Page 8 of 11

Re: Tesla Model 3 Battery Hacking

Posted: Sat Aug 15, 2020 1:59 pm
by tom91
Wait, so it works?

You have to do any mods or you just running my latest software?

Re: Tesla Model 3 Battery Hacking

Posted: Sat Aug 15, 2020 2:03 pm
by Jack Bauer
Yep just works bar a few missing cell voltages:) no mods just copied from your repo.

Re: Tesla Model 3 Battery Hacking

Posted: Sat Aug 15, 2020 2:05 pm
by tom91
Jack Bauer wrote: Sat Aug 15, 2020 2:03 pm Yep just works bar a few missing cell voltages:) no mods just copied from your repo.
Think something has broke on the slave?

Need to figure out the temperatures next, quite a wierd conversion factor they use.

Can you get a couple of temp sweep captures?

Re: Tesla Model 3 Battery Hacking

Posted: Sat Aug 15, 2020 2:56 pm
by Jack Bauer
Yeah could be a bad board. I'll test it on a full m3 pack next.

Re: Tesla Model 3 Battery Hacking

Posted: Sat Aug 15, 2020 3:06 pm
by tom91
Code does not support all modules yet, will tweak and upload a version that does.

Re: Tesla Model 3 Battery Hacking

Posted: Sun Aug 16, 2020 8:53 am
by Jack Bauer
Thanks Tom. I can test on the 4 individual modules in the meantime.

Re: Tesla Model 3 Battery Hacking

Posted: Sun Aug 16, 2020 10:17 am
by tom91
Already modified the decoding loops, so you run as many as you want.

Re: Tesla Model 3 Battery Hacking

Posted: Sun Aug 16, 2020 11:18 am
by Jack Bauer
Ah you're too quick for me Tom:)
Ok, full pack tests and logs inbound ....

Re: Tesla Model 3 Battery Hacking

Posted: Sat Aug 22, 2020 4:01 pm
by muehlpower
Hello,
I did my own tests with the HV controller and got completely different results. I bought a data logger and connected it to the HV controller. Here you find the log data (I hope :? ):

https://github.com/muehlpower/EV-FFB

my battery is from a 2018 US model and both sides of the boards are connected!

Re: Tesla Model 3 Battery Hacking

Posted: Sun Aug 23, 2020 3:01 pm
by muehlpower
I found all 96 voltage values. But there are other measuring blocks that I cannot assign.
8 times values ​​about 38000
8 times values ​​about 1370
8 times values ​​about 62500
16 times values ​​about 6000

Re: Tesla Model 3 Battery Hacking

Posted: Sun Aug 23, 2020 6:00 pm
by Jack Bauer
You may be seeing the temp sensors. 2 on each board.

Re: Tesla Model 3 Battery Hacking

Posted: Sun Aug 23, 2020 6:21 pm
by muehlpower
If the temperature sensors are on the board, I should be able to check it with a hair dryer

Re: Tesla Model 3 Battery Hacking

Posted: Sun Aug 23, 2020 6:40 pm
by muehlpower
the requests for the voltage are: 0x0763, 0x08F9, 0x09D6, 0x0AA7, 0x0B88 followed by 32 times 0x0000. Always 3 values ​​and a checksum, gives 24 values ​​per request. The order of the values ​​depends on the order of the daisy chain, not on the number of the boards.

Re: Tesla Model 3 Battery Hacking

Posted: Sun Aug 23, 2020 6:44 pm
by tom91
muehlpower wrote: Sat Aug 22, 2020 4:01 pm Hello,
I did my own tests with the HV controller and got completely different results. I bought a data logger and connected it to the HV controller. Here you find the log data (I hope :? ):

https://github.com/muehlpower/EV-FFB

my battery is from a 2018 US model and both sides of the boards are connected!
The thing that might be happening is that you got a really early battery that sterilises the other chips on the boards.

Re: Tesla Model 3 Battery Hacking

Posted: Mon Aug 24, 2020 5:22 pm
by Jack Bauer
Tests today on an m3 pack. One short and one long module.

Short m3 pack

IC 1 : | 3998mV| 4012mV| 4011mV| 4012mV| 4012mV| 4012mV| 4012mV| 4011mV| 4013mV| 4013mV| 4013mV| 4001mV| 0mV| 0mV| 0mV
IC 2 : | 4012mV| 4012mV| 4013mV| 4012mV| 4013mV| 4013mV| 4013mV| 0mV| 4013mV| 4014mV| 4014mV| 4001mV| 0mV| 0mV| 0mV
C613
71F3
CE13
287C
AF
13FE
F5D8
1309
ABFF
300
0
334A
3
0

Long m3 pack

IC 1 : | 3998mV| 4010mV| 4011mV| 4011mV| 4010mV| 4012mV| 4012mV| 4011mV| 4012mV| 4012mV| 4012mV| 4012mV| 4009mV| 0mV| 0mV
IC 2 : | 3999mV| 4011mV| 4011mV| 4012mV| 4010mV| 4011mV| 4010mV| 4011mV| 4012mV| 4012mV| 4012mV| 3998mV| 0mV| 0mV| 0mV
ED13
D5F1
DA13
3F9E
C9
1392
FAF1
1320
7FFF
F300
0
2FC4
F3
0

Re: Tesla Model 3 Battery Hacking

Posted: Wed Aug 26, 2020 12:45 pm
by muehlpower
I've got it going now. The biggest problem was the 16bit transmission with the DUE. The temperatures are found. I now wonder how balancing works. Do the boards do this themselves or does a value have to be sent for each cell or a start signal for balancing?

but as already written I have completely different requests!

Re: Tesla Model 3 Battery Hacking

Posted: Wed Aug 26, 2020 1:39 pm
by Jack Bauer
Well done:) Interesting how you have different requests. How did you get around the 16 bit spi on the due?

Re: Tesla Model 3 Battery Hacking

Posted: Wed Aug 26, 2020 2:11 pm
by muehlpower
Jack Bauer wrote: Wed Aug 26, 2020 1:39 pm Well done:) Interesting how you have different requests. How did you get around the 16 bit spi on the due?

I modified the arduino files SPI.h and SPI.cpp and wrote directly to the sam register.

you can find the program here: https://github.com/muehlpower/EV-FFB The chanigs ar

Re: Tesla Model 3 Battery Hacking

Posted: Wed Aug 26, 2020 2:24 pm
by muehlpower
If you google for "Modified pulse shaping for echo control in isoSPI bus applications" you will find an article that describes how to increase the pulse duration of the LTC6820 by replacing the terminator with a capacitor! have you tried that?

Re: Tesla Model 3 Battery Hacking

Posted: Wed Aug 26, 2020 2:31 pm
by tom91
muehlpower wrote: Wed Aug 26, 2020 12:45 pm but as already written I have completely different requests!
Yes your requests are only 2 bytes not 3. Probally because its the "older version" of the battery slaves.

What is the correct divider number for you voltage? Is it 12.5 or 12.8 or something different?

Re: Tesla Model 3 Battery Hacking

Posted: Wed Aug 26, 2020 2:43 pm
by muehlpower
tom91 wrote: Wed Aug 26, 2020 2:31 pm

What is the correct divider number for you voltage? Is it 12.5 or 12.8 or something different?
12.5 vor the voltage to mV( the screenshot is done with 1.25!). And for the temperature 10 to °K with 160 offset

Re: Tesla Model 3 Battery Hacking

Posted: Wed Aug 26, 2020 4:41 pm
by Jack Bauer
muehlpower wrote: Wed Aug 26, 2020 2:24 pm If you google for "Modified pulse shaping for echo control in isoSPI bus applications" you will find an article that describes how to increase the pulse duration of the LTC6820 by replacing the terminator with a capacitor! have you tried that?
No I didn't experiment with the LTC6820 after discovering the differences. Might be worth a revisit.

Re: Tesla Model 3 Battery Hacking

Posted: Sat Aug 29, 2020 4:45 pm
by Jack Bauer
Have ordered a few LTC6820 for a revisit to see if they can be made compatible with Musk iso spi.

Re: Tesla Model 3 Battery Hacking

Posted: Wed Sep 02, 2020 1:26 pm
by Jack Bauer
Some initial reverse engineering on the "Batman" chip on the hv controller. Pinout up on the repo :
https://github.com/damienmaguire/Tesla- ... pinout.ods

Next move is to harvest the little guy. I also noted some interesting RC networking going on around the pulse transformer primary.

Re: Tesla Model 3 Battery Hacking

Posted: Thu Sep 03, 2020 8:53 am
by Jack Bauer
Datasheet on the isolation transformer used on the hv controller and slaves for isospi :
https://xfmrs.com/wp-content/uploads/XFBMC29-BA09-B.pdf

Can someone find us an equivalent that we can actually buy?