Tesla Cybertruck decoding

Topics concerning OEM and open source BMSes
Post Reply
evz
Posts: 6
Joined: Tue Jan 30, 2024 7:34 pm
Has thanked: 2 times

Tesla Cybertruck decoding

Post by evz »

Hello everyone!
I have an opportunity to start Tesla Cybertruck (Cyberbeast model) decoding soon with focus on BMS. I got a very contradictory information if the CyberTruck has CANbus at all.
Wiki says:
The Cybertruck uses a central, bi-directional gigabit Etherloop network with CAN bus satellite networks to operate vehicle systems. The result is that data travels over the same network, as opposed to traditional CAN bus systems which require individual connections, reducing the amount of wiring in the vehicle. Audio travels over the same network, eliminating the need for audio-specific wiring. For comparison, while the number of endpoints increased 50% over the Model 3, the amount of cross-vehicle wiring was reduced by two-thirds.
But also I found following opposite info in a different forum:
Unless things have changed, Tesla doesn't use the OBDII port for data/diagnostics. Also, the vehicle communication network doesn't use a traditional CAN bus so you would need an ethernet device to interface with the network to even start to attempt to decode network traffic. After that, it might be technically possible, but you would probably run into some kind of end-to-end message security that would prevent any tampering of message modifications. So in short, technically within the realm of possibility, but difficult for any normal user.
And:
Okay so it looks like newer Teslas do have an OBD port, but it's located in the center console rather than in the standard driver well location. These devices work by putting appropriate CAN messages/signals on the bus for the desired functionality. Say you want to open the glove box with one of these devices. Instead of hitting the glove box button, which is programmed to send put a signal on the bus to actuate the glovebox lock mechanism, this programmable button would send that signal, mimicking the built-in functionality.

The communication network on the Cybertruck is not CANbus based, but rather automotive ethernet based. Payload data could be similar/same from an ECU perspective, but rather than using CAN standards of communications, it's using IPs and MAC addresses. I haven't read, or there hasn't been a lot of details on exactly how Tesla is implementing it's ethernet communications, but it has been mentioned that it's a ring network (pathing redundancies) with zonal controllers. Again, you would need an ethernet interface device to rx/tx into the network, and all the relevant information regarding the rear and front steering messaging because not only would you have to emulate it, you would also have to prevent "normal" operation messages from rx/tx ing to and from those systems. Those types of messages are constantly being sent by their respective software stacks and sensors at very high frequencies. So from a non-Tesla implementation standpoint, in the realm of possibilities (in a lab) probably technically possible, but I would be impressed by any single engineer working out of their garage that could make the Cybertruck Crabwalk.

Seems that it makes no sense to start with OBD2 requests and probably I have to connect to wires with CAN-crocodile and read all messages flow. Also Cybertruck has a ring-topology wires which means I could find a correct pair of CAN-H/CAN-L wires at any ECU.

Another problem I noticed is that Cybertruck wires voltage is 48V, not 12V, and in theory it meant that any OBD loggers connected to OBD2 port will be damaged and broken. Link to news.

Based on that, I suggest to discuss following:
1. Is the Cybertruck really has no CANbus?
2. Is OBD2 port voltage supposed to be 48V as well as ethernet cabling?
3. If it has no CANbus (or not all needed signals in CANbus), does it make sense try to sniff ethernet traffic to decode it like CANbus? Any ideas/recommendations/concerns on that?
evz
Posts: 6
Joined: Tue Jan 30, 2024 7:34 pm
Has thanked: 2 times

Re: Tesla Cybertruck decoding

Post by evz »

2. We measured the OBD voltage, it's 15V when it is parked and moving, so no issues with loggers connecting.
User avatar
celeron55
Posts: 802
Joined: Thu Jul 04, 2019 3:04 pm
Location: Finland
Has thanked: 37 times
Been thanked: 133 times
Contact:

Re: Tesla Cybertruck decoding

Post by celeron55 »

I think the cybertruck has ethernet available at the OBD2 port, so at least for regular diagnostics you want an OBD2-ethernet adapter. Whether that allows you to do any reverse engineering, I don't know.

The etherloop bus runs between the front and rear of the vehicle but not into every module. It seems likely there are other buses (CAN or whatever) branching off from controllers that talk on the main bus.

On which bus the battery talks on is a good question.
User avatar
SuperV8
Posts: 157
Joined: Wed Mar 24, 2021 2:57 pm
Has thanked: 57 times
Been thanked: 12 times

Re: Tesla Cybertruck decoding

Post by SuperV8 »

Can't help on decoding - but just to say Cybertruck parts catalogue is now on:
https://epc.tesla.com/
ferbass
Posts: 1
Joined: Mon Dec 02, 2024 5:33 am

Re: Tesla Cybertruck decoding

Post by ferbass »

Hi @evz

Recently, I had the opportunity to use Cybertruck to study software and hardware architecture in my company, and I would like to share a few things with you, if not too late.

1. Is the Cybertruck really has no CANbus?
The etherloop connects all controllers over a Single-Twisted Pair Ethernet (Left, Right, MCU, Rear, HV Batt), but from those controllers to small controllers like Door Controllers, they still rely on CANBUS.
Here's a Tesla Diagram about Etherloop https://service.tesla.com/docs/Cybertru ... erloop.svg

2. Is OBD2 port voltage supposed to be 48V and ethernet cabling?
I have no answer for that one

3. If it has no CANbus (or not all needed signals in CANbus), does it make sense try to sniff ethernet traffic to decode it like CANbus? Any ideas/recommendations/concerns on that?
Under the console, there is a Ethernet RJ 45 connector that I couldn't make work; next to it, you have a Diagnostic CAN line you can connect to (https://service.tesla.com/docs/Cybertru ... A1180.html), but no Etherloop information on those lines.
The OBD2 port also has no Etherloop information.
So far, I have created a bridge between the Rear Controller and the Left Controller using two Media Converters, a four-port switch, and my computer with Wireshark to capture Etherloop information.
If you are interested, I can share some packets I have captured with you. So far, I couldn't make sense of the data; I can see the MacAddresses that identify the controllers and some extra information. I could identify some CANBUS frames in some packets, but I haven't identified any pattern so far.

Please let me know if you have found anything interesting on your end.

Cheers
Post Reply