Tesla Model 3 Battery Hacking

[Jack Bauer]

Setting up a thread to document the reverse engineering of the Model 3 battery. The specimen is from a European 2019 car with just over 20k km on the clock. We have the full guts of the battery minus the casing. First task will be putting it back together so we can begin discovering how the bms communicates with the cell modules. This will also provide a way to get some much needed info on the PCS communications with the hv controller.




Edit : 01/08/20 : MCU used on the HVC is : https://www.nxp.com/part/SPC5746CSK1AMKU6#/

11/10/20: New breakout board for the "batman" chip available as a kit from the webshop but DOES NOT INCLUDE BATMAN CHIP!
https://www.evbmw.com/index.php/evbmw-w ... bms-batman

[tom91]

The battery modules communicate via a variant of the ISO-SPI from LTC.

I have struggled myself trying to get it to work with the available dev kits from LTC, had no real luck getting it working.

[Jack Bauer]

Thanks Tom. Should be an interesting adventure:)

[tom91]

I would say it be of great benefit if you pull it off. Wish I could help but almost started pulling my hair out after 8+ hours of trying to get communications.

[Kevin Sharpe]

online consensus seems to be that BMS is using LTC6812;

https://www.analog.com/en/products/ltc6 ... t-overview

https://cabrioev.blogspot.com/2019/01/h ... board.html

[Kevin Sharpe]

I have struggled myself trying to get it to work with the available dev kits from LTC, had no real luck getting it working.

Is this what you were using Tom?

https://www.analog.com/en/design-center ... b-overview

[tom91]

I have struggled myself trying to get it to work with the available dev kits from LTC, had no real luck getting it working.

Is this what you were using Tom?

https://www.analog.com/en/design-center ... b-overview

DCA2617A with an LTC6820 on it. I have found some others who tried the same as myself and just found it too much of a struggle to get working.

I would almost think Tesla has taken the ISO-SPI and gave it their own spin, like they done with the Model S battery slaves.

[Kevin Sharpe]

Battery module 3D CAD models

viewtopic.php?f=10&t=123#p3644

[Jack Bauer]

Some info on this thread :
https://www.diyelectriccar.com/forums/s ... 99509.html

Of course the github rerpo is now empty. Guy must have retired to Lanzarote after selling the ip.

[Jack Bauer]

and then we get this : https://teslaownersonline.com/threads/d ... ost-269950

Oh well, let's see what a nice new Keysight deep memory scope makes of this.

[Jack Bauer]

This little board may prove to be a way in :
https://www.maleetronic.com/boardsproje ... pi-module/

[JaniK]

The latest EVTV video explains how they managed to query the individual cell voltages from the packs.
Gooood stuff.

[Jack Bauer]

The latest EVTV video explains how they managed to query the individual cell voltages from the packs.
Gooood stuff.

Where is that explained?

[JaniK]

Quickly go to exactly 27minutes and play it forward for 90seconds.

"Identified by ID type request"
"UDS request over CAN to the high voltage controller." They were able to retrieve individual cell data.

Little longer on video:
"Time between these messages to get the cell data is 3ms"

They wrote a program to do that. I have no idea how to replicate that, but that is the principle of how it works.

Hope this helps.

[muehlpower]

I have a complete Model3 battery in US version that I want to use for my project and an additional EU charger. If that can help somehow.

[Jack Bauer]

Thanks will be great to compare notes. My first plan is to get the pcs (charger and dcdc) running in the E46 touring then go at the weird iso-spi comms between the battery modules and the hv controller.

[Kevin Sharpe]

[Jack Bauer]

Let's see what this baby makes of Elon's weird bms comms ...

[cloudy]

A little overkill perhaps?! That's a rather nice (and expensive) scope! :

[Bentto]

WTF that's a serious badboy.

[Jack Bauer]

Only the best for Mr.Musk:)

[clanger9]

Crikey, where did you steal acquire that from??

[Jack Bauer]

Let's see if we can figure out what Batbrain and the Boy blunder are at.......

[Kevin Sharpe]

Crikey, where did you steal acquire that from??

https://twitter.com/EvBmw/status/124319 ... 47526?s=20

[Jack Bauer]

Datasheet for the isolation transformer used on the bms comms.