Tesla Model 3 Rear Drive Unit Hacking

EV_Builder · Post by **EV_Builder** » Sat Oct 16, 2021 2:55 pm

JaniK wrote: ↑Sat Oct 16, 2021 10:53 am I have an unmodified inverter sitting next to my PC..

Dammn you make me tempting togo after one my self too....

I probably will because i still am in need of a front wheel drive motor. But i need tobe sure to have enough room for batteries so i better tackle that first...

dsp1108 · Post by **dsp1108** » Sat Oct 16, 2021 5:35 pm

Hi guys!
I'm Dmitry from Russia.
It seems to me ... I was able to write a bootloder and foc program for tesla inverter 3.

Jack Bauer · Post by **Jack Bauer** » Sat Oct 16, 2021 5:39 pm

Dmitry contacted me today and shared some videos of his work. He has an M3 inverter running custom firmware spinning a non Tesla motor! Fantastic work and welcome to the forum:)

dsp1108 · Post by **dsp1108** » Sat Oct 16, 2021 5:49 pm

If the moderator posts a video, then that will be good.

I am also ready to answer questions about the program.

dsp1108 · Post by **dsp1108** » Sat Oct 16, 2021 5:51 pm

Thanks Jack Bauer!

Jack Bauer · Post by **Jack Bauer** » Sat Oct 16, 2021 6:26 pm

Here is one of the videos of Dmitry's work :

YouTube · Post by **johu** » Sat Oct 16, 2021 9:42 pm

Keeps getting more interesting. Good job. What's the firmware based on? Is it on github?

Isaac96 · Post by **Isaac96** » Sat Oct 16, 2021 11:59 pm

Phenomenal! Well done!

collin80 · Post by **collin80** » Sun Oct 17, 2021 1:30 am

dsp1108 wrote: ↑Sat Oct 16, 2021 5:49 pm If the moderator posts a video, then that will be good.

I am also ready to answer questions about the program.

!!! Otlichna! Horoshaya rabota!

Really, that's awesome! I hope we can all work together to make Tesla parts a bit easier to work with. You said you wrote FOC code and we can see in the video that it's some sort of other motor. Does that other motor also use a resolver or is it possible to interface an encoder to the M3 inverter? And, is your bootloader CAN based? Does it use UDS for firmware updates like the inverter does with the OEM firmware?

dsp1108 · Post by **dsp1108** » Sun Oct 17, 2021 1:46 am

I have been developing electronics for many years and got a Tesla inverter on occasion I have PMSM control projects, including for texas instrument processors.
I decided to transfer my code to a tesla inverter.

dsp1108 · Post by **dsp1108** » Sun Oct 17, 2021 1:55 am

The resolver is used.
Bootloader is first loaded via jtag.

Then the main program and calibrations are loaded through can.

Private can is for debugging and oscilloscope.

There is support for uds download, but it has not been tested.

jetpax · Post by **jetpax** » Sun Oct 17, 2021 5:02 am

You would be a total hero if you could share any of this with us mortals

I am especially interested in bootloader/CAN loader details, and how you use the private CAN for debugging and scope.

The M3 DU sitting in my garage would certainly appreciate it…

dsp1108 · Post by **dsp1108** » Sun Oct 17, 2021 7:02 am

I will prepare a bootloader project and post it.
A little bit later.
Now, I'm debugging the main program.

dsp1108 · Post by **dsp1108** » Sun Oct 17, 2021 12:19 pm

What do you think of the idea to hack the tesla plaid inverter?

The probability, is more than 95 cents ...)))

The biggest problem, as I see it, is the squib.

EV_Builder · Post by **EV_Builder** » Sun Oct 17, 2021 12:31 pm

dsp1108 wrote: ↑Sun Oct 17, 2021 12:19 pm The biggest problem, as I see it, is the squib.

What is a squib?

dsp1108 · Post by **dsp1108** » Sun Oct 17, 2021 12:39 pm

Breaks two of the three output buses.

dsp1108 · Post by **dsp1108** » Sun Oct 17, 2021 1:52 pm

There is a consideration:
Break the squib activation circuit with voltage OFF.
And debug tesla plaid inverter.

EV_Builder · Post by **EV_Builder** » Mon Oct 18, 2021 9:17 am

How is it mounted / fixxed?
Can we emulate it's presence?

Who has this engine/inverter in the first place

?

mikeselectricstuff · Post by **mikeselectricstuff** » Mon Oct 18, 2021 10:44 am

EV_Builder wrote: ↑Sun Oct 17, 2021 12:31 pm
dsp1108 wrote: ↑Sun Oct 17, 2021 12:19 pm The biggest problem, as I see it, is the squib.
What is a squib?

Shown here - pyro device to blow the busbars in case of a catastrophic fault

EV_Builder · Post by **EV_Builder** » Mon Oct 18, 2021 10:58 am

Yeah I remembered it. But again who has this engine / inverter?
Think we should first focus on the M3 engine it's more widely spread.

Jack Bauer · Post by **Jack Bauer** » Mon Oct 18, 2021 2:52 pm

Good news : Harvested a FT2232 from a dev board, soldered to the jtag adapter, programmed and presto we are talking to Elon. Push fits perfectly into the horrible jtag socket.

Bad news : Design flaw! That 1k pull down resistor on ADBUS5? Should have been ACBUS5!! Gahhh. Anyway. Boards are fairly cheap from jlc without the ft2232 so I'll fix and order a fresh batch.

dsp1108 · Post by **dsp1108** » Mon Oct 18, 2021 3:10 pm

Hello.
It seems to me, there is a simpler option:

Finished debugging 95 percent.
The loader will try to post on this week.

davefiddes · Post by **davefiddes** » Mon Oct 18, 2021 5:41 pm

Jack Bauer wrote: ↑Mon Oct 18, 2021 2:52 pm Bad news : Design flaw! That 1k pull down resistor on ADBUS5? Should have been ACBUS5!! Gahhh. Anyway. Boards are fairly cheap from jlc without the ft2232 so I'll fix and order a fresh batch.

Sorry about missing that when I reviewed. That was my design fix too...

Jack Bauer · Post by **Jack Bauer** » Mon Oct 18, 2021 6:05 pm

No worries Dave:) new boards ordered. At least we know it all works other than that.

collin80 · Post by **collin80** » Tue Oct 19, 2021 12:57 am

dsp1108 wrote: ↑Mon Oct 18, 2021 3:10 pm Hello.
It seems to me, there is a simpler option:

Finished debugging 95 percent.
The loader will try to post on this week.

That's only simpler if you can find the mating connector and successfully crimp the pins. Damien's board is a MUCH easier solution for everyone else. Since he's tested it to work (other than the one problem) I'd say he's in good shape and everyone is likely to want to go that route rather than crimping pins you need brain surgeon dexterity for.

I feel so lucky that the Model S board has 14 pin ARM JTAG headers right on it. No dinking around making things, just use a normal ARM JTAG cable and it works. Why couldn't they do that on the Model 3 as well?! XDS110 works great on a Model S controller too. It seems like they've went backward a bit in terms of accessibility. But, that doesn't really surprise me a whole lot.

Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking

Re: Tesla Model 3 Rear Drive Unit Hacking