Tesla Model 3 Battery Hacking

Topics concerning the Tesla front and rear drive unit drop-in board
tom91
Posts: 1278
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 205 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

Wait, so it works?

You have to do any mods or you just running my latest software?
Founder Volt Influx https://www.voltinflux.com/
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Yep just works bar a few missing cell voltages:) no mods just copied from your repo.
I'm going to need a hacksaw
tom91
Posts: 1278
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 205 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

Jack Bauer wrote: Sat Aug 15, 2020 2:03 pm Yep just works bar a few missing cell voltages:) no mods just copied from your repo.
Think something has broke on the slave?

Need to figure out the temperatures next, quite a wierd conversion factor they use.

Can you get a couple of temp sweep captures?
Founder Volt Influx https://www.voltinflux.com/
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Yeah could be a bad board. I'll test it on a full m3 pack next.
I'm going to need a hacksaw
tom91
Posts: 1278
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 205 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

Code does not support all modules yet, will tweak and upload a version that does.
Founder Volt Influx https://www.voltinflux.com/
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Thanks Tom. I can test on the 4 individual modules in the meantime.
I'm going to need a hacksaw
tom91
Posts: 1278
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 205 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

Already modified the decoding loops, so you run as many as you want.
Founder Volt Influx https://www.voltinflux.com/
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Ah you're too quick for me Tom:)
Ok, full pack tests and logs inbound ....
I'm going to need a hacksaw
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: Tesla Model 3 Battery Hacking

Post by muehlpower »

Hello,
I did my own tests with the HV controller and got completely different results. I bought a data logger and connected it to the HV controller. Here you find the log data (I hope :? ):

https://github.com/muehlpower/EV-FFB

my battery is from a 2018 US model and both sides of the boards are connected!
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: Tesla Model 3 Battery Hacking

Post by muehlpower »

I found all 96 voltage values. But there are other measuring blocks that I cannot assign.
8 times values ​​about 38000
8 times values ​​about 1370
8 times values ​​about 62500
16 times values ​​about 6000
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

You may be seeing the temp sensors. 2 on each board.
I'm going to need a hacksaw
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: Tesla Model 3 Battery Hacking

Post by muehlpower »

If the temperature sensors are on the board, I should be able to check it with a hair dryer
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: Tesla Model 3 Battery Hacking

Post by muehlpower »

the requests for the voltage are: 0x0763, 0x08F9, 0x09D6, 0x0AA7, 0x0B88 followed by 32 times 0x0000. Always 3 values ​​and a checksum, gives 24 values ​​per request. The order of the values ​​depends on the order of the daisy chain, not on the number of the boards.
tom91
Posts: 1278
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 205 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

muehlpower wrote: Sat Aug 22, 2020 4:01 pm Hello,
I did my own tests with the HV controller and got completely different results. I bought a data logger and connected it to the HV controller. Here you find the log data (I hope :? ):

https://github.com/muehlpower/EV-FFB

my battery is from a 2018 US model and both sides of the boards are connected!
The thing that might be happening is that you got a really early battery that sterilises the other chips on the boards.
Founder Volt Influx https://www.voltinflux.com/
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Tests today on an m3 pack. One short and one long module.

Short m3 pack

IC 1 : | 3998mV| 4012mV| 4011mV| 4012mV| 4012mV| 4012mV| 4012mV| 4011mV| 4013mV| 4013mV| 4013mV| 4001mV| 0mV| 0mV| 0mV
IC 2 : | 4012mV| 4012mV| 4013mV| 4012mV| 4013mV| 4013mV| 4013mV| 0mV| 4013mV| 4014mV| 4014mV| 4001mV| 0mV| 0mV| 0mV
C613
71F3
CE13
287C
AF
13FE
F5D8
1309
ABFF
300
0
334A
3
0

Long m3 pack

IC 1 : | 3998mV| 4010mV| 4011mV| 4011mV| 4010mV| 4012mV| 4012mV| 4011mV| 4012mV| 4012mV| 4012mV| 4012mV| 4009mV| 0mV| 0mV
IC 2 : | 3999mV| 4011mV| 4011mV| 4012mV| 4010mV| 4011mV| 4010mV| 4011mV| 4012mV| 4012mV| 4012mV| 3998mV| 0mV| 0mV| 0mV
ED13
D5F1
DA13
3F9E
C9
1392
FAF1
1320
7FFF
F300
0
2FC4
F3
0
Attachments
2020-08-24 13.17.36.jpg
I'm going to need a hacksaw
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: Tesla Model 3 Battery Hacking

Post by muehlpower »

I've got it going now. The biggest problem was the 16bit transmission with the DUE. The temperatures are found. I now wonder how balancing works. Do the boards do this themselves or does a value have to be sent for each cell or a start signal for balancing?

but as already written I have completely different requests!
Attachments
Screenshot1.png
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Well done:) Interesting how you have different requests. How did you get around the 16 bit spi on the due?
I'm going to need a hacksaw
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: Tesla Model 3 Battery Hacking

Post by muehlpower »

Jack Bauer wrote: Wed Aug 26, 2020 1:39 pm Well done:) Interesting how you have different requests. How did you get around the 16 bit spi on the due?

I modified the arduino files SPI.h and SPI.cpp and wrote directly to the sam register.

you can find the program here: https://github.com/muehlpower/EV-FFB The chanigs ar
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: Tesla Model 3 Battery Hacking

Post by muehlpower »

If you google for "Modified pulse shaping for echo control in isoSPI bus applications" you will find an article that describes how to increase the pulse duration of the LTC6820 by replacing the terminator with a capacitor! have you tried that?
tom91
Posts: 1278
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 205 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

muehlpower wrote: Wed Aug 26, 2020 12:45 pm but as already written I have completely different requests!
Yes your requests are only 2 bytes not 3. Probally because its the "older version" of the battery slaves.

What is the correct divider number for you voltage? Is it 12.5 or 12.8 or something different?
Founder Volt Influx https://www.voltinflux.com/
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: Tesla Model 3 Battery Hacking

Post by muehlpower »

tom91 wrote: Wed Aug 26, 2020 2:31 pm

What is the correct divider number for you voltage? Is it 12.5 or 12.8 or something different?
12.5 vor the voltage to mV( the screenshot is done with 1.25!). And for the temperature 10 to °K with 160 offset
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

muehlpower wrote: Wed Aug 26, 2020 2:24 pm If you google for "Modified pulse shaping for echo control in isoSPI bus applications" you will find an article that describes how to increase the pulse duration of the LTC6820 by replacing the terminator with a capacitor! have you tried that?
No I didn't experiment with the LTC6820 after discovering the differences. Might be worth a revisit.
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Have ordered a few LTC6820 for a revisit to see if they can be made compatible with Musk iso spi.
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Some initial reverse engineering on the "Batman" chip on the hv controller. Pinout up on the repo :
https://github.com/damienmaguire/Tesla- ... pinout.ods

Next move is to harvest the little guy. I also noted some interesting RC networking going on around the pulse transformer primary.
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Datasheet on the isolation transformer used on the hv controller and slaves for isospi :
https://xfmrs.com/wp-content/uploads/XFBMC29-BA09-B.pdf

Can someone find us an equivalent that we can actually buy?
I'm going to need a hacksaw
Post Reply