I decided to create a topic about reverse engineering ibooster gen2 which is on the Tesla M3 and Y. Personally, I have from a 2022 M3. Today I was playing with Party CAN and discovered that ibooster reacts to three messages (0x38B, 0x38C, 0x38D) and goes into EXTERNAL_BRAKE_REQUEST status by moving the rod a little.
There is no DBC file for these messages anywhere and therefore I am asking for help in decrypting them. Let's figure it out together!
Re: Tesla M3 and Y ibooster gen2 hacking
Posted: Sat May 11, 2024 9:56 am
by AMP3R
I don’t know how to calculate the checksum for messages, so I manually wrote a short log that puts the ibooster in the EXTERNAL_BRAKE_REQUEST state, but the push rod stays still.
I think all these 3 messages are related. Having changed at least one payload byte in any of them, ibooster remains silent.
I just googled and found out that the checksum algorithm is CRC_SAE_J1850.
I threw several messages from the log into the calculator and the checksum converged. I think now you can create any messages of your own and play with ibooster.
Re: Tesla M3 and Y ibooster gen2 hacking
Posted: Sun May 12, 2024 6:57 pm
by AMP3R
Played around with ibooster a little more and noticed one interesting thing. If you send message 0x38B (tried different data in bytes 2 and 3), and at the same time press the push rod, it held by the motor and returns to its original state only if you stop sending messages.
Perhaps this is some kind of firmware glitch. No idea. In short, I need can-bus logs from the car while driving in ACC mode.
Re: Tesla M3 and Y ibooster gen2 hacking
Posted: Mon May 13, 2024 9:22 am
by AMP3R
Push rod is moving.
Re: Tesla M3 and Y ibooster gen2 hacking
Posted: Tue Jun 04, 2024 3:48 pm
by alexbeatle
Hello.
Does your ibooster fall asleep with a "failed" mode after 15+mins of inactivity? Mine seems to do so... viewtopic.php?p=71415#p71415
Re: Tesla M3 and Y ibooster gen2 hacking
Posted: Tue Jun 04, 2024 5:36 pm
by AMP3R
alexbeatle wrote: ↑Tue Jun 04, 2024 3:48 pm
Hello.
Does your ibooster fall asleep with a "failed" mode after 15+mins of inactivity? Mine seems to do so... viewtopic.php?p=71415#p71415
Hey! I have never seen ibooster show me a fault status in savvycan. It laid on on my desk turned on for hours. Always had the status IBOOSTER_READY
Re: Tesla M3 and Y ibooster gen2 hacking
Posted: Sun Jun 09, 2024 10:38 pm
by alexbeatle
Is this on the YAW CAN bus or on the vehicle CAN bus?
How did you set it to external EXTERNAL_BRAKE_REQUEST? Trying to figure out how to set mine to LOCAL_BRAKE_REQUEST to possibly fix the failure. It goes into LOCAL_BRAKE_REQUEST when brake is pressed, but maybe needs to be maintained.
Re: Tesla M3 and Y ibooster gen2 hacking
Posted: Mon Jun 10, 2024 8:06 am
by AMP3R
alexbeatle wrote: ↑Sun Jun 09, 2024 10:38 pm
Is this on the YAW CAN bus or on the vehicle CAN bus?
YAW
Re: Tesla M3 and Y ibooster gen2 hacking
Posted: Tue Jun 18, 2024 5:55 pm
by thibaultponcelet
AMP3R wrote: ↑Mon May 13, 2024 9:22 am
Push rod is moving.
Amazing job @AMP3R!
Would you mind sharing the trace you used to make it move?
From what I can see ibooster EXTERNAL_BRAKE_REQUEST.csv is valid but not requesting any braking.
thibaultponcelet wrote: ↑Tue Jun 18, 2024 5:55 pm
Amazing job @AMP3R!
Would you mind sharing the trace you used to make it move?
From what I can see ibooster EXTERNAL_BRAKE_REQUEST.csv is valid but not requesting any braking.
Thanks a lot!
Based on this trace we could actuate the ibooster with our code.
It seems that bytes 2 and 3 of frame 0x38C is controlling the flow rate (ml/s) of fluid sent into the baking system.
We did not find the scale and offset yet but 0x7e00 seems to be the zero point, applying more (up to 0x9200) is applying more brake and less (until 0x6A00) is releasing the brake.
Still have to find were the rod target (in mm) is sent in the frames sent by the ibooster and it will be possible to implement a PID algorithm.
Once we have everything working we will post a DBC and source code here.
Have a good day
Re: Tesla M3 and Y ibooster gen2 hacking
Posted: Thu Jun 20, 2024 2:57 pm
by AMP3R
thibaultponcelet wrote: ↑Thu Jun 20, 2024 10:29 am
Thanks a lot!
Based on this trace we could actuate the ibooster with our code.
It seems that bytes 2 and 3 of frame 0x38C is controlling the flow rate (ml/s) of fluid sent into the baking system.
We did not find the scale and offset yet but 0x7e00 seems to be the zero point, applying more (up to 0x9200) is applying more brake and less (until 0x6A00) is releasing the brake.
Still have to find were the rod target (in mm) is sent in the frames sent by the ibooster and it will be possible to implement a PID algorithm.
Once we have everything working we will post a DBC and source code here.
Have a good day
I'm new here
I would like to get an iBooster Gen 2 working fully autonomously - ie no input from the brake pedal, for a remote-drive project.
I've followed the conversation above, but some of the links are now dead.
Did anyone manage to get an iBooster working from CAN?
I can talk to the iBooster on the yaw can bus, and from what I can tell, sending it the right sort of values, but there's no physical response from the unit. Possibly due to the fault and faiure shown here:
Any ideas?
Re: Tesla M3 and Y ibooster gen2 hacking
Posted: Tue May 13, 2025 1:15 pm
by KennyMillarSFX
I figured out the issue - a bad connection between the pedal sensor (4-pin connector) and the main connector on the iBooster.
Now it's working as I expect.
However I can only get 21mm of travel out of it 'autonomously' -ie with no pedal input.
Anyone have any data on how to drive the full 40mm or so that it has?
Re: Tesla M3 and Y ibooster gen2 hacking
Posted: Thu May 15, 2025 11:05 am
by marcexec
Hey guys,
I linked to this thread from https://openinverter.org/wiki/Bosch_iBooster. As you have the iBooster(s) on the bench, can you measure them when you have a chance and add the details in the table, similar to what we have for the Zoe and Yaris ones already?
Happy to help with any editing!
Re: Tesla M3 and Y ibooster gen2 hacking
Posted: Thu May 15, 2025 3:30 pm
by Jacobsmess
marcexec wrote: ↑Thu May 15, 2025 11:05 am
Hey guys,
I linked to this thread from https://openinverter.org/wiki/Bosch_iBooster. As you have the iBooster(s) on the bench, can you measure them when you have a chance and add the details in the table, similar to what we have for the Zoe and Yaris ones already?
Happy to help with any editing!
Just a quick thought but it would be useful for some to include the MC bolt hole clocking and spacing also I guess. As there may be some other MC options that would work for people.
