Tesla Model 3 Rear Drive Unit Hacking

[Bratitude]

Can you write your own firmware into the processor or is the processor locked from writing new firmware into the flash area ?

david is porting the openinverter code base to run on the c2000. so yes. maybe read through the thread a bit.. these questions have been answered numerous times

[AMP3R]

What heat produce this drive unit? Tesla claims that their model 3/Y motors have efficiency 97%. For example 3d5 drive unit have 180 KW of power. Is that means that it will make 5.4 KW of heat? (to make 180 KW it need 185.4 KW of energy) Am I right?

Is it possible to use a cabin heater core as cooling element?

[SuperV8]

What heat produce this drive unit? Tesla claims that their model 3/Y motors have efficiency 97%. For example 3d5 drive unit have 180 KW of power. Is that means that it will make 5.4 KW of heat? (to make 180 KW it need 185.4 KW of energy) Am I right?

Is it possible to use a cabin heater core as cooling element?

photo_2023-02-28_19-19-32.jpg

Regarding the efficiency - I don't think/doubt that 97% is total drivetrain efficiency including inverter/motor/gear reduction/battery/driveshafts etc..?

Can your heater core dissipate 5.4kW of heat? If yes then this could work in theory but seems a lot of heat to me (thinking of my 3kW fan heater) - however it will be dissipating this 5.4kW into the cabin which in winter might be ok, but in the summer would not!
Obviously this is only peak load - and cruising will be much less Kw/heat, but still you need to design the cooling system for the worst/hardest case.

Better to have two heater matrix/radiators (one in the cabin - one outside the cabin) and a valve to direct heat where required.

[EV_Builder]

I think that the heat scenario is valid for nominal power.
All other powers are very short duration. So yes you need to cool that but nominal won't be used all the time either so laying out for nominal with enough thermal mass should do it.

[bitMuse]

Hey all, I went back through the thread and could only find the main inverter connector. (Speaking of which you can order all of it through BMotorsports ( https://www.bmotorsports.com/shop/produ ... ts_id/5526 ) including the pins and plugs.

Do we have the connectors for the resolver coils and oil pump as well?

I've got a 980-*-C motor on my bench if we need any info pulled from it

[davefiddes]

Connector details are on the wiki: https://openinverter.org/wiki/Tesla_Mod ... Drive_Unit

Wiring details can be found in Damien's repo: https://github.com/damienmaguire/Tesla- ... Pinout.ods

[bitMuse]

It should have occurred to me to check the wiki. Doh.

Thanks for the polite response.

[davefiddes]

No worries. The info is somewhat spread out all over the place. Useful source for that Sumitomo connector.

[vwbrady]

I think that the heat scenario is valid for nominal power.
All other powers are very short duration. So yes you need to cool that but nominal won't be used all the time either so laying out for nominal with enough thermal mass should do it.

Agree with EV Builder. 5kW of heating might be necessary if you're driving around outputting all 180kW - which you're not.

On my 110kW Leaf setup, I barely produce enough heat to even run my water pump. in fact in the current chilly climate I can just leave the water pump turned off and the inverter temp just goes up and down between 25 and 35C during normal driving as it passively exchanges heat with the motor and stagnant coolant.

The cooling requirements of EV systems are completely application and location dependent and are only necessary when energy is being moved around. Unlike ICE setups where you're constantly trying to reject heat due to their ≈20% efficiency, even when you're sitting idle.

[vwbrady]

HV Connector for Model 3 RDU (wiki updated)

I took these photos to share with Damien over on Patreon and thought they'd be useful for this thread.

Weirdly the TE connector has a printed on part number that TE doesn't have published anywhere 2-2840440-1. The connector is from their HC STAK line and it's current part number is 2840900-1.

By far the easiest way to get this connector is used, and the best part is the cable assembly has the battery connection on the other side which is the same connector. So you can get a 2for in that deal for around $150.

[catphish]

If you attempt to run it on a Tesla Model 3 drive unit it is trivial to brick the drive unit and render it completely inoperable. Once bricked it is impossible to fix at this point in time.

DO NOT attempt to use this code in Tesla Model 3 / Y drive units unless you are an experienced embedded software engineer. When developing this software it is very easy to wipe the existing Tesla software rendering the drive unit largely worthless.

Can you elaborate on what you mean by these warnings? Assuming I don't want the Tesla software, is it unsafe to erase it?

[davefiddes]

That's correct. If you erase the Tesla software the device isn't going to do anything until you/we program it to do something else.

So far I have discovered nothing to prevent the reuse of the TMS320F28377D on the Tesla M3 inverter boards. There are a bunch of One Time Programmable(OTP) bits that if you attempt to read cause the CPU to get upset and reboot because of code security. The easy answer to that is to not read those bits of memory. The rest of the device appears fully functional.

As an aside the ultimate fallback to a over-locked MCU is to dig out the scalpel, hot-air gun, soldering iron and flux and fit a new one as Damien did. The chip shortage makes this harder right now. Seems that Mouser is the best bet and they do appear to be getting deliveries.

It is entirely possible to run an inverter out of the on-board RAM on the device and leave the Tesla software intact. This could be useful for further reverse-engineering of the board. There is a lot Damien and I don't know about these boards even now.

The TI Code Composer Studio software is great but has a pathological desire to erase all the Flash on an attached device. You have to follow the instructions I put together very carefully to get a good debugging set up. Even following my own instructions I still manage to screw up occasionally and re-wipe my flash. It's not so painful when it's just a blinky test app I've uploaded but still irritating.

[bitMuse]

This is a different type of hacking, but unlike many others in this thread who have come, said a thing, and then vanished forever, I have gotten quite a bit further.

I'm exploring the boundaries of what can be done with hardware alone. While I have the motor spinning normally using an off the shelf solution, I am working to trick the motor into running in reverse like a lot of the LDUs have for Model S.



With the very limited space inside the motor I have designed in CAD a way to cross two of the bus-bar linkages for the AC feeding into the stator. I need to modify the oil seal housing next, but I'll be getting these milled out of copper here soon.

My 3D print shows the bus bar linkage SHOULD fit in the motor, but I will have to cut the leads to 35mm, so it's a one way ticket to destroying this motor. Should be fun.



I'll be reversing the resolver pins too which is the easy part. If nothing else this should be entertaining in the line of model 3 RDU hacking to see what's possible. It's a crude solution.

[EV_Builder]

Usable if you use OEM hardware and max. Reverse speed is limited by firmware (not bij command).

In the OI solution you can change config too accomplish this.

[bitMuse]

Yep. There's no OI solution though and like you mentioned there's the firmware limit in Tesla's firmware.

Should work really great here with the switched phases, motor will run backwards and think it's running forwards. 'Reverse' at no limit.

[davefiddes]

Intriguing way to solve the problem. I like it.

It would be interesting to hear more about the oil pump modifications required. Many have made arm-wavy assertions about how reverse on the M3 DUs are just limited by firmware because the oil pump is electric. Reality sounds more complicated.

[dougyip]

Interesting method of switching two phases! We are looking at converting our race car to AWD and one option we looked at was to run a front M3 Induction Motor in reverse. Our solution for that option was to mount the inverter remotely and swap two of the cables, but your solution preserves the stock form motor form factor. One thing that stopped us is that we talked to Quaife and found that their ATB differential will NOT work in reverse. A standard open diff should run fine in reverse though.

[bitMuse]

Interesting method of switching two phases! We are looking at converting our race car to AWD and one option we looked at was to run a front M3 Induction Motor in reverse. Our solution for that option was to mount the inverter remotely and swap two of the cables, but your solution preserves the stock form motor form factor. One thing that stopped us is that we talked to Quaife and found that their ATB differential will NOT work in reverse. A standard open diff should run fine in reverse though.

Fascinating! I didn't know that about the diff and was planning to purchase one so you may have just saved me a few thousand. That's not a deal breaker for me, it's not a race car just a for-fun car, so as long as I don't take it drifting it should be fine.

Regarding the oil pump, I didn't see anything that would really matter forward or reverse. It's an electric pump, and the pickup is at the bottom of the case. Interestingly, if you disconnect the signal wire of the pump and power the motor, the oil pump defaults to running at full speed. It's likely run with a PWM off the signal wire.

But if the engine explodes I'll be sure to tell you guys.

[davefiddes]

Ah. I misunderstood. The oil seal housing != oil pump.

The oil pump defaults to limp home mode if not plugged in to the Tesla SW. It's controlled over LIN using an as yet undocumented protocol. There are some captures to decode if anyone wants a simple(ish) project. It's down Damien's and my priority list due to the limp home behaviour.

[Jack Bauer]

Here are a few videos on recent progress with the M3 drive unit project :

[Proton]

Can I use some 20 Ohm pre-charge resistors instead of that heating element? and what kind of breaker are you using. what values?

[crasbe]

Can I use some 20 Ohm pre-charge resistors instead of that heating element? and what kind of breaker are you using. what values?

If your precharge resistors have 2000W power dissipation: yes, otherwise: No.
The reason for that is simply that you do not want the resistors to burn out. Because if they do, you'll end up with a fried inverter. For that reason just use a 20€ heating element, certainly cheaper than the hundreds or thousands of Euros for the Drive Unit Inverter.

The breaker has to be rated for DC currents and disconnection ability, not all breakers can do that (or up to the same specification as AC currents). The current rating depends on what you'll feel safe with on a bench setup. I don't know what Damien uses.

[AMP3R]

How do you think that oem cable will be enough to power the rear drive unit? Battery is on the back side and motor is on the front.

[supernova]

How do you think that oem cable will be enough to power the rear drive unit? Battery is on the back side and motor is on the front.
Screenshot from 2023-05-29 14-16-18.png

Hi,
I have joined this cable to the standard (short) TM3 RDU lead.
The cable CSA is identical.

[nathaniel]

i'm following this topic for a while now with very high intrest, and now I could buy a m3 unit from a damage car for very low price which I couldn't resist. only 600 euro's. the car entered the workshop under its own power, so the motor is still working.
so now i want to play with the inverter to get it to run.
is i understand dave is working on a port to the TI micro but working in the electronics world and embedded software I know the difficulties that come with that. it sounds like a very nice solution that I would prefer but I don't know what its current status is and how much work it still takes. I'm unfortunately also not skilled enough to contribute at this level of software writing.
so the next option is the one demain is working on and got his engine running. i have my own conversion project running on an oi mini with a custom mitsubishi inverter so that is familiar territory for me. but i can't find the design files for the adapter pcb on his github and also the link on the wiki to johannis's firmware doesn't work unfortunately. I understand that it is still in full development so that may be why it has not been made open source yet.
but i would like to try to convert my inverter in this way. I also have 2 separate inverters from the M3, with possible problems but useful for parts if I were to demolish something.