Tesla Model 3 Rear Drive Unit Hacking

[ScythianNite]

so this setup requires an originally-paired inverter and VCSEC and canspoofing for the rest of the messages? (not to be reductive, just trying to parse through the posts so far)

[P.S.Mangelsdorf]

Dude that is awesome! Great work!

[Bratitude]

great work AMP3R, just to recap:

-stock M3/MY drive unit
-matching VCSEC (from the same vehicle)
-stock pedal
-vehicle CAN
-HVIL terminated


key card is not required? or key card is required to enable keyless driving?

[AMP3R]

so this setup requires an originally-paired inverter and VCSEC and canspoofing for the rest of the messages? (not to be reductive, just trying to parse through the posts so far)

Yes

[AMP3R]

great work AMP3R, just to recap:

-stock M3/MY drive unit
-matching VCSEC (from the same vehicle)
-stock pedal
-vehicle CAN
-HVIL terminated


key card is not required? or key card is required to enable keyless driving?

Key card is not required. You can enable keyless driving via can and that's it.

[dimonlipko]

Great work AMP3R! I long time dont read this thread, you progress is cool!

I very slowly but work on this way to run M3 inverter. I make some research on MY and change rear drive inverter from 990 to 980 version. I make new IMMO pair with VCSEC and DIR with Tesla Toolbox. But then I change back stock inverter, VCSEC forgot it, so VCSEC can make pair only with one inverter.

I buy MCU with old software , display, motor, VCSEC, pedal and wiring for bench test. MCU help me rewrite software in inverter for more old version, when I start redeploy. And MCU help me make IMMO pair.

Next step emulate CAN frame to make motor spin)))

[Jack Bauer]

Almost ready for first real prototype from JLC

[Davidk]

Almost ready for first real prototype from JLC

Dont you miss holes for white plastic stands next to ST1/2/3?
Not sure what is under as i did not desolder my board yet.

[Jack Bauer]

Thanks but turns out Artur designed in a different sensor from mouser that doesnt need those holes so saves having to harvest them from the oem board. Have sent the step file for print.

[Jack Bauer]

She's done:)

[Davidk]

Because I desoldered my board i will post few notes for future adventurers:

1. To remove board you need to desolder all joints marked in green, total of 51 solder joints. I used just solder iron and solder wick.
2. You need to desolder High Voltage interlock loop marked in orange, only top and bottom solder joints are actually connected. Be kind to white plastic, it burns very easily.
3. You need to remove clamp over 30 pin connector, just take long flat screwdriver and move latches inward from plug side
4. Remove 11 T20 bolts (they are all same length). Yellow circles.

Now you can remove board, with connector, temp sensors and current sensors. For me this was easy and i did not had issue, i just wiggled it a bit.

Now you can continue with 30 pin connector in purple colour, this is bit painful part:
1. leads and whole surrounding area is covered by solder mask, i used Dremel with small tip to clean as much as i could.
2. Even when i tried a lot i was not able to wick solder from joins and free connector.
3. I ended with propane torch and connector just slid our, by this i obviously damaged board beyond repair/reuse.
4. To do this without damage to board you will need to use hot air soldering station.

Current sensor. Area around is again covered by solder mask a lot, i used Dremel again to clean area around. Housing is hold by 3 T10 bolts, coloured with blue dots. When trying to desolder sensors they slid out from black plastic housing, not sure if this is suppose to happen or not. I definitely used force to press housing away from board. Now i have plastic housing and two sensors which i desoldered later.

Tools used:
Solder iron, Solder wick, Bit of solder and flux, Torx T20 and T10, Dremel with small tip, propane torch.

Totally i spend 6-8 hours, i did not used solder iron for last 15 years and first two joints took me 30-40 minutes...

[Davidk]

If someone wants to reference internals of 3D6 inverter with other versions.

[Jack Bauer]

Thats great info thanks:) Can someone please add this to the wiki.

Edit : Wiki page is here : https://openinverter.org/wiki/Tesla_Mod ... Drive_Unit

[ScythianNite]

Now you can continue with 30 pin connector in purple colour, this is bit painful part:
1. leads and whole surrounding area is covered by solder mask, i used Dremel with small tip to clean as much as i could.
2. Even when i tried a lot i was not able to wick solder from joins and free connector.
3. I ended with propane torch and connector just slid our, by this i obviously damaged board beyond repair/reuse.
4. To do this without damage to board you will need to use hot air soldering station.

Current sensor. Area around is again covered by solder mask a lot, i used Dremel again to clean area around. Housing is hold by 3 T10 bolts, coloured with blue dots. When trying to desolder sensors they slid out from black plastic housing, not sure if this is suppose to happen or not. I definitely used force to press housing away from board. Now i have plastic housing and two sensors which i desoldered later.

I want to preface by saying this is an outstanding post and I will do my best to add to it based on my abilities. to prevent damage, it is best to use a stripping agent to remove the conformal coating on the affected areas. I suspected the conformal coating (referred to in your post as "solder mask") might be polyurethane based, and so found a stripping agent capable of softening said coating for mechanical removal. I did a small experiment on the main TI chip surface to verify function and will post an updated later during the week with detailed images and timings to help anyone using the chemical method in the future.

additional tools needed aside from those listed in this post:
Mg chemicals 8310/8310A as available in your locality or equivalent mg chemicals 8310A

UV/blacklight (I have party store blacklights at home and they work as shown) as conformal coating is uv reactive

Various stiffness brushes

Nitrile gloves, eyepro and respirator with volatile chemical filtering or some kind of active ventilation (or both for maximum safety)

Xacto blade or sharp flat screwdriver (again, peel not scrape, don't want to damage things)

Fine picks and tweezers to aid in coating removal of challenging areas and around leads. I have attached photos from my experiment

before

after

[Davidk]

Thats great info thanks:) Can someone please add this to the wiki.

I will copy it to Wiki once commented by others, I will also add notes around whole motor, how i disassembled it.

conformal coating

Ahh this is naming i was looking for! I also agree with you that chemicals should be used if some are effective. When asking friends about this i was always get answer "if it is automotive you need to use mechanical means, chemical should not work", because of this i used Dremel to clean it. Also damaging board is not a issue from my point of view as it is useless because of Tesla pairing to the car. In case i would like to put it on the wall i would obviously use less destructive means (especially not propane torch )

[davefiddes]

Interesting experiments with conformal coating. I saw a video about someone repairing a potted hybrid module in an old computer the other week using regular paint stripper (with dimethoxymethane) and wondered if this approach might work on Telsa board but didn't want to experiment as I'd really quite like to keep my board operational...

MG Chemicals 8310A is readily available in the UK from Farnell and RS Components so I might give this a try. I still don't understand how the Tesla standby PSU works and this is obviously not something Damien is interested in.

As an aside if anyone in the UK manages to remove the inverter board to install one of Damien's I'd be interested in getting hold of the board for further reverse engineering and to be a dev. board for my firmware project. Doesn't have to be perfect as long as components can be reattached or bridged out. Not worth shipping from further afield.

[Jack Bauer]

I ordered the 8310A from RS today. Also spent a few hours cleaning up the JLC bom and cpl so they dont generate weird errors. Good thing I did as JLC now have the STM32F103VCT6 as preorder only so I "reserved" 10. In any event, am ready to push the button finally to order 2 real prototypes as soon as confirm the fit of the 3d printed version.

[Jack Bauer]

Real prototypes ordered. Wish me luck:)

[Jack Bauer]

In production at JLC. BOM and footprints all match.

[Jack Bauer]

They have arrived

[Jack Bauer]

So far so good. Boards power up , 5v and 3v3 work and I can talk to the STM32.

Getting interesting:)

[Jack Bauer]

Sadly missed one locating peg for the current sensor block. No big deal. I can just snip it on this one.