# Tesla Battery BMS and Modules BMB Reverse Engineering



## kennybobby (Aug 10, 2012)

Jarrod, Tom, and Collin have discovered how to operate the Battery Monitoring Boards (BMB) that are attached to each module. It is possible to talk directly to the bq76 cell monitoring chip on the boards to read the cell voltages, the 2 module temperature sensors, and control the bleed resistor circuit used for cell balancing. Their findings are documented on hackaday:
https://hackaday.io/project/10098-model-s-bms-hacking

My investigation has been focused on understanding the firmware used within the 8051 microcontroller chip that basically provides a Serial Port UART conversion and pass thru on the SPI Port to the bq76 chip. My latest working notes are found on github: https://github.com/kenny56/tesla-bmb

Jack and Collin at evtv.me have built an add-on box and figured out how to externally command an entire pack to turn On and reveal full voltage at the OEM terminals, for those who wish to re-use an entire pack without cutting it open.

The missing link is to figure out the CAN Buss messages to send to a pack to gain full control. That function is found on the BMS board, and so far there is little known about reverse engineering the master. It may not be practical for DIY cars, but is of interest for power-wall and solar storage.

If anyone has progress or success in using any of these please post it up...


----------

