Tesla Model 3 Rear Drive Unit Closed Source CAN Hacking

[AMP3R]

Hey. Now I have a 3D7 drive unit that traveled only 895 km, "go" pedal, keycard and matching VCSEC from the 2023 Tesla MY.

Today I've checked, how the pedal works. And it works fine.

Tomorrow I want to connect the VCSEC module to the vehicle can bus of the drive unit and fingers crossed it will appear the message DI_immbilizerState: DI_IMM_STATE_DISARMED.

Unfortunately I have the can logs only from 2019 M3 Perf and very old model 3 can dbc file. It seems to me that my motor has newer software and nothing is going to happen.

[johu]

Good luck! Various proprietary solutions exist, would be nice to have an open source one

[AMP3R]

I wired the VCSEC with Vehicle can bus of the drive unit and nothing happened like I had guessed before. Need help. Maybe can logs from fresh M3/Y?

[dimonlipko]

Yes, I can make CAN BUS log from my M3 with fresh software.

[AMP3R]

Yes, I can make CAN BUS log from my M3 with fresh software.

I would appreciate it.

[coryjfowler]

Can anyone provide any good sources of info regarding the inverter "pairing"? Most of the discussion seems to be about using the Tesla motor in alternative applications, and how it is unusable with other controllers, but I'm working on a project where I plan to replace the existing drive unit of an M3 with an alternative inverter/motor and I'd like to retain compatibility with the rest of the Tesla architecture. Is the VCSEC likely to block this at the vehicle end? If so, is it likely that I could get around this by listening to the interaction between the VCSEC/IDU and playing it back with my new drive unit?

Looking at the Service documents for the Model 3 "Drive Unit - Rear (3DU) (Remove and Replace)" the Install step 115 deals with using toolbox for "Secure pairing (immobilizer pairing) between the Security Controller and Drive Inverter and Vehicle Odometer Pairing to UI".

[RadioKot]

Hello everybody!
Is anyone working on creating their own cortroller to start the engine? I am only at the beginning of this difficult path, so I would like to listen to already experienced users.. However, I have already managed to pair the TM3 rear motor with the TM3 battery using the ingenext controller. I also implemented a cooling and heating system using TMS components, but I would like to control the engine myself.
Can anyone suggest something about this?

[AMP3R]

Hello everybody!
Is anyone working on creating their own cortroller to start the engine? I am only at the beginning of this difficult path, so I would like to listen to already experienced users.. However, I have already managed to pair the TM3 rear motor with the TM3 battery using the ingenext controller. I also implemented a cooling and heating system using TMS components, but I would like to control the engine myself.
Can anyone suggest something about this?

Let's collaborate and reverse engineer your ingenext controller.

[RadioKot]

Great idea! Soon I will review the entire topic to understand what local users have already managed to do. Together we will be able to create a unique ingenext. I would like to attach a photo of my installation, but I don't know how to do it

[AMP3R]

here

[RadioKot]

So there is my installation

[davefiddes]

That's an impressive setup. I'm jealous!

A open CAN based solution would be welcomed by many. If you guys can collaborate on it that would be fantastic.

The approach I'm taking to build a brand new firmware for the inverter is completely mad. Sort of equivalent to casting your own cylinder head and pistons for a hot-rod. Technically possible for some but very slow going and it might struggle to meet the OEM performance.

[P.S.Mangelsdorf]

Technically possible for some but very slow going

But how awesome it will be when it works!

[RadioKot]

The approach I'm taking to build a brand new firmware for the inverter is completely mad.

Tell us about your idea?

A open CAN based solution would be welcomed by many. If you guys can collaborate on it that would be fantastic.

Yes, I would like to work on creating a CAN controller, but I need someone's help with this

[AMP3R]

Tell us about your idea?

Yes, I would like to work on creating a CAN controller, but I need someone's help with this

Have you already "paired" your motor with the controller? If not, you can record the entire inverter flash procedure from ingenext support when you communicate via teamviewer. The main thing is that you have reliable CAN analyzer.

Can you do it yourself?

[davefiddes]

Tell us about your idea?

My github project: https://github.com/davefiddes/c2000-inverter explains the scope of what I'm working towards.

[RadioKot]

Have you already started your motor with the controller?

I've already started the engine. Ingenext has already done everything that was needed with it two months ago, since then I have been developing a thermal controller

Can you do it yourself?

Yes, I can try to do it on my own. I already have the final CAN log. But I didn't risk sending messages to CAN. I could try to do it, but I need an experienced person. I have not encountered these programs before, but I would really like to learn

[AMP3R]

I've already started the engine. Ingenext has already done everything that was needed with it two months ago, since then I have been developing a thermal controller


Yes, I can try to do it on my own. I already have the final CAN log. But I didn't risk sending messages to CAN. I could try to do it, but I need an experienced person. I have not encountered these programs before, but I would really like to learn

What log do you have exactly? The inverter firmware procedure itself or did you just record what the controller sends to the motor?

What is your end goal? Do you want to make your own controller and then sell it or what?

[RadioKot]

What log do you have exactly?

Of course, I do not have the procedure for flashing the inverter. Ingenext keeps it a secret… I only have the signals that the controller sends

What is your end goal? Do you want to make your own controller and then sell it or what?

This controller will be useful to me in my other projects. It's more of a challenge to myself, but maybe I'll sell it piece by piece to interested people.

[AMP3R]

Of course, I do not have the procedure for flashing the inverter. Ingenext keeps it a secret… I only have the signals that the controller sends

This controller will be useful to me in my other projects. It's more of a challenge to myself, but maybe I'll sell it piece by piece to interested people.

Will you share the logs? Many will thank you.

[RadioKot]

I can't attach it.trc file because it is an invalid file extension. I can send it in other messengers

[AMP3R]

I can't attach it.trc file because it is an invalid file extension. I can send it in other messengers

Check PM

[AMP3R]

I have this scary setup with a computer power supply, from which I take 310V 6A max. It seems to be suitable for testing.

Using prepared can logs and so far only VEHICLE CAN, I managed to achieve the inverter states IMMOBILIZER_STATE DISARMED and DI_SYSTEM_STATE IDLE.

I am sure that I am doing something wrong, because the ACTIVE DISCHARGE - ON error is active.

[RadioKot]

Good job!

[davefiddes]

Do you have an intact HVIL loop with a 20mA current running through it? Without that the HV bus discharge circuit on the inverter will not deactivate.