EVTV Tesla Model 3 Full Battery Pack Controller for EV Conversions or Energy Storage Systems (ESS)

Our patent-pending battery controller for Tesla Model 3 full battery packs. This version of our controller is the solution to manage your Tesla Model 3 full battery pack's BMS. Pair this with a battery you provide to close contactors, manage charging/discharging and balancing for your unique application.

EVTV Tesla Model 3 Full Battery Pack Controller for EV Conversions or Energy Storage Systems (ESS)

We have had a Model 3 battery project going on around here some time, but it hadn't been too serious. And the reason is, we've had a lot of work involving producing a PowerSafe 15, a dozen of those. We're doing 8 or 10 of our Tesla battery module control units a week now.

And so everybody's been busy fabricating stuff. Of course, we have the PowerSafe 100, the PowerSafe 60, and then the 15, which is for marine and RV. Wayne Reavers, by the way, loves his so much, he wants me to turn it into a 30 and a 48 volt.

I tried to tell him, you can't do that. A design's kind of a design, guys. It's not a design, but all different.

And things feed into each other. Anyway, we've been very busy, but I have several Model 3 modules laying here. And Colin and I have been working on a prototype board to talk to it.

As it turns out, the chips on the battery management system for the Model 3 modules are not repurposed LTC chips. In fact, both of them are ASIC chips, or application-specific integrated circuits designed for Tesla, which is what they said. Well, they weren't kidding.

They're very specific and have some very interesting properties. They transmit in both directions in a loop and at two different frequencies. And there's two sets of chips, and they're entirely redundant, very different BMS systems.

And so there's two BMS systems on every module. And kind of some, it's like the isolated serial peripheral interface, SPI, ISO-SPI that LTC did. And it's nothing like it.

So we've never seen anything like it. We had to upgrade our test equipment to even be able to figure out what it was actually doing. Just some 100 MHz scopes with a lot of storage and so forth.

We designed a board, got it back. It did not work. Colin kind of hand-wired it into a little bit of a rat's nest and got it to sort of kind of work.

And so he did a redesign on the board, and I sent that off, oh, ten days ago. But it's Chinese New Year, so we'll get that back sometime in February. The Chinese have what they call 996 now.

And the whole country is working nine in the morning until nine at night, six days a week. And then they all go on vacation for a month. And they go on vacation on all their holidays, and they go on vacation on all our holidays, too, now.

So whenever I'm trying to do something with them, some holiday or another gets right in the middle of it. But God love them. They're working 12 hours a day, six days a week when they're not on holiday, so I don't quite blame them.

Anyway, the other aspect we have is a full Model 3 battery pack. And this week, things have kind of slowed down over the holidays. And so I started to attack the Model 3 flat battery pack.

And, you know, I got some connector diagrams and some wiring diagrams and was just kind of going over them. And we've got four people now here. Dan, who's our lead tech, Zeki, and then we have two interns, Ryan Shaw and Brandon DeGroory.

And so we've got a whole team, and they were kind of curious what I was putting around with over here. And I stopped and thought about it. And I said, you know, I've done this 3,000 times.

Why don't you guys just do it? My favorite TV show is House, and he's got a team of five or six doctors, and he poses a question to them, and they all shout different solutions. And he berates them with a great deal of sarcasm, as is the resident smartass, which I always thought, you know, I'm kind of like that. I can say smartass things and tell you you don't know what you're doing and do it over again.

And so we'll just do this like House. You guys go figure it out. The process has actually worked pretty good.

And the key is this car, if you'll recall, we took the front end off this car and put it on the other one because it was wrecked in the front. And this one's wrecked in the back. And this panel here, which includes the charge port, is actually kind of difficult to replace.

I watched some guys do it on YouTube. They had to cut it out and weld new stuff in, and it was one of those sped up videos, and it still went 20 minutes long. Just showing them running back and forth doing this, and by the time they got done, I didn't want any part of it.

So this was probably the better car. I think it only had 746 miles on it. But it was a more severe wreck for our purposes.

The other one was wrecked on the front, and the front end of the Tesla Model 3, kind of everything is just sort of bolted on there. And so we took the pieces off the front of this, including the hood, the bumper, the radiator, the crash impact stuff, headlights and everything. And one of the doors, maybe two of the doors, and put it on the other car, and it's now driving.

Richard's going to do a session on how you get one of those timings when licensed, as soon as he figures out how to do that. Leaving this car, but it's still intact, and if you connect a 12 volt battery, it comes alive. Obviously it has a few error messages.

But the important part is that the contactors close and the battery empowers the car. Now you have power for your 12 volts, and you have high voltage power when those contactors close. That's our mission with the full battery pack.

So here's one that does what we want that one on the bench to do. I'll figure out how it's doing it on the car, and we'll go do it there. What did you come up with, Danu? So what we have here, our quality test is checking, this is the gray connector that connects into the full pack on the Model 3. What is that, X098? Yeah, X098.

Yeah, that's the connector. And this ties in inside the car, I believe it goes to the vehicle control units. So what we were trying to do is figure out what it needs to wake the battery up.

So we found out that it has exactly 13 wires, and what I did was simply wire this connector from the silver car. From the rack out front. Rack out front, so I cut it, I spliced them open, and I put it on a breadboard.

And I simply used some jumper cables to go from the breadboard to the actual gray connector in the car. Now this connector is the control connector to the battery. Everything else to the battery is high voltage, to the front and rear drive, to the air conditioning and heating system.

There's some coolant connections. But all the electrical interface, our intelligent interface to the battery is through this connector. So you put that between the actual car connector and the battery.

And then what do you do with that information? So what we were trying to figure out is what we need to wake the battery up. So we tried taking one wire off at a time from the 13 wires to see how many we really need for the contactors to close. So once I got these all connected, I switched on the car and I heard the contactors close.

And so what I did was I next removed two wires, which was the, I started with the charge port can. I removed it and then I gave it 12 volts and I heard the contactors click again. So that proved that we didn't need charge port can for the contactors to close on the full pack.

So you disconnect some wires, apply the 12 volts, and you can audibly hear the contactors closing. It's a pretty loud deal. Okay.

And then, so it came down to, we only needed seven wires to really close the contactors. Because when I removed the seventh wire in there and gave 12 volts, it didn't close the contactors. So that way I found out that we needed exactly seven wires to close.

And two of those wires were the HVI loop, high voltage interlock loop. And two wires were the powertrain can. And there were two wires of 12 volts and one wire of ground.

Okay. So if you have those hooked up, you can make the contactors close. Yes.

All right. The high voltage interlock loop, Tesla doesn't like to have high voltage loose in the car unless everything's already hooked up. And so it runs out those two pins.

It's just a loop through the rear drive unit, the heater air conditioner unit, and the front drive unit if you have one. And back to the other pin, pins one and three. There's a 60 ohm resistor.

Kat, does that test apparatus meet with your quality assurance approval? She's got to get in there for video now. So as it turns out, the battery is kind of stupid. It doesn't care if you have one or both drive units hooked up.

It needs about 60 ohms to detect that that loop is closed. It'll do it at 120 as well. So sort of anything in between there would be appropriate.

So you had two wires that were 12 volts and one that's ground. There's no magic in that, right? No. Just 12 volts DC and ground.

Oh, there was another thing that you found. Something else that had to be hooked up to the battery. Yes, when we tried it on the bench, we weren't getting it to come on.

And we were thinking about what that could be. And then we found out that the car was actually giving 12 volts into the PCS, the power conversion system. There is a power conversion system inside the battery.

That's what they call it. It's the charger for the battery. But it also converts high voltage DC to 12 volts DC, really about 15 volts DC.

And so you have to apply 12 volts from the battery to that or it's not going to switch on. Anybody know why? I don't either. Anyway, you have to have those two terminals.

And the connector for this and both terminals are under the rear passenger seat on the passenger side. And so you have to have those two PCS terminals hooked up too. But you only need seven wires to the control connector.

And we have, of course, our system, the OBD2 adapter that we can plug into the powertrain can behind the console. And in fact, we have a version of that that doesn't really do OBD2. It's just a CAN monitor version that has the connectors to connect in there for analysis and monitoring with Collins' excellent SavvyCAN program.

SavvyCAN is like a poor man's version of Vector's Canoe, which is a software suite that starts at $10,000. Because it was originally written for about 17 guys worldwide. But now CAN is kind of popular.

And anyway, Cullen did a totally free open source version of Vector's suite. I actually like Cullen's better, to capture CAN, play back CAN, and so forth. And Daniel wouldn't really trust all that.

He wanted to capture it at the breadboard, at the actual place that it went into the battery. As it turns out, there's no difference. The console connection would have done just fine.

It's called the powertrain CAN, really. But a lot of people refer to it as the vehicle CAN. As opposed to three or four other CAN buses in the car for entertainment, windows, and that sort of thing.

So we did a CAN capture. And we did a playback. And it didn't work.

So we had to work on our playback speed. And go back and look at our logs. And calculate how often, at what rate these frames were thrown at.

And adjust Savvy CAN, which has controls for that, to send it at the right rate. So we put a resistor across the HVIL, fed in the CAN. And got it to close the contactors, without really anything from the car.

And we did all this on the car. It took a couple of tries. Well, yeah.

This is the problem with the reverse engineering. And as I was describing to them, it's not quite the genius event that everybody thinks. There's two schools of thought.

Nikola Tesla's and Thomas Edison's. I'm in the Edison camp. It's 1% inspiration and 99% perspiration.

And so it looks like genius. It's sort of tedious. But what I was trying to get these guys to, is how real that is.

It's not a native talent. It's grunt work. And you just do it by iteration.

Unfortunately, it's not very forgiving. If you have the right CAN, but you don't have the HVIL loop connected correctly, it doesn't work. If you have the HVIL loop and the CAN connected correctly, but you don't have the 12V to the PCS terminals, it doesn't work.

If you have the CAN right and the HVIL loop right and the PCS terminals, that doesn't work unless you have both terminals of the 12V connected. Now, it's already getting 12V in one terminal. I know it should work.

But the guys that designed it, they just did it that way. Did they do it for a good reason? What the hell difference does it make? They did it. And so you can be four-fifths of the way there and you've got nothing.

And this is why most people fail in reverse engineering. If you do 127 tests and it takes 128, if you quit after 127, you might as well not have showed up. It's kind of brute force quantity stuff.

You have to think it through. That's true. It's like a puzzle.

But you have to have all the parts. Having most of them right is not encouraging. You don't get any feedback that says, you know, you guys are almost there.

By golly, I think you've almost got it. You either don't have it or you have it. And so you can work at it for 19 consecutive days.

And if it takes 20, you didn't get there. And you quit a loser. And you went home and said, well, it's just too hard.

I don't like to lose. So if it takes 20 days, I might spend 60 on it. Just to do it three times.

It's persistence is the admirable value here. Genius isn't. There's only 13 wires here.

Some combination of signals on some number of those wires will close that contactor. I guarantee you. But it can be quite a thing.

For example, you could have something going out the charge port 10 and a timed response required to get there. Daniel kind of cunningly eliminated that possibility by unplugging the wires. And it still closed the contactor.

So we don't need to worry about that at all. And so it's a process of logical step-by-step troubleshooting to eliminate the unnecessary and determine the required. And did you all find that an educational process? Yes.

Very much. So the team, the four guys, did all this. I occasionally made a smart-ass comment like Gregory House does.

When they would get discouraged, I might suggest something. But I didn't do it. I've done it a lot.

I believe it's valuable. And I wouldn't do it again. But I'm old and my knees don't work very good.

And here's four guys. And let them do it. And it'll be educational for them.

Less so for me at this point. Once you've done 30 of them. Boy, you learn something every time.

That's true. But it was more valuable for them than it would be for me. And so that's where we went with it.

And then we have to translate that to the battery on the bench. And let's go take a look at that. Here we are at the battery pack on the bench.

A full Model 3 battery. Danu, tell us what we've got set up here. Yes, so we have the connector that we have wired in.

With a CAN going into our ESP32. A microcontroller. And then we also have an HVIL loop.

With a 100 ohm resistor. And we have 12 volts and ground supplied. With our little lithium ion battery here.

That is a 12 volt battery. And we also have this little thicker wire going into our PCS. That's wired also from this 12 volt battery.

And we just put a switch in there so we can toggle it on and off. So we have 12 volts on two pins. Ground on one.

That HVIL loop has a resistor on it. And we have an ESP32 RET loaded up here. Let's see if we can turn on the contactors.

We have 12 volts off. Well we might want to have it on. This is something we haven't got worked out yet.

Where do you get 12 volts for this? And there goes our contactors. And you have a voltmeter behind you. Wired into the output.

What's that reading? 357.71 volts DC. Success. And so we're turning on the contactors.

We'll go into SavvyCan and put it on pause. And quit sending that message. And there we are.

And our voltage goes off and the contactors open. Let's take a look at this SavvyCan program and see what we did. Okay, here we are with SavvyCan.

We have a connection to our GEVRET, Generalized Vehicle Reverse Engineering Tool, on our ESP32 board. And we're on CAN0 at 500,000 bits per second. And I've loaded our capture file here.

And it has all the IDs that we captured from the car. And we're going to select Loop Sequence. So it sends it over and over again.

And I have it at a playback speed of 1 and a burst rate of 2. And that seems to do pretty good. And I'm going to load a filter that I call BatFilter. And what this is, is it turns off all the messages that we know that the battery puts out.

So we're not going to send messages that the battery is sending anyway. And here is our thing we're receiving. And these are all the messages that the battery is sending.

We've turned on 12 volts. And we're receiving CAN from the battery. And I've eliminated with the filter all those from our playback sequence.

And so we're going to turn on. And there we hear the contactors closing. And they remain closed.

And so we're sending all of the captured CAN that we did during a contact closure on the car. And sure enough, on our battery, it is closing the contactors. Now with the blue checks, these are all the messages we're sending.

It's doubtful that all of them are needed to do the thing. So we're going to turn them off by unchecking them. And this actually takes them out of the loop real time while we're sending this loop.

So 5,699 frames. And we loop right back around and send them again. And as long as we do that.

And there I paused it and you heard the contactors go off. If I restart it, they come back on and close. So I'm gradually eliminating messages out of this loop.

And I'm going to keep doing that until we find a message that causes the contactors to close. If I turn one message off, or maybe more, then we're not going to close the contactors after all. And we've turned off quite a few.

They're still closed. I'm just going to keep going here. Turning off messages until I get to one that is required to keep the contactors closed.

Now some of them you might have to have to start, but you don't have to have to keep. And so we're going to have to play with this a little bit, but we'll see what happens here. And I'm still turning off messages and our contactors are still closed.

And here we go. We're turning off a lot of messages and not losing our contactors at all. So I'm just going through here.

Every time I remove a blue checkmark, it quits sending that message. In this pane over here, you can see the messages coming in. I'll turn on auto-scrolling so you can see them coming in at the bottom.

And these are all the messages it's receiving. But as you can see, we're not getting a whole lot of the ones I've turned off. Back here, I'm still turning off messages.

If I clear frames, you'll see.