[scottf200]

Like many dual motor owners, I believe the only difference between the performance and dual motor model is software. I would like to kick start an effort to unlocking the full performance of the dual motor model.

According to the EPA, the rear motor in the performance model and the RWD long range model are both rated 211 kW while the dual motor is rated at 188 kW. Both the dual motor and performance model front motor are rated at 147 kW. So it seems Tesla is only limiting the power on the rear motor.

Focusing on understand how the rear inverter communicates with the accelerator pedal and the rest of the car seems like a good first step. I know a few people in this thread have already start looking into some of the CAN messages being sent from the inverter.

According to the model 3 wiring diagram from the service manual, there some direct analog communication between the inverter and accelerator pedal. I think I'll have a look there first.

Source: https://www.fueleconomy.gov/feg/Find.do?action=sbs&id=41190&id=41191&id=41189

In InsideEVs update to their story on:
Update From Tesla: No Tesla Model 3 Performance For Under $50K
https://insideevs.com/news/360589/tesla-model-3-performance-49990-off-menu/

They still believe there is a unique inverter. See underlined below.
"
Update: We reached out to Tesla for clarification since this information came from "sources familiar with the matter." Tesla says customers can't order a new Model 3 Performance from the online configurator for $49,990. If you select or request the 18-inch Aero wheels, the price will remain at $54,990. Also, the changes made Monday assure that every Model 3 Performance comes standard with the Performance Upgrades Package, and that can't be "unbundled" off-menu. So, you'll automatically get the performance features, including Track Mode.

It's additionally important to note that the Model 3 Performance continues to have more torque and more power than the regular Model 3 Long Range Dual Motor due to its unique inverter that carries more current from the battery to the motors.
"

 

[scottf200]

Maybe MaxWellTech is on here in another name (I did a search) but they look like they build S/X cables currently. Don't know if they had access to the parts if they'd build TM3 cables.
Just a thought. Sorry if this is repeated.

https://www.ebay.com/usr/maxwelltech?_trksid=p2047675.l2559

 

[jackbauer]

Message 0x22a on ipc can at 10ms intervals. Byte 1 , bit 2 is dcdc enable. set it to one and the dcdc wakes up. set it to 0 and it shutsdown. Released a first cut at a pcs controller on github. Just a modification to the existing gen3 charger controller.
https://github.com/damienmaguire/Tesla-Model-3-Charger

 

[Perscitus]

Received the Fleetcarma pass-through cable and will finally take OBDLink LX and MX plus ScanMyTesla out for a spin. Zero intention of using the C2 dongle.

 

[jackbauer]

Need a little help on some can decoding. I had been looking for a message from the pcs with the 12v system voltage. None seemed to show itself. Then I observed message 0x424 pop up when the dcdc enable bit in 0x22a is sent. Here are a few samples of 0x424 with various 12v voltages applied. Anyone want to guess how the 12v is encoded here?

12v applied : 2b 80 2d 0d 01 00 00 a0
13v applied : 2b 80 4a 35 01 bc 0b a0
14v applies : 2b 80 65 5d 01 bc 0b a0
15v applied : 2b 80 7f 7d 01 bc 0b a0

 

[JWardell]

Need a little help on some can decoding. I had been looking for a message from the pcs with the 12v system voltage. None seemed to show itself. Then I observed message 0x424 pop up when the dcdc enable bit in 0x22a is sent. Here are a few samples of 0x424 with various 12v voltages applied. Anyone want to guess how the 12v is encoded here?

12v applied : 2b 80 2d 0d 01 00 00 a0
13v applied : 2b 80 4a 35 01 bc 0b a0
14v applies : 2b 80 65 5d 01 bc 0b a0
15v applied : 2b 80 7f 7d 01 bc 0b a0

I don't know of 12v in the PCS, I usually get it from the inverter or the VCfront/12v battery

 

[Calibr8r]

Has anyone played around with the ASAP2DEMO with the .dbc yet?

 

[JWardell]

Has anyone played around with the ASAP2DEMO with the .dbc yet?

what's that?

 

[juanmax]

I thought you may find interesting a plot of a quick charge session of my M3P. Interesting to see the temps of the battery going that high (and then stabilizing). In the first 5 min the car charges 19% SoC, this is impressive. I can not wait to have Superchargers V3 here in Europe! This Unity charger has a 500A max (350kW @ 700V) limit. Looks like the two times where the charge power went down is commanded from the charger itself, since I could see the charger setting a lower current limit on those two instances.

Your thoughts?

Regards,

Juanma

 

[juanmax]

Ok ok, my last post was off topic but look at this one:

I think I found what could be front axle motor torque request in the ID 0x136, first 12bits:

Anybody wants to double check?

 

[JWardell]

Ok ok, my last post was off topic but look at this one:

I think I found what could be front axle motor torque request in the ID 0x136, first 12bits:

Anybody wants to double check?

View attachment 28029

I don't think we have ever seen ID 136 before, where did you read it from?

 

[juanmax]

On the Party CAN. I can access now measurements from all party, veh and chas. CAN direclty on the connector from the MCU.

Also found just now another message containing steering wheel angle (maybe a second ECU for redundancy?) This one is only present on the chassis CAN

 

[Calibr8r]

I thought you may find interesting a plot of a quick charge session of my M3P. Interesting to see the temps of the battery going that high (and then stabilizing). In the first 5 min the car charges 19% SoC, this is impressive. I can not wait to have Superchargers V3 here in Europe! This Unity charger has a 500A max (350kW @ 700V) limit. Looks like the two times where the charge power went down is commanded from the charger itself, since I could see the charger setting a lower current limit on those two instances.

Your thoughts?

Regards,

Juanma

The first was probably from the A/C chiller activation command which happens around 47.5 to 48*C battery temps. The second may be from a battery temp limit at about 54*C (unconfirmed). I hit 148kW on the V2 150kW charger log from 6-85% SoC and the de-rate occurred at 47.5-48*C and the highest temp recorded was 53*c, hovering at around 52*C the majority of the time (started at 36*C).

/offtopic

 

[amund7]

I thought of something. Since the ethernet bus seems to have all the data, can we either connect, or sniff those wires? How cool would it be if there exists an inductive ethernet sniffer that anyone could clamp on a wire somewhere, and read ALL the info from ALL the can-buses. Or are there reasons this can't be done ? (Encryption comes to mind)

 

[michi84]

Does the EVTV OBD 2 adapter work with ScanMyTesla? I have a european Model 3 AWD, built in April or May. I do have an OBDLink MX from my previous car.

 

[0x6d33]

I thought of something. Since the ethernet bus seems to have all the data, can we either connect, or sniff those wires? How cool would it be if there exists an inductive ethernet sniffer that anyone could clamp on a wire somewhere, and read ALL the info from ALL the can-buses. Or are there reasons this can't be done ? (Encryption comes to mind)

There seems to be 3 types of ethernet documented in the model 3. Diag, Radio and Auto Pilot. The diag ethernet is accessible via the driver side footwell however, no one seem to have figured out how to get this port to transmit data. Perhaps the Autopilot ethernet might have something interesting. It is a twisted pair of white and blue wires connected between the MCU and Autopilot ECU. It could be encrypted like you mentioned though.

The AP board has a 7 port ethernet switch (Marvell 88EA6321). There also a port on the AP board that looks like a USB port called DEBUG ETH.

 

[TomT]

I went to fleetcarma.com and could not find the cable... Do you have a specific link for it? I have a OBDLink and ScanMy Tesla and would love to be able to use it, but have had no luck in finding a cable for my 2019 Model 3... I don't want to spend $300 for the EVTV OBD 2...

Received the Fleetcarma pass-through cable and will finally take OBDLink LX and MX plus ScanMyTesla out for a spin. Zero intention of using the C2 dongle.

 

[Perscitus]

Its not something you 'find'... instead, sign up for Fleetcarma (if operating in your state) and they ship you the hardware (including required cable) free of charge.

Make sure you stipulate a 2019, and hope they send a cable thats wired differently than the 2017/2018s.

 

[David King]

I'm new to CAN but am a young engineer that loves to learn and figure new things out. So after reading all 49 pages, I feel like it's possible to make a simple version MPP's Party Box by reading the wheel speed messages and immediately injecting my own wheel speed message. This could consist of reading say the driver rear wheel's speed and sending that as the other wheels' speeds, or sending the average wheel speed to all wheels. From line 42 in this .dbc file it looks like writing to the Chassis Bus will allow this. The Chassis bus is not located at the bottom rear of the center console but near the VCU correct?
There's been a lot of talk about reading messages but not about writing them. Am I wrong in thinking that the hardest part of writing messages is figuring out the checksum? Are the checksums all the same so what is described on page 45 would apply to the wheel speed message? If I just want all the wheels to look like they're spinning together so that TC doesn't step in, all the new wheel speed messages would be identical except for the wheel ID. It seems kinda simple to figure out how to only change the wheel ID when copying one wheel speed to the others if you compare messages of the car rolling normally and then with some wheels slipping. I'm assuming messing with these wheel speeds would interfere with ABS so the fake messages could be disabled when the brake is sensed. This sounds kinda dangerous to be messing with such fundamental vehicle systems so please kill this dream of mine before I do something stupid. I just want to slide my AWD Model 3 on snowy parking lots like my old Subaru haha Thank you for your time!

 

[JWardell]

I'm new to CAN but am a young engineer that loves to learn and figure new things out. So after reading all 49 pages, I feel like it's possible to make a simple version MPP's Party Box by reading the wheel speed messages and immediately injecting my own wheel speed message. This could consist of reading say the driver rear wheel's speed and sending that as the other wheels' speeds, or sending the average wheel speed to all wheels. From line 42 in this .dbc file it looks like writing to the Chassis Bus will allow this. The Chassis bus is not located at the bottom rear of the center console but near the VCU correct?
There's been a lot of talk about reading messages but not about writing them. Am I wrong in thinking that the hardest part of writing messages is figuring out the checksum? Are the checksums all the same so what is described on page 45 would apply to the wheel speed message? If I just want all the wheels to look like they're spinning together so that TC doesn't step in, all the new wheel speed messages would be identical except for the wheel ID. It seems kinda simple to figure out how to only change the wheel ID when copying one wheel speed to the others if you compare messages of the car rolling normally and then with some wheels slipping. I'm assuming messing with these wheel speeds would interfere with ABS so the fake messages could be disabled when the brake is sensed. This sounds kinda dangerous to be messing with such fundamental vehicle systems so please kill this dream of mine before I do something stupid. I just want to slide my AWD Model 3 on snowy parking lots like my old Subaru haha Thank you for your time!

Congrats on what is becoming quite an achievement reading this whole thread

We know how to decode/recreate the checksums now, but the problem is the network is broadcast, so you will still have the real data mixed in with the fake data, plus many of the messages also have counters so everything has to be sequential. Tesla really did an impressive job over engineering an already robust network.

The known only way around it is a man-in-the-middle, which means literally cutting the sensors and splicing in a box to spit out modified signals.

There are always corners of software modes to be discovered though, like generating an ABS error or something to make the software ignore traction control or similar, that might be easier to do if they can be figured out.