disconnected and the replacement box needs to produce a similar signal on CANBUS. The ODB-II wires and antennas can be ignored, either spend the effort to remove them completely, cut them or whatever. Regardless, we can't have the original box producing conflicting CAN signals.

So, this brings us to my notes on the CAN protocol:

The signalling is at a 1 MHz rate and the update interval is roughly one second. The Baolong box writes data to addresses 0x343, 0x344 and 0x345, all three of them in subsequent order. It's unclear how much the rest of the Tesla software cares about these values. At least they seem to ignore the tire pressure and tire temperature altogether unlike the Continental upgrade present on all Teslas from mid-September 2014 onward.

I'm using the convention of describing each CAN address as 64 bits arranged in 8 bytes named B1, B2, B3, B4, B5, B6, B7 and B8 from the most significant (or leftmost) byte onward. Each value is presented as hexadecimal unless indicated otherwise.

The order of wheels in the data (left to right) seems to be: front left, front right, rear left, and rear right.

On address 0x343, the important bytes are:
- B8, where the highest 4 bits (high nibble) are each wheel's "OK" status in order. 1=ok, 0=error. Therefore, 0xf0 (0b11110000) means every wheel's senor is ok and present.
- B7, which seems to always be 0x20.
- B6, which is 0x01, when no sensors are detected, 0x02 when some sensors are detected and 0x0a when all sensors are detected.
- B3, which is 0x04, when all sensors are detected and 0x00, when no sensors are detected.
- The rest of the bytes are always 0x00.

At address 0x344, we have pressure and temperature, each as a byte for each wheel. Therefore two bytes per wheel and eight bytes total. The pressure value seems to be 45 PSI * 2.755 (45 PSI is 3.1). Therefore, the ideal value would be 0x7C. Temperature seems to be reported in °C but offset by 40, which means the value 0x00 is -40°C and 0x28 would be 0°C and 0x3c would be 20°C. Therefore the value of 0x3c would be regarded as ideal.

Lastly, we have 0x345, where all the bytes are 0x00 when there's an error and B2 is 0x22 when everything is ok. It's possible the Tesla MCU only reads this value, ignoring everything else, but verifying this might need experimentation. At least their primitive level of "error" vs "no error" in the MCU notifications would indicate something of this sort. Otherwise, they'd have built a similar UI to the Continental system to support Baolong-equipped cars.

Therefore, we have this ideal CAN package table to send at 1Hz intervals to CANBUS:

Address B1 B2 B3 B4 B5 B6 B7 B8 0x343 00 00 04 00 00 0A 20 F0 0x344 7C 3C 7C 3C 7C 3C 7C 3C 0x345 00 22 00 00 00 00 00 00

That's likely all there is to it in theory. Now, for the practice, I haven't even found where the Baolong box is located, except Tesla's upgrade instructions say it's under the third wind deflector, apparently meaning the bottom shield plate at the rear of the car.

I have also never written any CANBUS code and never connected any device on CANBUS. However, I understand its principles, I'm familiar with software development including embedded code, and I have CAN-capable microcontroller development boards including STM32 Bluepill and STM32 Nucleo boards. I'll need to buy some CAN transceiver chips however to have a working circuit. I have plenty of tools including oscilloscopes, power supplies and very good soldering equipment among other things.

Therefore, please help me with achieving this first-level goal if you can, and let's make this an open source project. It could expand into something that helps people who have to keep their TPMS system in place, helping them troubleshoot what's wrong by for instance producing an auxiliary display to read from CAN the status, temperature and pressure of each wheel detected and to indicate which of the error bytes have a non-OK value. This information would be trivial to fit on an HD44780 LCD. However, reading this information is already possible on OMVS and their fancy $100 box and mobile application.
 
Last edited:

jammi

12/2013 Model S P85
Nov 25, 2021
11
6
Finland
There's valuable information in for instance this thread and especially this summarized thread, on the Roadster side and this old post on the Model S side that brought me to this forum thanks to its google search hit, although I had registered the account earlier. @scotty2541 has basically done most of the real research work I in my turn summarized in the start message.
 
Last edited:
There's valuable information in for instance this thread and especially this summarized thread, on the Roadster side and this old post on the Model S side that brought me to this forum thanks to its google search hit, although I had registered the account earlier. @scotty2541 has basically done most of the real research work I in my turn summarized in the start message.
Also, the OVMS project has something that can fake the TPMS messages on the CAN bus. It would be likely the entire Balong unit could be removed and the OVMS unit just send fake messages.

 

jammi

12/2013 Model S P85
Nov 25, 2021
11
6
Finland
Also, the OVMS project has something that can fake the TPMS messages on the CAN bus. It would be likely the entire Balong unit could be removed and the OVMS unit just send fake messages.
Ok, I'll have to research that. Didn't see anything of the sort mentioned but it might be undocumented features or something in some certain fork of it only.
 

hcsharp

Active Member
Jun 7, 2011
3,480
1,598
Vermont
Apparently, the 2008-2012 Roadster does use the exact same Baolong system, though. The location of the module is different though.
Nit picking but Tesla started using the Baolong system in the 2.0 and 2.5 versions of the Roadster, not the 1.5 . So OVMS configured for a 1.5, and other solutions for the 1.5 Roadsters won’t help you with the Model S.

Ok, I'll have to research that. Didn't see anything of the sort mentioned but it might be undocumented features or something in some certain fork of it only.
The OVMS experts know a lot more about this than I do but there’s a lot of discussion about it in the Roadster OVMS threads.
 

markwj

Asia Pacific
Moderator
Apr 10, 2011
4,671
1,372
Hong Kong
You will find this post from the OVMS Developers Mailing List, July 2020, interesting:

TPMS subsystem, Roadster, Model S, Baolong, and some UDS hacking/cracking


Back then, I too was told that the early Model S and 2.x Roadster TPMS systems were 'the same'. They aren't. The only thing in common is the supplier Baolong (who, based on my experience with corresponding with them, go by the emoticon 🤐). My car (a 2014 Model S) uses a Baolong ECU, and can’t display the tyre pressures or temperatures. It is a simpler system than the roadster, with just one ECU, one CAN bus connection, no k-line, no Lin bus, and no external antennas. Also about US$40 (or cheaper) on eBay :)

The manufacturer uses UDS Security authentication to protect writes, but implements it with a trivial protection scheme that took less than a night to break. At the time, it did make me wonder what is the point of even attempting to add a security layer so trivially easy to crack, and I I did consider commissioning a T shirt with the slogan "OR R, AND r".

The focus of that work was (a) to be able to write tyre sensor IDs to the Baolong ECU, and (b) to be able to display tyre pressures and temperatures on OVMS. Both goals were achieved, and in the public OVMS firmware today. I consider Baolong Model S TPMS a solved problem.

If I had a problem with mine, I would either swap out the sensors with bad batteries, or the ECU (both reasonably priced) - as I do consider TPMS a useful feature. But for me it has been rock-solid for 8 years now. I haven't looked much at spoofing the ECU signals, but given the above write-up, availability of cheap units for bench testing, and public disclosure of TPMS messages, it should not be difficult. A small javascript plugin to OVMS could output the required values. Alternatively, a small CAN bus device could do it relatively simply.

There are plenty of documents (DBCs, etc) on the Model S CAN bus out there, and they cover the basic TPMS messages. Brianman's Tesla Model S DBC is comprehensive, and covers TPMS, but I think only Continental messages, not Baolong. Not sure what you would need to spoof to keep the car happy, but I don't think it would be hard. Your 0x343 message is for the Roadster - on Model S Baolong it is 0x31f.

One starting point is the open source OVMS vehicle support module for the Tesla Model S:

OVMS Tesla Model S vehicle support code
 
Last edited:

About Us

Formed in 2006, Tesla Motors Club (TMC) was the first independent online Tesla community. Today it remains the largest and most dynamic community of Tesla enthusiasts. Learn more.

Do you value your experience at TMC? Consider becoming a Supporting Member of Tesla Motors Club. As a thank you for your contribution, you'll get nearly no ads in the Community and Groups sections. Additional perks are available depending on the level of contribution. Please visit the Account Upgrades page for more details.


SUPPORT TMC
Top