Tesla Model 3 Charger
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Tesla Model 3 Charger
Thanks to a kind donation from a customer I have a Tesla Model 3 battery charger on the way. Setting up a thread for reverse engineering and control system design. More detail once it lands.
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Charger
Found this video while searching online. Seems the DC DC converter is built in:)
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
-
- Posts: 1326
- Joined: Fri Mar 01, 2019 9:15 pm
- Location: Bristol
- Has thanked: 106 times
- Been thanked: 226 times
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Charger
Sadly no can captures but I did also get the wiring harnesses and a weird looking black box called the "Assy HV Controller" that plugs into the charger so will see what that does. What is interesting is that from what I can see the charger no longer handles the control pilot and signals from the charge port in the Model 3.
I also have a sneaky suspicion that the DC DC part will just work with an enable signal.
I also have a sneaky suspicion that the DC DC part will just work with an enable signal.
I'm going to need a hacksaw
-
- Posts: 1326
- Joined: Fri Mar 01, 2019 9:15 pm
- Location: Bristol
- Has thanked: 106 times
- Been thanked: 226 times
Re: Tesla Model 3 Charger
come on Damien, you have her open but not crocodile clips on the hv and lv wiring to prove you theory.
Apply some of that rectified mains on her, or maybe she is picky and only likes a tight voltage range. Only one way to find out.
Apply some of that rectified mains on her, or maybe she is picky and only likes a tight voltage range. Only one way to find out.
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Charger
I'll get there. Have the variac all set:)
From what I can make out this is the wiring connector from the PCS to the HV Controller. Signal descriptions are quite useful.
From what I can make out this is the wiring connector from the PCS to the HV Controller. Signal descriptions are quite useful.
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Charger
Ok update from yesterday. PCS is now awake. turns out I was wrong about the low voltage lines being derived from the HV. They are derived from the 12v connector via 3 L7987 devices. Enable is achieved by grounding wire W02 to the 12v battery ground NOT the ISO Gnd. All the power supplies wake up and the TMS320 boots and starts flashing some nice leds:) Once I get a new ISO7741 to replace the one I blew we should be able to start some propper testing. Uploaded 2 can captures to github. One with just the HV controller (pumps out over 2k frames per sec!) and one with just the pcs.
https://github.com/damienmaguire/Tesla-Model-3-Charger
https://github.com/damienmaguire/Tesla-Model-3-Charger
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Charger
Also worth noting there are two can channels between the HV controller and PCS. One, called CP CAN is normal levels at 500k. The second, called IPC-CAN is created using two ISO7741 digital isolators and transmitted as a 0-5v signal also at 500k baud.
I'm going to need a hacksaw
-
- Posts: 1326
- Joined: Fri Mar 01, 2019 9:15 pm
- Location: Bristol
- Has thanked: 106 times
- Been thanked: 226 times
Re: Tesla Model 3 Charger
Oh good news you are getting some where.
I have blown up an isolator myself on a BMW I3 bms slave doing the exact same thing. Luckily OEMs do not like spinning their own ICs.
Have you seen if the data on them is the same source or are they two completley different can busses from? Are they from two different chips?
Example one is from the big chip behind the coils? and the none isolated can from some other chip?
I have blown up an isolator myself on a BMW I3 bms slave doing the exact same thing. Luckily OEMs do not like spinning their own ICs.
Have you seen if the data on them is the same source or are they two completley different can busses from? Are they from two different chips?
Example one is from the big chip behind the coils? and the none isolated can from some other chip?
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Charger
Looks like all the data is on CP CAN and only a few messages on IPC-CAN but both run at crazy fast speed. Not sure where they originate but from looking at the architecture I'm going to venture a guess that the TMS320 is running everything. I don't think there are any other micros in the pcs.
Found this Model 3 CAN dbc : https://github.com/joshwardell/model3dbc
It decodes one or two messages from the hv controller so its a start.
Found this Model 3 CAN dbc : https://github.com/joshwardell/model3dbc
It decodes one or two messages from the hv controller so its a start.
I'm going to need a hacksaw
- Kevin Sharpe
- Posts: 1345
- Joined: Fri Dec 14, 2018 9:24 pm
- Location: Ireland and US
- Been thanked: 4 times
Re: Tesla Model 3 Charger
I'm sure you've seen all the data that Josh Wardell maintains but just incase you haven't;Jack Bauer wrote: ↑Mon Jul 08, 2019 6:44 pm Found this Model 3 CAN dbc : https://github.com/joshwardell/model3dbc
https://teslaownersonline.com/threads/d ... cess.7502/
This is a personal post and I disclaim all responsibility for any loss or damage which any person may suffer from reliance on the information and material in this post or any opinion, conclusion or recommendation in the information and material.
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Charger
Yes I had seen that. While a very good resource it lacks the juicy bits needed like command and control messages.
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Charger
Uploaded a few more CAN logs to the Github repo. Things discovered :
* On powerup the PCS puts out no messages on either CP Can or IPC Can until it hears from the HV Controller.
*IPC can is super weird levels. The CAN Due will read it but it's dropping frames and I'm seeing a lot of colisions. Its can in name only I reckon as it's created on both sides by ISO7741 digital isolators as opposed to transcievers. Wish I had a scope the could do protocol decoding ...
*Messages on IPC can will trigger messages on CP can but not vice versa.
* Identified the vehicle side can connection on the HV Controller and did a log. At first glance a lot of messages are repeated from CP can. Sadly the dbc is next to useless.
Work continues ...
* On powerup the PCS puts out no messages on either CP Can or IPC Can until it hears from the HV Controller.
*IPC can is super weird levels. The CAN Due will read it but it's dropping frames and I'm seeing a lot of colisions. Its can in name only I reckon as it's created on both sides by ISO7741 digital isolators as opposed to transcievers. Wish I had a scope the could do protocol decoding ...
*Messages on IPC can will trigger messages on CP can but not vice versa.
* Identified the vehicle side can connection on the HV Controller and did a log. At first glance a lot of messages are repeated from CP can. Sadly the dbc is next to useless.
Work continues ...
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Charger
Ok some actual progress. I'm slowly getting to grips with the IPC CAN. The PCS sends 5 ids:
0x76C,0x2C4,0x204,0x264,0x224.
Message 0x264 reports the AC voltage applied to the modules. Not worked out how but here is a capture doing a sweep from 0 to 240v and back to 0.
https://github.com/damienmaguire/Tesla- ... 0_240v.csv
0x224 and 0x204 bytes 6 and 7 respectively respond to the state of the PWM DCDC or PWM CHG enable lines. Going from 0 to 1 when 5v is applied.
0x76C,0x2C4,0x204,0x264,0x224.
Message 0x264 reports the AC voltage applied to the modules. Not worked out how but here is a capture doing a sweep from 0 to 240v and back to 0.
https://github.com/damienmaguire/Tesla- ... 0_240v.csv
0x224 and 0x204 bytes 6 and 7 respectively respond to the state of the PWM DCDC or PWM CHG enable lines. Going from 0 to 1 when 5v is applied.
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Charger
Looks like a few of the PCS messages are rebroadcast over vehicle can and have been worked out.
https://docs.google.com/spreadsheets/d/ ... edit#gid=0
Next trick will be to use two laptops and two candues to play the hvcontroller messages back to the pcs and see which bring it to life.
https://docs.google.com/spreadsheets/d/ ... edit#gid=0
Next trick will be to use two laptops and two candues to play the hvcontroller messages back to the pcs and see which bring it to life.
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Charger
So I got a neat tip. It seems the messages BACK from the PCS to the HVController are can ACKs.
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Charger
Just when you thought it was safe to assume...
It seems the PCS does indeed transmit something on powerup. If connected to a powered off HVcontroller however it forces the line to 5v and you don't see anything. Disconnect the hvcon and viola. It's not can according to the analyser so what is it ....
It seems the PCS does indeed transmit something on powerup. If connected to a powered off HVcontroller however it forces the line to 5v and you don't see anything. Disconnect the hvcon and viola. It's not can according to the analyser so what is it ....
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Charger
Log uploaded to github using a Salea Logic analyser. Free software available here : https://www.saleae.com/downloads/
IPC can Tx with just the PCS powered up and HVCon disconnected :
https://github.com/damienmaguire/Tesla- ... .logicdata
IPC can Tx with PCS and HVCon connected and powered :
https://github.com/damienmaguire/Tesla- ... .logicdata
IPC can Tx on chan0 and Rx on chan1 :
https://github.com/damienmaguire/Tesla- ... .logicdata
Any guesses?
IPC can Tx with just the PCS powered up and HVCon disconnected :
https://github.com/damienmaguire/Tesla- ... .logicdata
IPC can Tx with PCS and HVCon connected and powered :
https://github.com/damienmaguire/Tesla- ... .logicdata
IPC can Tx on chan0 and Rx on chan1 :
https://github.com/damienmaguire/Tesla- ... .logicdata
Any guesses?
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Charger
Some good progress this evening. Worked back through the hv controller to find where the ipc can terminates. A real tour de force but it seems to end up in several places one of which is a qfp device with a weird part number. Decided to try something. Rigged up a 65HVD255 CAN transciever on a breadboard with Tx and Rx connected to the PCS and a short can line connecting it to the candue. Fired up the PCS and bingo. With the transciever handling the bus arbitration the pcs puts out messages from power on.
Log of pcs from powerup :
https://github.com/damienmaguire/Tesla- ... henoff.csv
Threw a CAN capture at it for laughs and found a message that controls the AC current limit of the charger section.
0X25D bit 4. When set reduces AC current limit from 48A (default) to 32A.
Log of 0x25D from a model 3 on charge :
https://github.com/damienmaguire/Tesla- ... wercmd.csv
Log of pcs from powerup :
https://github.com/damienmaguire/Tesla- ... henoff.csv
Threw a CAN capture at it for laughs and found a message that controls the AC current limit of the charger section.
0X25D bit 4. When set reduces AC current limit from 48A (default) to 32A.
Log of 0x25D from a model 3 on charge :
https://github.com/damienmaguire/Tesla- ... wercmd.csv
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Charger
Major progress made:) Video and info on the way.
I'm going to need a hacksaw