EVControls TC-1 Teardown

Topics concerning the Tesla front and rear drive unit drop-in board
Post Reply
KimchiKimKim
Posts: 69
Joined: Wed Mar 03, 2021 1:36 am
Location: California
Has thanked: 4 times
Been thanked: 4 times
Contact:

EVControls TC-1 Teardown

Post by KimchiKimKim »

I bought a broken TC-1 to teardown and show whats going on inside.

The design is super weird - using high-side drivers to drive relays but not just driving 12v outputs with them directly. Also, everything is hand soldered and there were even solder balls running around inside!

They are using a Mikro 7inch smart display dev board: https://www.mikroe.com/mikromedia-7-stm32f7

They are using a balling F7 mcu

I connected my stlinkv3 and it locked through byte options RIPPP

The firmware is RDP so I'm looking into making a glitcher for it. If anyone has info on STM32F7 glitching to bypass RDP please let me know.

I have a friend with IDA pro so that could be interesting. If I can disassemble the code I will post it here.

Hopefully, this helps someone at least a little
Attachments
IMG_4918.JPG
IMG_4917.JPG
IMG_4913.JPG
IMG_4912.JPG
IMG_4911.JPG
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: EVControls TC-1 Teardown

Post by Jack Bauer »

Thanks for posting:)
I'm going to need a hacksaw
AMP3R
Posts: 37
Joined: Sun Oct 09, 2022 8:32 pm
Has thanked: 10 times
Been thanked: 3 times

Re: EVControls TC-1 Teardown

Post by AMP3R »

Does anybody sell broken T-2C controller? :)
KimchiKimKim
Posts: 69
Joined: Wed Mar 03, 2021 1:36 am
Location: California
Has thanked: 4 times
Been thanked: 4 times
Contact:

Re: EVControls TC-1 Teardown

Post by KimchiKimKim »

I bought a new display and the touch is restored! Looks like the guy basically gave me a TC-1 for free since the replacement resistive touch panel was less than 20bucks from buydisplay.com

Unfortunately, there is nothing in settings or options for firmware updating. I think the fuse they set might be permanent (aka hardware Efuse RDP).

This is extremely impressive as the people who wrote the software for this thing left a ridiculous amount of horsepower untouched. The code runs extremely slow and I'm surprised the developers actually enabled RDP.
KimchiKimKim
Posts: 69
Joined: Wed Mar 03, 2021 1:36 am
Location: California
Has thanked: 4 times
Been thanked: 4 times
Contact:

Re: EVControls TC-1 Teardown

Post by KimchiKimKim »

Called up EV controls. They state that without the logic board I'm straight out of luck as they do not reflash more than one control board per unit sold. Man, I really wish someone would post the CAN firmware update sequence for updating the drive unit. I've been looking into doing this for a while now and it seems like you can with Tesla Toolbox. It would be so nice if people could simply replay the flashing sequence via the CAN bootloader and then everyone can benefit from open-source CAN emulation!
Wayne Campbell
Posts: 13
Joined: Sun May 05, 2019 4:23 pm
Location: Fife
Has thanked: 4 times
Been thanked: 2 times
Contact:

Re: EVControls TC-1 Teardown

Post by Wayne Campbell »

AMP3R wrote: Mon Oct 31, 2022 6:32 pm Does anybody sell broken T-2C controller? :)

I have just bought the T-2C controller I will upload a pic soon.
Attachments
IMG_3505 2.pdf
(3.54 MiB) Downloaded 105 times
Post Reply