Page 1 of 2

Tesla Model S GEN2 DC-DC Converter hacking

Posted: Tue Oct 29, 2019 6:29 pm
by Lee Malo
I have a TESLA model S DC-DC charger and I am wondering if anybody has hacked or manipulate the DC-DC charger to work on other cars >


Lee

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Tue Oct 29, 2019 7:28 pm
by Kevin Sharpe
Which part number do you have?

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Wed Oct 30, 2019 6:12 pm
by Lee Malo
Kevin Sharpe wrote: Tue Oct 29, 2019 7:28 pm Which part number do you have?
P/N 1028665-00-B

REV 02

model DAP-2500AB A

S/N A15D0061224

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Wed Oct 30, 2019 8:18 pm
by Kevin Sharpe
Lee Malo wrote: Wed Oct 30, 2019 6:12 pm
Kevin Sharpe wrote: Tue Oct 29, 2019 7:28 pm Which part number do you have?
P/N 1028665-00-B

REV 02

model DAP-2500AB A

S/N A15D0061224
iirc that's the same one Damien uses in Der Panzer and by default it 'just works' without any CAN or other control mechanism. Some useful info here;

https://www.diyelectriccar.com/forums/s ... p?t=192042

https://www.diyelectriccar.com/forums/s ... 81417.html

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Wed Oct 30, 2019 9:21 pm
by Lee Malo
Thank you Kevin !!!! Thank you !

Great info !

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Sat Nov 16, 2019 6:12 pm
by D@F
what is the max voltage that could be plugged on input?
is see on the diy forum that output is can commanded to have a 14v and without can only 12v.

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Sat Nov 16, 2019 8:57 pm
by Zapatero
Is the same valid, that it "just works" without can, for part number: 1028665-00-C which is the c instead of the b in the end?

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Fri Dec 06, 2019 3:04 pm
by Zapatero
Can someone tell me, which one is the positive and which one the negative terminal on this charger?

Image

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Fri Dec 06, 2019 6:22 pm
by Lee Malo
Image

pin 1 is positive

pin 2 is negative

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Sun Dec 08, 2019 7:09 am
by Zapatero
Thanks for the info,
But I'm not sure if we're taking about the 12 Volt Output or the 360v input? For the 12v output it's clear but i have no clue for the 360v imput, if the left or the right orange cable is positive?

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Sat Sep 26, 2020 10:19 am
by Zapatero
My power steering is throwing a code from time to time because it is expecting 13.5 volts minimum while driving. The original alternator was producing around 14 Volts whilst the Tesla DC DC is producing 13.5 Volts. When turning on the Blower and turning hard on the steering wheel the voltage drops under 13.5 Volts and throwing an code and the power steering is unoperational until i restarted the car.

The question is: Can i make the Tesla DC DC Charger to put out a higher voltage with can control?? Or in any other way??

Thanks for your help

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Sat Sep 26, 2020 11:22 am
by Zapatero
I might have found the answer in a link posted in this threat:


Jeff try sending it CAN id 0x03D8 , Data length 3 , data : 0xDD 0x06 0x00

and watch the 12 output :)
I tried it... "0x03D8, 3 bytes, DD, 06, 00" but instead of 12v I momentarily got 14v (D1 = DD, D2 = 06)

So I tried some other values to establish the relationship ... 0x03D8, D1, D2, 00 (also keep resending every 5ms to maintain the voltage).

D1, D2 = volts
DD, 06 = 14.0v
B0, 06 = 13.75v
A0, 06 = 13.64v
E0, 05 = 12.33v
D0, 05 = 12.22v
C0, 05 = 12.11v
B0, 05 = 12.0v

D2D1 = (148 * volts) - 325

So by resending 0x03D8, B0, 05, 00 every 5ms I got a steady 12v out of the DCDC with no load (other than the voltmeter).

Jeff





Can anyone confirm that?

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Sat Sep 26, 2020 1:16 pm
by Zapatero
Found this pinout - will try to connect it to my CanBus next week and report if i had success with raising the voltage.

Image

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Thu Oct 01, 2020 7:10 am
by Zapatero
Just wanted to leave the information here, in case someone else needs it, too.
The Can messages are correct and work fine. Was very easy. The plug is easily sourceable.

I bought it at Digikey for around 3.5 USD per piece:

PART: WM13161-ND
MFG : Molex / 0334721301

DESC: CONN RCPT HSG 12POS 3.50MM

Connectors from left to right:
Hardware enable pin, 12V input - if no can messages are received DCDC will run in fault mode at 13.5v
Can High
Can Low

When you look at the inverter the Pinout is as follows:
HW CH CL X X X
X X X X X X



Image
Image
Image

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Mon Dec 21, 2020 10:36 pm
by Bratitude
i have the 2 HV blue connectors (one is wired) when i received my unit.

id like to get the pins and such to have a clean cable system. from my diggin its a KET conector

looks like its MG655776 type D
http://www.ket.com/resources/web/MG6557 ... 776_2d.pdf

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Tue Dec 22, 2020 12:59 am
by collin80
Zapatero wrote: Sat Sep 26, 2020 11:22 am I might have found the answer in a link posted in this threat:
Jeff try sending it CAN id 0x03D8 , Data length 3 , data : 0xDD 0x06 0x00

and watch the 12 output :)
I tried it... "0x03D8, 3 bytes, DD, 06, 00" but instead of 12v I momentarily got 14v (D1 = DD, D2 = 06)

So I tried some other values to establish the relationship ... 0x03D8, D1, D2, 00 (also keep resending every 5ms to maintain the voltage).

D1, D2 = volts
DD, 06 = 14.0v
B0, 06 = 13.75v
A0, 06 = 13.64v
E0, 05 = 12.33v
D0, 05 = 12.22v
C0, 05 = 12.11v
B0, 05 = 12.0v

D2D1 = (148 * volts) - 325

So by resending 0x03D8, B0, 05, 00 every 5ms I got a steady 12v out of the DCDC with no load (other than the voltmeter).
Jeff
Can anyone confirm that?
Sort of. The below info is for a very recent firmware revision. YMMV for anything older but it seems to check out.

0x3D8 is indeed a command to the DC/DC converter and it is three bytes long. The first 10 bits (little endian format) in the message encode the output voltage. The next bit (11th bit which is really labeled bit 10) is the DC/DC enable bit. This would seem to pan out for your examples above as 06 and 05 both have the "4" bit set which is the third bit in the second byte and is indeed bit "10". And, the voltage is really the 10 bit value encoded / 146 (approximately) and afterward add 9.

As an example,
02DD from your first reading is 733/146 + 9 = 14.02V
01B0 = 11.95V

0000 would be 9v (bad idea!) and 03FF is about 16V which is also a bad idea. But, this allows for custom tuning any voltage within that range to suit your needs.

So, basically just what you said. The only thing to keep in mind here is that the third bit in the second byte must be a 1 or the DC/DC will be disabled. In my example calculations I've removed that enable bit because it isn't factored into the voltage calculations. And, because the signal is little endian I've swapped the byte order too. Isn't CAN fun?!

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Wed Dec 23, 2020 9:14 pm
by Zapatero
I want 14.4 Volts, as my alternator used to deliver. My ABS unit seems to quit after a while when my electric power steering draws too much power - especially when turning at very low speeds when the force for the electric power steering is the most.

So 14,4v would be:

(14,4-9)*146 = 788
hex = 314
bin = 1100010100

So i'm gonna send
0x03D8, 03, 14, 00, 00, 00, 00, 00, 00


is that correct?
Or did i miss that:
collin80 wrote: Tue Dec 22, 2020 12:59 am The only thing to keep in mind here is that the third bit in the second byte must be a 1 or the DC/DC will be disabled. In my example calculations I've removed that enable bit because it isn't factored into the voltage calculations. And, because the signal is little endian I've swapped the byte order too. Isn't CAN fun?!

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Thu Dec 24, 2020 1:12 am
by collin80
Close. 0x314 is the right answer for the voltage calculation. Somewhat annoyingly this value is stored flipped in the CAN message so it'd be 0x14 0x03 as sent in the CAN frame. But, you also have to add 4 to that second byte for the enable bit. That makes the value 0x14 0x07 instead. Then, the CAN frame is three bytes even though nothing seems to use or care about that third byte. So, the end result is:

0x3D8, 0x14, 0x07, 00 for 14.4 volts.

Zapatero wrote: Wed Dec 23, 2020 9:14 pm I want 14.4 Volts, as my alternator used to deliver. My ABS unit seems to quit after a while when my electric power steering draws too much power - especially when turning at very low speeds when the force for the electric power steering is the most.

So 14,4v would be:

(14,4-9)*146 = 788
hex = 314
bin = 1100010100

So i'm gonna send
0x03D8, 03, 14, 00, 00, 00, 00, 00, 00


is that correct?
Or did i miss that:
collin80 wrote: Tue Dec 22, 2020 12:59 am The only thing to keep in mind here is that the third bit in the second byte must be a 1 or the DC/DC will be disabled. In my example calculations I've removed that enable bit because it isn't factored into the voltage calculations. And, because the signal is little endian I've swapped the byte order too. Isn't CAN fun?!

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Thu Jan 14, 2021 10:00 am
by muehlpower
Since the first DCDC converters are the cheapest to get, I bought one and tested it. The voltage can be controlled with the same CAN message as described above. A message is returned with the identifier 0x210. The second byte apparently returns the temperature. 0xE1 at 20 ° C, increased to 0xFE, approx. 50 ° C during testing. Byte 5 gives the output voltage in 0.1V. 0x8C for 14V, 0x82 for 13V etc. The connections are at the top right 12V enable signal, bottom center CAN L, bottom right CAN H. The two top left pins a HVIL.


Because the case was damaged i opened it. I noticed that the two orange plugs have 40A fuses. The gray plug seems to be an adjustable output. The corresponding CAN message for controlling this output would be interesting. Does somebody has any idea?

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Thu Jan 14, 2021 10:13 am
by New Electric Ireland
muehlpower wrote: Thu Jan 14, 2021 10:00 am Does somebody has any idea?
Same circuit as this?

https://www.diyelectriccar.com/threads/ ... ox.193729/

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Thu Jan 14, 2021 11:08 am
by muehlpower
New Electric Ireland wrote: Thu Jan 14, 2021 10:13 am
muehlpower wrote: Thu Jan 14, 2021 10:00 am Does somebody has any idea?
Same circuit as this?

https://www.diyelectriccar.com/threads/ ... ox.193729/
My device is a combination of this box and the DCDC converter. The HV outputs are the same in color and function. The control must be different, my plug is only 6 pin and assigned as described. No PWM input and no status output!

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Thu Jan 14, 2021 12:35 pm
by muehlpower
I found this in internet:

CAN3, ID 0x0210
● Description: DC­DC Converter Status
● Length observed: 7 bytes
● Frequency on bus: Approximately 10 Hz
● Example frames: 00 00 D6 1B 1E 8A 00
○ inletTemperature: 19 C
○ inputPower: 432 W
○ outputCurrent: 30 A
○ outputPower: 414 W
○ outputVoltage: 13.8 V
● Value descriptions:
○ inputPower = byte3 * 16
■ Watts
○ outputCurrent = byte4
■ Amps
○ outputVoltage = byte5 / 10
■ Volts
○ inletTemperature = ((byte2 ­ (2 * (byte2 & 0x80))) * 0.5) + 40
■ degrees C
○ outputPower = byte4 * (byte5 / 10)
■ Watts

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Mon Apr 25, 2022 11:23 am
by janosch
Fire!

We used this DCDC for 1500+ miles without CAN control.

Thursday it set itself ablaze.

I wonder what went wrong? Maybe we overloaded it on 12V side, but no heater was on, maybe PS pump (60A fuse). Will fuse the 13.5V+ output just in case for the next one.

Cooling issue possible, but it is mounted flat as it would be in the Tesla.

Part #:
MKP25 225K630 ( 600V grey capacitor )
C3D10060G ( 600V / 14A Schottky Diode near fire)
Burned are Q30, Q31, look like HV MOSFETs to me at first glance, but I am not very familiar with the innards of this device (yet).

If I find out what the MOSFETs were I might be able to salvage the board actually.

Until then:
Classifieds: wanted: Tesla DCDC

Edit: In retrospect, why I decided not to fuse both HV and 12V side for an expensive component like that is now a mystery to me. #movefastandbreakdcdcconverters

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Sun Nov 20, 2022 4:04 pm
by arber333
Hi

I am trying to solve 14V for my Tesla DCDC.
When i start it by enable pin i get 13,5V. OK
I connect 12V battery and a 12V light bulb for suitable load. OK

Then i try to up the voltage by ransmitting CAN at 5ms
CAN ID 0x3D8 MSG DD 06 00 ........... NOT OK!
I get brief 14V but next second it drops back to 13,5V.

Then i tried what Collin suggested and sent
0x3D8, 0x14, 0x07, 00

There is again a brief 14,4V jump, but then it drops back to 13,5V.
Well at least DCDC works in legacy mode....
Would i need to connect another wire to gnd somewhere?

tnx

EDIT: Hm.... i just dumped 10000 telegrams onto CAN bus and surprisingly DCDC stayed at 14V! I will need to test this on my uC but it seems DCDC needs to see faster repetition of telegrams to keep voltage up.

EDIT2: False alarm! It seems CANalyst tool did something wrong as i just programmed my DUE and ESP32 and both worked fine with
CAN ID 0x3D8 MSG DD 06 00


I even setup a timer function that would transmit DCDC telegram. I tried at various intervals and i can confirm DCDC works at 5ms, 10ms, 30ms, 100ms and at 500ms. That makes it just perfect for my use. I will update the wiki now.

Re: First GEN TESLA S DC-DC charger hacking ??

Posted: Fri Mar 17, 2023 9:23 am
by arber333
I noticed yesterday i managed to drain my 12V battery. Probably it was damaged before, but now has quit completely...

No other problem besides that when i connected another aux battery in parallel i couldnt get my Tesla DCDC to start operating. There are processes preset in my VCU so that DCDC starts either:
- when i connect 12V enable signal
- when i connect charging cable

Does anyone know if loss of 12V would be bad for Tesla DCDC?
Should i simply reset (remove fuse) HV power and try again? The problem is my car is on the parking lot and not at home so i cant go under the car to disconnect and reconnect DCDC or inspect the 30A fuse i installed.