I think there is no point in making a custom controller when everything works on its own. But I'll play with the can for a while.

tom91 wrote: ↑Thu Jun 05, 2025 4:14 pm I do not know if I would trust an evaporator to run as an condensor.

What's the danger? Will it burst? By the way, I found almost brand new VCFRONT from 2023 MY for $100. Maybe I'll take a chance and buy it.

What are you looking to use as condensor, one from an EV?

An evaporator from GMC cars. It's designed as a two-section one, like Tesla's, only smaller.

71Oi9nqR28L._AC_UF894,1000_QL80_DpWeblab_.jpg

I don’t have the opportunity to make a dual-zone climate control, so I don’t need one as huge ...

Also the radiator sizing will be key to this setup to be able to reject the heat from doing cabin AC.
The plan is to use as many components from M3/Y as possible: the radiator and hoses to it, possibly VCFRONT, to get the control as is. The only non-original parts are the condenser and cabin ...

After another googling and studying the Wim Boone's controller, I got some valuable information.

Screenshot from 2025-06-05 12-36-20.png
Screenshot from 2025-06-05 12-23-01.png
Screenshot from 2025-06-05 12-23-09.png

For water pumps, he uses bldc drivers with integrated FETs MCF8316 series ...

tom91 wrote: ↑Tue Jun 03, 2025 6:17 pm EXVs are steppers, 4 pole I believe.

Yes

In principle in the extreme case for summer you can just manually set EXVs LCC, Chiller and Evaporator to some average value and go for a ride. Yes, I understand that this is a redneck style 😁

I bought this system only because no one except Tesla has yet been able to make such a compact thermal ...

This your source? https://aircondlounge.com/how-tesla-heat-pump-works/

Yes

A little googling revealed that EXV control is fairly simple, but it need to figure out how much to open the valve. As I understand, the amount of passage is calculated based on feedback from the pressure sensor ...

First, I will show the main operating modes of the system.

Component introduction
component-introduction-1-1.jpg

Compressor as a heater
compressor-as-a-heater.jpg

Water cooled cooling
water-cooled-cooling.jpg

Ambient air source heating
ambient-air-source-heating.jpg

Battery system drive ...

You mean the work this guy did?

https://github.com/Wim426F/Superman-Firmware

Yes


The heatpump itself, the compressor is CAN. The rest of the sensors and actuators on the super manifold and such are all Analogue or direct controlled.

I am sure that it will not be difficult to run the ...

I have already seen that there were attempts to reverse engineer the heat pump system on the forum (seemingly successful, but this is not certain). Most likely, that guy is unlikely to share the nuances.

Therefore, I suggest that we unite and pick apart this miracle of technology. In particular, I ...

I have some Lin logs from my missus's e2008
From the heater and I believe a/c Lin bus this runs a 5kw eberspacher heater.
I started the log full hot I believe then full cold then full hot again. I did verify the heater hose were getting warm.

https://github.com/Gn1c3/Lin-E2008-Heater-a-c/tree ...

Just tested my assumptions, and they fit perfectly to the published data of the 0x229. It needs one table with 16 entries for the magic bytes, and for each direction an additional one-byte value. Available here: https://github.com/uhi22/tesla-crc
To be tested, whether this sufficient for the 0x229 ...

tg1929 wrote: ↑Fri Apr 04, 2025 1:35 am I found when simulating the 249 messages the car would respond to a minimum of 4 consecutive messages with correct cksums. did you find something similar?

Judging by the different logs, apparently even two valid frames are enough.

Which positions are possible? If there are only
- Idle
- Full Up
- Full down
- halve Up
- half down
- Park

No more positions.


I guess it is possible to calculate the crc using
1. A table with 16 entries ("Magic Bytes") and
2. A table with 5 "addon" XOR patterns.

In short, there is no way to ...

Frames crcFullUp:
0x229 0xA9 0x20 0x00
0x229 0xAB 0x21 0x00
0x229 0xBD 0x22 0x00
0x229 0x82 0x23 0x00
0x229 0xAC 0x24 0x00
0x229 0xAE 0x25 0x00
0x229 0x32 0x26 0x00
0x229 0x16 0x27 0x00
0x229 0xA3 0x28 0x00
0x229 0x4A 0x29 0x00
0x229 0x19 0x2A 0x00
0x229 0x63 0x2B 0x00
0x229 0xA6 0x2C 0x00
0x229 ...

uhi22 wrote: ↑Thu Apr 03, 2025 5:15 am We would need more data. The full counter range, and some more bits of the buttons.

Added more data.

If we would have more data (also changing some payload data it should be possible to reverse-engineer the algorithm.

Hey uhi22. Would you help to reverse the algorithm?

Frames crcCenter:
0x229 0x46 0x00 0x00
0x229 0x44 0x01 0x00
0x229 0x52 0x02 0x00
0x229 0x6D 0x03 0x00
0x229 0x43 0x04 0x00 ...

great work AMP3R, just to recap:

-stock M3/MY drive unit
-matching VCSEC (from the same vehicle)
-stock pedal
-vehicle CAN
-HVIL terminated


key card is not required? or key card is required to enable keyless driving?

Key card is not required. You can enable keyless driving via can and that's ...

ScythianNite wrote: ↑Tue Apr 01, 2025 11:36 pm so this setup requires an originally-paired inverter and VCSEC and canspoofing for the rest of the messages? (not to be reductive, just trying to parse through the posts so far)

Yes

Hi AMP3R, I am currently playing with generating Stalk messages and UI messages to test how the VCLeft, VCRight and VCFront modules interact in my model 3.
For example I simulated blinker commands by sending 0x249 messages with a cksum lookup based on a capture of successful messages from the ...

It works. Switches to D and R, but for some reason immediately returns to P. Also, a new alert DI_a125_noBatteryPower appeared.
Screenshot from 2025-03-30 16-11-04.png
Screenshot from 2025-03-30 16-11-21.png
Screenshot from 2025-03-30 16-11-39.png
Screenshot from 2025-03-30 16-19-22.png ...

A few days ago I had an idea to take another close look what the inverter sends to the vehicle CAN and after poking around found something interesting. It turns out that there are many more ids with alerts and errors than I thought. By simple calculations edited the dbc file and when turned on the ...

Great job!

So are you saying that if i record these 65536 challenge responses for a paired motor/VCSEC, then i could dump the motor firmware and flash it into another motor and the new motor should authenticate?


A small update for you. It's impossible to dump the inverter flash via CAN ...