Tesla Model 3 Battery Hacking

[Jack Bauer]

First tests with the Spartan 6 FPGA. Looks like we can detect the long pulses in order to decode CS. Now onto clk and data.

[Jack Bauer]

New board just arrived from JLCPCB.

[mike77cos]

I can't wait to see how you get on with it

[Jack Bauer]

Good news is our new pcbs with the Xilinx FPGA onboard work a treat.

[retrEVnoc]

Do your boards work with each battery module board, or require the main Model3 BMS?

[Kevin Sharpe]

Do your boards work with each battery module board, or require the main Model3 BMS?

Damien's board generates the Tesla version of the isoSPI bus that connects the battery modules. It's possible this hardware will be enough to implement the BMS functionality but we just don't know today.

[Jack Bauer]

[Kevin Sharpe]

Another great video Damien

You say in the video that you are not sure what you are going to do with this development. My advice is to sell the board as a closed source, tested and supported solution that simply converts isoSPI to SPI and nothing else. Basically a board that does one thing really, really well.

You are entitled to make a financial return for your efforts and I have no doubt that you'll end up using the funds to undertake even more open source projects that we all benefit from

[Jack Bauer]

Time for a little update on the M3 BMS isospi board development.

As of today we have successful decode of the Tesla variant iso spi into normal spi that can be read by a (fast!) microcontroller. When connected to just one slave the data rate is very fast. There is just enough block ram in the fpga to buffer it so I'm leaning towards having to put some external fast ram on the board once we get talking to a full pack.

Work on transmission has now commenced so once we get something running on the bench I'll make a video.

[MattsAwesomeStuff]

I have nothing useful to say, other than general praise and excitement at yet another milestone being achieved. Great work.

[Jack Bauer]

New Keysight scope purchased with Patreon donations. Now I can get back to work on the Tesla Model 3 BMS. Lack of a 4 channel fast DSO with SPI decode meant this project has been on hold since I had to give back the demo unit. As I don't get any sponsorship, things like this need to be purchased at normal price so delays happen. Thanks to the kind assistance of those on Patreon (and elsewhere) we can get back to hacking and publish a beta design for the M3 bms decoder.

[Isaac96]

I hope you take that with you to Lanzarote

[mdrobnak]

Are the PC based DAQs not good for this sort of thing? (PicoScope I think is one of the more well known ones)
-Matt

[Jack Bauer]

Lots of options out there. My experience with pc based scopes is that unless you get a good one (expensive) and a good pc (expensive) then its no use. Plus I prefer to have physical buttons to push:)

[retrEVnoc]

I have nothing useful to say, other than general praise and excitement at yet another milestone being achieved. Great work.

Same here, great work Damien, please unlock these awesome batteries for everyone!! Heading to your Patreon now...

[Ken_S]

I thought I would share this here, as an aside replying to the prior discussions about using edge connectors with the flex pcb cables on these modules. This is a photo of a partial solution, tested on a spare flex PCB from eBay.

As excited as I am following the developments towards decoding the Tesla model 3 BMS, my final pack assembly is happening in the next month, and therefore I am going with an off the shelf BMS... in order to simplify the wiring process I have been searching for a solution for connecting to the flex PCBs directly, and this is what settled on.

The blue connector is an Amphenol Flat Flex Connector (digikey PN 609-2193-ND). The contact is ideal, a very secure flat crimp insulation piercing design, but they are only available in 2.54 mm spacing connectors, while the Tesla flex PCB is 3.5 mm spacing. Therefore my plan is to remove the contacts from the connector and solder the pins into a PCB laid out for the correct spacing, designed to connect the flex PCB pads to a board mount connector for the BMS cell tap wires. The PCB will slide in behind the flex cable and provide a rigid backing for carefully crimping each contact.

Hopefully this helps someone! When I finish the pcb layout and test the boards, I will post the eagle and gerber files online somewhere to share them.

[muehlpower]

I would prefer to solder additional cables to the original board to use any BMS. Later, when the BMS has hacked, you can remove the cables and reactivate the tesla boards.

[Kevin Sharpe]

I am going with an off the shelf BMS...

I would prefer to solder additional cables to the original board to use any BMS

Not a topic for this thread but be extremely careful with "off the shelf" BMS systems and Tesla batteries. We have seen several examples of destroyed modules and very poor support by a 'reputable' supplier.

If you wish to discuss further then the BMS sub forum is the place to post;

viewforum.php?f=13

[Ken_S]

I am going with an off the shelf BMS...

I would prefer to solder additional cables to the original board to use any BMS

Not a topic for this thread but be extremely careful with "off the shelf" BMS systems and Tesla batteries. We have seen several examples of destroyed modules and very poor support by a 'reputable' supplier.

If you wish to discuss further then the BMS sub forum is the place to post;

viewforum.php?f=13

Thanks for the warning. I will continue the discussion there.

[Jack Bauer]

Right, back to the hacking. The next phase of this op requires a battery and slave board. Fun though it would be to haul around a full size model 3 brick, I decided to make a bench version from 25 x 18650 cells. This has the added advantage of allowing individual cells to be connected and disconnected allowing us to observe the data changes.

[Jack Bauer]

How to tell a good bms from a bad, Lesson 1: A good bms draws f%^k all current from its attached battery when in sleep mode:)

[Jack Bauer]

So time for a little bms update. Now that we have our bench battery and slave setup we can connect the whole lot to a hv controller. Looking at the pt can output on message 0x332 we see the cell voltages correctly reported. Then we can spy on the spi with the salea and actually see the data coming in from the slave board. But what we can now do most importantly is to cause changes in that data by messing with the connected cells.

[tom91]

Can you export raw hex data of the SPI bus? Then I would not mind having a look at it, I would suspect quite some likeness to the standard linear chip protocol.

[Jack Bauer]

Attached capture from Salae logic analyser. Can be viewed with free software : https://www.saleae.com/downloads/

Few points to note : The spi runs with Cpol=1 and Cpha=1. The capture starts with the hv controller powered down and powers on after about 0.5sec. One slave connected with all 25 cells attached.

[Jack Bauer]

Ignore my last. I am a clown. Attached capture as before but with correct spi decode pin assignments.