[DrJeff]

I'd really like to get the Main Junction Box from the Tesla 70D hooked up to my NLG513. Since the Tesla junction box can handle HV DC connections, it seems like all the right components should be there. Big downside could be if Tesla sets the config of the junction box with CAN messages.

Has anyone hacked one of these yet?

In the Tesla the junction box has the following connections...
[HV]
- to Battery
- to Drive Unit Motor(s)
- to Front HV Junction Box (to heater, air heater, compressor, dc-dc)
- from Charge Port
- to/from Charger

[LV]
- CAN connection to Charger only
- HV interlock lines
- 5V
- FC-CTR-FAULT-L
- FC-CTR-12V-OUT
- FC-CTR1-DRV-CPLD
- FC-CTR2-DRV-CPLD

More Photos

This shows the Main JB with the cover over the connections to the Master and Slave charger links removed. There are six wires running to the Master charger (labelled AC Master) and six wires running back (labelled DC Master). Without any power, there are 3 wires outgoing (to the charger) connected to the +positive charger port post, and 3 wires outgoing (to the charger) connected to the -negative charger port post.

From the view of the bottom you can see that the bus bars run all the way to the contactors. The charge ports line as connected to one side of the contactor and the bis bars to the other.

So guessing at the Main JB operations, when an AC source is connected the contactors are not used and the power is routed to the charger (via six wires) and DC accepted on the return 6 wires. However when DC source is connected (i.e. DC fast charging, the contactors connect the DC lines directly to the bus bars - bypassing the chargers.

Chances are that the detection of DC is signaled to the Main JB via the FC-CTR-12V-OUT, FC-CTR1-DRV-CPLD, FC-CTR2-DRV-CPLD lines. It seems unlikely that the CAN connection to the Charger is involved... the charger would be telling the Main JB to trigger the contactors and bypass the charger (but Tesla have done stranger). I suspect the signal to the Main JB that the source is DC and to trigger the contactors is some simple signalling on the control lines (no luck with experimenting though).

One interesting hack (okay this would be hackish) would be to connect the AC Master lines to the charger directly back to the DC Master lines "from" the charger. The NLG513 would be outputting DC, which would "not" be routed to the charger and would then get into the DC side of the Main JB circuit. Total SWAG here, but is there a chance the large resister is a pre-charge resister to handle the battery connection back from the charger. (I did mention total SWAG).

 

[kennybobby]

That's great that you have a Gen 2 HVJB opened up. i looked at the gen1 circuits and it seems that the master charger talks over CAN and controls the contactors. There was a CAN port on the gen 1 slave box but it only had termination resistors. Here's a sketch of what i found, and someone told me later that the device labelled as TPC was actually an EMI filter:

 

[DrJeff]

I pulled the main junction box apart to have a look at the bus bar connections and the contactors. Best case it looks like the bus bars are easily reusable. Interestingly the contactors fell (fell away under gravity) from the circuit board. It looks like they were all bad or dry solder joints.

The contactors are small, but need to research their capacity. They were sitting on the circuit that brought supercharger power in, so I expect something decent.

I'm planning to relocate the bus bars and contactors to a new fully plastic contactor box - can't say I'm keen on the aluminum housing with internal orange plastic shielding.

It'll make a good junction box, and I'll add a precharge circuit to protect the NLG513.

Jeff

 

[Kevin Sharpe]

It looks like the charger is checking for an earth connection (see here)... it might be something to look out for on the HVJB which has a similar heavy duty ground strap.

 

[Kevin Sharpe]

Interestingly the contactors fell (fell away under gravity) from the circuit board. It looks like they were all bad or dry solder joints.

I had the same experience with two HVJBs and decided to take a closer look with a magnifier. I believe the contactors are not soldered directly to the PCB but are using tiny sockets

 

[Kevin Sharpe]

I've attached the schematic for the main PCB. I'll upload the Eagle version to GitHub once I've had a chance to verify the component footprints.

 

[DrJeff]

Re: Hacking the Tesla Main Junction Box - DCDC Converter

Somewhat related to the HVJB... I got the Tesla Gen 2 DCDC converter enabled today. Very simple setup - just 12v on the enable line to activate once the HV is available. No input needed on the HVIL or CAN.

I have the 370v battery (A123) routed through the HVJB (passthrough), then routed through the Front HVJB (provided 12v and GND), then on to the DCDC converter (12v on enable, and GND).

370v input provided a steady 13.53v output.

Next up : Seeing if CAN is active and pulling some data.

Interesting aside : The DCDC board has no Tesla markings (on the upper side at least), and also no separate control board like in other Tesla units (PTC heater, charger).

Jeff

 

[Kevin Sharpe]

Re: Hacking the Tesla Main Junction Box - DCDC Converter

Somewhat related to the HVJB... I got the Tesla Gen 2 DCDC converter enabled today. Very simple setup - just 12v on the enable line to activate once the HV is available. No input needed on the HVIL or CAN.

Fabulous, thanks for sharing

 

[Tomdb]

A nice simple 'failsafe' I bett. Have you tried loading up the output?

 

[DrJeff]

A nice simple 'failsafe' I bett. Have you tried loading up the output?

Here's a capture of the CAN output...

0x210 seems to carry voltage/current. I was popping a 12v LED/Resistor on and off the DCDC posts (tiny load) and you can see it show up in the data. More testing needed with larger 12v loads to establish how to interpret the frames.

0x500 may carry temperature information. It was 10x less frequent than 0x210 and frame data didn't change during the test.

Attached ZIP contains a small .csv SavvyCAN capture.

Jeff

 

[jackbauer]

Jeff try sending it CAN id 0x03D8 , Data length 3 , data : 0xDD 0x06 0x00

and watch the 12 output

 

[DrJeff]

Jeff try sending it CAN id 0x03D8 , Data length 3 , data : 0xDD 0x06 0x00

and watch the 12 output

I tried it... "0x03D8, 3 bytes, DD, 06, 00" but instead of 12v I momentarily got 14v (D1 = DD, D2 = 06)

So I tried some other values to establish the relationship ... 0x03D8, D1, D2, 00 (also keep resending every 5ms to maintain the voltage).

D1, D2 = volts
DD, 06 = 14.0v
B0, 06 = 13.75v
A0, 06 = 13.64v
E0, 05 = 12.33v
D0, 05 = 12.22v
C0, 05 = 12.11v
B0, 05 = 12.0v

D2D1 = (148 * volts) - 325

So by resending 0x03D8, B0, 05, 00 every 5ms I got a steady 12v out of the DCDC with no load (other than the voltmeter).

Jeff

 

[Kevin Sharpe]

I've spun out the 'AC switch box' discussion to a new thread because it's only relevant to European cars

Hacking the Tesla Model S Rear Junction Box (AC Switching)

 

[DrJeff]

More on the Tesla DCDC CAN Codes

0x0500
- frequency every 1000ms
- bytes 4 and 6 contain data
- 4 = 0xA0
- 6 = 0x19
- I had hoped this was temperature, however values output are the same irregardless of ambient temperature

0x0620
- frequency only once on initial high voltage (DCDC wakeup broadcast)
- no interpretation of the data

0x0210
- frequency every 100ms
- Appears to have data in (D3&D2 and D5&D4)
- Does change in response to load changes (switching headlamp on/off)
- no interpretation of the data yet

Jeff

 

[Kevin Sharpe]

Great info Jeff, do you think it would be more useful in this thread?

Tesla DC DC Converter Hacking

 

[hokiematt]

On the gen 1 DC-DC on my Rav4 EV, messages x500 and x620 are ID and version number and don't change.

Message x210: bytes 0-1 are status bits (normally zeros), byte 2 is coolant inlet temp, byte 3 is input power (16 W/bit), byte 4 is output current (1 A/bit), and byte 5 is output voltage (0.1 V/bit). Byte 6 appears to be static.

If you can load test your gen 2 DC-DC, see if this decode still applies and let us know