Many cars, especially the smarter kind, have multiple CAN buses. A CAN bus is relatively low bandwidth by today's standards, so manufacturers have had to resort to splitting them up to increase effective utilization, (which also leads to its own problems when a device on Bus 1 needs to talk to a device on Bus 2).
I would expect this user-accessible (give-or-take the connector) bus is only the monitor/dashboard bus, to avoid possibly fucking up the timings on the more loaded and critical buses.
On many motorcycle brands the CAN bus solved the age old problem of buyers having to find same spots to splice into for accessory and lighting power. Now the CAN bus that controls runs separate from power making power take offs much easier and safer
They are - but they don't forward all messages. All gateways are configured in detail which signals should be forwarded from Bus A to B and which transformation functions should be applied.
This means you won't get access to any signal from any bus.
Yeah, I know of at least one company who spec'd their gateway module for something like 20% message bridging, but expanded use mean they're way beyond that and facing the limitations of their original design. :)
The physical connector is J1962, not the "OBDII" port. OBDII encompasses multiple network layers (datalink, physical, etc). Prior to the J1962 connector there were other physical connector allowed.
According to Wikipedia (and other research I did) "The OBD-II specification provides for a standardized hardware interface—the female 16-pin (2x8) J1962 connector." OBD-II mandates the J1962 connector, so I wasn't so much wrong as slightly vague. In my case, I was referring to the whole system, meaning the connector and what passes through it, so I lumped everything together under one moniker.
Thanks for pointing out the difference though. I'll update the Instructable to reflect that.
The Instructable is awesome, thanks for writing it up! Do you have a guess as to what higher-layer protocol Tesla uses (like CANOpen http://en.wikipedia.org/wiki/CANopen)? I used to work on devices with ECUs that communicated via j1939, and I'd be curious if Tesla uses a known standard on top of CAN, or their own thing.
No, thank you! I nearly hit the roof when I saw it had over 14K views on Instructables (I thought it was an April fools prank) when I checked earlier this evening. In fact it's now up to 16K+, thats 2K views in only a few hours, it took me 2+ weeks to get that kind of viewership when I originally posted it.
As for the protocol, so far Tesla isn't using much standard stuff, everything from the connector to the codes is proprietary, not surprising considering that they aren't starting from a legacy platform (like Chevy, Ford, Toyota). Frankly I'm more of a hardware guy then an infosec expert, so the communication protocols seem a bit abstract to me (got to do some more reading), however, from what I've gathered based on jobs postings and forum chatter on TMC (Tesla Motors Club) Tesla might have worked with Vector group to implement CANOpen, but thats purely speculation at this point.
If you are interested in helping decode the bus or getting a closer look at the protocols used, just let me know and I will send you an email with more details. Many hands make light work as they say.
I would be interested in taking a closer look, although I can't guarantee I'll have time to help decode. If you feel like it you can shoot me an email at the address in my profile! Thanks again.
In the automotive industry (at least among german OEMs which I'm familiar with) CanTP was used for bigger messages. I'm guessing that the Autosar Stack that is now commonly used incorporates that or a replacement for it. Don't know if Tesla uses Autosar, but it would make sense.
Aw man I read this and thought they were getting into public transportation.
Then I thought about it, and it seems feasible to me. Since the lines are predictable and buses tend to end up at the bus terminal we can just put a charging station there. Since we're doing hybrid buses anyway might as well go all the way?
If the Model S has all the sensors and actuators for automatic driving, those should be accessible. The cameras might not be on CANbus (it's too slow) but the brakes, steering, powertrain, and radars probably are.
I certainly hope those aren't accessible! That's safety-critical hardware, I don't want some overconfident geek messing up their car's driving systems.
Everything is accessible, it's just a question of how many layers of plastic you have to remove to get there. I wouldn't call the bus he found in this article user accessible but he still found it by removing some cover.
The fact that you can access the HV BMS directly is definitely concerning, but it's tough to make any comment on how big a security risk that is without poking around myself. That said, I really want to try this out with CANtact + CANard: http://cantact.io
Is anyone willing to lend me their Model S, possibly permanently?
I would expect this user-accessible (give-or-take the connector) bus is only the monitor/dashboard bus, to avoid possibly fucking up the timings on the more loaded and critical buses.