TMC is an independent, primarily volunteer organization that relies on ad revenue to cover its operating costs. Please consider whitelisting TMC on your ad blocker or making a Paypal contribution here: paypal.me/SupportTMC

New Wall Connector load sharing protocol

Discussion in 'Model S: Battery & Charging' started by ctr, Jul 1, 2016.

  1. ctr

    ctr Member

    Joined:
    Oct 15, 2014
    Messages:
    7
    Location:
    Germany
    Not sure if this has been discussed in the existing HPWC/WC thread yet, but for the sake of discussion (and people being able to find this info afterwards) I'm opening up a new thread to discuss this.

    The new 80A single-phase (US) / 32A three-phase (EU) wall connector has an option to daisy chain multiple wall connectors, eventually enabling load sharing. The master unit has to be configured to the max. line power and subsequent units set to slave mode. For signaling there is a D+/D- (IN/OUT) wiring between the units, from master to slave, on to further slaves if applicable. According to an answer from Tilburg (Netherlands) this is currently pretty much "dumb" signaling, with the master telling the slave(s) what's "left". This brings me to an interesting idea to actually run the first and only wall connector in slave mode and actual tell it through D+/D- (IN) how much power it may draw, allowing for dynamic load assignment (i.e. based on tariff or solar power production. So I'd like to "simulate" a master unit.

    Did anyone measure the current on D+/D- (OUT) on one of the new wall connectors yet? I assume its either a simple dynamic resistor value (based on settings of master unit), similar to type-1/type-2 plug CP/PP signaling or an actual simple bus (maybe RS422?) with discrete power signaling. In either case it should be pretty trivial to simulate the signaling, turning the new wall connector into "dynamic output mode".
     
    • Love x 1
  2. MP3Mike

    MP3Mike Active Member

    Joined:
    Feb 1, 2016
    Messages:
    1,628
    Location:
    Oregon
    We have heard that there is more going on than just how much power is left. The power is split based on the SoC of the vehicles. So if one vehicle is at 25% and the other at 75% the car at 25% will get more of the available power. And you can have 4 of them on the bus.

    I haven't heard of anyone trying to hack the protocol, but I can imagine that an interface to do what you want would be welcomed by a number of people. (others have used the API to control the charging rate on the car instead of on the HPWC.)
     
  3. scaesare

    scaesare Active Member

    Joined:
    Mar 14, 2013
    Messages:
    3,938
    Location:
    NoVA
    I didn't think charge current could be manipulated via the API?

    Did somebody find that in the HTTP command set despite the official Tesla apps not offering that functionality?
     
  4. MP3Mike

    MP3Mike Active Member

    Joined:
    Feb 1, 2016
    Messages:
    1,628
    Location:
    Oregon
    I thought I read that it did. I'm pretty sure that @wk057 is controlling the charge current for his cars, but maybe he hacked the HPWC itself. (or maybe I am confusing it with him just starting/stopping the charging and he wanted to control the current.)
     
  5. scaesare

    scaesare Active Member

    Joined:
    Mar 14, 2013
    Messages:
    3,938
    Location:
    NoVA
    He did hack the HPWC so he could control the pilot signal it sends to the car, which will then throttle the current. He does this in conjunction with his solar array and home storage battery battery monitoring setup.
     
  6. ctr

    ctr Member

    Joined:
    Oct 15, 2014
    Messages:
    7
    Location:
    Germany
    Thats exactly the opposite of what I have heard, saying that this would not be possible as SoC is not communicated over CP/PP and since its a standard Type1/2 connector such a functionality (while technically possible with some quirks like Supercharging over Type1/2) would not work with other cars anyway, so there is no way to rely on this information.

    Additionally power control via API might be on its way, but its not there yet afaik.

    I'll just do some measurements when its installed then...
     
  7. MP3Mike

    MP3Mike Active Member

    Joined:
    Feb 1, 2016
    Messages:
    1,628
    Location:
    Oregon
    Someone with two of the new HPWCs and cars has confirmed that it does take SoC into account. I think with the new WCs that it doesn't 100% use the J1772 protocol when hooked to a Tesla.
     
  8. M_VdM

    M_VdM Member

    Joined:
    Mar 31, 2016
    Messages:
    6
    Location:
    Izegem, Belgium
  9. ctr

    ctr Member

    Joined:
    Oct 15, 2014
    Messages:
    7
    Location:
    Germany
    Interesting that they labeled it RS485, afaik (this is also what Wikipedia says) RS485 is a 2wire bi-directional Bus, but they have discrete "IN" and "OUT" which would rather indicate RS422 (actually many claim RS422 is a substandard of RS485) which is what I assumed from the very beginning. Good, RS485 or RS422 are standard enough to not break things physically and hack around to see whats possible...
     
  10. ctr

    ctr Member

    Joined:
    Oct 15, 2014
    Messages:
    7
    Location:
    Germany
    Alright, I tried in RS485 4wire mode (haven't tried RS422 mode yet) and received some stuff. Baud rate is 9600

    Does anyone see the packet pattern here? Afaict its at least two different types in master mode, even more in slave mode.
    Except for slave mode the packets are only send when reconnecting the HPWC or pressing the reset button, nothing continuous (although I havent tried very long). I also did not connect the car yet, I'm pretty sure something is being sent as soon as charging starts.
     

    Attached Files:

  11. ctr

    ctr Member

    Joined:
    Oct 15, 2014
    Messages:
    7
    Location:
    Germany
    #11 ctr, Jul 10, 2016
    Last edited: Jul 10, 2016
    Some more analysis, as far as I can see there are just two different message types in master mode, but both carry the same data (byte order is just swapped) and both are 10 bytes long. I'll call them c0 messages (because they start with c0) and f8 messages (as they end in f8).
    Code:
    6A
    c00d c0fe e1fc 7801 00b3
    0d00 fec0 fcc0 01e1 b378
    c00e c0fe e2fb 7801 00b3
    0e00 fec0 fbc0 01e2 b378
    c00e c0fe e1fc 7801 0025
    7f00 fec0 fcc0 01e1 2578
    c080 c0fe e2fb 7801 0025
    8000 fec0 fbc0 01e2 2578
    0b00 fec0 fcc0 01e1 b178
    c00b c0fe e1fc 7801 00b1
    
    8A
    c080 c0fe e1fc 7801 00ae
    0800 fec0 fcc0 01e1 ae78
    0900 fec0 fbc0 01e2 ae78
    c009 c0fe e2fb 7801 00ae
    
    10A
    0900 fec0 fcc0 01e1 0078
    6d00 fec0 fbc0 01e2 0078
    6e00 fec0 fbc0 01e2 0078
    
    13A (0x0d)
    6e00 fec0 fcc0 01e1 7d78
    c0d7 c0fe e1fc 7801 007d
    d800 fec0 fbc0 01e2 7d78
    c0d8 c0fe e2fb 7801 007d
    
    16A (0x10) - 11kW 0x0b
    c0d8 c0fe e1fc 7801 00b0
    0a00 fec0 fcc0 01e1 b078
    c00b c0fe e2fb 7801 00b0
    0b00 fec0 fbc0 01e2 b078
    
    20A (0x14)
    0b00 fec0 fcc0 01e1 5d78
    c0b7 c0fe e1fc 7801 005d
    b800 fec0 fbc0 01e2 5d78
    c0b8 c0fe e2fb 7801 005d
    
    25A (0x19)
    c0b8 c0fe e1fc 7801 0017
    7100 fec0 fcc0 01e1 1778
    c072 c0fe e2fb 7801 0017
    7200 fec0 fbc0 01e2 1778
    
    32A (0x20)
    c072 c0fe e1fc 7801 0018
    7200 fec0 fcc0 01e1 1878
    c073 c0fe e2fb 7801 0018
    7300 fec0 fbc0 01e2 1878
    
    
    SLAVE
    c015 c0fe e2fd 7801 0c2e 0080
    1500 fec0 fdc0 01e2 2e78 800c
    It seems the c0 message carries a current specific value in the 10th byte, the f8 message in the 9th byte. I couldn't find any check sums in the messages, so the structure should be fairly trivial.
    "c0fe" and "fec0" but also the first byte of a 78 message seem to prepend / carry an incrementing counter, but with an unknown offset.
     
  12. M_VdM

    M_VdM Member

    Joined:
    Mar 31, 2016
    Messages:
    6
    Location:
    Izegem, Belgium
  13. ctr

    ctr Member

    Joined:
    Oct 15, 2014
    Messages:
    7
    Location:
    Germany
    Yes it seems they reverse-engineered (I wouldn't call this cracking a code) the protocol, but unfortunately they are not willing to share their findings. Again, this is not rocket science, but I do not have the time to do this anytime soon.
     
  14. M_VdM

    M_VdM Member

    Joined:
    Mar 31, 2016
    Messages:
    6
    Location:
    Izegem, Belgium
    I had a closer look at this. Only had the file “tesla hpwc log.txt” (see above, thanks ctr) to work from.
    I have no access to any Tesla hardware (yet) !

    So I ‘m not sure about the methodology used, the timing(s) & direction of those signals ...
    I rearranged the data, but let the “0000” packets in. They appear important.

    Have a look at the attached files. (Sorry but TMC-forum only takes TXT- or PDF-files)

    Some stuff jumped out (mark the colour coding):
    • The words “c0fe”, “fec0” + “7801” reappear in every telegram.
    • In the scenario “Slave Reconnected”, all telegrams are identical.
    Happy deciphering !
     

    Attached Files:

  15. ViviV

    ViviV Member

    Joined:
    Sep 12, 2016
    Messages:
    24
    Location:
    Southern New Jersey
    A related question which I hope someone can help me with....if we currently have an 80 amp 2015 HPWC, but we would like to have the option of sharing the electrical signal between 2 Teslas using 2 wall connectors installed on the same 100 amp circuit do we need to purchase 2 of the new generation wall connectors or is there a way to convert or use the old one to share with one of the new ones? In other words, do we need to buy 1 or 2 of the new WC?
     
  16. MP3Mike

    MP3Mike Active Member

    Joined:
    Feb 1, 2016
    Messages:
    1,628
    Location:
    Oregon
    You need 2 of the new WCs.
     
    • Informative x 1
    • Like x 1

Share This Page