Here’s a number that should have set off every alarm I built.
On June 29, my 2017 Model X’s battery management system reported its high-voltage isolation resistance at 50 kΩ — one tenth of the floor most monitoring treats as the healthy minimum. That’s the kind of reading that, taken at face value, says the insulation between 400 volts and the metal body you touch is failing. On a lot of monitoring setups, that’s a 2 a.m. push notification and a drive to the service center.
My monitor logged it, looked at it, and said nothing.
This is the story of why that silence is the most important feature I’ve built — and why a health monitor’s credibility is measured not by how many alarms it sends, but by whether you believe the one it finally does.
What isolation resistance actually is
In an electric car, something like 400 volts lives a few millimeters away from a metal shell you lean on every day. Isolation resistance is the measure of how well the high-voltage system is insulated from that chassis. High is good: the more resistance between the HV bus and the body, the less current could ever find a path through it — or through you.
Healthy readings live in the hundreds to thousands of kilo-ohms. If that number collapses toward zero, current can start leaking to the chassis: shock risk, and eventually the car throws its own isolation fault and limits power. This isn’t a vanity metric. It’s one of the genuine safety signals the battery management system watches, and it rides on the CAN bus in message 0x212, updated many times a second.
So it’s exactly the kind of signal a monitor should take seriously. Which is the whole problem.
Five months of a boring flat line
Before I can tell you why one reading didn’t matter, I have to show you what normal looks like. Here is the daily median isolation resistance on my car, every day from January through June:
That’s it. That’s the whole picture of a healthy high-voltage system: 5,160 kΩ, and it does not move. Day after day, the median lands on the same number, an order of magnitude above anything that would concern you.
There’s one exception, and it’s a nice piece of physics. The one time isolation resistance moves is when I drive — I measured it climbing to about 9,940 kΩ on the highway back in February. Isolation resistance breathes with operating condition; contactors close, the pack energizes differently, and the number shifts. That matters for a monitor, because a system that doesn’t know isolation is supposed to change between parked and driving will happily flag normal driving as a change worth a warning. Knowing what “normal” looks like in each state is half the job.
The one frame that dropped
Now the day in question. Here is every valid isolation reading my car logged on June 29:
The car took 789,272 valid isolation samples that day. Exactly one of them read 50 kΩ. At roughly nine readings per second, that single frame is 0.0001% of the day — here and gone in about a tenth of a second, with 789,271 perfectly healthy readings on either side of it. The daily median didn’t move a single kΩ.
This is what a sensor glitch looks like. Not a trend. Not a cluster. Not a slow slide toward the floor. One lonely dot, surrounded on all sides by a car that is completely fine.
What a naive monitor does here
A monitor built to collect “caught it!” screenshots fires on that dot. The reading is below the floor; sound the alarm; ship the notification.
Play that forward. The owner gets a fire-risk alert at 2 a.m., doesn’t sleep, drives to a service center, pays a diagnostic fee — and Tesla finds nothing, because there was nothing to find. Do that once and you’ve cost them a night and a bill. Do it twice and they mute you. A health monitor that cries wolf isn’t a safety feature. It’s noise with a logo, and the day it’s finally right, no one is listening.
The entire value of a monitor is that you believe it. Every false alarm spends trust you can’t easily earn back. So the engineering problem isn’t “how do we catch the 50 kΩ reading” — the car handed us that for free. The problem is “how do we know it doesn’t matter.”
The gate: alarm on a condition that holds, not a frame that dips
The answer is a rule about persistence. We don’t alarm on a reading. We alarm on a condition that stays true.
A genuine insulation fault does not fix itself in a tenth of a second. It persists — the resistance stays down, frame after frame, because the physical thing causing it is still there. So the rule is simple: isolation has to read below the floor for at least 20 consecutive samples — about two seconds — before it counts as real. One frame at 50 kΩ can’t clear that bar by definition. A real leak clears it easily.
That gate is the whole difference between a monitor you trust and one you mute.
And even clearing the gate doesn’t trigger a panic. The system moves through states, not straight to your lock screen: normal → observe → warn → alert, with a three-day clean-recovery buffer before anything resets. On June 29 it did exactly that — logged the frame, slipped into observe, watched, confirmed the glitch, and returned to normal. My phone never buzzed. That isn’t the monitor missing something. That’s the monitor working.
But how do you even know 5,160 is the right number?
A fair skeptic asks the harder question: why trust any of these readings? If your decode is wrong, a flat line at 5,160 is just a confidently-wrong number.
This is where isolation gets genuinely tricky, and it’s worth seeing. Message 0x212 doesn’t carry one clean isolation value — it multiplexes several internal states, and only one of them carries the stable insulation reading. Read the wrong state and you’ll pull ceiling values or transitional garbage into your “minimum” — and that, not any real fault, is how you manufacture a false leak alarm. The car is fine; your decoder is lying.
So we pinned the correct state empirically. It’s the one that makes up about 92% of frames and the one that sits rock-steady at 5,160 kΩ for five straight months; we cross-checked the decode against a second reference, and then let five months of physical self-consistency be the final referee. A number that stays put for half a year, moves the right way when you drive, and agrees with an independent decode is a number you’ve earned the right to trust.
Here’s the part I like: the 50 kΩ frame on June 29 was in the correct state. It wasn’t a decode artifact — it was a real reading of a momentary electrical blip. And it still didn’t earn an alarm, because one frame never does. We got the decode right so we could believe the number, and we built the gate so that believing the number never meant overreacting to it.
The restraint is the product
A monitoring system’s credibility is not measured by how many alarms it sends. It’s measured by whether you believe the one it finally does.
That reframes the whole job. Most of the engineering doesn’t go into detection — the car practically hands you the anomalies. It goes into the opposite problem: making very sure that when your phone finally buzzes, it means something. The flat line, the state filtering, the sustained-low gate, the observe-before-you-warn ladder — all of it exists to protect the value of a single future alert you haven’t received yet.
789,272 readings that day. One dropped below the floor. We didn’t send it.
That silence was the whole point.
This exact isolation logic runs live on my car. The garage shows the real daily readings, and how the monitor works walks through the alert ladder end to end. If you’re weighing a used Model S or X, the same read-the-data-before-you-trust-it discipline is what a pre-purchase inspection is for — reading someone else’s car once, before you inherit its surprises.