Tesla Model 3 Battery Hacking

Topics concerning the Tesla front and rear drive unit drop-in board
tom91
Posts: 1275
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 204 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

Very well documented Damien, hats off. I gave up when the LTC6820 solution turned out to be a none starter, did not dig into why.

If they literally increased all the pulses by a factor of 2 I wonder if any of the SPI data still holds true. But then again reverse engineering it will still be possible.
Founder Volt Influx https://www.voltinflux.com/
User avatar
Kevin Sharpe
Posts: 1345
Joined: Fri Dec 14, 2018 9:24 pm
Location: Ireland and US
Been thanked: 4 times

Re: Tesla Model 3 Battery Hacking

Post by Kevin Sharpe »

Jack Bauer wrote: Mon Apr 13, 2020 7:41 pm The pulse widths are the issue.
OK, thanks for the clarification :)
This is a personal post and I disclaim all responsibility for any loss or damage which any person may suffer from reliance on the information and material in this post or any opinion, conclusion or recommendation in the information and material.
User avatar
Kevin Sharpe
Posts: 1345
Joined: Fri Dec 14, 2018 9:24 pm
Location: Ireland and US
Been thanked: 4 times

Re: Tesla Model 3 Battery Hacking

Post by Kevin Sharpe »

Tesla BMS connector cell count 8-)
Screenshot 2020-04-13 at 23.34.19.png
This is a personal post and I disclaim all responsibility for any loss or damage which any person may suffer from reliance on the information and material in this post or any opinion, conclusion or recommendation in the information and material.
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Got my little analog front end boards in from JLC. To my amazement they work:) We can now translate Musk-spi into 3.3v pulses ready to feed into an fpga or micro for decoding into data.
Attachments
decode1.jpg
decode2.jpg
decode3.jpg
decode4.jpg
decode5.jpg
decode6.jpg
decode7.jpg
2020-04-14 15.07.36.jpg
2020-04-14 15.54.36.jpg
2020-04-14 15.54.40.jpg
2020-04-14 15.59.21.jpg
I'm going to need a hacksaw
Leo Max
Posts: 10
Joined: Tue Apr 14, 2020 5:59 am
Location: Los Angeles

Re: Tesla Model 3 Battery Hacking

Post by Leo Max »

I now have a PACK 25S battery pack. Can I remove the original control board in the middle? Then connect a 25S third-party BMS to make it work?
Thank God! thank you!
User avatar
Kevin Sharpe
Posts: 1345
Joined: Fri Dec 14, 2018 9:24 pm
Location: Ireland and US
Been thanked: 4 times

Re: Tesla Model 3 Battery Hacking

Post by Kevin Sharpe »

Leo Max wrote: Thu Apr 16, 2020 8:18 pm Then connect a 25S third-party BMS to make it work?
You can do anything you want but whether it's a good idea is for you to decide ;)

If you want to discuss this further please start another thread so that we can focus on Model 3 battery hacking here.
This is a personal post and I disclaim all responsibility for any loss or damage which any person may suffer from reliance on the information and material in this post or any opinion, conclusion or recommendation in the information and material.
User avatar
johu
Site Admin
Posts: 5684
Joined: Thu Nov 08, 2018 10:52 pm
Location: Kassel/Germany
Has thanked: 153 times
Been thanked: 960 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by johu »

Am I late to the party?
Thought I'd post some ltspice goodness.

This should recover a true SPI data stream with clock, data and CS that can be processed by a standard SPI peripheral.
Attachments
chipselect.png
chipselect.png (5.67 KiB) Viewed 2738 times
recovered-data.png
recovered-clock.png
isospi-decoder.png
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
User avatar
johu
Site Admin
Posts: 5684
Joined: Thu Nov 08, 2018 10:52 pm
Location: Kassel/Germany
Has thanked: 153 times
Been thanked: 960 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by johu »

Delayed clock and removed OR gate
Attachments
isospi.asc.zip
(1.03 KiB) Downloaded 67 times
circuit.png
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Thanks Johannes. Building this will be fun:)
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Connector used on the board for the isospi is Molex Mini50 Series, 34912 Series Number, 1 Row 2 Way Surface Mount Plug PCB Header.
Black for BMB-A (batman)
Part number : 34912-8020
RS Stock No. 131-4729

Grey for BMB-B (robin)
Part number : 34912-8021
Mouser No: 538-34912-8021
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

New design transciever board in production at JLC. Based on a Xilinx Spartan 6 FPGA running at 100MHz. Ultimately will provide receive and transmit with spi and uart interfaces. Couple this up to Simpbms and we should be good to go:)

....ok I was going to put a vga port on it but I stopped myself :twisted:
Attachments
isospi_v2.png
I'm going to need a hacksaw
Leo Max
Posts: 10
Joined: Tue Apr 14, 2020 5:59 am
Location: Los Angeles

Re: Tesla Model 3 Battery Hacking

Post by Leo Max »

Jack Bauer wrote: Mon Apr 20, 2020 5:26 pm New design transciever board in production at JLC. Based on a Xilinx Spartan 6 FPGA running at 100MHz. Ultimately will provide receive and transmit with spi and uart interfaces. Couple this up to Simpbms and we should be good to go:)

....ok I was going to put a vga port on it but I stopped myself :twisted:
Does this mean I can buy this product within a month?
Thank God! thank you!
retrEVnoc
Posts: 33
Joined: Sun Aug 11, 2019 8:22 pm
Location: CA & OR, USA
Been thanked: 1 time

Re: Tesla Model 3 Battery Hacking

Post by retrEVnoc »

Well done JB / DM! Connects to the 2-wire connection from the module boards?
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Yeah will plug into the existing harness. Of course it probably won't work so don't get too excited just yet:)
I'm going to need a hacksaw
User avatar
Kevin Sharpe
Posts: 1345
Joined: Fri Dec 14, 2018 9:24 pm
Location: Ireland and US
Been thanked: 4 times

Re: Tesla Model 3 Battery Hacking

Post by Kevin Sharpe »

Jack Bauer wrote: Mon Apr 20, 2020 5:26 pm New design transciever board in production at JLC. Based on a Xilinx Spartan 6 FPGA running at 100MHz. Ultimately will provide receive and transmit with spi and uart interfaces.
This is fabulous :)

Can I suggest that you keep the FPGA design closed source and sell the PCB as a tested and supported product? We really do want to wave you off to Lanzarote one day ;)
This is a personal post and I disclaim all responsibility for any loss or damage which any person may suffer from reliance on the information and material in this post or any opinion, conclusion or recommendation in the information and material.
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: Tesla Model 3 Battery Hacking

Post by muehlpower »

Do you think i can rearrange the module as shown. The order of the boards remains, but the HV part is different. The reason for this is that I want to stack the short modules on top of the Long ones so that they fit between the frame rails.
rearange.png
User avatar
Kevin Sharpe
Posts: 1345
Joined: Fri Dec 14, 2018 9:24 pm
Location: Ireland and US
Been thanked: 4 times

Re: Tesla Model 3 Battery Hacking

Post by Kevin Sharpe »

muehlpower wrote: Thu Apr 23, 2020 8:49 am Do you think i can rearrange the module as shown.
We're not currently aware of any limitations that would prevent you from doing that :)
This is a personal post and I disclaim all responsibility for any loss or damage which any person may suffer from reliance on the information and material in this post or any opinion, conclusion or recommendation in the information and material.
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Getting close ...
Attachments
Capture2.PNG
I'm going to need a hacksaw
tom91
Posts: 1275
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 204 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

Nice, any way of grabbing SPI data logs? So we can start looking at doing some decoding.

These simulated or done on actual hardware?
Founder Volt Influx https://www.voltinflux.com/
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Thats a simulation on Xilinx ISE. Hope to start actual hardware tests next week. Once proven any data logger like a Saleae or Analog discovery can connect to the spi or uart ports on the board and grab data. Initial release will be receive only. If it works out on the bench I'll pop one in the post to you Tom.
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

First tests with the Spartan 6 FPGA. Looks like we can detect the long pulses in order to decode CS. Now onto clk and data.
Attachments
2020-04-28 13.44.28.jpg
2020-04-28 13.44.43.jpg
scope_10.jpg
scope_9.jpg
scope_8.jpg
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

New board just arrived from JLCPCB.
Attachments
2020-05-08 15.25.00.jpg
2020-05-08 15.24.31.jpg
I'm going to need a hacksaw
mike77cos
Posts: 26
Joined: Mon Oct 14, 2019 6:29 am
Location: Cornwall
Has thanked: 1 time

Re: Tesla Model 3 Battery Hacking

Post by mike77cos »

I can't wait to see how you get on with it 😍
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Good news is our new pcbs with the Xilinx FPGA onboard work a treat.
Attachments
2020-05-17 10.07.07.jpg
2020-05-17 10.12.08.jpg
I'm going to need a hacksaw
retrEVnoc
Posts: 33
Joined: Sun Aug 11, 2019 8:22 pm
Location: CA & OR, USA
Been thanked: 1 time

Re: Tesla Model 3 Battery Hacking

Post by retrEVnoc »

Do your boards work with each battery module board, or require the main Model3 BMS?
Post Reply