Page 1 of 11

Tesla Model 3 Battery Hacking

Posted: Fri Feb 28, 2020 3:35 pm
by Jack Bauer
Setting up a thread to document the reverse engineering of the Model 3 battery. The specimen is from a European 2019 car with just over 20k km on the clock. We have the full guts of the battery minus the casing. First task will be putting it back together so we can begin discovering how the bms communicates with the cell modules. This will also provide a way to get some much needed info on the PCS communications with the hv controller.




Edit : 01/08/20 : MCU used on the HVC is : https://www.nxp.com/part/SPC5746CSK1AMKU6#/

11/10/20: New breakout board for the "batman" chip available as a kit from the webshop but DOES NOT INCLUDE BATMAN CHIP!
https://www.evbmw.com/index.php/evbmw-w ... bms-batman

Re: Tesla Model 3 Battery Hacking

Posted: Fri Feb 28, 2020 5:21 pm
by tom91
The battery modules communicate via a variant of the ISO-SPI from LTC.

I have struggled myself trying to get it to work with the available dev kits from LTC, had no real luck getting it working.

Re: Tesla Model 3 Battery Hacking

Posted: Fri Feb 28, 2020 6:04 pm
by Jack Bauer
Thanks Tom. Should be an interesting adventure:)

Re: Tesla Model 3 Battery Hacking

Posted: Fri Feb 28, 2020 7:45 pm
by tom91
I would say it be of great benefit if you pull it off. Wish I could help but almost started pulling my hair out after 8+ hours of trying to get communications.

Re: Tesla Model 3 Battery Hacking

Posted: Fri Feb 28, 2020 8:45 pm
by Kevin Sharpe

Re: Tesla Model 3 Battery Hacking

Posted: Fri Feb 28, 2020 8:47 pm
by Kevin Sharpe
tom91 wrote: Fri Feb 28, 2020 5:21 pm I have struggled myself trying to get it to work with the available dev kits from LTC, had no real luck getting it working.
Is this what you were using Tom?

https://www.analog.com/en/design-center ... b-overview

Re: Tesla Model 3 Battery Hacking

Posted: Fri Feb 28, 2020 9:42 pm
by tom91
Kevin Sharpe wrote: Fri Feb 28, 2020 8:47 pm
tom91 wrote: Fri Feb 28, 2020 5:21 pm I have struggled myself trying to get it to work with the available dev kits from LTC, had no real luck getting it working.
Is this what you were using Tom?

https://www.analog.com/en/design-center ... b-overview
DCA2617A with an LTC6820 on it. I have found some others who tried the same as myself and just found it too much of a struggle to get working.

I would almost think Tesla has taken the ISO-SPI and gave it their own spin, like they done with the Model S battery slaves.

Re: Tesla Model 3 Battery Hacking

Posted: Sat Feb 29, 2020 6:29 pm
by Kevin Sharpe
Battery module 3D CAD models 8-)

viewtopic.php?f=10&t=123#p3644

Re: Tesla Model 3 Battery Hacking

Posted: Sun Mar 01, 2020 12:22 pm
by Jack Bauer
Some info on this thread :
https://www.diyelectriccar.com/forums/s ... 99509.html

Of course the github rerpo is now empty. Guy must have retired to Lanzarote after selling the ip.

Re: Tesla Model 3 Battery Hacking

Posted: Sun Mar 01, 2020 12:33 pm
by Jack Bauer
and then we get this : https://teslaownersonline.com/threads/d ... ost-269950

Oh well, let's see what a nice new Keysight deep memory scope makes of this.

Re: Tesla Model 3 Battery Hacking

Posted: Mon Mar 02, 2020 9:33 am
by Jack Bauer
This little board may prove to be a way in :
https://www.maleetronic.com/boardsproje ... pi-module/

Re: Tesla Model 3 Battery Hacking

Posted: Mon Mar 02, 2020 7:10 pm
by JaniK
The latest EVTV video explains how they managed to query the individual cell voltages from the packs.
Gooood stuff.

Re: Tesla Model 3 Battery Hacking

Posted: Tue Mar 03, 2020 7:43 am
by Jack Bauer
JaniK wrote: Mon Mar 02, 2020 7:10 pm The latest EVTV video explains how they managed to query the individual cell voltages from the packs.
Gooood stuff.
Where is that explained?

Re: Tesla Model 3 Battery Hacking

Posted: Thu Mar 05, 2020 2:45 pm
by JaniK
Quickly go to exactly 27minutes and play it forward for 90seconds.

"Identified by ID type request"
"UDS request over CAN to the high voltage controller." They were able to retrieve individual cell data.

Little longer on video:
"Time between these messages to get the cell data is 3ms"

They wrote a program to do that. I have no idea how to replicate that, but that is the principle of how it works.

Hope this helps.

Re: Tesla Model 3 Battery Hacking

Posted: Mon Mar 16, 2020 4:45 pm
by muehlpower
I have a complete Model3 battery in US version that I want to use for my project and an additional EU charger. If that can help somehow.
20200313_145337.jpg
20200313_145345.jpg

Re: Tesla Model 3 Battery Hacking

Posted: Mon Mar 16, 2020 4:55 pm
by Jack Bauer
Thanks will be great to compare notes. My first plan is to get the pcs (charger and dcdc) running in the E46 touring then go at the weird iso-spi comms between the battery modules and the hv controller.

Re: Tesla Model 3 Battery Hacking

Posted: Thu Mar 19, 2020 10:01 pm
by Kevin Sharpe

Re: Tesla Model 3 Battery Hacking

Posted: Thu Mar 26, 2020 2:33 pm
by Jack Bauer
Let's see what this baby makes of Elon's weird bms comms ...

Re: Tesla Model 3 Battery Hacking

Posted: Thu Mar 26, 2020 2:57 pm
by cloudy
A little overkill perhaps?! That's a rather nice (and expensive) scope! : :D

Re: Tesla Model 3 Battery Hacking

Posted: Thu Mar 26, 2020 3:34 pm
by Bentto
WTF that's a serious badboy.

Re: Tesla Model 3 Battery Hacking

Posted: Thu Mar 26, 2020 6:03 pm
by Jack Bauer
Only the best for Mr.Musk:)

Re: Tesla Model 3 Battery Hacking

Posted: Thu Mar 26, 2020 8:05 pm
by clanger9
Crikey, where did you steal acquire that from??

Re: Tesla Model 3 Battery Hacking

Posted: Sun Mar 29, 2020 10:45 am
by Jack Bauer
Let's see if we can figure out what Batbrain and the Boy blunder are at.......

Re: Tesla Model 3 Battery Hacking

Posted: Sun Mar 29, 2020 10:55 am
by Kevin Sharpe
clanger9 wrote: Thu Mar 26, 2020 8:05 pm Crikey, where did you steal acquire that from??
https://twitter.com/EvBmw/status/124319 ... 47526?s=20

Re: Tesla Model 3 Battery Hacking

Posted: Sun Mar 29, 2020 11:19 am
by Jack Bauer
Datasheet for the isolation transformer used on the bms comms.