Search found 110 matches
- Fri Oct 29, 2021 1:33 am
- Forum: Inverters / Motor Controllers
- Topic: CANBUS Paameter Mapping
- Replies: 3
- Views: 1441
Re: CANBUS Paameter Mapping
Seems like you did everything right. Are you aware that everything is decimal including ID? From what I can tell, a lot of people are confused by that. I mean, other than DBC files I have never seen anyone specify CAN ids as decimal. It just feels sick and wrong. Is there any way that IDs on the pa...
- Mon Oct 25, 2021 1:26 am
- Forum: Tesla
- Topic: Tesla Model 3 Rear Drive Unit Hacking
- Replies: 639
- Views: 143867
Re: Tesla Model 3 Rear Drive Unit Hacking
The just replied to my YT comment - it is Tesla 2021 firmware. The not great thing about using the drive-train as-is is that Tesla can jam a stick in your spokes any time they'd like. I mean, once it's out of the car the firmware won't change. But, they are free to change the firmware to lock out t...
- Fri Oct 22, 2021 6:29 pm
- Forum: Tesla
- Topic: Tesla Model 3 Rear Drive Unit Hacking
- Replies: 639
- Views: 143867
Re: Tesla Model 3 Rear Drive Unit Hacking
And, the bootloader somehow knows where in flash to start executing after it is done so it's kind of tough to figure out where to start disassembling the main firmware at. I doubt this would be hard - the first thing the code will be doing is initialising registers,memory etc., and also, chances ar...
- Fri Oct 22, 2021 1:38 am
- Forum: Tesla
- Topic: Tesla Model 3 Rear Drive Unit Hacking
- Replies: 639
- Views: 143867
Re: Tesla Model 3 Rear Drive Unit Hacking
If 12 volts are lost at high speeds, then the power keys may break. Yeah, a lot of bad things might happen. The motor is, of course, permanent magnet so if power dies and the motor is rapidly spinning it will become a generator of hundreds of volts. Almost all of the alternatives are bad. If the mo...
- Fri Oct 22, 2021 1:26 am
- Forum: Tesla
- Topic: Tesla Model 3 Rear Drive Unit Hacking
- Replies: 639
- Views: 143867
Re: Tesla Model 3 Rear Drive Unit Hacking
I was thinking of a stragedy: Important is to catch the first few canbus messages of the M3 drive unit. They contain your actual software revisions. Bootloader and firmware versions. Then i think it would be good to be able to copy Elon SW to disc and after init of the chip make some screenshot of ...
- Tue Oct 19, 2021 12:57 am
- Forum: Tesla
- Topic: Tesla Model 3 Rear Drive Unit Hacking
- Replies: 639
- Views: 143867
Re: Tesla Model 3 Rear Drive Unit Hacking
Hello. It seems to me, there is a simpler option: Finished debugging 95 percent. The loader will try to post on this week. That's only simpler if you can find the mating connector and successfully crimp the pins. Damien's board is a MUCH easier solution for everyone else. Since he's tested it to wo...
- Sun Oct 17, 2021 1:30 am
- Forum: Tesla
- Topic: Tesla Model 3 Rear Drive Unit Hacking
- Replies: 639
- Views: 143867
Re: Tesla Model 3 Rear Drive Unit Hacking
If the moderator posts a video, then that will be good. I am also ready to answer questions about the program. !!! Otlichna! Horoshaya rabota! Really, that's awesome! I hope we can all work together to make Tesla parts a bit easier to work with. You said you wrote FOC code and we can see in the vid...
- Wed Oct 13, 2021 11:59 pm
- Forum: Tesla
- Topic: Model S motor controller JTAG Hijinks
- Replies: 4
- Views: 1191
Re: Model S motor controller JTAG Hijinks
As promised, I grabbed a Model S drive train controller and found my XDS110 and adapters. As luck would have it, the control board uses standard ARM 14 pin JTAG connectors. Yes, connectors because they used two separate C2000 chips and each has its own JTAG pins. The two TI chips are: TMS320F2811 (...
- Fri Oct 08, 2021 2:46 pm
- Forum: Tesla
- Topic: Model S motor controller JTAG Hijinks
- Replies: 4
- Views: 1191
Model S motor controller JTAG Hijinks
As promised, I grabbed a Model S drive train controller and found my XDS110 and adapters. As luck would have it, the control board uses standard ARM 14 pin JTAG connectors. Yes, connectors because they used two separate C2000 chips and each has its own JTAG pins. The two TI chips are: TMS320F2811 (l...
- Thu Oct 07, 2021 11:22 pm
- Forum: Tesla
- Topic: Tesla Instrument Cluster (IC) Center Display (CID/MCU) Retrofit
- Replies: 10
- Views: 2994
Re: Tesla Instrument Cluster (IC) Center Display (CID/MCU) Retrofit
I was wondering if there is any progress with these displays, it would be very interesting if these could be used. The answer is still the same basically. Both the IC and CID are linux computers. They use TEGRA processors which are ARM. So, you run linux ARM executables on them. Once you get to the...
- Thu Oct 07, 2021 3:18 pm
- Forum: Tesla
- Topic: Tesla Model 3 Rear Drive Unit Hacking
- Replies: 639
- Views: 143867
Re: Tesla Model 3 Rear Drive Unit Hacking
Call me ignorant but i think that those where code protected. Only the first versions of the boards had no security and that firmware is swirling around in certain groups. I might be wrong though. I think we should wait and see what the future brings. When we open more and more models of the drive-...
- Wed Oct 06, 2021 9:43 pm
- Forum: Tesla
- Topic: Tesla Model 3 Rear Drive Unit Hacking
- Replies: 639
- Views: 143867
Re: Tesla Model 3 Rear Drive Unit Hacking
Will everyone slap me if I bring up the fact that Model S/X drive trains use TI C2000 processors for motor control as well? I mean, if I were a daring man, I might suggest that supporting flashing the Model S drive train directly with OpenInverter firmware might also be pretty cool.
- Wed Oct 06, 2021 5:31 pm
- Forum: Tesla
- Topic: Tesla Model 3 Rear Drive Unit Hacking
- Replies: 639
- Views: 143867
Re: Tesla Model 3 Rear Drive Unit Hacking
You will find that in the recent master branch a lot of math has been ported to use float. Only the code that runs at 8.8 kHz retains fixed point math. Maybe that is somehow useful. I saw you were working on that. This will be very helpful! Just about to set about merging in your latest release. Th...
- Fri Sep 24, 2021 6:57 pm
- Forum: General
- Topic: CRC reverse engineering
- Replies: 3
- Views: 972
Re: CRC reverse engineering
I have no experience or knowledge about CRC yet but I have got a CAN log and I know that CRC is 16 bit CCITT. Where do I start as a novice? Maybe a stupid question but it's not clear to me - if a CAN message sent has a CRC value in it so a receiving device receives it and checks if its correct so w...
- Wed Aug 04, 2021 11:10 pm
- Forum: Getting Started
- Topic: Teensy Flexcan Canbus mailboxes
- Replies: 6
- Views: 2117
Re: Teensy Flexcan Canbus mailboxes
Exactly. I'm using the version straight from the Teensy installer, which I think is Paul Stoffregen's work. Here's the story: A long time ago I added to the FlexCAN driver by Pawelsky. This was for the Teensy 3.5/3.6 boards and it was... OK. It worked. It was included with the Teensy installer for ...
- Wed Aug 04, 2021 10:57 pm
- Forum: Ford
- Topic: Ford Azure dynamics DMOC 645 inverter
- Replies: 6
- Views: 5659
Re: Ford Azure dynamics DMOC 645 inverter
From the Ford transit connect or better Azure dynamics transit connect The parts do not come from the dismantled or damaged car, they have never been used and come from the Azure dynamics warehouse and as you might know the company does no longer exist.. Regulators claim also that controllers can c...
- Mon Jun 21, 2021 1:29 am
- Forum: Vehicle Control (VCU)
- Topic: ZombieVerter VCU Support
- Replies: 915
- Views: 507743
Re: ZombieVerter VCU Support
I would propose that a separate abstract class is developed for "vehicle" "charger" and "inverter", which has the basic interface for each of these objects. So it doesn't matter if it is a leaf or a Toyota inverter, they have the same interface to the vehicle logic. If...
- Tue Jun 15, 2021 11:21 pm
- Forum: Tesla
- Topic: Model 3 High Voltage Controller
- Replies: 188
- Views: 47787
Re: Model 3 High Voltage Controller
You have to look at the 2 byte binary, then you will understand how it works. 00 10 10 10 means everthing OK (2Ah) 00 01 10 10 means last value wrong, rest OK (1Ah) 00 10 01 10 means second value wrong, rest OK (26h) 00 01 01 01 means everytin wrong (15h) Yup, you're right. Each CAN message has thr...
- Thu Jun 10, 2021 12:42 am
- Forum: Tesla
- Topic: Tesla Large Drive Unit Support Thread
- Replies: 802
- Views: 138534
Re: Tesla Large Drive Unit Support Thread
IMG_20210609_233228.jpg The picture you labeled "optimal?" isn't. What you're show is A and A_BAR (Inverse of A). Dual channel encoders do not look like inverse image of each other. They look like the same signal A and B but displaced in time. Whether B leads or lags A tells you which dir...
- Fri May 28, 2021 10:35 pm
- Forum: Tesla
- Topic: Model 3 High Voltage Controller
- Replies: 188
- Views: 47787
Re: Model 3 High Voltage Controller
In one of the EVTV videos Collintalked about the BMS closed loop can have one break and it will continue working - the signals essentially being bidirectional. Was looking closer at my pack to see if I could source my issues and noticed one of the BMS plugs was damaged, probably when they split the...
- Wed May 26, 2021 10:28 pm
- Forum: Tesla
- Topic: Model 3 High Voltage Controller
- Replies: 188
- Views: 47787
Re: Model 3 High Voltage Controller
Nice work👍. Did you also do it manually? That is almost like the active balancing shuts off voltage measuring? Some of Damiens video about just the bms balancing, did he expect the active balancing to be around 250mA if i remember correctly?? If the voltage measuring happens during balancing there ...
- Tue May 25, 2021 10:40 pm
- Forum: Tesla
- Topic: Model 3 High Voltage Controller
- Replies: 188
- Views: 47787
Re: Model 3 High Voltage Controller
Wow thanks for great explanation👍😀 Just harvested all the cells voltage via canbus, 92 cells between 37,45 to 4,076 4 cells with 0,000volt, the last cellfrom each "batterypack". Total voltage with reference of canbus: 360vdc From my fluke 391vdc, verified with another fluke. Same result. ...
- Tue May 25, 2021 4:06 pm
- Forum: Tesla
- Topic: Model 3 High Voltage Controller
- Replies: 188
- Views: 47787
Re: Model 3 High Voltage Controller
Not really sure how to get the correct info of 0x332, even if your explanation was good. This is my recent readout from 0x332 approx 1 message/sec 0x332 DD 1F 00 00 14 2F 0X332 14 03 74 74 74 74 The message is multiplexed which is why you're getting such different data in the frame. It should look ...
- Mon May 24, 2021 11:21 pm
- Forum: Tesla
- Topic: Model 3 High Voltage Controller
- Replies: 188
- Views: 47787
Re: Model 3 High Voltage Controller
Latest capture of the vehicle CAN with the four modules connected up to make full pack and a second CAN capture with 0x500 introduced after approx 10 seconds for comparison. As Collin said, the two extra ID's do show up here too 240521 - TM3 HV Controller - Vehicle CAN - Full Pack Connected 0x500.c...
- Sun May 23, 2021 11:23 pm
- Forum: Tesla
- Topic: Model 3 High Voltage Controller
- Replies: 188
- Views: 47787
Re: Model 3 High Voltage Controller
Thax for amazing knowledge Collin :D Got a look at all the cells manually and it looks promising to be a healthy battery :) ID: 0x332 will be easy to use but i cant really see it in my log, closest item is 0x14A (0x330) would be grateful if you can look at my attached file :) It may not do a lot of...