Tesla Model 3 Rear Drive Unit Hacking

[Kevin Sharpe]

Please note design source files will be only available via Patreon for a period of time:

https://www.patreon.com/evbmw

That's good news... I hope this makes things more financially stable for you

[Jack Bauer]

Now in production at JLCPCB.

[Jack Bauer]

[station240]

I should be able to help you with programming that particular C2000 micro.
Been programming the 379D version which is just the 377D with some minor changes TI made that didn't alter the code or pin out.
First you need to trace what GPIO72 and GPIO84 are wired to, as these set the boot mode.
It's possible JTAG has been disabled, in order to upload firmware over CAN, hence the need to find the boot mode select pins..

[JaniK]

Nice post Station240 great things.

[Jack Bauer]

GPIO72 (pin 139) goes to an led that flashes at about 10hz on power application.

GPIO84 (pin 154) goes to another led that flashes alternativly with the other. One red one green.

[Jack Bauer]

Just to be clear here while I am happy to explore the blank the TI device and port over the Openinverter system idea there are a few caveats:

1-Reading through the datasheet for the part, I am concerned about the code security module. I would bet my shiny new Keysight scope that Elon will be using that to prevent access to the memories. As to if it would stop the device being erased and reprogrammed with new code is uncertain.

2-the only option I will participate in is the porting of the openinverter. No instaspin or other nonsense.

3-My main focus is the modboard. I will (for as long as I have the drive units) be available to test TI device software options developed by the community.

[Jack Bauer]

So looks like the JTAG connector used on both front and rear inverters is : DF20F-10DP-1V(55) from Hirose. Available from RS :https://ie.rs-online.com/web/p/pcb-headers/6850722/

Now need to find a plug that fits.

EDIT : Matching plug : DF20A-10DS-1C
RS : https://ie.rs-online.com/web/p/wire-hou ... s/6850696/

Pins : DF20F-2830SCFA
RS : https://ie.rs-online.com/web/p/crimp-contacts/6850757/

[station240]

Ah GPIO72 and GPIO84 are tied to 3.3V via the LEDs then.
I was worried they wouldn't be attached to anything at all, given the size of the pins that would be an issue.

1. Yeah I worry about the various software locks that could be fitted also, but given the complete lack of information we have to try and see.
In theory it could be reprogrammed over CAN but I suspect there are encryption keys for that.

2. Instaspin isn't an option, TI didn't feel like porting it to this micro.
It's a pain to use anyway, took me 2 days just to get it to compile on a micro it is supported on.

3. Fair enough, it's a lot of work just figuring out the pin out of the device.

[Jack Bauer]

What JTAG tool would you recommend?

[station240]

I've been using the XDS100-V2, as it's one TI build into their own Dev boards.
Not seen anyone selling a version with the HV isolation though.
https://www.olimex.com/Products/DSP/Emu ... XDS100-V2/

TI have also shared all the design files to make your own.
"Q: Where can I get the design / schematic / BOM for the XDS100v2"
https://processors.wiki.ti.com/index.ph ... mmended.29

[Jack Bauer]

Ordered from Olimex. Also have what I hope is the right connector and pins for the jtag port on the way so we'll see what happens.

In other news , V2 modboards on the way from JLCPCB so should be with me in a few days.

[JaniK]

That was fast. Can I have 1?

Assuming it works out as you intented of course.

[Jack Bauer]

Of course you can have one:) Will be on sale soon all going well :
https://www.evbmw.com/index.php/evbmw-w ... u-modboard

In other news in honor of the recent success at SpaceX I got me a LaunchPad:)

[johu]

Sounds interesting Due to lack of time I can't be of any assistance in porting the software to C2000. Quick and dirty solution would probably be porting the relevant parts of libopencm3 to C2000, I suppose.
Really cool solution would be to create an openinverter specific HAL that bundles all peripheral access. But again, I don't have time for that right now.

[Jack Bauer]

That's why we have the modboard:)

[Jack Bauer]

Just arrived:)

[MX5EV]

I purchased this Launchpad I'd definitely be willing to help as well. Though I don't have a ton of experience programming TI parts. I'm going to try and figure out how to blinking the LEDs mentioned.

Hopefully, once we end up with these motors overflowing at junkyards the price will come down.

[station240]

One downside of that TI Launchpad board is not all the signals are available.
There is a very tiny connector on the underside with some extra signals, it's cell phone connector small, and TI never did release that addon board to break it out.

Oh and only CANB is connected to a transceiver, CANA needs an extra transceiver chip added (think I'd had bad luck getting that to work)
To be honest we probably need a custom made TMS320F28379D board, for development as Drive Unit PCBs are kinda expensive and come with a heavy lump attached.

I have my own custom TI board for a different processor, however it's just a block of blank PCBs and components till I get everything I need to assemble one. It does have Isolated CAN and JTAG over USB, which I could re-use.

[JaniK]

Have you found anything in the resolver signaling "sawtooth" or other parts in inverter that would prevent running the M3RDU in reverse?

[Jack Bauer]

Nope. And with the electric oil pump it can go full bore in reverse without and mechanical mods. Now I just need to make some time to fit and test the new modboard....

[JaniK]

Cool. Thanks for fast answer.

[Jack Bauer]

Finally back at the M3 rear du. Time to swap out the old V1 modboard for the V2 and see if we can run closed loop with the inverter back on the drive unit:)

[Jack Bauer]

Also since I've been away seems this guy has had some major success

[Jack Bauer]

Good news is the V2 modboard resolver circuit is working perfectly. We are now driving the original Tesla amp and reading back via their filter. BAd news is it seems my current sensor signs are flipped so no foc tuning today.