Tesla Model 3 Battery Hacking

Topics concerning the Tesla front and rear drive unit drop-in board
Post Reply
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Setting up a thread to document the reverse engineering of the Model 3 battery. The specimen is from a European 2019 car with just over 20k km on the clock. We have the full guts of the battery minus the casing. First task will be putting it back together so we can begin discovering how the bms communicates with the cell modules. This will also provide a way to get some much needed info on the PCS communications with the hv controller.




Edit : 01/08/20 : MCU used on the HVC is : https://www.nxp.com/part/SPC5746CSK1AMKU6#/

11/10/20: New breakout board for the "batman" chip available as a kit from the webshop but DOES NOT INCLUDE BATMAN CHIP!
https://www.evbmw.com/index.php/evbmw-w ... bms-batman
Attachments
2020-02-28 10.57.09.jpg
2020-02-28 10.57.14.jpg
2020-02-28 13.41.51.jpg
2020-02-28 13.41.59.jpg
I'm going to need a hacksaw
tom91
Posts: 1273
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 201 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

The battery modules communicate via a variant of the ISO-SPI from LTC.

I have struggled myself trying to get it to work with the available dev kits from LTC, had no real luck getting it working.
Founder Volt Influx https://www.voltinflux.com/
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Thanks Tom. Should be an interesting adventure:)
I'm going to need a hacksaw
tom91
Posts: 1273
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 201 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

I would say it be of great benefit if you pull it off. Wish I could help but almost started pulling my hair out after 8+ hours of trying to get communications.
Founder Volt Influx https://www.voltinflux.com/
User avatar
Kevin Sharpe
Posts: 1345
Joined: Fri Dec 14, 2018 9:24 pm
Location: Ireland and US
Been thanked: 4 times

Re: Tesla Model 3 Battery Hacking

Post by Kevin Sharpe »

This is a personal post and I disclaim all responsibility for any loss or damage which any person may suffer from reliance on the information and material in this post or any opinion, conclusion or recommendation in the information and material.
User avatar
Kevin Sharpe
Posts: 1345
Joined: Fri Dec 14, 2018 9:24 pm
Location: Ireland and US
Been thanked: 4 times

Re: Tesla Model 3 Battery Hacking

Post by Kevin Sharpe »

tom91 wrote: Fri Feb 28, 2020 5:21 pm I have struggled myself trying to get it to work with the available dev kits from LTC, had no real luck getting it working.
Is this what you were using Tom?

https://www.analog.com/en/design-center ... b-overview
This is a personal post and I disclaim all responsibility for any loss or damage which any person may suffer from reliance on the information and material in this post or any opinion, conclusion or recommendation in the information and material.
tom91
Posts: 1273
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 97 times
Been thanked: 201 times

Re: Tesla Model 3 Battery Hacking

Post by tom91 »

Kevin Sharpe wrote: Fri Feb 28, 2020 8:47 pm
tom91 wrote: Fri Feb 28, 2020 5:21 pm I have struggled myself trying to get it to work with the available dev kits from LTC, had no real luck getting it working.
Is this what you were using Tom?

https://www.analog.com/en/design-center ... b-overview
DCA2617A with an LTC6820 on it. I have found some others who tried the same as myself and just found it too much of a struggle to get working.

I would almost think Tesla has taken the ISO-SPI and gave it their own spin, like they done with the Model S battery slaves.
Founder Volt Influx https://www.voltinflux.com/
User avatar
Kevin Sharpe
Posts: 1345
Joined: Fri Dec 14, 2018 9:24 pm
Location: Ireland and US
Been thanked: 4 times

Re: Tesla Model 3 Battery Hacking

Post by Kevin Sharpe »

Battery module 3D CAD models 8-)

viewtopic.php?f=10&t=123#p3644
This is a personal post and I disclaim all responsibility for any loss or damage which any person may suffer from reliance on the information and material in this post or any opinion, conclusion or recommendation in the information and material.
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Some info on this thread :
https://www.diyelectriccar.com/forums/s ... 99509.html

Of course the github rerpo is now empty. Guy must have retired to Lanzarote after selling the ip.
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

and then we get this : https://teslaownersonline.com/threads/d ... ost-269950

Oh well, let's see what a nice new Keysight deep memory scope makes of this.
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

This little board may prove to be a way in :
https://www.maleetronic.com/boardsproje ... pi-module/
I'm going to need a hacksaw
JaniK
Posts: 391
Joined: Sun Aug 25, 2019 12:39 pm
Location: Finland
Has thanked: 49 times
Been thanked: 10 times

Re: Tesla Model 3 Battery Hacking

Post by JaniK »

The latest EVTV video explains how they managed to query the individual cell voltages from the packs.
Gooood stuff.
Any opinions are my own, unless stated otherwise. I take no responsibility if you follow my way of doing things and it doesn't work. Please double check with someone who knows what they are doing.
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

JaniK wrote: Mon Mar 02, 2020 7:10 pm The latest EVTV video explains how they managed to query the individual cell voltages from the packs.
Gooood stuff.
Where is that explained?
I'm going to need a hacksaw
JaniK
Posts: 391
Joined: Sun Aug 25, 2019 12:39 pm
Location: Finland
Has thanked: 49 times
Been thanked: 10 times

Re: Tesla Model 3 Battery Hacking

Post by JaniK »

Quickly go to exactly 27minutes and play it forward for 90seconds.

"Identified by ID type request"
"UDS request over CAN to the high voltage controller." They were able to retrieve individual cell data.

Little longer on video:
"Time between these messages to get the cell data is 3ms"

They wrote a program to do that. I have no idea how to replicate that, but that is the principle of how it works.

Hope this helps.
Any opinions are my own, unless stated otherwise. I take no responsibility if you follow my way of doing things and it doesn't work. Please double check with someone who knows what they are doing.
User avatar
muehlpower
Posts: 570
Joined: Fri Oct 11, 2019 10:51 am
Location: Germany Fürstenfeldbruck
Has thanked: 12 times
Been thanked: 96 times

Re: Tesla Model 3 Battery Hacking

Post by muehlpower »

I have a complete Model3 battery in US version that I want to use for my project and an additional EU charger. If that can help somehow.
20200313_145337.jpg
20200313_145345.jpg
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Thanks will be great to compare notes. My first plan is to get the pcs (charger and dcdc) running in the E46 touring then go at the weird iso-spi comms between the battery modules and the hv controller.
I'm going to need a hacksaw
User avatar
Kevin Sharpe
Posts: 1345
Joined: Fri Dec 14, 2018 9:24 pm
Location: Ireland and US
Been thanked: 4 times

Re: Tesla Model 3 Battery Hacking

Post by Kevin Sharpe »

This is a personal post and I disclaim all responsibility for any loss or damage which any person may suffer from reliance on the information and material in this post or any opinion, conclusion or recommendation in the information and material.
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Let's see what this baby makes of Elon's weird bms comms ...
Attachments
2020-03-26 14.22.20.jpg
2020-03-26 14.22.23.jpg
I'm going to need a hacksaw
User avatar
cloudy
Posts: 202
Joined: Wed Oct 02, 2019 12:15 am
Location: UK
Been thanked: 1 time

Re: Tesla Model 3 Battery Hacking

Post by cloudy »

A little overkill perhaps?! That's a rather nice (and expensive) scope! : :D
Bentto
Posts: 27
Joined: Thu Feb 13, 2020 6:55 pm
Location: The Netherlands

Re: Tesla Model 3 Battery Hacking

Post by Bentto »

WTF that's a serious badboy.
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Only the best for Mr.Musk:)
I'm going to need a hacksaw
User avatar
clanger9
Posts: 203
Joined: Mon Oct 28, 2019 7:41 am
Location: Chester, UK
Been thanked: 1 time
Contact:

Re: Tesla Model 3 Battery Hacking

Post by clanger9 »

Crikey, where did you steal acquire that from??
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Let's see if we can figure out what Batbrain and the Boy blunder are at.......
Attachments
2020-03-29 11.42.31.jpg
I'm going to need a hacksaw
User avatar
Kevin Sharpe
Posts: 1345
Joined: Fri Dec 14, 2018 9:24 pm
Location: Ireland and US
Been thanked: 4 times

Re: Tesla Model 3 Battery Hacking

Post by Kevin Sharpe »

clanger9 wrote: Thu Mar 26, 2020 8:05 pm Crikey, where did you steal acquire that from??
https://twitter.com/EvBmw/status/124319 ... 47526?s=20
This is a personal post and I disclaim all responsibility for any loss or damage which any person may suffer from reliance on the information and material in this post or any opinion, conclusion or recommendation in the information and material.
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Battery Hacking

Post by Jack Bauer »

Datasheet for the isolation transformer used on the bms comms.
Attachments
XFBMC29DNC-BA09-A.pdf
(51.25 KiB) Downloaded 263 times
I'm going to need a hacksaw
Post Reply