Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Vendor BMS_u029 Scammers, Toolbox Is Onto You…

This site may earn commission on affiliate links.
So...

We recently had a very interesting situation arise with an out of balance pack that came in with a BMS_u018 imbalance alert and a voltage delta of 120 mV. Pretty standard stuff and we go to work.

Problem was that when we ran the full diagnostics, the CAC was pretty much even across the board and very much in line with the mileage.

But that’s the opposite of how an imbalance would show up, and we couldn’t sort out why the voltage on one brick was completely off. There was no BMS_u029 present, no weak short data on any of the bricks and the BMBs looked good. Maybe one of the bleed resistors on the BMB was stuck open??

Then, one of our techs then suggested that maybe the BMS_u029 has been reset...

So… we log into Toolbox and what so we see? Low and behold, turns out the BMS had detected a weak short and had been spewing out BMS_w117 Weak Short alerts on the low voltage brick for over a month 😮, bleeding about 225 mAh per day, or roughly 0.1% SoC every day, more than enough to trigger a BMS_u029…

What's more, about two weeks prior to coming into our service center the pack had thrown an over-voltage error (ie. one of the bricks exceeded 4.2V) and then the BMS begins charge limiting the pack to ~3.62 volts (roughly 48% SoC). Then a few days later the BMS is reset, clearing any weak short data logged internally, the charge limit disappears and the vehicle starts charging again normally... very interesting...

And then finally, a week or two later the BMS suddenly shuts down the pack, this time for good and starts throwing BMS_u018 imbalance alerts as the pack continues to bleed out.

But here's the BIG takeaway, ALL of these details - all the data signals, all the alerts and all the ECU history are now available in the latest version of ToolBox 3 in their Periscope tool (recently renamed CAN Viewer in Toolbox 3) - available for any tech, any dealership, any owner to take to a service center for a Pre-Purchase Inspection (PPI).

Now, for good measure we pulled the defective module and set it up on our new IRQ testing rig and we were able to identify the exact runaway cell in question (red in the last pic), along with a few other cells (in pink) with high, but manageable, Internal Resistance (IR). Turns out the runaway cell was bleeding about 225 mAh per day, or about 8% of its total capacity per day. As a point of reference, a cell like this would normally take 2-3 years to fully discharge - instead with weak short it would fully discharge in less that two weeks - in some cases we've seen them completely drain in less than 24 hours. 😮

All in all, some pretty interesting forensics. What's more, it's now all available to any tech, dealership or owner.

As they say, ‘sunlight is the best disinfectant.’

Note: for privacy reasons we've not included dates and/or ECU reset details.
 

Attachments

  • Exported at 03-20-2024 13-54 CDT.png
    Exported at 03-20-2024 13-54 CDT.png
    64 KB · Views: 26
  • Exported at 03-20-2024 13-53 CDT.png
    Exported at 03-20-2024 13-53 CDT.png
    32 KB · Views: 17
  • toolbox.jpg
    toolbox.jpg
    72.4 KB · Views: 18
  • IMG_3356 copy.jpg
    IMG_3356 copy.jpg
    608.7 KB · Views: 19
Last edited:
Thanks for sharing all of this information!

What's more, about two weeks prior to coming into our service center the pack had thrown an over-voltage error (ie. one of the bricks exceeded 4.2V) and then the BMS begins charge limiting the pack to ~3.62 volts (roughly 48% SoC). Then a few days later, the BMS is reset clearing any weak short data logged internally, the charge limit disappears and the vehicle starts charging again normally…. very interesting...

And then finally, a week or two later the BMS suddenly shuts down the pack, this time for good and starts throwing BMS_u018 imbalance alerts as the pack continues to bleed out.

How much did your customer pay to get the BMS reset, gaining them nothing more than two weeks of continued use of the pack?
 
  • Like
Reactions: Recell
we obviously can't speak to any of that - we're simply showing the diagnostics and how this is all available in Toolbox 3.

Beyond even the weak short alerts being thrown by the BMS -- 33 in total! 😮, the real tell for any prospective buyer is the charge limiting behavior in the Max Voltage readout on second graph - whether it's a BMS_u029 (which can be reset) or BMS_u018 (which can be intermittent at first until the pack eventually fails altogether)
 
Last edited:
I'm very curious to know if you think it's not outlandish to suspect the infamous mid-2019 software update that nerfed the fleet of "85kWh" battery packs was in response to reduce the risk of fires. There were a number of them in a short window of time between 2018-2019 and suddenly you don't hear about them anymore; as if they are inversely proportional to the complaints of limited range, power, and extended Supercharging sessions. It seemed that the Model S that caught fire were Supercharged to a SOC% >50 shortly before the fires began. wk057 was adamant that the software update wasn't related to the fires, but was in attempt to detect and mitigate "condition X and Z," and he published an article here:


I'm not asking you to take a position, but I value your knowledge and judgment and thought it could be enlightening to hear your thoughts on the issue.

Thanks
 
  • Like
Reactions: Recell
There was a lot going on during that period - Brick 6 failures on the BMBs, weak short issues starting to emerge (beyond simply pack imbalances), sudden rash of fires, etc.

whether it’s THE factor behind the reduced supercharging rates, unclear. but surely reduced supercharging rates would have been one of the mitigation bullets on the BMS firmware review slides circa 2019.
 
Last edited:
Cool that Tesla is allowing some log history decoding now.

Curious if you guys ever ran into any of the cars that have had a third party BMS Reset Device installed on them yet?

It's Definitely the most extreme version of the reset scam I've ever seen, mainly because it takes the BMS some real time to recover and re-detect certain dissues after such a reset (it generally always does, hence one time resets not being enough for some people to get away with it)... and in the meantime you could be left stranded or with a car that burns to the ground.

Last I heard, the one person I personally know of who ended up getting screwed buying a car that had one of these hidden on it (which I found after he ended up stranded), handed the device over to a law enforcement agency and has been trying to pursue it from a fraud perspective. Haven't heard any details since then though, but hopefully he's successful.
 
  • Like
Reactions: Recell
yes. we’ve come across these devices several times now…

this one came from a car that left the owner stranded in the middle of nowhere West Texas. no buttons for user intervention, so when left plugged in, the device will continue to auto-reset the u029, based on some undisclosed criteria. 😮

so basically it's firmware defeat, functionally equivalent to hacking into the BMS firmware with an automatic override on the weak short logic. owners have no idea if/when/how their pack is being reset.

set aside form factor, this would never get past even a basic design review.
 

Attachments

  • 6E62835B-A2EC-40BD-AFC2-8449FAA7F36F.jpeg
    6E62835B-A2EC-40BD-AFC2-8449FAA7F36F.jpeg
    743.8 KB · Views: 36
Last edited:
yes. we’ve come across these devices several times now…

this one came from a car that left the owner stranded in the middle of nowhere West Texas. no buttons for user intervention, so when left plugged in, the device will continue to auto-reset the u029, based on some undisclosed criteria. 😮

so basically it's firmware defeat, functionally equivalent to hacking into the BMS firmware with an automatic override on the weak short logic. owners have no idea if/when/how their pack is being reset.

set aside form factor, this would never get past even a basic design review.

Yep, looks pretty similar to the one I ran across.

Insane.
 
  • Like
Reactions: cpaull and Recell
yes. we’ve come across these devices several times now…

this one came from a car that left the owner stranded in the middle of nowhere West Texas. no buttons for user intervention, so when left plugged in, the device will continue to auto-reset the u029, based on some undisclosed criteria. 😮

so basically it's firmware defeat, functionally equivalent to hacking into the BMS firmware with an automatic override on the weak short logic. owners have no idea if/when/how their pack is being reset.

set aside form factor, this would never get past even a basic design review.
This is wild. i didn't even know devices like this exist. I'm guessing it's gotta be plugged into the CANBUS somewhere right? So when purchasing used, probably a good idea to check the common OBD locations on the vehicle for any foreign devices.
 
  • Like
Reactions: cpaull and Recell
...probably a good idea to check the common OBD locations on the vehicle for any foreign devices.
OBD does not have the CAN bus access needed. It seems they are installed on the Diagnostic connector (which is a bit more hidden too). There are legitimate third-party connections to the diagnostics connector, such as S3XY Buttons and some monitoring devices - so you sort of have to know a bit more than most to understand if it's a hack or not. From Recell, the photo shows what one hack device looks like.

Worse, the sneaky scammer could tap into the CAN bus at some other point in the wiring harness, but that seems far less likely. Tesla might be able to add software to detect such devices and alert the owner that a major problem exists. Since it's only an issue with very old cars, I don't see Tesla spending the effort.
 
While a device may still be present - hopefully not, if it's continuously resetting an alert - it's probably not likely to be if there's some kind of scam afoot. And if it's not, what then? Still doesn't mean that an alert hasn't been reset previously.

The real key is the ability to view the log history and understand overall battery health. Even the existence of these features now being in Toolbox 3 should serve as a reasonable deterrent against scams of this sort.

And let's not forget, it needn't be a scam for a prospective buyer to use this capability to get an overall assessment of battery health prior to any vehicle purchase. This is something we'd encourage all buyers, and even sellers, to consider in order to ensure a clean, smooth purchase transaction.👍
 
Last edited:
  • Like
Reactions: wk057 and Rocky_H
OBD does not have the CAN bus access needed. It seems they are installed on the Diagnostic connector (which is a bit more hidden too). There are legitimate third-party connections to the diagnostics connector, such as S3XY Buttons and some monitoring devices - so you sort of have to know a bit more than most to understand if it's a hack or not. From Recell, the photo shows what one hack device looks like.

Worse, the sneaky scammer could tap into the CAN bus at some other point in the wiring harness, but that seems far less likely. Tesla might be able to add software to detect such devices and alert the owner that a major problem exists. Since it's only an issue with very old cars, I don't see Tesla spending the effort.
Makes sense. I'm more familiar with the 3/Y platform where canbus is accessible from the OBD port in the rear of the center console, but the S/X sounds like its a bit different.
 
Makes sense. I'm more familiar with the 3/Y platform where canbus is accessible from the OBD port in the rear of the center console, but the S/X sounds like its a bit different.
The rear center console connector on the 3/Y is the diagnostics connector! The ODB wasn't on the early Model 3, but is now, and has always been on the Model Y. It is under the dash on the driver's side (at least with RHD vehicles). I think it is always been a black connector. It has no useful CAN data.

The diagnostics connector is typically blue or white and is not physically the same as ODB. It has all the CAN bus data available (typically 4 CAN busses). Not sure about the Cybertruck.
 
  • Informative
Reactions: MattChristian