Tesla M3 and Y ibooster gen2 hacking

[AMP3R]

I decided to create a topic about reverse engineering ibooster gen2 which is on the Tesla M3 and Y. Personally, I have from a 2022 M3. Today I was playing with Party CAN and discovered that ibooster reacts to three messages (0x38B, 0x38C, 0x38D) and goes into EXTERNAL_BRAKE_REQUEST status by moving the rod a little.

There is no DBC file for these messages anywhere and therefore I am asking for help in decrypting them. Let's figure it out together!

[AMP3R]

I don’t know how to calculate the checksum for messages, so I manually wrote a short log that puts the ibooster in the EXTERNAL_BRAKE_REQUEST state, but the push rod stays still.

I think all these 3 messages are related. Having changed at least one payload byte in any of them, ibooster remains silent.

ibooster EXTERNAL_BRAKE_REQUEST.csv

(2.21 KiB) Downloaded 252 times

[AMP3R]

I just googled and found out that the checksum algorithm is CRC_SAE_J1850.

I threw several messages from the log into the calculator and the checksum converged. I think now you can create any messages of your own and play with ibooster.

[AMP3R]

Played around with ibooster a little more and noticed one interesting thing. If you send message 0x38B (tried different data in bytes 2 and 3), and at the same time press the push rod, it held by the motor and returns to its original state only if you stop sending messages.

Perhaps this is some kind of firmware glitch. No idea. In short, I need can-bus logs from the car while driving in ACC mode.

[AMP3R]

Push rod is moving.

[alexbeatle]

Hello.
Does your ibooster fall asleep with a "failed" mode after 15+mins of inactivity? Mine seems to do so...
viewtopic.php?p=71415#p71415

[AMP3R]

Hello.
Does your ibooster fall asleep with a "failed" mode after 15+mins of inactivity? Mine seems to do so...
viewtopic.php?p=71415#p71415

Hey! I have never seen ibooster show me a fault status in savvycan. It laid on on my desk turned on for hours. Always had the status IBOOSTER_READY

[alexbeatle]

Is this on the YAW CAN bus or on the vehicle CAN bus?
How did you set it to external EXTERNAL_BRAKE_REQUEST? Trying to figure out how to set mine to LOCAL_BRAKE_REQUEST to possibly fix the failure. It goes into LOCAL_BRAKE_REQUEST when brake is pressed, but maybe needs to be maintained.

[AMP3R]

Is this on the YAW CAN bus or on the vehicle CAN bus?

YAW

[thibaultponcelet]

Push rod is moving.

Amazing job @AMP3R!
Would you mind sharing the trace you used to make it move?
From what I can see ibooster EXTERNAL_BRAKE_REQUEST.csv is valid but not requesting any braking.

I'm also busy reverse engineering the Ibooster Gen2 here: https://github.com/open-vehicle-control ... er/yaw.yml But I could not make it move yet.

Thanks!

[AMP3R]

Amazing job @AMP3R!
Would you mind sharing the trace you used to make it move?
From what I can see ibooster EXTERNAL_BRAKE_REQUEST.csv is valid but not requesting any braking.

I'm also busy reverse engineering the Ibooster Gen2 here: https://github.com/open-vehicle-control ... er/yaw.yml But I could not make it move yet.

Thanks!

Sorry, there was a little mistake. Play with a speed of this trace. All the messages should be around 10 ms.

ibooster EXTERNAL_BRAKE_REQUEST.csv

(2.21 KiB) Downloaded 122 times

[thibaultponcelet]

Thanks a lot!
Based on this trace we could actuate the ibooster with our code.

It seems that bytes 2 and 3 of frame 0x38C is controlling the flow rate (ml/s) of fluid sent into the baking system.
We did not find the scale and offset yet but 0x7e00 seems to be the zero point, applying more (up to 0x9200) is applying more brake and less (until 0x6A00) is releasing the brake.
Still have to find were the rod target (in mm) is sent in the frames sent by the ibooster and it will be possible to implement a PID algorithm.

Once we have everything working we will post a DBC and source code here.
Have a good day

[AMP3R]

Thanks a lot!
Based on this trace we could actuate the ibooster with our code.

It seems that bytes 2 and 3 of frame 0x38C is controlling the flow rate (ml/s) of fluid sent into the baking system.
We did not find the scale and offset yet but 0x7e00 seems to be the zero point, applying more (up to 0x9200) is applying more brake and less (until 0x6A00) is releasing the brake.
Still have to find were the rod target (in mm) is sent in the frames sent by the ibooster and it will be possible to implement a PID algorithm.

Once we have everything working we will post a DBC and source code here.
Have a good day

You are welcome. Together is easier to work.

[thibaultponcelet]

In case it could help someone, we published a DBC file for the I Booster Gen 2 (Tesla Model 3) here: https://github.com/open-vehicle-control ... n/ibooster
Our first implementation is working and allows to control the brakes and monitor them: https://github.com/open-vehicle-control ... er_gen2.ex

[KennyMillarSFX]

I'm new here
I would like to get an iBooster Gen 2 working fully autonomously - ie no input from the brake pedal, for a remote-drive project.
I've followed the conversation above, but some of the links are now dead.
Did anyone manage to get an iBooster working from CAN?
I can talk to the iBooster on the yaw can bus, and from what I can tell, sending it the right sort of values, but there's no physical response from the unit. Possibly due to the fault and faiure shown here:


Any ideas?

[KennyMillarSFX]

I figured out the issue - a bad connection between the pedal sensor (4-pin connector) and the main connector on the iBooster.
Now it's working as I expect.
However I can only get 21mm of travel out of it 'autonomously' -ie with no pedal input.
Anyone have any data on how to drive the full 40mm or so that it has?

[marcexec]

Hey guys,
I linked to this thread from https://openinverter.org/wiki/Bosch_iBooster. As you have the iBooster(s) on the bench, can you measure them when you have a chance and add the details in the table, similar to what we have for the Zoe and Yaris ones already?
Happy to help with any editing!

[Jacobsmess]

Hey guys,
I linked to this thread from https://openinverter.org/wiki/Bosch_iBooster. As you have the iBooster(s) on the bench, can you measure them when you have a chance and add the details in the table, similar to what we have for the Zoe and Yaris ones already?
Happy to help with any editing!

Just a quick thought but it would be useful for some to include the MC olt hole clocking and angle also I guess. As there may be some other MC options that would work for people.