Reverse Engineering a Tesla Battery Management System (Q&A)

Automotive security researcher Patrick Kiley answers questions regarding his project reverse engineering Tesla's high-voltage Battery Management System (BMS) to unlock additional power output and integrate pack components into custom electric vehicle conversions [00:11]. Kiley emphasizes the importance of hardware bench-testing and testbed prototyping when auditing hazardous high-voltage systems, noting that building a simulated bench environment using salvaged subcomponents was essential to safely exploring the vehicle architecture without risking catastrophic pack damage or vehicle bricking [05:34].

The Q&A details the internal communication protocols and electronic control unit (ECU) relationships within Tesla Model S and Model 3 battery architectures [15:34]. Kiley explains how the central vehicle gateway mediates updates, diagnostic commands, and CAN bus messaging between the powertrain, inverter, and the BMS slave boards (BMBs). He discusses the software locks and configuration gating Tesla employs to tier battery capacities and performance upgrades (such as Ludicrous Mode), detailing how altering vehicle configuration bits in gateway memory can alter performance limits [10:19].

Kiley also addresses the broader implications of working with salvage and aftermarket Tesla vehicles, including Tesla's server-side disabling of Supercharging access on salvage titles [25:24]. He discusses Tesla's formal vehicle security research program, bug bounty engagements, and the legal and warranty landscape surrounding automotive ECU reverse engineering and right-to-repair initiatives [20:36].

(AI summary — Gemini Flash)