Tesla Model 3 Rear Drive Unit Hacking

[GuyH]

@bitMuse - have you had any more progress on the switching cables & the resolver pins? - working on a similar project here at the moment.Working with Ingenext and their controller as well.

Thanks

This is a different type of hacking, but unlike many others in this thread who have come, said a thing, and then vanished forever, I have gotten quite a bit further.

I'm exploring the boundaries of what can be done with hardware alone. While I have the motor spinning normally using an off the shelf solution, I am working to trick the motor into running in reverse like a lot of the LDUs have for Model S.



With the very limited space inside the motor I have designed in CAD a way to cross two of the bus-bar linkages for the AC feeding into the stator. I need to modify the oil seal housing next, but I'll be getting these milled out of copper here soon.

My 3D print shows the bus bar linkage SHOULD fit in the motor, but I will have to cut the leads to 35mm, so it's a one way ticket to destroying this motor. Should be fun.



I'll be reversing the resolver pins too which is the easy part. If nothing else this should be entertaining in the line of model 3 RDU hacking to see what's possible. It's a crude solution.

[bitMuse]

Good question!

I moved across the country before I could get them made. Essentially the problem I ran into is I need them machined as I lack the tooling. I contacted a couple places but they never got back to me. I started looking into sintering services, and theeeeeen I moved across the US. Now I have JUST arranged to have a place to work, but the car and motor are elsewhere having other repairs done while I work on the traction pack.

So suffice to say.. I haven't made much progress beyond confirming that the model DOES fit. And it SHOULD theoretically work. I am happy to share the model for free.

https://www.dropbox.com/scl/fi/a6hz1s71 ... r5fd9&dl=0

Here's the file for the bus bars. Totally open source, providing with no guarantees.

[dimonlipko]

I think, that good idea is use Tesla VCSEC and OEM inverter. In last software in service mode, available function change rear motor, so i think that it will be not hard to pair VCSEC to inverter. Next step is only send other CAN message from car to spin motor.

In Ukraine i see solution to write new key in VCSEC via CAN, without old key. So steal M3 is not to hard)))

[AMP3R]

According to this table does it mean that 3D7 has a "full mosfet" inverter? Not like old 3D5 without 3 mosfets?

[AMP3R]

I have the possibility to buy a 3D7 motor from MY 2023 for 800 euros with a broken rear mount. Is this a good price? How to check it with a multimeter for broken mosfets? Or are there no problems with inverters in this generation of motors?

[EV_Builder]

Always best to measure it; at least you are best informed then.

This is what I would do:

Get to the motor phases and measure between them for Ohm.
Between each phase and housing. Ohm.

Diode setting on multi meter between battery positive and each phase. Red leg on battery positive / black on each motor phase.
All should be endless.

Then reverse the Pens and measure IGBT forward diode per phase.

To check negative side red leg to phase and black to negative battery.

Final check : diode setting red pen on batt + , BLK on bat - and confirm voltage buildup and endless will pop-up on your multimeter.

Please correct me if I'm wrong guys.

Maybe this is something for in the wiki?

[johu]

Maybe this is something for in the wiki?

The quick check is already described: https://openinverter.org/wiki/Electronics_Basics

[MartinN]

The Model 3 drive units are cryptographically paired with the VCSEC. Without the appropriate handshake, the inverter won't budge. Ingineerix and EV Controls collaborated on breaking (or going around, still not clear to me) this handshake, but they aren't willing to share--the stated reason is: "obviously giving out code to bypass this would be bad as then once it gets out people can use it to steal cars". If it involved extracting key material from the onboard microcontroller in the inverter, then it'd also likely pose a legal challenge to share it, but I don't want to guess.

I am however, nevertheless, also extremely interested in driving a Model 3 RDU without modifying any hardware. I'll dig through your CAN logs (and some I have access to here...). Feel free to reach out to me if you'd like to collab.

My understanding, and I could be wrong, is that it is less a "pairing" and more a encrypted call and response between the drive unit and other computers in the car. No one has (open source anyways) broken the encryption. Even on the LDU and SDU, when the call and response was implemented, the commercial conversion solutions required reprograming the inverter to an earlier firmware without it.

There might be some sort of initial key provided when vehicles are programmed at the factory to tie the computers together, but I have no idea, it's way above my head.

Also, and feel free to not answer this, but how in the world did you get a zero mile drive unit? I thought Tesla didn't sell those? Did it "fall off a truck"?

Can anyone provide any good sources of info regarding the inverter "pairing"? Most of the discussion seems to be about using the Tesla motor in alternative applications, and how it is unusable with other controllers, but I'm working on a project where I plan to replace the existing drive unit of an M3 with an alternative inverter/motor and I'd like to retain compatibility with the rest of the Tesla architecture. Is the VCSEC likely to block this at the vehicle end? If so, is it likely that I could get around this by listening to the interaction between the VCSEC/IDU and playing it back with my new drive unit?

[AMP3R]

What are the chances that the pyrofuse didn't break 2 phases in the inverter of 3D7 motor whose rear mount was torn off?

[EV_Builder]

If so, is it likely that I could get around this by listening to the interaction between the VCSEC/IDU and playing it back with my new drive unit?

Easy to check I would say. Why not check?

[dsp1108]

Hello, colleagues.The next step was to write software for Tesla Plaid rear-wheel drives.A special feature of Plaid is the locked control chip and the rejection of direct measurement of the temperature of the electric machine.The task was difficult but interesting.The parameters of the Plaid and Tesla 3 electric cars are different.Currently, the 190 kW Tesla3 rear drive and the 410-420 kW Plaid drives have been tested.I plan to make a YouTube channel.I will be glad to cooperate on this topic and other topics of power electronics.
dsp1108@mail.ru

[dsp1108]

Addendum:The control of oil cooling pumps is also implemented...Plaid has 3 of them.

[johu]

Sounds interesting.
Did you port the OI code or something else? Anything on github?

[dsp1108]

Sounds interesting.
Did you port the OI code or something else? Anything on github?

The program code is written independently.

[davefiddes]

Great. Do you have a link to the code? I'd be interested to compare with my own efforts. Thanks!

[dsp1108]

Great. Do you have a link to the code? I'd be interested to compare with my own efforts. Thanks!

Somewhere on this forum I have already shown an example code for working with a tlf chip.

Vector control is used.I use MPTA algoritm.MPTV is reaching now.The second core handles the resolver processing.For Tesla Plaid, it was necessary to resolder the Tms chip and solder the one that was not locked.The gear oil pump for Plaid has other IDs for the LIN protocol.I had to investigate the operation of the oil pump....There is interest in implementing a standard protocol for exchanging the drive and other devices...As far as I understand, Tesla does not have a VCU unit....But maybe I'm wrong.

[EVS2K]

I read through the first seven pages and skimmed through the last few.

Did this ever get productised? Couldn’t see it in the shop.

[davefiddes]

Been having a bit of fun this week programming in the garage to see how the Tesla M3 oil pump works. Turns out to be pretty simple. There's a single command being sent out by the inverter to the pump and although it's 2 bytes long only 1 seems to actually do anything. The value that's sent commands the pump to vary the output with 0 being off.

The Tesla inverter firmware traces taken before I accidentally nuked it showed 4 separate requests being sent to the pump. I've been able to decode a bunch of the values these return including: fluid and pump temperatures (and 4 other temps!), supply voltage and current, motor RPM, and suspected fluid flow and pressure.

A simple ESP32 Arduino sketch to drive the pump and the retrieve the status can be found here: https://github.com/davefiddes/Tesla-Model-3-Drive-Unit/

I'm sure that there's more to be found particularly on error states. I can only really see the Fluid Temp being useful in the short term.

Here's a graph of what a short 50 second run of the pump produces:

[LRBen]

Regarding unit oil. If you have the drive unit where oil is in the motor as well you need to use FUCHS BluEV EDF 7005. Apparently it has the correct additives for use inside the motor.
It is black in colour from new with additives in suspension as well as solution. So it needs a good physical mix before refilling.

I got this info from Fellten who spent a good bit of time researching it.

[davefiddes]

Wished I'd known about this before buying 3 bottles of Fuchs Titan ATF 6009 which was what Opie Oils were recommending last year.

[AMP3R]

[Jack Bauer]

Sooo, some updates on the musk. I must admit I had let the replacement pcb project lag. Thankfully, Artur Kustusch came onboard and reverse engineered the ENTIRE gate driver section This has given me a big push to get back on the project and I've since reversed the gate driver psu and other peripherial circuits to the point now that I'm laying out the pcb with a view to ordering some bare boards before year end for fit testing. So yeah its been slow but its a BIG project

Attached latest schematic for those interested. Note that like the MG drive unit logic board this design utilised the 100 pin VCT6 variant of the STM32F103.

Also, where is practical, oem component designators and positions are used on the OI board. The OI board will be 4 layer, single sided SMD. And just for fun I get to learn kicad along the way.

Github repo : https://github.com/damienmaguire/Tesla- ... Drive-Unit

Jeez, 5 years has flown:)

And some recent progress videos :





And of course I have my trusty Volvo V50 with a drive unit installed just waiting for some openinverter goodness:)

[Jack Bauer]

Huh.....something weird must have happened while I was away. Not been told I'm doing it wrong for a whole day .....

[AMP3R]

Huh.....something weird must have happened while I was away. Not been told I'm doing it wrong for a whole day .....

They are waiting for your new circuit board.

[Jack Bauer]

Sorry am not much help on the can front. Years ago I did look into it but as its not a repeatable solution for folks I didn't spend any further time at it. Hope you have success.