# Hacking the Tesla Main Junction Box



## kennybobby (Aug 10, 2012)

That's great that you have a Gen 2 HVJB opened up. i looked at the gen1 circuits and it seems that the master charger talks over CAN and controls the contactors. There was a CAN port on the gen 1 slave box but it only had termination resistors. Here's a sketch of what i found, and someone told me later that the device labelled as TPC was actually an EMI filter:


----------



## DrJeff (Apr 24, 2015)

I pulled the main junction box apart to have a look at the bus bar connections and the contactors. Best case it looks like the bus bars are easily reusable. Interestingly the contactors fell (fell away under gravity) from the circuit board. It looks like they were all bad or dry solder joints.

The contactors are small, but need to research their capacity. They were sitting on the circuit that brought supercharger power in, so I expect something decent.

I'm planning to relocate the bus bars and contactors to a new fully plastic contactor box - can't say I'm keen on the aluminum housing with internal orange plastic shielding.

It'll make a good junction box, and I'll add a precharge circuit to protect the NLG513.

Jeff


----------



## Kevin Sharpe (Jul 4, 2011)

It looks like the charger is checking for an earth connection (see here)... it might be something to look out for on the HVJB which has a similar heavy duty ground strap.


----------



## Kevin Sharpe (Jul 4, 2011)

DrJeff said:


> Interestingly the contactors fell (fell away under gravity) from the circuit board. It looks like they were all bad or dry solder joints.


I had the same experience with two HVJBs and decided to take a closer look with a magnifier. I believe the contactors are not soldered directly to the PCB but are using tiny sockets


----------



## Kevin Sharpe (Jul 4, 2011)

I've attached the schematic for the main PCB. I'll upload the Eagle version to GitHub once I've had a chance to verify the component footprints.


----------



## DrJeff (Apr 24, 2015)

*Re: Hacking the Tesla Main Junction Box - DCDC Converter*

Somewhat related to the HVJB... I got the Tesla Gen 2 DCDC converter enabled today. Very simple setup - just 12v on the enable line to activate once the HV is available. No input needed on the HVIL or CAN.

I have the 370v battery (A123) routed through the HVJB (passthrough), then routed through the Front HVJB (provided 12v and GND), then on to the DCDC converter (12v on enable, and GND).

370v input provided a steady 13.53v output.

Next up : Seeing if CAN is active and pulling some data.






Interesting aside : The DCDC board has no Tesla markings (on the upper side at least), and also no separate control board like in other Tesla units (PTC heater, charger).

Jeff


----------



## Kevin Sharpe (Jul 4, 2011)

*Re: Hacking the Tesla Main Junction Box - DCDC Converter*



DrJeff said:


> Somewhat related to the HVJB... I got the Tesla Gen 2 DCDC converter enabled today. Very simple setup - just 12v on the enable line to activate once the HV is available. No input needed on the HVIL or CAN.


Fabulous, thanks for sharing


----------



## Tomdb (Jan 28, 2013)

A nice simple 'failsafe' I bett. Have you tried loading up the output?


----------



## DrJeff (Apr 24, 2015)

Tomdb said:


> A nice simple 'failsafe' I bett. Have you tried loading up the output?


Here's a capture of the CAN output...

0x210 seems to carry voltage/current. I was popping a 12v LED/Resistor on and off the DCDC posts (tiny load) and you can see it show up in the data. More testing needed with larger 12v loads to establish how to interpret the frames.

0x500 may carry temperature information. It was 10x less frequent than 0x210 and frame data didn't change during the test.

Attached ZIP contains a small .csv SavvyCAN capture.

Jeff


----------



## jackbauer (Jan 12, 2008)

Jeff try sending it CAN id 0x03D8 , Data length 3 , data : 0xDD 0x06 0x00

and watch the 12 output


----------



## DrJeff (Apr 24, 2015)

jackbauer said:


> Jeff try sending it CAN id 0x03D8 , Data length 3 , data : 0xDD 0x06 0x00
> 
> and watch the 12 output


I tried it... "0x03D8, 3 bytes, DD, 06, 00" but instead of 12v I momentarily got 14v (D1 = DD, D2 = 06)

So I tried some other values to establish the relationship ... 0x03D8, D1, D2, 00 (also keep resending every 5ms to maintain the voltage).

D1, D2 = volts
DD, 06 = 14.0v
B0, 06 = 13.75v
A0, 06 = 13.64v
E0, 05 = 12.33v
D0, 05 = 12.22v
C0, 05 = 12.11v
B0, 05 = 12.0v

D2D1 = (148 * volts) - 325

So by resending 0x03D8, B0, 05, 00 every 5ms I got a steady 12v out of the DCDC with no load (other than the voltmeter).

Jeff


----------



## Kevin Sharpe (Jul 4, 2011)

I've spun out the 'AC switch box' discussion to a new thread because it's only relevant to European cars 

Hacking the Tesla Model S Rear Junction Box (AC Switching)


----------



## DrJeff (Apr 24, 2015)

*More on the Tesla DCDC CAN Codes*

0x0500
- frequency every 1000ms
- bytes 4 and 6 contain data
- 4 = 0xA0
- 6 = 0x19
- I had hoped this was temperature, however values output are the same irregardless of ambient temperature

0x0620
- frequency only once on initial high voltage (DCDC wakeup broadcast)
- no interpretation of the data

0x0210
- frequency every 100ms
- Appears to have data in (D3&D2 and D5&D4)
- Does change in response to load changes (switching headlamp on/off)
- no interpretation of the data yet

Jeff


----------



## Kevin Sharpe (Jul 4, 2011)

Great info Jeff, do you think it would be more useful in this thread?

Tesla DC DC Converter Hacking


----------



## hokiematt (Feb 13, 2018)

On the gen 1 DC-DC on my Rav4 EV, messages x500 and x620 are ID and version number and don't change.

Message x210: bytes 0-1 are status bits (normally zeros), byte 2 is coolant inlet temp, byte 3 is input power (16 W/bit), byte 4 is output current (1 A/bit), and byte 5 is output voltage (0.1 V/bit). Byte 6 appears to be static.

If you can load test your gen 2 DC-DC, see if this decode still applies and let us know


----------

