TSLA
(→CAN Chip) |
(→CAN Chip) |
||
| 第146行： | 第146行： | ||
CAN 总线规范为 ISO11898。 | CAN 总线规范为 ISO11898。 | ||
| + | |||
| + | CAN 总线就两条连线，CAN_H 和 CAN_L，通常电压值为： CAN_H = 3.5V，CAN_L= 1.5V | ||
2023年7月14日 (五) 16:05的版本
目录 |
1 Overview
- CID (Central Information Display) – the large console at the centre of the dash
- IC (Instrument Cluster)
- Conventional CAN connected ECUs
CAN Buses:
- 1 – dedicated connection to diagnostic OBD-II port
- 2 – body – door, lights, mirrors
- 3 – powertrain – drive inverters, battery management system, charger, thermal controller（动力总成 – 驱动逆变器、电池管理系统、充电器、热控制器）
- 4 – body – climate control, seats
- There is no ‘5’ – although the hardware is present on the CID it is not used.
- 6 – chassis – suspension, instrument cluster, stability controller, power steering （底盘 – 悬架、仪表盘、稳定控制器、动力转向）
例如 Model S 的诊断口 (20pin)：
Model 3 & Y 诊断口：
26pin，右上 P1，左上 P14，右下 P15，P18(CanH), P19(CanL)
2 Model 3 CAN MSG
- Diagnostic Port & Data access
- https://github.com/joshwardell/model3dbc
- https://github.com/commaai/opendbc
$ git clone https://github.com/linux-can/can-utils.git $ cd can-utils/ && make && make install $ ip link set can0 type can bitrate 500000 listen-only on $ ifconfig can0 up # output all of the CAN messages (including errors) to your terminal: $ candump -cae can0,0:0,#FFFFFFFF (1423606588.555165) can0 00E#1E563FFF08FFA066 (1423606588.555434) can0 102#CA98F8FFEEFF (1423606588.555881) can0 202#845E6B9D00007102 (1423606588.556169) can0 6F2#1634B40D1D43C3D0 (1423606588.556193) can0 212#5800227400 (1423606588.556455) can0 23A#000B001200050000 (1423606588.556678) can0 21A#FE0000FE000000B7 (1423606588.556902) can0 222#0000DA98F01070 (1423606588.557139) can0 29A#0000FE0000000000 (1423606588.557481) can0 27A#292903DC092600 # log out all the data to a file in your current working directory (name like: candump-2023-02-10_221628.log $ candump -l any,0:0,#FFFFFFFF
3 DBC (CAN Databases)
DBC Message Format:
- A message starts with BO_ and the ID must be unique and in decimal (not hexadecimal)
- The DBC ID adds 3 extra bits for 29 bit CAN IDs to serve as an 'extended ID' flag
- The name must be unique, 1-32 characters and may contain [A-z], digits and underscores
- The length (DLC) must be an integer between 0 and 1785
- The sender is the name of the transmitting node, or Vector__XXX if no name is available
DBC Signal Format:
- Each message contains 1+ signals that start with SG_
- The name must be unique, 1-32 characters and may contain [A-z], digits and underscores
- The bit start counts from 0 and marks the start of the signal in the data payload
- The bit length is the signal length
- The @1 specifies that the byte order is little-endian/Intel (vs @0 for big-endian/Motorola)
- The + informs that the value type is unsigned (vs - for signed signals)
- The (scale,offset) values are used in the physical value linear equation (more below)
- The [min|max] and unit are optional meta information (they can e.g. be set to [0|0] and "")
- The receiver is the name of the receiving node (again, Vector__XXX is used as default)
- CAN DBC File - QuickStart
- Online DBC Editor
- https://github.com/joshwardell/model3dbc/blob/master/README.md
- https://github.com/commaai/opendbc
4 Tesla EDR
EDR: Event Data Recorder，汽车事件数据记录系统，用于记录车辆碰撞前、碰撞时、碰撞后三个阶段的汽车运行关键数据，包括速度、方向盘的转向角度、气囊状态、制动状态、加速踏板状态、ABS 状态等数据，能有效还原事故发生前后的真实状态，可视为 Tesla 的 “黑匣子”。
当系统检测到碰撞或类似碰撞的情況（例如撞到道路障碍物）时，EDR 会记录与车辆动力学和安全系统有关的数据。该数据存储在车辆的约束控制模块 (RCM) 中。Tesla Model S/X/3/Y 都有 RCM (Restraint Control Module)，在 Model 3 & Y 上，其位于中央扶手箱的底部。
记录的数据可以帮助调查人员更准确地还原事故原因。在正常行驶条件下，EDR不会记录数据；仅当车辆检测到异常事件时，才会记录事件数据。
官方读取工具软件： Tesla EDR https://edr.tesla.com
官方推荐 CAN 硬件：PCAN USB （不带隔离 IPEH-002021 € 188, 带隔离 IPEH-002022 € 228）Linux and PEAK-System's CAN Interfaces
官方连接线：Tesla Model 3 Direct-To Module EDR Retrieval Cable (Tesla part number 1492139) 约 $200
官方读取指南：https://edr.tesla.com/guides/CD-20-20-003_Model_3_EDR_Data_Retrieval_Guide.pdf
Hacking: https://www.teslaownersonline.com/threads/tesla-event-data-recorder-access-by-can.6175/page-2
标准：强制国标 GB 39732-2020 汽车事件数据记录系统, 美标 CFR-49-563
[《机动车运行安全技术条件》(GB7258-2017)]
5 Model 3 Display & MCU
6 CAN Chip
CAN (Controller Area Network)，即控制器局域网总线，是一种有效支持分布式控制或实时控制的串行通信网络。
广泛应用于工业现场控制、智能楼宇、医疗器械、交通工具以及传感器等领域。
CAN 总线规范为 ISO11898。
CAN 总线就两条连线，CAN_H 和 CAN_L，通常电压值为： CAN_H = 3.5V，CAN_L= 1.5V
MCP2515:
- 工作电压 2.7V ~ 5.5V
- 5mA 典型工作电流
7 CAN Tools
canutils 包含canconfig、canecho、cansend、candump、cansequence 五个命令，用于检测和监控 Socket CAN接口。
编译 canutils 依赖 libsocketcan， 可用 canutils-4.0.6 和 libsocketcan-0.0.12 版本。
- canutils：https://github.com/linux-can/can-utils Old: https://public.pengutronix.de/software/socket-can/canutils/
- libsocketcan：https://git.pengutronix.de/cgit/tools/libsocketcan https://public.pengutronix.de/software/libsocketcan/
如出现如下错误：
$ ifconfig can0 up ifconfig: SIOCSIFFLAGS: Invalid argument mcp251x spi1.0: bit-timing not yet defined mcp251x spi1.0: unable to set initial baudrate! $ ip link set can0 type can bitrate 125000 triple-sampling on
需要使用 iproute2 中的 ip 工具：
/buildroot-2020.11.2$ scp output/build/iproute2-5.7.0/ip/ip $ ip link set can0 type can bitrate 500000 listen-only on $ ifconfig can0 up $ candump -cae can0,0:0,#FFFFFFFF $ candump -l any,0:0,#FFFFFFFF
8 Reference
- Reverse Engineering Tesla Hardware
- Reverse Engineering the Tesla Firmware Update Process
- https://github.com/lewurm/blog/issues
- https://www.teslaownersonline.com/threads/diagnostic-port-and-data-access.7502/
- CANServer (ODBLink MX+)
- https://github.com/amund7/CANBUS-Analyzer
- Extracting internal vehicle data
- TeslaOBD
- Scan MY Tesla, TesLAX ...
- https://carprotool.com/forum/pinouts
