Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Let the hacking begin... (Model S parts on the bench)

This site may earn commission on affiliate links.
OK, spent 30 seconds on it before dinner. Voltages start at 0.0V and are in increments of 0.000305V. No crazy formulas, as expected. Edit/update: Yep, looks like someone wanted a 0-5V range to fit in 14 bits.

- - - Updated - - -

Temperatures are similarly simple. 14-bit signed value, no offset, 0.0122C scaling. Gives a range from -100 to 100C

Edit: Lets see if I can identify Jack's temperature value before my wife calls me...

Interesting! I guess Arthur's initial guess that the 14th bit was a signal type just colored my perception. I suppose that makes sense but it makes creating a DBC file a lot harder.

Well, it's good that we know the proper scaling factor now.
 
The TI chip on the monitoring boards of each module uses a 14-bit ADC with a 0 to 6.250V range and a 2.5 V precision reference. Here is a snippet from the user's guide:

The converter returns 14 valid unsigned magnitude bits in the following format:
<00xxxxxx xxxxxxxx>

Each word is returned in big-endian format in a register pair consisting of two adjacent 8-bit registers. The MSB of the word is located in the lower-address register of the pair, i.e., data for cell 1 is returned in registers 0x03 and 0x04 as 00xxxxxx xxxxxxxxb.


Cell Voltage Measurements

Converting the returned cell measurement value to a dc voltage (in mV) is done using the following formula (all values are in decimal).

mV = (REGMSB x 256 + REGLSB) x 6250 / 16383

Example:

Cell_1 == 3.35 V (3350 mV);

After conversion, REG_03 == 0x22; REG_04 == 0x4d

0x22 x 0x100 + 0x4d = 0x224d (8781.)

8781 x 6250 / 16,383 = 3349.89 mV ~ 3.35 V


i'm thinking that the Cell and modules voltage (and temperatures) are sent using this format to the main BMS board at the back of the pack, where they are then scaled and reformatted and sent over the CAN. From looking at Kalud's data i had guessed that they were biased to 2.5V with a 0 to 5V range over 14-bits.

So would the formula would be this: [value x 5000 / 16383] + 2500 = cell mV

----------
edit:

i was using 0x0AFA (2810d), in the 6% soc listing from Kalud's post 630 data and the 2500 seemed to be necessary to get the correct cell voltage of 3.353...

2810 x 5000 / 16383 = 857 mV + 2500 mV = 3353 mV or 3.353 V

Can someone post a few lines in hexidecimal of ID 6F2 data?
 
Last edited:
Yeah, I'm pretty inclined to trust the built in diagnostic screen. When I set to 0x001 I get 0.000305V on the CAN diagnostic page for that value. Bump to 0x002 I get 0.00061V, etc all the way up to 5V.
 
And now for something completely different... though still on topic. Has anyone got a capture from the powertrain bus where they're charging the car on a car with the gen2 charger/s? I'm wondering what the difference is between the gen1 and gen2 chargers.
 
And now for something completely different... though still on topic. Has anyone got a capture from the powertrain bus where they're charging the car on a car with the gen2 charger/s? I'm wondering what the difference is between the gen1 and gen2 chargers.

I have cars with both, so, I've been planning on doing this... but I was waiting to actually get a loose charger before messing with it.

Gen1 and Gen2 are completely different beasts. Gen1 is one single phase 40A input charger. Gen2 is actually three different 16A chargers that can be parallel input on single phase for single phase markets or input from three phase for three phase markets. Each individual module in the Gen2 charger appears to be controlled individually.

Additionally, evidence suggests that the car is expected to verify the charger firmware as well since there seem to be quite a few changes there, especially between Gen1 and Gen2.
 
@wk057

Regarding the 0x306 ID, what exactly is the scale factor, you mentioned a -40C offset. I don't have any recent logs, so the only ones I have I had to look up historical weather data for, based on Wunderground it seems as though it was about 68°F when I took the logs. In the logs from that day 0x306 is reading 0x44 0x45 0x44 0x4E 0x46 0x43 0xAB 0x7D, so how exactly is your scale applied? Great work by the way!
 
I need to add that if the passive cooling target is still set to 30C in this software version, I have the fans kicks in when charging and cells getting to 30.0C (with a /100 factor). Someone wk057/Ingineer could you please post the current Passive, Active cooling and active heating targets from the Thermal Management screen.

Originally the passive/active targets were 40/55, then they changed to 30/55, and then were changed again to 30/50 (per recent post by wk).
 
I have cars with both, so, I've been planning on doing this... but I was waiting to actually get a loose charger before messing with it.

Gen1 and Gen2 are completely different beasts. Gen1 is one single phase 40A input charger. Gen2 is actually three different 16A chargers that can be parallel input on single phase for single phase markets or input from three phase for three phase markets. Each individual module in the Gen2 charger appears to be controlled individually.

Additionally, evidence suggests that the car is expected to verify the charger firmware as well since there seem to be quite a few changes there, especially between Gen1 and Gen2.

Will be interesting to see if there is a Gen3 in the wild. With some way to take 32A from the primary phase and 2 x16A on the second and third phases. This would make sense for EU, and also the new charging setup in the X.
 
Also, for those other data geeks out there.

Heating the battery pack from -6 degree Celcius with the battery coolant heater. Huge frozen mass, heating is about 2C/min Here's the temperature curve:

This sounds way too fast for battery heater alone. This would mean the ~1 hour I need for max battery performance would raise the temperature to somewhere around 120C.
 
Just some driving around with the pack heater off raised the pack from 5C to about 35C in no time (20-30 minutes or so of highway driving). The pack heater alone only gets so hot, also, so the taper near the end to get the last few degrees in max power mode take a while.
 
Seeing the Pack Voltage rise during charging is expected, and then as the
charging current drops to zero at the end, the PV should drop a little bit.

From its resting voltage, forcing current in raises the voltage a bit,
and taking current out drops the voltage a bit. The "bit" increases
as the current increases, and in a "stiff" battery chemistry the bit
is small, but in a "soft" chemistry the bit can be quite substantial.
The larger the "bit", the more energy is lost, usually to heating
the battery, during regen or charging, and during discharging.

So, one puts more energy into the battery than it stores, and
gets less usable energy out than was stored. The loss going
in, and out, usually shows up as heat inside the battery.
 
with the meds or whatever you're trying to do about it.

I would suggest that you just delete everything that you directed at Obrien. The reason is it's entirely unnecessary, and serves no benefit. Especially going so far as to suggest mental illness. I do understand where you're coming from, and I've said the same thing before. But, as an outside observer it doesn't help achieve the ultimate goal. Not only does it alienate him and his efforts, but it alienates others as well when they see insults like that flying around.

I say this as someone who doesn't believe any of this CAN stuff is commercially viable. So far the only one that's made any money is Jason, and that's because he somehow managed to find a vulnerability. Which isn't really impressive itself until you realize that not only did Tesla do a pretty damn good gob of security, but it's already been through a previous third-party vulnerability study.

But, this CAN stuff? It's work, and it's effort to decode everything. But is it commercially viable in terms of REAL money? I don't think so. I fully support anyone's desires to sell something to pay back for it's tooling/prototyping/manufacturing cost. That's totally okay, but I haven't seen anyone go beyond that so I don't know what the fuss is all about.
 
and even if it is commercially viable, quietly take what you can from the thread and try to disclose your commercial interests when you deal with people (reverse engineering stuff) privately so as not to upset them when you go to make money from their work. Contributing a little (of what turned out to be incorrect) information on this thread and then insulting a poster does not contribute to your commercial cause. I'm just now going back and fixing the 0x6F2 temp and voltage formatting in my logger code.
 
The Tesla Diagnostics Connector pin 3 is described previously as
being a K bus ISO9141 line. Is this line used in the Model S?
If so, for what, please?

The TDC is also described as having 4 CAN buses, 3 and 6 at 500k bits
per second, and two slower buses (2 and 4) at 125k bps. Apparently
CAN3 has most of the powertrain info, and a fair number of the MsgIDs
have been examined enough to find useful information.

When charging via J1772 (AC power in, as with the HPWC or UMC) there
is a Pilot line into the car, where the duty cycle of the 1k Hz signal tells
the car the Maximum AC Current to draw through the charging cable
from the connected power source, typically around 8 to 80 amps.

Apparently, as an extension to the original J1772 specifications,
making the duty cycle low, at 5%, is a request to go to digital
communications mode. When Supercharging, or Chademo
charging with Tesla's adapter, the car and the charger begin
a 33.33 kHz CAN type (single line to ground) communication
which we have studied in detail. We will share our results
with the right "open source" type serious investigators.

We wonder if this Pilot/CAN signal shows up on that "K-line"
pin on the TDC, or somewhere else easy to access, like perhaps
the OBD connector (but we do not think it appears on the OBD
connector).

My CAN-Do program has been used to examine and graph
the logs that we have produced. I do not yet know how my
program compares to other more recent programs, but it
is available online for non-commercial CAN investigation.
 
Yes but at least you can catch up here, whereas you would have missed out on meeting all of us in Asheville if you stayed home. :)

Thanks for the rides and the demos. Really cool to see your work in person.

I CAN3 logged a supercharger session a couple of days ago. It appears that the master charger in the car is doing the talking and relays relevant CAN messages to and from the supercharger. Specifically, there is one from the supercharger for if the stall is shared or not, how much power is available, etc. On the flip side, the supercharger listens for CAN messages from the car describing how much power to provide, and at what voltage, along with some other status things such as the car's VIN. Also appears the serial number of the supercharger is sent at some point to the car.
 
  • Love
Reactions: worldburger
Can you log what happens with the motors at 235 kph (145 mph) to 250 (155) on the P85D. I think the P85D only use the front motor above that speed because the large rear engine is not able to give power above 235 (145) because it does hit the rpm limit.
 
I would suggest that you just delete everything that you directed at Obrien. The reason is it's entirely unnecessary, and serves no benefit. Especially going so far as to suggest mental illness. I do understand where you're coming from, and I've said the same thing before. But, as an outside observer it doesn't help achieve the ultimate goal. Not only does it alienate him and his efforts, but it alienates others as well when they see insults like that flying around.

I say this as someone who doesn't believe any of this CAN stuff is commercially viable. So far the only one that's made any money is Jason, and that's because he somehow managed to find a vulnerability. Which isn't really impressive itself until you realize that not only did Tesla do a pretty damn good gob of security, but it's already been through a previous third-party vulnerability study.

But, this CAN stuff? It's work, and it's effort to decode everything. But is it commercially viable in terms of REAL money? I don't think so. I fully support anyone's desires to sell something to pay back for it's tooling/prototyping/manufacturing cost. That's totally okay, but I haven't seen anyone go beyond that so I don't know what the fuss is all about.

This stuff you guys are doing is so cool. I wish you could all get along, those of you that have disagreements. As someone with technical background, but nowhere near the EE level the heavy-weights on this thread have, I would like to see relevant diagnostic/telemetry/temperature read-only information either in app form, or more preferably, from the center screen and in real-time. For this, I would actually pay money for. I would be extremely hesitant to subscribe to something, but a reasonable one-time fee is something I would strongly entertain as I'm sure most technical people on this forum would. So there might be a commercial application for all your hard work after all. Just let us know.