Tesla Wall Connector load sharing protocol

[ctr]

Not sure if this has been discussed in the existing HPWC/WC thread yet, but for the sake of discussion (and people being able to find this info afterwards) I'm opening up a new thread to discuss this.

The new 80A single-phase (US) / 32A three-phase (EU) wall connector has an option to daisy chain multiple wall connectors, eventually enabling load sharing. The master unit has to be configured to the max. line power and subsequent units set to slave mode. For signaling there is a D+/D- (IN/OUT) wiring between the units, from master to slave, on to further slaves if applicable. According to an answer from Tilburg (Netherlands) this is currently pretty much "dumb" signaling, with the master telling the slave(s) what's "left". This brings me to an interesting idea to actually run the first and only wall connector in slave mode and actual tell it through D+/D- (IN) how much power it may draw, allowing for dynamic load assignment (i.e. based on tariff or solar power production. So I'd like to "simulate" a master unit.

Did anyone measure the current on D+/D- (OUT) on one of the new wall connectors yet? I assume its either a simple dynamic resistor value (based on settings of master unit), similar to type-1/type-2 plug CP/PP signaling or an actual simple bus (maybe RS422?) with discrete power signaling. In either case it should be pretty trivial to simulate the signaling, turning the new wall connector into "dynamic output mode".

 

[MP3Mike]

We have heard that there is more going on than just how much power is left. The power is split based on the SoC of the vehicles. So if one vehicle is at 25% and the other at 75% the car at 25% will get more of the available power. And you can have 4 of them on the bus.

I haven't heard of anyone trying to hack the protocol, but I can imagine that an interface to do what you want would be welcomed by a number of people. (others have used the API to control the charging rate on the car instead of on the HPWC.)

 

[scaesare]

We have heard that there is more going on than just how much power is left. The power is split based on the SoC of the vehicles. So if one vehicle is at 25% and the other at 75% the car at 25% will get more of the available power. And you can have 4 of them on the bus.

I haven't heard of anyone trying to hack the protocol, but I can imagine that an interface to do what you want would be welcomed by a number of people. (others have used the API to control the charging rate on the car instead of on the HPWC.)

I didn't think charge current could be manipulated via the API?

Did somebody find that in the HTTP command set despite the official Tesla apps not offering that functionality?

 

[MP3Mike]

I didn't think charge current could be manipulated via the API?

Did somebody find that in the HTTP command set despite the official Tesla apps not offering that functionality?

I thought I read that it did. I'm pretty sure that @wk057 is controlling the charge current for his cars, but maybe he hacked the HPWC itself. (or maybe I am confusing it with him just starting/stopping the charging and he wanted to control the current.)

 

[scaesare]

I thought I read that it did. I'm pretty sure that @wk057 is controlling the charge current for his cars, but maybe he hacked the HPWC itself. (or maybe I am confusing it with him just starting/stopping the charging and he wanted to control the current.)

He did hack the HPWC so he could control the pilot signal it sends to the car, which will then throttle the current. He does this in conjunction with his solar array and home storage battery battery monitoring setup.

 

[ctr]

We have heard that there is more going on than just how much power is left. The power is split based on the SoC of the vehicles. So if one vehicle is at 25% and the other at 75% the car at 25% will get more of the available power. And you can have 4 of them on the bus.

Thats exactly the opposite of what I have heard, saying that this would not be possible as SoC is not communicated over CP/PP and since its a standard Type1/2 connector such a functionality (while technically possible with some quirks like Supercharging over Type1/2) would not work with other cars anyway, so there is no way to rely on this information.

Additionally power control via API might be on its way, but its not there yet afaik.

I'll just do some measurements when its installed then...

 

[MP3Mike]

Thats exactly the opposite of what I have heard, saying that this would not be possible as SoC is not communicated over CP/PP and since its a standard Type1/2 connector such a functionality (while technically possible with some quirks like Supercharging over Type1/2) would not work with other cars anyway, so there is no way to rely on this information

Someone with two of the new HPWCs and cars has confirmed that it does take SoC into account. I think with the new WCs that it doesn't 100% use the J1772 protocol when hooked to a Tesla.

 

[M_VdM]

What's up with HPWC?

Have a look over there ...
Looks like that 's a RS-485 bus (Wikipedia article) !

 

[ctr]

Interesting that they labeled it RS485, afaik (this is also what Wikipedia says) RS485 is a 2wire bi-directional Bus, but they have discrete "IN" and "OUT" which would rather indicate RS422 (actually many claim RS422 is a substandard of RS485) which is what I assumed from the very beginning. Good, RS485 or RS422 are standard enough to not break things physically and hack around to see whats possible...

 

[ctr]

Alright, I tried in RS485 4wire mode (haven't tried RS422 mode yet) and received some stuff. Baud rate is 9600

Does anyone see the packet pattern here? Afaict its at least two different types in master mode, even more in slave mode.
Except for slave mode the packets are only send when reconnecting the HPWC or pressing the reset button, nothing continuous (although I havent tried very long). I also did not connect the car yet, I'm pretty sure something is being sent as soon as charging starts.

 

[ctr]

Some more analysis, as far as I can see there are just two different message types in master mode, but both carry the same data (byte order is just swapped) and both are 10 bytes long. I'll call them c0 messages (because they start with c0) and f8 messages (as they end in f8).

6A
c00d c0fe e1fc 7801 00b3
0d00 fec0 fcc0 01e1 b378
c00e c0fe e2fb 7801 00b3
0e00 fec0 fbc0 01e2 b378
c00e c0fe e1fc 7801 0025
7f00 fec0 fcc0 01e1 2578
c080 c0fe e2fb 7801 0025
8000 fec0 fbc0 01e2 2578
0b00 fec0 fcc0 01e1 b178
c00b c0fe e1fc 7801 00b1

8A
c080 c0fe e1fc 7801 00ae
0800 fec0 fcc0 01e1 ae78
0900 fec0 fbc0 01e2 ae78
c009 c0fe e2fb 7801 00ae

10A
0900 fec0 fcc0 01e1 0078
6d00 fec0 fbc0 01e2 0078
6e00 fec0 fbc0 01e2 0078

13A (0x0d)
6e00 fec0 fcc0 01e1 7d78
c0d7 c0fe e1fc 7801 007d
d800 fec0 fbc0 01e2 7d78
c0d8 c0fe e2fb 7801 007d

16A (0x10) - 11kW 0x0b
c0d8 c0fe e1fc 7801 00b0
0a00 fec0 fcc0 01e1 b078
c00b c0fe e2fb 7801 00b0
0b00 fec0 fbc0 01e2 b078

20A (0x14)
0b00 fec0 fcc0 01e1 5d78
c0b7 c0fe e1fc 7801 005d
b800 fec0 fbc0 01e2 5d78
c0b8 c0fe e2fb 7801 005d

25A (0x19)
c0b8 c0fe e1fc 7801 0017
7100 fec0 fcc0 01e1 1778
c072 c0fe e2fb 7801 0017
7200 fec0 fbc0 01e2 1778

32A (0x20)
c072 c0fe e1fc 7801 0018
7200 fec0 fcc0 01e1 1878
c073 c0fe e2fb 7801 0018
7300 fec0 fbc0 01e2 1878


SLAVE
c015 c0fe e2fd 7801 0c2e 0080
1500 fec0 fdc0 01e2 2e78 800c

It seems the c0 message carries a current specific value in the 10th byte, the f8 message in the 9th byte. I couldn't find any check sums in the messages, so the structure should be fairly trivial.
"c0fe" and "fec0" but also the first byte of a 78 message seem to prepend / carry an incrementing counter, but with an unknown offset.

 

[M_VdM]

Take a look at this Dutch thread High Power Wall Charger Mk II ...
Looks like the team of Cohere / Maxem cracked the code !?!

 

[ctr]

Yes it seems they reverse-engineered (I wouldn't call this cracking a code) the protocol, but unfortunately they are not willing to share their findings. Again, this is not rocket science, but I do not have the time to do this anytime soon.

 

[M_VdM]

I had a closer look at this. Only had the file “tesla hpwc log.txt” (see above, thanks ctr) to work from.
I have no access to any Tesla hardware (yet) !

So I ‘m not sure about the methodology used, the timing(s) & direction of those signals ...
I rearranged the data, but let the “0000” packets in. They appear important.

Have a look at the attached files. (Sorry but TMC-forum only takes TXT- or PDF-files)

Some stuff jumped out (mark the colour coding):

• The words “c0fe”, “fec0” + “7801” reappear in every telegram.
• In the scenario “Slave Reconnected”, all telegrams are identical.

Happy deciphering !

 

[ViviV]

A related question which I hope someone can help me with....if we currently have an 80 amp 2015 HPWC, but we would like to have the option of sharing the electrical signal between 2 Teslas using 2 wall connectors installed on the same 100 amp circuit do we need to purchase 2 of the new generation wall connectors or is there a way to convert or use the old one to share with one of the new ones? In other words, do we need to buy 1 or 2 of the new WC?

 

[MP3Mike]

A related question which I hope someone can help me with....if we currently have an 80 amp 2015 HPWC, but we would like to have the option of sharing the electrical signal between 2 Teslas using 2 wall connectors installed on the same 100 amp circuit do we need to purchase 2 of the new generation wall connectors or is there a way to convert or use the old one to share with one of the new ones? In other words, do we need to buy 1 or 2 of the new WC?

You need 2 of the new WCs.

 

[Ulmo]

He did hack the HPWC so he could control the pilot signal it sends to the car, which will then throttle the current. He does this in conjunction with his solar array and home storage battery battery monitoring setup.

Why this isn't standard for all Tesla products I can't fathom.

 

[Ulmo]

Have you tried recording after connecting the car?

 

[Bart Cerneels]

Why this isn't standard for all Tesla products I can't fathom.

Because they are made by different manufacturers.
Don't forget Tesla is an OEM, which means they manly do design, marketing and assembly, not manufacturing of electronics. And they will contract out most of the specialized engineering work like any other auto manufacturer.

 

[Ulmo]

He did hack the HPWC so he could control the pilot signal it sends to the car, which will then throttle the current. He does this in conjunction with his solar array and home storage battery battery monitoring setup.

I'm looking to do something like this myself. I can't find any work by others I could build on. I already have latest version of HPWC.