Tesla Model 3 Battery Hacking

[tom91]

Wait, so it works?

You have to do any mods or you just running my latest software?

[Jack Bauer]

Yep just works bar a few missing cell voltages:) no mods just copied from your repo.

[tom91]

Yep just works bar a few missing cell voltages:) no mods just copied from your repo.

Think something has broke on the slave?

Need to figure out the temperatures next, quite a wierd conversion factor they use.

Can you get a couple of temp sweep captures?

[Jack Bauer]

Yeah could be a bad board. I'll test it on a full m3 pack next.

[tom91]

Code does not support all modules yet, will tweak and upload a version that does.

[Jack Bauer]

Thanks Tom. I can test on the 4 individual modules in the meantime.

[tom91]

Already modified the decoding loops, so you run as many as you want.

[Jack Bauer]

Ah you're too quick for me Tom:)
Ok, full pack tests and logs inbound ....

[muehlpower]

Hello,
I did my own tests with the HV controller and got completely different results. I bought a data logger and connected it to the HV controller. Here you find the log data (I hope ):

https://github.com/muehlpower/EV-FFB

my battery is from a 2018 US model and both sides of the boards are connected!

[muehlpower]

I found all 96 voltage values. But there are other measuring blocks that I cannot assign.
8 times values ​​about 38000
8 times values ​​about 1370
8 times values ​​about 62500
16 times values ​​about 6000

[Jack Bauer]

You may be seeing the temp sensors. 2 on each board.

[muehlpower]

If the temperature sensors are on the board, I should be able to check it with a hair dryer

[muehlpower]

the requests for the voltage are: 0x0763, 0x08F9, 0x09D6, 0x0AA7, 0x0B88 followed by 32 times 0x0000. Always 3 values ​​and a checksum, gives 24 values ​​per request. The order of the values ​​depends on the order of the daisy chain, not on the number of the boards.

[tom91]

Hello,
I did my own tests with the HV controller and got completely different results. I bought a data logger and connected it to the HV controller. Here you find the log data (I hope ):

https://github.com/muehlpower/EV-FFB

my battery is from a 2018 US model and both sides of the boards are connected!

The thing that might be happening is that you got a really early battery that sterilises the other chips on the boards.

[Jack Bauer]

Tests today on an m3 pack. One short and one long module.

Short m3 pack

IC 1 : | 3998mV| 4012mV| 4011mV| 4012mV| 4012mV| 4012mV| 4012mV| 4011mV| 4013mV| 4013mV| 4013mV| 4001mV| 0mV| 0mV| 0mV
IC 2 : | 4012mV| 4012mV| 4013mV| 4012mV| 4013mV| 4013mV| 4013mV| 0mV| 4013mV| 4014mV| 4014mV| 4001mV| 0mV| 0mV| 0mV
C613
71F3
CE13
287C
AF
13FE
F5D8
1309
ABFF
300
0
334A
3
0

Long m3 pack

IC 1 : | 3998mV| 4010mV| 4011mV| 4011mV| 4010mV| 4012mV| 4012mV| 4011mV| 4012mV| 4012mV| 4012mV| 4012mV| 4009mV| 0mV| 0mV
IC 2 : | 3999mV| 4011mV| 4011mV| 4012mV| 4010mV| 4011mV| 4010mV| 4011mV| 4012mV| 4012mV| 4012mV| 3998mV| 0mV| 0mV| 0mV
ED13
D5F1
DA13
3F9E
C9
1392
FAF1
1320
7FFF
F300
0
2FC4
F3
0

[muehlpower]

I've got it going now. The biggest problem was the 16bit transmission with the DUE. The temperatures are found. I now wonder how balancing works. Do the boards do this themselves or does a value have to be sent for each cell or a start signal for balancing?

but as already written I have completely different requests!

[Jack Bauer]

Well done:) Interesting how you have different requests. How did you get around the 16 bit spi on the due?

[muehlpower]

Well done:) Interesting how you have different requests. How did you get around the 16 bit spi on the due?

I modified the arduino files SPI.h and SPI.cpp and wrote directly to the sam register.

you can find the program here: https://github.com/muehlpower/EV-FFB The chanigs ar

[muehlpower]

If you google for "Modified pulse shaping for echo control in isoSPI bus applications" you will find an article that describes how to increase the pulse duration of the LTC6820 by replacing the terminator with a capacitor! have you tried that?

[tom91]

but as already written I have completely different requests!

Yes your requests are only 2 bytes not 3. Probally because its the "older version" of the battery slaves.

What is the correct divider number for you voltage? Is it 12.5 or 12.8 or something different?

[muehlpower]

What is the correct divider number for you voltage? Is it 12.5 or 12.8 or something different?

12.5 vor the voltage to mV( the screenshot is done with 1.25!). And for the temperature 10 to °K with 160 offset

[Jack Bauer]

If you google for "Modified pulse shaping for echo control in isoSPI bus applications" you will find an article that describes how to increase the pulse duration of the LTC6820 by replacing the terminator with a capacitor! have you tried that?

No I didn't experiment with the LTC6820 after discovering the differences. Might be worth a revisit.

[Jack Bauer]

Have ordered a few LTC6820 for a revisit to see if they can be made compatible with Musk iso spi.

[Jack Bauer]

Some initial reverse engineering on the "Batman" chip on the hv controller. Pinout up on the repo :
https://github.com/damienmaguire/Tesla- ... pinout.ods

Next move is to harvest the little guy. I also noted some interesting RC networking going on around the pulse transformer primary.

[Jack Bauer]

Datasheet on the isolation transformer used on the hv controller and slaves for isospi :
https://xfmrs.com/wp-content/uploads/XFBMC29-BA09-B.pdf

Can someone find us an equivalent that we can actually buy?