Tesla Model S GEN2 DC-DC Converter hacking

Topics concerning the Tesla front and rear drive unit drop-in board
User avatar
Lee Malo
Posts: 47
Joined: Thu Mar 21, 2019 6:09 pm
Location: Gloucester MA , USA
Been thanked: 2 times

Tesla Model S GEN2 DC-DC Converter hacking

Post by Lee Malo »

I have a TESLA model S DC-DC charger and I am wondering if anybody has hacked or manipulate the DC-DC charger to work on other cars >


Lee
Poor quality lingers long after the cheap price is forgotten.
User avatar
Kevin Sharpe
Posts: 1345
Joined: Fri Dec 14, 2018 9:24 pm
Location: Ireland and US
Been thanked: 4 times

Re: First GEN TESLA S DC-DC charger hacking ??

Post by Kevin Sharpe »

Which part number do you have?
This is a personal post and I disclaim all responsibility for any loss or damage which any person may suffer from reliance on the information and material in this post or any opinion, conclusion or recommendation in the information and material.
User avatar
Lee Malo
Posts: 47
Joined: Thu Mar 21, 2019 6:09 pm
Location: Gloucester MA , USA
Been thanked: 2 times

Re: First GEN TESLA S DC-DC charger hacking ??

Post by Lee Malo »

Kevin Sharpe wrote: Tue Oct 29, 2019 7:28 pm Which part number do you have?
P/N 1028665-00-B

REV 02

model DAP-2500AB A

S/N A15D0061224
Poor quality lingers long after the cheap price is forgotten.
User avatar
Kevin Sharpe
Posts: 1345
Joined: Fri Dec 14, 2018 9:24 pm
Location: Ireland and US
Been thanked: 4 times

Re: First GEN TESLA S DC-DC charger hacking ??

Post by Kevin Sharpe »

Lee Malo wrote: Wed Oct 30, 2019 6:12 pm
Kevin Sharpe wrote: Tue Oct 29, 2019 7:28 pm Which part number do you have?
P/N 1028665-00-B

REV 02

model DAP-2500AB A

S/N A15D0061224
iirc that's the same one Damien uses in Der Panzer and by default it 'just works' without any CAN or other control mechanism. Some useful info here;

https://www.diyelectriccar.com/forums/s ... p?t=192042

https://www.diyelectriccar.com/forums/s ... 81417.html
This is a personal post and I disclaim all responsibility for any loss or damage which any person may suffer from reliance on the information and material in this post or any opinion, conclusion or recommendation in the information and material.
User avatar
Lee Malo
Posts: 47
Joined: Thu Mar 21, 2019 6:09 pm
Location: Gloucester MA , USA
Been thanked: 2 times

Re: First GEN TESLA S DC-DC charger hacking ??

Post by Lee Malo »

Thank you Kevin !!!! Thank you !

Great info !
Poor quality lingers long after the cheap price is forgotten.
D@F
Posts: 59
Joined: Mon Dec 24, 2018 1:12 pm
Has thanked: 1 time

Re: First GEN TESLA S DC-DC charger hacking ??

Post by D@F »

what is the max voltage that could be plugged on input?
is see on the diy forum that output is can commanded to have a 14v and without can only 12v.
User avatar
Zapatero
Posts: 443
Joined: Fri Oct 25, 2019 11:08 am
Location: Germany, Ulm
Has thanked: 25 times
Been thanked: 39 times
Contact:

Re: First GEN TESLA S DC-DC charger hacking ??

Post by Zapatero »

Is the same valid, that it "just works" without can, for part number: 1028665-00-C which is the c instead of the b in the end?
User avatar
Zapatero
Posts: 443
Joined: Fri Oct 25, 2019 11:08 am
Location: Germany, Ulm
Has thanked: 25 times
Been thanked: 39 times
Contact:

Re: First GEN TESLA S DC-DC charger hacking ??

Post by Zapatero »

Can someone tell me, which one is the positive and which one the negative terminal on this charger?

Image
User avatar
Lee Malo
Posts: 47
Joined: Thu Mar 21, 2019 6:09 pm
Location: Gloucester MA , USA
Been thanked: 2 times

Re: First GEN TESLA S DC-DC charger hacking ??

Post by Lee Malo »

Image

pin 1 is positive

pin 2 is negative
Attachments
pin one ( 1 ) is positive
pin one ( 1 ) is positive
Poor quality lingers long after the cheap price is forgotten.
User avatar
Zapatero
Posts: 443
Joined: Fri Oct 25, 2019 11:08 am
Location: Germany, Ulm
Has thanked: 25 times
Been thanked: 39 times
Contact:

Re: First GEN TESLA S DC-DC charger hacking ??

Post by Zapatero »

Thanks for the info,
But I'm not sure if we're taking about the 12 Volt Output or the 360v input? For the 12v output it's clear but i have no clue for the 360v imput, if the left or the right orange cable is positive?
User avatar
Zapatero
Posts: 443
Joined: Fri Oct 25, 2019 11:08 am
Location: Germany, Ulm
Has thanked: 25 times
Been thanked: 39 times
Contact:

Re: First GEN TESLA S DC-DC charger hacking ??

Post by Zapatero »

My power steering is throwing a code from time to time because it is expecting 13.5 volts minimum while driving. The original alternator was producing around 14 Volts whilst the Tesla DC DC is producing 13.5 Volts. When turning on the Blower and turning hard on the steering wheel the voltage drops under 13.5 Volts and throwing an code and the power steering is unoperational until i restarted the car.

The question is: Can i make the Tesla DC DC Charger to put out a higher voltage with can control?? Or in any other way??

Thanks for your help
User avatar
Zapatero
Posts: 443
Joined: Fri Oct 25, 2019 11:08 am
Location: Germany, Ulm
Has thanked: 25 times
Been thanked: 39 times
Contact:

Re: First GEN TESLA S DC-DC charger hacking ??

Post by Zapatero »

I might have found the answer in a link posted in this threat:


Jeff try sending it CAN id 0x03D8 , Data length 3 , data : 0xDD 0x06 0x00

and watch the 12 output :)
I tried it... "0x03D8, 3 bytes, DD, 06, 00" but instead of 12v I momentarily got 14v (D1 = DD, D2 = 06)

So I tried some other values to establish the relationship ... 0x03D8, D1, D2, 00 (also keep resending every 5ms to maintain the voltage).

D1, D2 = volts
DD, 06 = 14.0v
B0, 06 = 13.75v
A0, 06 = 13.64v
E0, 05 = 12.33v
D0, 05 = 12.22v
C0, 05 = 12.11v
B0, 05 = 12.0v

D2D1 = (148 * volts) - 325

So by resending 0x03D8, B0, 05, 00 every 5ms I got a steady 12v out of the DCDC with no load (other than the voltmeter).

Jeff





Can anyone confirm that?
User avatar
Zapatero
Posts: 443
Joined: Fri Oct 25, 2019 11:08 am
Location: Germany, Ulm
Has thanked: 25 times
Been thanked: 39 times
Contact:

Re: First GEN TESLA S DC-DC charger hacking ??

Post by Zapatero »

Found this pinout - will try to connect it to my CanBus next week and report if i had success with raising the voltage.

Image
User avatar
Zapatero
Posts: 443
Joined: Fri Oct 25, 2019 11:08 am
Location: Germany, Ulm
Has thanked: 25 times
Been thanked: 39 times
Contact:

Re: First GEN TESLA S DC-DC charger hacking ??

Post by Zapatero »

Just wanted to leave the information here, in case someone else needs it, too.
The Can messages are correct and work fine. Was very easy. The plug is easily sourceable.

I bought it at Digikey for around 3.5 USD per piece:

PART: WM13161-ND
MFG : Molex / 0334721301

DESC: CONN RCPT HSG 12POS 3.50MM

Connectors from left to right:
Hardware enable pin, 12V input - if no can messages are received DCDC will run in fault mode at 13.5v
Can High
Can Low

When you look at the inverter the Pinout is as follows:
HW CH CL X X X
X X X X X X



Image
Image
Image
User avatar
Bratitude
Posts: 783
Joined: Thu Jan 02, 2020 7:35 pm
Location: Canada
Has thanked: 57 times
Been thanked: 168 times
Contact:

Re: First GEN TESLA S DC-DC charger hacking ??

Post by Bratitude »

i have the 2 HV blue connectors (one is wired) when i received my unit.

id like to get the pins and such to have a clean cable system. from my diggin its a KET conector

looks like its MG655776 type D
http://www.ket.com/resources/web/MG6557 ... 776_2d.pdf
https://bratindustries.net/ leaf motor couplers, adapter plates, custom drive train components
collin80
Posts: 110
Joined: Sun Aug 30, 2020 3:28 pm
Location: United States, Michigan
Been thanked: 4 times
Contact:

Re: First GEN TESLA S DC-DC charger hacking ??

Post by collin80 »

Zapatero wrote: Sat Sep 26, 2020 11:22 am I might have found the answer in a link posted in this threat:
Jeff try sending it CAN id 0x03D8 , Data length 3 , data : 0xDD 0x06 0x00

and watch the 12 output :)
I tried it... "0x03D8, 3 bytes, DD, 06, 00" but instead of 12v I momentarily got 14v (D1 = DD, D2 = 06)

So I tried some other values to establish the relationship ... 0x03D8, D1, D2, 00 (also keep resending every 5ms to maintain the voltage).

D1, D2 = volts
DD, 06 = 14.0v
B0, 06 = 13.75v
A0, 06 = 13.64v
E0, 05 = 12.33v
D0, 05 = 12.22v
C0, 05 = 12.11v
B0, 05 = 12.0v

D2D1 = (148 * volts) - 325

So by resending 0x03D8, B0, 05, 00 every 5ms I got a steady 12v out of the DCDC with no load (other than the voltmeter).
Jeff
Can anyone confirm that?
Sort of. The below info is for a very recent firmware revision. YMMV for anything older but it seems to check out.

0x3D8 is indeed a command to the DC/DC converter and it is three bytes long. The first 10 bits (little endian format) in the message encode the output voltage. The next bit (11th bit which is really labeled bit 10) is the DC/DC enable bit. This would seem to pan out for your examples above as 06 and 05 both have the "4" bit set which is the third bit in the second byte and is indeed bit "10". And, the voltage is really the 10 bit value encoded / 146 (approximately) and afterward add 9.

As an example,
02DD from your first reading is 733/146 + 9 = 14.02V
01B0 = 11.95V

0000 would be 9v (bad idea!) and 03FF is about 16V which is also a bad idea. But, this allows for custom tuning any voltage within that range to suit your needs.

So, basically just what you said. The only thing to keep in mind here is that the third bit in the second byte must be a 1 or the DC/DC will be disabled. In my example calculations I've removed that enable bit because it isn't factored into the voltage calculations. And, because the signal is little endian I've swapped the byte order too. Isn't CAN fun?!
User avatar
Zapatero
Posts: 443
Joined: Fri Oct 25, 2019 11:08 am
Location: Germany, Ulm
Has thanked: 25 times
Been thanked: 39 times
Contact:

Re: First GEN TESLA S DC-DC charger hacking ??

Post by Zapatero »

I want 14.4 Volts, as my alternator used to deliver. My ABS unit seems to quit after a while when my electric power steering draws too much power - especially when turning at very low speeds when the force for the electric power steering is the most.

So 14,4v would be:

(14,4-9)*146 = 788
hex = 314
bin = 1100010100

So i'm gonna send
0x03D8, 03, 14, 00, 00, 00, 00, 00, 00


is that correct?
Or did i miss that:
collin80 wrote: Tue Dec 22, 2020 12:59 am The only thing to keep in mind here is that the third bit in the second byte must be a 1 or the DC/DC will be disabled. In my example calculations I've removed that enable bit because it isn't factored into the voltage calculations. And, because the signal is little endian I've swapped the byte order too. Isn't CAN fun?!
collin80
Posts: 110
Joined: Sun Aug 30, 2020 3:28 pm
Location: United States, Michigan
Been thanked: 4 times
Contact:

Re: First GEN TESLA S DC-DC charger hacking ??

Post by collin80 »

Close. 0x314 is the right answer for the voltage calculation. Somewhat annoyingly this value is stored flipped in the CAN message so it'd be 0x14 0x03 as sent in the CAN frame. But, you also have to add 4 to that second byte for the enable bit. That makes the value 0x14 0x07 instead. Then, the CAN frame is three bytes even though nothing seems to use or care about that third byte. So, the end result is:

0x3D8, 0x14, 0x07, 00 for 14.4 volts.

Zapatero wrote: Wed Dec 23, 2020 9:14 pm I want 14.4 Volts, as my alternator used to deliver. My ABS unit seems to quit after a while when my electric power steering draws too much power - especially when turning at very low speeds when the force for the electric power steering is the most.

So 14,4v would be:

(14,4-9)*146 = 788
hex = 314
bin = 1100010100

So i'm gonna send
0x03D8, 03, 14, 00, 00, 00, 00, 00, 00


is that correct?
Or did i miss that:
collin80 wrote: Tue Dec 22, 2020 12:59 am The only thing to keep in mind here is that the third bit in the second byte must be a 1 or the DC/DC will be disabled. In my example calculations I've removed that enable bit because it isn't factored into the voltage calculations. And, because the signal is little endian I've swapped the byte order too. Isn't CAN fun?!
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: First GEN TESLA S DC-DC charger hacking ??

Post by muehlpower »

Since the first DCDC converters are the cheapest to get, I bought one and tested it. The voltage can be controlled with the same CAN message as described above. A message is returned with the identifier 0x210. The second byte apparently returns the temperature. 0xE1 at 20 ° C, increased to 0xFE, approx. 50 ° C during testing. Byte 5 gives the output voltage in 0.1V. 0x8C for 14V, 0x82 for 13V etc. The connections are at the top right 12V enable signal, bottom center CAN L, bottom right CAN H. The two top left pins a HVIL.


Because the case was damaged i opened it. I noticed that the two orange plugs have 40A fuses. The gray plug seems to be an adjustable output. The corresponding CAN message for controlling this output would be interesting. Does somebody has any idea?
Attachments
$_59 (5).jpg
$_59 (4).jpg
$_59 (3).jpg
$_59 (2).jpg
User avatar
New Electric Ireland
Posts: 172
Joined: Sun May 31, 2020 12:22 pm
Location: Ireland
Been thanked: 1 time
Contact:

Re: First GEN TESLA S DC-DC charger hacking ??

Post by New Electric Ireland »

muehlpower wrote: Thu Jan 14, 2021 10:00 am Does somebody has any idea?
Same circuit as this?

https://www.diyelectriccar.com/threads/ ... ox.193729/
In Ireland we undertake training & open source RND for the New Electric group, 5 companies converting boats, buses, cars and trucks to electric drive since 2008.
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: First GEN TESLA S DC-DC charger hacking ??

Post by muehlpower »

New Electric Ireland wrote: Thu Jan 14, 2021 10:13 am
muehlpower wrote: Thu Jan 14, 2021 10:00 am Does somebody has any idea?
Same circuit as this?

https://www.diyelectriccar.com/threads/ ... ox.193729/
My device is a combination of this box and the DCDC converter. The HV outputs are the same in color and function. The control must be different, my plug is only 6 pin and assigned as described. No PWM input and no status output!
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: First GEN TESLA S DC-DC charger hacking ??

Post by muehlpower »

I found this in internet:

CAN3, ID 0x0210
● Description: DC­DC Converter Status
● Length observed: 7 bytes
● Frequency on bus: Approximately 10 Hz
● Example frames: 00 00 D6 1B 1E 8A 00
○ inletTemperature: 19 C
○ inputPower: 432 W
○ outputCurrent: 30 A
○ outputPower: 414 W
○ outputVoltage: 13.8 V
● Value descriptions:
○ inputPower = byte3 * 16
■ Watts
○ outputCurrent = byte4
■ Amps
○ outputVoltage = byte5 / 10
■ Volts
○ inletTemperature = ((byte2 ­ (2 * (byte2 & 0x80))) * 0.5) + 40
■ degrees C
○ outputPower = byte4 * (byte5 / 10)
■ Watts
User avatar
janosch
Posts: 306
Joined: Tue Jun 30, 2020 9:23 am
Location: London, UK
Has thanked: 67 times
Been thanked: 54 times
Contact:

Re: First GEN TESLA S DC-DC charger hacking ??

Post by janosch »

Fire!

We used this DCDC for 1500+ miles without CAN control.

Thursday it set itself ablaze.

I wonder what went wrong? Maybe we overloaded it on 12V side, but no heater was on, maybe PS pump (60A fuse). Will fuse the 13.5V+ output just in case for the next one.

Cooling issue possible, but it is mounted flat as it would be in the Tesla.

Part #:
MKP25 225K630 ( 600V grey capacitor )
C3D10060G ( 600V / 14A Schottky Diode near fire)
Burned are Q30, Q31, look like HV MOSFETs to me at first glance, but I am not very familiar with the innards of this device (yet).

If I find out what the MOSFETs were I might be able to salvage the board actually.

Until then:
Classifieds: wanted: Tesla DCDC

Edit: In retrospect, why I decided not to fuse both HV and 12V side for an expensive component like that is now a mystery to me. #movefastandbreakdcdcconverters
Attachments
PXL_20220425_104107838-min.jpg
arber333
Posts: 3241
Joined: Mon Dec 24, 2018 1:37 pm
Location: Slovenia
Has thanked: 74 times
Been thanked: 223 times
Contact:

Re: First GEN TESLA S DC-DC charger hacking ??

Post by arber333 »

Hi

I am trying to solve 14V for my Tesla DCDC.
When i start it by enable pin i get 13,5V. OK
I connect 12V battery and a 12V light bulb for suitable load. OK

Then i try to up the voltage by ransmitting CAN at 5ms
CAN ID 0x3D8 MSG DD 06 00 ........... NOT OK!
I get brief 14V but next second it drops back to 13,5V.

Then i tried what Collin suggested and sent
0x3D8, 0x14, 0x07, 00

There is again a brief 14,4V jump, but then it drops back to 13,5V.
Well at least DCDC works in legacy mode....
Would i need to connect another wire to gnd somewhere?

tnx

EDIT: Hm.... i just dumped 10000 telegrams onto CAN bus and surprisingly DCDC stayed at 14V! I will need to test this on my uC but it seems DCDC needs to see faster repetition of telegrams to keep voltage up.

EDIT2: False alarm! It seems CANalyst tool did something wrong as i just programmed my DUE and ESP32 and both worked fine with
CAN ID 0x3D8 MSG DD 06 00


I even setup a timer function that would transmit DCDC telegram. I tried at various intervals and i can confirm DCDC works at 5ms, 10ms, 30ms, 100ms and at 500ms. That makes it just perfect for my use. I will update the wiki now.
arber333
Posts: 3241
Joined: Mon Dec 24, 2018 1:37 pm
Location: Slovenia
Has thanked: 74 times
Been thanked: 223 times
Contact:

Re: First GEN TESLA S DC-DC charger hacking ??

Post by arber333 »

I noticed yesterday i managed to drain my 12V battery. Probably it was damaged before, but now has quit completely...

No other problem besides that when i connected another aux battery in parallel i couldnt get my Tesla DCDC to start operating. There are processes preset in my VCU so that DCDC starts either:
- when i connect 12V enable signal
- when i connect charging cable

Does anyone know if loss of 12V would be bad for Tesla DCDC?
Should i simply reset (remove fuse) HV power and try again? The problem is my car is on the parking lot and not at home so i cant go under the car to disconnect and reconnect DCDC or inspect the 30A fuse i installed.
Post Reply