Tesla Model 3 CAN Bus Logging and Data Analysis

Today, we’re discussing CAN (Controller Area Network) in Tesla vehicles. The Tesla Model S originally had an OBDII (On-Board Diagnostics II) connector, which was nearly useless for diagnostics. This connector was added mainly to comply with EPA regulations, although Tesla did once pay a $244,000 fine for not filing an EPA emissions test on an electric car – a surprising requirement, given that electric vehicles produce no emissions.

In the Model S (and possibly the Model X), there’s an OBDII port located near the steering column, but it doesn’t provide much useful information. The main CAN bus, which connects the car’s components and carries operational signals, is accessible via a diagnostic connector hidden under the center console screen. For six years, EVTV has been selling a CANDue device with a special connector for this diagnostics port. However, Tesla switched to a new connector in 2016, creating some confusion for users as there are now two versions, making it easy to order the wrong one.

The Tesla Model 3 lacks a similar CAN-based diagnostics port. Instead, it uses a unique connector on the left kick panel, which primarily supports low-speed Ethernet rather than CAN. This setup allows video routing and is mainly used by technicians for tasks like programming new key cards. However, while the Model 3 uses CAN for communication between the MCU (main control unit), battery, drive unit, and other components, finding a convenient access point for CAN data has been challenging.

EVTV has been exploring the Tesla Model 3’s CAN bus to learn more about the car’s operations, such as speed, RPM, steering angle, and throttle position. This data is essential for understanding and controlling core vehicle functions. While there are ways to access CAN by splicing into wires or using an inductive tool called the CAN Gator, finding a more accessible CAN access point is ideal.

Recently, EVTV identified a potential access point in the Model 3. This will allow further research into CAN messages and vehicle control. Exploring these messages may take years, but it’s valuable work for understanding the car’s operations.

In the meantime, EVTV continues to work on a controller for the Tesla Model S modules and expand on features like display integration and power-saving options.

There are a lot of small, frustrating things with the Tesla Model 3. One ongoing issue I have is with the garage door opener. Ideally, I should be able to open the garage door, get in the car, and drive off, and the door should automatically close. Sometimes, it works perfectly, but around one-third of the time, it doesn’t do anything, or it displays a notification saying it's closing the door, though the door doesn’t move.

This inconsistency might be due to a weak transmitter in the car. I can close the door using a BLE program on my phone, so it’s not an issue with the garage door itself. Sometimes, the car seems to forget its location via GPS, leading to more failures. However, let’s move on from my garage door troubles to a bigger topic: autopilot.

Elon Musk originally promised a coast-to-coast autopilot drive from California to New York by the end of 2017. In a recent earnings call, he revised this prediction, hoping to achieve it by the end of 2019. While Musk is optimistic about autopilot, I’ve been skeptical. Driving environments are highly variable, with countless edge cases that software alone can’t handle effectively.

For example, the other day I stopped when I saw a ball roll into the street, anticipating a child would follow. It turned out to be just the ball – no child – but this incident raised a question: would Tesla’s autopilot stop for a ball? And if it does, would it know when to resume driving if no child appears?

This highlights a challenge in artificial intelligence: handling the countless unique, unpredictable situations that can arise in real-world driving. AI, as it stands, is impressive for tasks like financial predictions or internet behavior analysis, but it’s more of an expert system than true intelligence.

In that same earnings call, Musk was careful to say that Tesla is years ahead of other companies in autopilot technology – and he’s right about that. However, I remain skeptical of how soon we’ll see truly reliable, fully autonomous driving.

Tesla has some of the best talent and incredibly powerful hardware. At one point, I almost started to believe in their autopilot technology. But I came to my senses—there's a lot of processing power there, but I have my doubts. Elon Musk recently emphasized that Tesla is years ahead of everyone else in autonomy. What I think he’s really saying is, “This is harder than I thought. I should have listened to the skeptics, but I’m committed to making it work. If I haven’t cracked it yet, trust me, the competition doesn’t stand a chance.”

Today, Amazon announced a partnership for autonomous driving, and Tesla stock took a hit at the thought of Jeff Bezos as a competitor. Musk has accomplishments in space, like launching satellites and servicing space stations, while Bezos’s space ventures haven’t reached the same level. Amazon’s interest in autonomy probably centers on delivery robots for packages, which fits their recent move to acquire 50 jumbo jets to compete with FedEx and UPS. That’s great, but it’s not a threat to Tesla, at least not anytime soon.

Switching gears, I have issues with some entry features in the Model 3. When my phone dies, or it’s raining, cold, and dark, getting the key card out and placing it on the black-on-black spot to unlock the door is frustrating. It’s not exactly a convenient or advanced feature.

Once inside, the card needs to be placed on a specific spot behind the cup holders in the console for the car to operate. The card doesn’t have electronics in it; it just has an ID that can be sensed through near-field radio. The reader is located just under the cup holder, which is very close for near-field purposes, but it’s awkward in practice.

Underneath that panel is a security control module. There are actually two of these modules in the car. This particular one connects via a 12-pin connector, which is hard to source. It has 12 volts, ground, and three CAN buses for Bluetooth Low Energy (BLE) devices around the car, which detect my phone and relay that information to the device. The main vehicle CAN bus also connects here. So, every time I get in the car with a cup of coffee, my hand is directly over this essential component, which is central to the car’s functionality.

Many people seem concerned about my health, but I assure you, drinking Dr. Pepper has been my secret to a long life. I also drink a lot of coffee, but Dr. Pepper is my go-to health drink.

Let’s get back to the Tesla project. Under my hand is a connector with the CAN bus that I’m specifically interested in. I got some connectors, but they’re so close together that you can’t even use a normal perf board for prototyping. I had to send one of the connectors to Colin so he could create a custom board that breaks out the 12 pins, allowing us to wire things more easily. This setup lets us insert our plug between the car’s original connector and the security control module, creating a man-in-the-middle device. We can then tap into the CAN high and CAN low wires we’re interested in using a two-pin connector.

For this project, we’re using an ESP32 CAN controller, which we’ve recently adopted for everything. It’s the same device we use in the controller for the Tesla Model S battery modules. The ESP32 CAN gives us wireless capability and significantly more processing power compared to older devices.

When I started in computers, I was dealing with the VAX 11/786, which did about 1 MIPS (million instructions per second) and cost around $550,000. This little ESP32 device, by comparison, does 600 MIPS, making it 600 times more powerful than that old VAX. It’s amazing how far technology has come!

Our new controller board has built-in Wi-Fi and BLE (Bluetooth Low Energy). We’re not using the BLE much, but we are using the Wi-Fi. We’ll put this board in a box, connect the CAN input to our controller, and find a good spot for the box in the car.

Dr. James Grosch, our recent addition to the team, will be helping us with this project. He’ll take a look at how to disassemble everything to make room for our box.

In this video, we’re going to get under the security control module, which is where you slide your Tesla key card to start the car. This module uses near-field radio (NFR) broadcasting at 17 GHz. To access it, first remove the leather cover near the armrest using a flathead screwdriver. This reveals seven Torx screws on each side (T15 size). You need to remove screws from both sides to fully access the module.

Once the screws are removed, you can pop out the four pins on the security module, exposing the 12-pin TE connector and the security control module where the key card is placed. Our plan is to use our ESP32 board and connect it to the Tesla TE connector with our own plug, then place our box neatly under the armrest. There’s a bit of storage space there, which should work perfectly for our setup.

We've found a solution for where to place our ESP32 box, which will go under a false bottom. First, you need to remove the plastic cover near the cup holders. There's a clip at the front to detach, followed by four Torx screws (the same T15 screws used on the sides). Once removed, this exposes the hole where the TE connector wire goes through, which is where we'll feed our wire to the connector.

With this setup, we'll be able to pull CAN data through a USB port, making it readable on a computer. This setup gives us access to the CAN traffic for the Model 3, and I'm working with James, Danu, and Richard on this project. Ideally, we want to develop a product that can be easily installed without damaging the car.

To make this more user-friendly, we’re using a program Colin developed, the ESP32 Reverse Engineering Tool. It works with the SavvyCAN CAN analysis program, which can run on Linux, Windows, or Mac. The idea is to eventually create a device that’s as easy to install as a plug-and-play OBD-II reader but specifically for the Tesla Model 3.

We’ll use a similar approach to the ELM327 OBD-II protocol, routing the CAN bus through an OBD-II connector so users could, for example, access real-time vehicle data on heads-up displays. This device should be easy enough for anyone to install without needing to call me for support!

Once installed, we can start capturing CAN data. Here’s the setup in detail:

The ESP32 in Action

We’ve placed the ESP32 CAN controller inside an enclosure and connected it to the security control module. Using the ESP32’s Wi-Fi capability, we can interface with it wirelessly, and I’m running a program Colin developed on GitHub, called ESP32 RAT (Reverse Analysis Tool). This program emulates ELM327 and adds wireless functionality.

Data Stream Capture

With this setup, we’re capturing a stream of CAN data at 500 kbps directly from the vehicle’s CAN bus. The ESP32 device connects at 1 Mbps, which is fast enough to keep up with the data flow.

Data Display and Analysis

The CAN data appears as a fast sequence of message IDs and data bytes in hexadecimal. Eventually, we’ll switch to binary data output and connect it to SavvyCAN for deeper analysis. SavvyCAN is a powerful tool that allows us to analyze values, message frequency, and visualize data.

Moving Forward

This initial setup allows us to tap into the Model 3’s CAN bus without needing an OBD-II port. Our goal is to create a hardware solution that’s easy to install and lets users capture CAN data without damaging their vehicles.

In the future, this device will support wireless transmission of CAN data, similar to OBD-II functionality, allowing connection with analysis programs on Android, iOS, and other platforms. This could open up vehicle data to users in new ways, such as through apps like Torque.

For now, we’ve made a man-in-the-middle device that works without disrupting the vehicle's operation, and we’ve successfully captured CAN data from one of our test Model 3s. It's been a productive week at EVTV!