openinverter forum

Thanks to a kind donation from a customer I have a Tesla Model 3 battery charger on the way. Setting up a thread for reverse engineering and control system design. More detail once it lands.

Found this video while searching online. Seems the DC DC converter is built in:)

Model 3 Power conversion system has arrived

Any internal Canbus captures to support with the reverse engineering?

Sadly no can captures but I did also get the wiring harnesses and a weird looking black box called the "Assy HV Controller" that plugs into the charger so will see what that does. What is interesting is that from what I can see the charger no longer handles the control pilot and signals from the charge port in the Model 3.

I also have a sneaky suspicion that the DC DC part will just work with an enable signal.

come on Damien, you have her open but not crocodile clips on the hv and lv wiring to prove you theory.

Apply some of that rectified mains on her, or maybe she is picky and only likes a tight voltage range. Only one way to find out.

I'll get there. Have the variac all set:)

From what I can make out this is the wiring connector from the PCS to the HV Controller. Signal descriptions are quite useful.

Ok update from yesterday. PCS is now awake. turns out I was wrong about the low voltage lines being derived from the HV. They are derived from the 12v connector via 3 L7987 devices. Enable is achieved by grounding wire W02 to the 12v battery ground NOT the ISO Gnd. All the power supplies wake up and the TMS320 boots and starts flashing some nice leds:) Once I get a new ISO7741 to replace the one I blew we should be able to start some propper testing. Uploaded 2 can captures to github. One with just the HV controller (pumps out over 2k frames per sec!) and one with just the pcs.
https://github.com/damienmaguire/Tesla-Model-3-Charger

Also worth noting there are two can channels between the HV controller and PCS. One, called CP CAN is normal levels at 500k. The second, called IPC-CAN is created using two ISO7741 digital isolators and transmitted as a 0-5v signal also at 500k baud.

Oh good news you are getting some where.

I have blown up an isolator myself on a BMW I3 bms slave doing the exact same thing. Luckily OEMs do not like spinning their own ICs.

Have you seen if the data on them is the same source or are they two completley different can busses from? Are they from two different chips?

Example one is from the big chip behind the coils? and the none isolated can from some other chip?

Looks like all the data is on CP CAN and only a few messages on IPC-CAN but both run at crazy fast speed. Not sure where they originate but from looking at the architecture I'm going to venture a guess that the TMS320 is running everything. I don't think there are any other micros in the pcs.
Found this Model 3 CAN dbc : https://github.com/joshwardell/model3dbc

It decodes one or two messages from the hv controller so its a start.

Jack Bauer wrote: ↑Mon Jul 08, 2019 6:44 pm Found this Model 3 CAN dbc : https://github.com/joshwardell/model3dbc

I'm sure you've seen all the data that Josh Wardell maintains but just incase you haven't;

https://teslaownersonline.com/threads/d ... cess.7502/

Yes I had seen that. While a very good resource it lacks the juicy bits needed like command and control messages.

Seriously Elon? Whats next, CANWoman?

Uploaded a few more CAN logs to the Github repo. Things discovered :

* On powerup the PCS puts out no messages on either CP Can or IPC Can until it hears from the HV Controller.

*IPC can is super weird levels. The CAN Due will read it but it's dropping frames and I'm seeing a lot of colisions. Its can in name only I reckon as it's created on both sides by ISO7741 digital isolators as opposed to transcievers. Wish I had a scope the could do protocol decoding ...

*Messages on IPC can will trigger messages on CP can but not vice versa.

* Identified the vehicle side can connection on the HV Controller and did a log. At first glance a lot of messages are repeated from CP can. Sadly the dbc is next to useless.

Work continues ...

Ok some actual progress. I'm slowly getting to grips with the IPC CAN. The PCS sends 5 ids:
0x76C,0x2C4,0x204,0x264,0x224.

Message 0x264 reports the AC voltage applied to the modules. Not worked out how but here is a capture doing a sweep from 0 to 240v and back to 0.
https://github.com/damienmaguire/Tesla- ... 0_240v.csv

0x224 and 0x204 bytes 6 and 7 respectively respond to the state of the PWM DCDC or PWM CHG enable lines. Going from 0 to 1 when 5v is applied.

Looks like a few of the PCS messages are rebroadcast over vehicle can and have been worked out.
https://docs.google.com/spreadsheets/d/ ... edit#gid=0

Next trick will be to use two laptops and two candues to play the hvcontroller messages back to the pcs and see which bring it to life.

So I got a neat tip. It seems the messages BACK from the PCS to the HVController are can ACKs.

Just when you thought it was safe to assume...

It seems the PCS does indeed transmit something on powerup. If connected to a powered off HVcontroller however it forces the line to 5v and you don't see anything. Disconnect the hvcon and viola. It's not can according to the analyser so what is it ....

Log uploaded to github using a Salea Logic analyser. Free software available here : https://www.saleae.com/downloads/

IPC can Tx with just the PCS powered up and HVCon disconnected :
https://github.com/damienmaguire/Tesla- ... .logicdata

IPC can Tx with PCS and HVCon connected and powered :
https://github.com/damienmaguire/Tesla- ... .logicdata

IPC can Tx on chan0 and Rx on chan1 :
https://github.com/damienmaguire/Tesla- ... .logicdata


Any guesses?

Some good progress this evening. Worked back through the hv controller to find where the ipc can terminates. A real tour de force but it seems to end up in several places one of which is a qfp device with a weird part number. Decided to try something. Rigged up a 65HVD255 CAN transciever on a breadboard with Tx and Rx connected to the PCS and a short can line connecting it to the candue. Fired up the PCS and bingo. With the transciever handling the bus arbitration the pcs puts out messages from power on.
Log of pcs from powerup :
https://github.com/damienmaguire/Tesla- ... henoff.csv
Threw a CAN capture at it for laughs and found a message that controls the AC current limit of the charger section.

0X25D bit 4. When set reduces AC current limit from 48A (default) to 32A.

Log of 0x25D from a model 3 on charge :
https://github.com/damienmaguire/Tesla- ... wercmd.csv

Major progress made:) Video and info on the way.