Tesla pre-AP CAN bus layout

Pre-AP Model S has six standard CAN buses plus one EtherCAN bus. The Gateway ECU (GTW) sits in the middle, bridging all of them. Messages can travel between buses with the same ID or a rewritten ID depending on what GTW decides to forward.

Most messages carry a 4-bit rolling counter (mod 16) and either a byte-sum checksum or an SAE J1850 CRC — Tesla added these to catch bus errors and replay attacks. The counters are how you know a message is "live" vs. replayed.

The six buses

Chassis CAN

This is the bus NAP cares about most. It carries everything steering-related:

• EPAS — Electric Power Steering. Receives steering commands and reports back steering angle, torsion bar torque, hands-on torque level, and fault codes.
• SCCM / STW — Steering Column Control Module. This is where stalk actions come from: cruise stalk pulls, turn signal lever, high beam flash.
• GTW — the Gateway node on this bus, which routes messages to/from other buses.
• EPB — Electronic Parking Brake.
• PARK — Parking Assist sensors.
• TPMS — Tire Pressure Monitoring.
• TAS — Air Suspension (if equipped).

Pre-AP cars may or may not have Chassis CAN wired to OBD2 pins 1 and 9 depending on production date. Cars built before late May 2013 often lack those pins. See Connecting to the car for how to verify and fix this.

Powertrain CAN

Motor, battery, and charging electronics live here. NAP reads this bus for vehicle speed, gear position, pedal position, and brake state:

• DI — Drive Inverter (the main motor controller). Sends speed, torque, gear, and brake pedal state.
• BMS — Battery Management System.
• CHG / FC — Charging system.
• DCDC — DC-DC converter.
• PM / PMS — Pedal Module and Power Management.
• THC — Thermal Control.

Body CAN

Comfort and body electronics. NAP doesn't write here, but reads door states (used for safety disengages):

• DDM / PDM — Door controllers (driver/passenger).
• EFUSE — Electronic fuse controller.
• GTW — Gateway node.
• LFT — Liftgate.
• SEC — Security module.
• SUN — Sunroof (if equipped).
• TUNER — Radio/media head unit.

Body Fault-Tolerant CAN

A separate low-speed bus for safety-critical body functions that need to keep working even if the main Body CAN goes down:

• BCS — Body Control for Seats.
• MSM — Memory Seat Module.
• PTC — Positive Temperature Coefficient heater.
• RCCM — Remote Climate Control Module.

EtherCAN

UDP-based CAN encapsulation on port 20101, running between the Gateway, CID (center infotainment display), and IC (instrument cluster). NAP does not use this bus.

Diagnostic / CAN Bus port

Four buses accessible via a diagnostic connector located under the CID (you need to remove the panel below the screen to reach it). This port is the source for the Chassis CAN retrofit harness — if your OBD2 port pins 1 and 9 are unpopulated, this is where the retrofit wires tap in.

Which buses NAP uses

NAP runs on the Chassis CAN bus, accessed via the OBD2 port (pins 6/14 for the main Chassis CAN — or pins 1/9 for the secondary CAN pair that carries Chassis signals on post-May 2013 cars).

The Comma Pedal interceptor sits inline on the pedal harness and communicates on bus 0 or bus 2 (the wiring varies by install; NAP detects which one is live at startup).

Message IDs NAP cares about

Hex ID	Decimal	Name	Direction	Purpose
0x488	1160	DAS_steeringControl	TX (NAP → EPAS)	Steering angle request with counter + checksum
0x2B9	697	DAS_control	TX (NAP → GTW)	ACC state, set speed, acceleration limits
0x45	69	STW_ACTN_RQ	TX (NAP → GTW)	Stalk action spoof — used in no-pedal mode to engage/cancel stock CC
0x214	532	EPB_epasControl	TX (NAP → EPAS)	EPAS mode/power enable
0x370	880	EPAS_sysStatus	RX (EPAS → NAP)	Steering angle, hands-on level, fault codes, torsion bar torque
0x551	1361	GAS_COMMAND	TX (NAP → Pedal)	Throttle command to Comma Pedal interceptor
0x552	1362	GAS_SENSOR	RX (Pedal → NAP)	Pedal interceptor health + current gas sensor reading

DAS_steeringControl (0x488) is what actually moves the wheel. It carries a 15-bit steering angle request (0.1 deg/LSB, centered at −1638.35°), a control type field, and a byte-sum checksum + 4-bit counter that must be correct or EPAS ignores the message.

DAS_control (0x2B9) tells the car the ACC set speed and acceleration envelope. In no-pedal mode, this drives what the stock CC does via GTW forwarding.

STW_ACTN_RQ (0x45) is normally sent by the steering column module with the physical stalk position. In no-pedal mode, NAP spoofs this message to send a "pull down" or "cancel" stalk event to engage or disengage stock cruise — this is why no-pedal mode can engage CC without you physically pulling the stalk.

DBC file

NAP's full signal definitions live at opendbc_repo/opendbc/dbc/tesla_preap.dbc in the NAP repo. Load this file in cabana (see Cabana) to decode any message from a recorded drive.