Setting up a thread to document the reverse engineering of the Model 3 battery. The specimen is from a European 2019 car with just over 20k km on the clock. We have the full guts of the battery minus the casing. First task will be putting it back together so we can begin discovering how the bms communicates with the cell modules. This will also provide a way to get some much needed info on the PCS communications with the hv controller.
The battery modules communicate via a variant of the ISO-SPI from LTC.
I have struggled myself trying to get it to work with the available dev kits from LTC, had no real luck getting it working.
Re: Tesla Model 3 Battery Hacking
Posted: Fri Feb 28, 2020 6:04 pm
by Jack Bauer
Thanks Tom. Should be an interesting adventure:)
Re: Tesla Model 3 Battery Hacking
Posted: Fri Feb 28, 2020 7:45 pm
by tom91
I would say it be of great benefit if you pull it off. Wish I could help but almost started pulling my hair out after 8+ hours of trying to get communications.
Re: Tesla Model 3 Battery Hacking
Posted: Fri Feb 28, 2020 8:45 pm
by Kevin Sharpe
online consensus seems to be that BMS is using LTC6812;
tom91 wrote: ↑Fri Feb 28, 2020 5:21 pm
I have struggled myself trying to get it to work with the available dev kits from LTC, had no real luck getting it working.
tom91 wrote: ↑Fri Feb 28, 2020 5:21 pm
I have struggled myself trying to get it to work with the available dev kits from LTC, had no real luck getting it working.
The latest EVTV video explains how they managed to query the individual cell voltages from the packs.
Gooood stuff.
Re: Tesla Model 3 Battery Hacking
Posted: Tue Mar 03, 2020 7:43 am
by Jack Bauer
JaniK wrote: ↑Mon Mar 02, 2020 7:10 pm
The latest EVTV video explains how they managed to query the individual cell voltages from the packs.
Gooood stuff.
Where is that explained?
Re: Tesla Model 3 Battery Hacking
Posted: Thu Mar 05, 2020 2:45 pm
by JaniK
Quickly go to exactly 27minutes and play it forward for 90seconds.
"Identified by ID type request"
"UDS request over CAN to the high voltage controller." They were able to retrieve individual cell data.
Little longer on video:
"Time between these messages to get the cell data is 3ms"
They wrote a program to do that. I have no idea how to replicate that, but that is the principle of how it works.
Hope this helps.
Re: Tesla Model 3 Battery Hacking
Posted: Mon Mar 16, 2020 4:45 pm
by muehlpower
I have a complete Model3 battery in US version that I want to use for my project and an additional EU charger. If that can help somehow.
Re: Tesla Model 3 Battery Hacking
Posted: Mon Mar 16, 2020 4:55 pm
by Jack Bauer
Thanks will be great to compare notes. My first plan is to get the pcs (charger and dcdc) running in the E46 touring then go at the weird iso-spi comms between the battery modules and the hv controller.
Re: Tesla Model 3 Battery Hacking
Posted: Thu Mar 19, 2020 10:01 pm
by Kevin Sharpe
Re: Tesla Model 3 Battery Hacking
Posted: Thu Mar 26, 2020 2:33 pm
by Jack Bauer
Let's see what this baby makes of Elon's weird bms comms ...
Re: Tesla Model 3 Battery Hacking
Posted: Thu Mar 26, 2020 2:57 pm
by cloudy
A little overkill perhaps?! That's a rather nice (and expensive) scope! :
Re: Tesla Model 3 Battery Hacking
Posted: Thu Mar 26, 2020 3:34 pm
by Bentto
WTF that's a serious badboy.
Re: Tesla Model 3 Battery Hacking
Posted: Thu Mar 26, 2020 6:03 pm
by Jack Bauer
Only the best for Mr.Musk:)
Re: Tesla Model 3 Battery Hacking
Posted: Thu Mar 26, 2020 8:05 pm
by clanger9
Crikey, where did you steal acquire that from??
Re: Tesla Model 3 Battery Hacking
Posted: Sun Mar 29, 2020 10:45 am
by Jack Bauer
Let's see if we can figure out what Batbrain and the Boy blunder are at.......
Re: Tesla Model 3 Battery Hacking
Posted: Sun Mar 29, 2020 10:55 am
by Kevin Sharpe
clanger9 wrote: ↑Thu Mar 26, 2020 8:05 pm
Crikey, where did you steal acquire that from??