Search found 110 matches

by collin80
Fri Oct 29, 2021 1:33 am
Forum: Inverters / Motor Controllers
Topic: CANBUS Paameter Mapping
Replies: 3
Views: 1441

Re: CANBUS Paameter Mapping

Seems like you did everything right. Are you aware that everything is decimal including ID? From what I can tell, a lot of people are confused by that. I mean, other than DBC files I have never seen anyone specify CAN ids as decimal. It just feels sick and wrong. Is there any way that IDs on the pa...
by collin80
Mon Oct 25, 2021 1:26 am
Forum: Tesla
Topic: Tesla Model 3 Rear Drive Unit Hacking
Replies: 639
Views: 143867

Re: Tesla Model 3 Rear Drive Unit Hacking

The just replied to my YT comment - it is Tesla 2021 firmware. The not great thing about using the drive-train as-is is that Tesla can jam a stick in your spokes any time they'd like. I mean, once it's out of the car the firmware won't change. But, they are free to change the firmware to lock out t...
by collin80
Fri Oct 22, 2021 6:29 pm
Forum: Tesla
Topic: Tesla Model 3 Rear Drive Unit Hacking
Replies: 639
Views: 143867

Re: Tesla Model 3 Rear Drive Unit Hacking

And, the bootloader somehow knows where in flash to start executing after it is done so it's kind of tough to figure out where to start disassembling the main firmware at. I doubt this would be hard - the first thing the code will be doing is initialising registers,memory etc., and also, chances ar...
by collin80
Fri Oct 22, 2021 1:38 am
Forum: Tesla
Topic: Tesla Model 3 Rear Drive Unit Hacking
Replies: 639
Views: 143867

Re: Tesla Model 3 Rear Drive Unit Hacking

If 12 volts are lost at high speeds, then the power keys may break. Yeah, a lot of bad things might happen. The motor is, of course, permanent magnet so if power dies and the motor is rapidly spinning it will become a generator of hundreds of volts. Almost all of the alternatives are bad. If the mo...
by collin80
Fri Oct 22, 2021 1:26 am
Forum: Tesla
Topic: Tesla Model 3 Rear Drive Unit Hacking
Replies: 639
Views: 143867

Re: Tesla Model 3 Rear Drive Unit Hacking

I was thinking of a stragedy: Important is to catch the first few canbus messages of the M3 drive unit. They contain your actual software revisions. Bootloader and firmware versions. Then i think it would be good to be able to copy Elon SW to disc and after init of the chip make some screenshot of ...
by collin80
Tue Oct 19, 2021 12:57 am
Forum: Tesla
Topic: Tesla Model 3 Rear Drive Unit Hacking
Replies: 639
Views: 143867

Re: Tesla Model 3 Rear Drive Unit Hacking

Hello. It seems to me, there is a simpler option: Finished debugging 95 percent. The loader will try to post on this week. That's only simpler if you can find the mating connector and successfully crimp the pins. Damien's board is a MUCH easier solution for everyone else. Since he's tested it to wo...
by collin80
Sun Oct 17, 2021 1:30 am
Forum: Tesla
Topic: Tesla Model 3 Rear Drive Unit Hacking
Replies: 639
Views: 143867

Re: Tesla Model 3 Rear Drive Unit Hacking

If the moderator posts a video, then that will be good. I am also ready to answer questions about the program. !!! Otlichna! Horoshaya rabota! Really, that's awesome! I hope we can all work together to make Tesla parts a bit easier to work with. You said you wrote FOC code and we can see in the vid...
by collin80
Wed Oct 13, 2021 11:59 pm
Forum: Tesla
Topic: Model S motor controller JTAG Hijinks
Replies: 4
Views: 1191

Re: Model S motor controller JTAG Hijinks

As promised, I grabbed a Model S drive train controller and found my XDS110 and adapters. As luck would have it, the control board uses standard ARM 14 pin JTAG connectors. Yes, connectors because they used two separate C2000 chips and each has its own JTAG pins. The two TI chips are: TMS320F2811 (...
by collin80
Fri Oct 08, 2021 2:46 pm
Forum: Tesla
Topic: Model S motor controller JTAG Hijinks
Replies: 4
Views: 1191

Model S motor controller JTAG Hijinks

As promised, I grabbed a Model S drive train controller and found my XDS110 and adapters. As luck would have it, the control board uses standard ARM 14 pin JTAG connectors. Yes, connectors because they used two separate C2000 chips and each has its own JTAG pins. The two TI chips are: TMS320F2811 (l...
by collin80
Thu Oct 07, 2021 11:22 pm
Forum: Tesla
Topic: Tesla Instrument Cluster (IC) Center Display (CID/MCU) Retrofit
Replies: 10
Views: 2994

Re: Tesla Instrument Cluster (IC) Center Display (CID/MCU) Retrofit

I was wondering if there is any progress with these displays, it would be very interesting if these could be used. The answer is still the same basically. Both the IC and CID are linux computers. They use TEGRA processors which are ARM. So, you run linux ARM executables on them. Once you get to the...
by collin80
Thu Oct 07, 2021 3:18 pm
Forum: Tesla
Topic: Tesla Model 3 Rear Drive Unit Hacking
Replies: 639
Views: 143867

Re: Tesla Model 3 Rear Drive Unit Hacking

Call me ignorant but i think that those where code protected. Only the first versions of the boards had no security and that firmware is swirling around in certain groups. I might be wrong though. I think we should wait and see what the future brings. When we open more and more models of the drive-...
by collin80
Wed Oct 06, 2021 9:43 pm
Forum: Tesla
Topic: Tesla Model 3 Rear Drive Unit Hacking
Replies: 639
Views: 143867

Re: Tesla Model 3 Rear Drive Unit Hacking

Will everyone slap me if I bring up the fact that Model S/X drive trains use TI C2000 processors for motor control as well? I mean, if I were a daring man, I might suggest that supporting flashing the Model S drive train directly with OpenInverter firmware might also be pretty cool.
by collin80
Wed Oct 06, 2021 5:31 pm
Forum: Tesla
Topic: Tesla Model 3 Rear Drive Unit Hacking
Replies: 639
Views: 143867

Re: Tesla Model 3 Rear Drive Unit Hacking

You will find that in the recent master branch a lot of math has been ported to use float. Only the code that runs at 8.8 kHz retains fixed point math. Maybe that is somehow useful. I saw you were working on that. This will be very helpful! Just about to set about merging in your latest release. Th...
by collin80
Fri Sep 24, 2021 6:57 pm
Forum: General
Topic: CRC reverse engineering
Replies: 3
Views: 972

Re: CRC reverse engineering

I have no experience or knowledge about CRC yet but I have got a CAN log and I know that CRC is 16 bit CCITT. Where do I start as a novice? Maybe a stupid question but it's not clear to me - if a CAN message sent has a CRC value in it so a receiving device receives it and checks if its correct so w...
by collin80
Wed Aug 04, 2021 11:10 pm
Forum: Getting Started
Topic: Teensy Flexcan Canbus mailboxes
Replies: 6
Views: 2117

Re: Teensy Flexcan Canbus mailboxes

Exactly. I'm using the version straight from the Teensy installer, which I think is Paul Stoffregen's work. Here's the story: A long time ago I added to the FlexCAN driver by Pawelsky. This was for the Teensy 3.5/3.6 boards and it was... OK. It worked. It was included with the Teensy installer for ...
by collin80
Wed Aug 04, 2021 10:57 pm
Forum: Ford
Topic: Ford Azure dynamics DMOC 645 inverter
Replies: 6
Views: 5659

Re: Ford Azure dynamics DMOC 645 inverter

From the Ford transit connect or better Azure dynamics transit connect The parts do not come from the dismantled or damaged car, they have never been used and come from the Azure dynamics warehouse and as you might know the company does no longer exist.. Regulators claim also that controllers can c...
by collin80
Mon Jun 21, 2021 1:29 am
Forum: Vehicle Control (VCU)
Topic: ZombieVerter VCU Support
Replies: 915
Views: 507743

Re: ZombieVerter VCU Support

I would propose that a separate abstract class is developed for "vehicle" "charger" and "inverter", which has the basic interface for each of these objects. So it doesn't matter if it is a leaf or a Toyota inverter, they have the same interface to the vehicle logic. If...
by collin80
Tue Jun 15, 2021 11:21 pm
Forum: Tesla
Topic: Model 3 High Voltage Controller
Replies: 188
Views: 47787

Re: Model 3 High Voltage Controller

You have to look at the 2 byte binary, then you will understand how it works. 00 10 10 10 means everthing OK (2Ah) 00 01 10 10 means last value wrong, rest OK (1Ah) 00 10 01 10 means second value wrong, rest OK (26h) 00 01 01 01 means everytin wrong (15h) Yup, you're right. Each CAN message has thr...
by collin80
Thu Jun 10, 2021 12:42 am
Forum: Tesla
Topic: Tesla Large Drive Unit Support Thread
Replies: 802
Views: 138534

Re: Tesla Large Drive Unit Support Thread

IMG_20210609_233228.jpg The picture you labeled "optimal?" isn't. What you're show is A and A_BAR (Inverse of A). Dual channel encoders do not look like inverse image of each other. They look like the same signal A and B but displaced in time. Whether B leads or lags A tells you which dir...
by collin80
Fri May 28, 2021 10:35 pm
Forum: Tesla
Topic: Model 3 High Voltage Controller
Replies: 188
Views: 47787

Re: Model 3 High Voltage Controller

In one of the EVTV videos Collintalked about the BMS closed loop can have one break and it will continue working - the signals essentially being bidirectional. Was looking closer at my pack to see if I could source my issues and noticed one of the BMS plugs was damaged, probably when they split the...
by collin80
Wed May 26, 2021 10:28 pm
Forum: Tesla
Topic: Model 3 High Voltage Controller
Replies: 188
Views: 47787

Re: Model 3 High Voltage Controller

Nice work👍. Did you also do it manually? That is almost like the active balancing shuts off voltage measuring? Some of Damiens video about just the bms balancing, did he expect the active balancing to be around 250mA if i remember correctly?? If the voltage measuring happens during balancing there ...
by collin80
Tue May 25, 2021 10:40 pm
Forum: Tesla
Topic: Model 3 High Voltage Controller
Replies: 188
Views: 47787

Re: Model 3 High Voltage Controller

Wow thanks for great explanation👍😀 Just harvested all the cells voltage via canbus, 92 cells between 37,45 to 4,076 4 cells with 0,000volt, the last cellfrom each "batterypack". Total voltage with reference of canbus: 360vdc From my fluke 391vdc, verified with another fluke. Same result. ...
by collin80
Tue May 25, 2021 4:06 pm
Forum: Tesla
Topic: Model 3 High Voltage Controller
Replies: 188
Views: 47787

Re: Model 3 High Voltage Controller

Not really sure how to get the correct info of 0x332, even if your explanation was good. This is my recent readout from 0x332 approx 1 message/sec 0x332 DD 1F 00 00 14 2F 0X332 14 03 74 74 74 74 The message is multiplexed which is why you're getting such different data in the frame. It should look ...
by collin80
Mon May 24, 2021 11:21 pm
Forum: Tesla
Topic: Model 3 High Voltage Controller
Replies: 188
Views: 47787

Re: Model 3 High Voltage Controller

Latest capture of the vehicle CAN with the four modules connected up to make full pack and a second CAN capture with 0x500 introduced after approx 10 seconds for comparison. As Collin said, the two extra ID's do show up here too 240521 - TM3 HV Controller - Vehicle CAN - Full Pack Connected 0x500.c...
by collin80
Sun May 23, 2021 11:23 pm
Forum: Tesla
Topic: Model 3 High Voltage Controller
Replies: 188
Views: 47787

Re: Model 3 High Voltage Controller

Thax for amazing knowledge Collin :D Got a look at all the cells manually and it looks promising to be a healthy battery :) ID: 0x332 will be easy to use but i cant really see it in my log, closest item is 0x14A (0x330) would be grateful if you can look at my attached file :) It may not do a lot of...