Tesla Model 3 Rear Drive Unit Hacking

[Jack Bauer]

I'm reminded of a line from a Bond movie today. "Mr.Bond, you continue to defy all my attempts to plan an amusing death for you". So I managed to drop a spanner on the inverter phase terminals while the motor was spinning, then managed somehow to set deadtime to zero. Gate drivers just shut down. But not before ripping the lining out of one of the T3RD's brake pads.

This might prove to be VERY premature but so far I can't kill this inverter....

[Bratitude]

This is great news

So they probably learned a thing or two… they must have blowen a lot of ldu and sdu inverters them selfs

[Jack Bauer]

Well folks I screwed up. Enough this time to make the board unusable with FOC firmware. I feel really stupid if I'm honest as its an amateur mistake. The scope shot attached is taken between the ground pin on the main multiway connector and ground at the gate psu. When the gate psu is running we get a horrible ground bounce that pumps noise into the STM32 ADC , current sensor 5V supply and resolver circuits. Kinda explains why it was so hard to tune

Anyway after a few days of investigation and testing its now painfully obvious why Tesla have 4 board mounting holes via stitched to the inverter case and two ground planes via stitched all the way around the LV area. So V1 is dead , long live V2. I started today on modification. Also too the decision to switch to an LDO for the final 3V3 supply and add and extra LC filter to the 5V supply as described in the datasheet. With luck I'll start washing the files through JLC next week for a potential order. Usually takes a LOT of trial and error on such a large board.

Just wanted to say a massive thanks publicly to those who have helped and encouraged with this project

[davefiddes]

That's unfortunate. Progress is never smooth.

You might want to look at the package sizes. It seems you're still using 0804. JLC will do down to 0402 on their standard process. That makes an L of a difference to decoupling.

Also a good idea to stick ground vias close to any signal where it switches layers. If you don't pick the return current path then James Clerk Maxwell does it for you.

[Jack Bauer]

Today's mission is lining up all the holes , dowels and of course the connector.

[Jack Bauer]

Current V2 schematic and board layout. Feedback welcome. Plan is to push the button on an order in the next few days.

[Jack Bauer]

[Jack Bauer]

New board layout done. Getting hole alignments as close as possible before placing the order with JLCPCB. Gonna bite the bullet and go with 2oz copper this time.

Also got the correct fitting coolant connectors from Aliexpress.

[Jack Bauer]

V2 boards ordered.

[Jack Bauer]

In production

[Jack Bauer]

Started testing on the V2 board.

[Jack Bauer]

[Jack Bauer]

OpenInverter Can tool working on the drive unit with a Peak can usb over socketcan on ubuntu.

[Jack Bauer]

Not very exciting but now have control over the drive unit pump speed from the inverter via LIN. Thanks Dave for the reverse engineering work.

[davefiddes]

Can I lend a hand with the firmware development?

Seeing johu's decision to step back from developing stm32-sine I took a close look at the status of the master branch. There's some important fixes relating to CAN SDO there but not in your MG_DU branch. This means that CAN map saving is non-functional. I've taken the liberty of merging the current master onto the MG_DU branch and testing it thoroughly. This can be found here:

https://github.com/davefiddes/stm32-sine/tree/MG_DU

I'd be quite happy to take any rough and ready development code and fit it into the main firmware in a sympathetic way. It should be possible to keep a single firmware image for all stm32-sine inverters.

[Jack Bauer]

That would be brilliant thanks Dave. I'm working on an offline copy at the minute due to the changes needed for things like resolver freq , LIN on UART4 etc. I'll document it all here shortly once I have things running properly.

[Jack Bauer]

Talking LIN to the oil pump. 40psi at idle not too bad

[Jack Bauer]

Dave, here is my basic working version. Now tested on bench drive unit and drive unit in Volvo V50. Both rear so FOC firmware. There are a lot of changes in here so I'm considering this a M3 only branch for now as some of the changes for example lock the PWM freq to 8.8khz and the resolver exciter to 8.8khz also.

These are in pwmgeneration.cpp lines 39 and 373 and incencoder.cpp line 65.
The other sort of bodge is on using UART4 for LIN. I had to hardcode this into linbus.cpp which I will attach.
https://github.com/damienmaguire/stm32-sine/tree/M3_DU

First run in the car today :

[davefiddes]

Thanks. I'll take a look and try to come up with some ideas.

[Jack Bauer]

Thank you Dave.

[Jack Bauer]

Slight problem Dave. Your new libopeninv is spamming the canbus at the exmpense of running the motor

Edit : The remove can mappings button has no effect.

[davefiddes]

I'm not sure what I'm looking at there. It looks like a lot of garbage CAN frames?

You can revert the libopeninv change by:

Code: Select all

cd libopeninv
git switch --detach d3d67d2

Then rebuild. I'm not sure why that would be doing anything wild unless the CAN freqency is wrong because of the different STM32 part you are using. It was quite benign when I tested it on my Bluepill based inverter.

Edit: I've reverted my libopeninv uptick until we figure out why it broke anything.

[Jack Bauer]

Yeah garbage CAN frames and sending them at such a rate as to trigger the watchdog. The part I'm using is the STM32F103VCT6.

[Jack Bauer]

So the VCT6 has 2k flash page size. Changed that and is somewhat better but still not working properly. This popped up when I asked it to delete all mappings.

[davefiddes]

Oh, 2KB flash pages are going to screw things up royally.

Sounds like the calculations in GetFlashAddress() in param_save.cpp and the equivalent CanMap::GetFlashAddress() might be inconsistent and/or wrong. The way they are supposed to work is that the params are saved in the top flash page and the CAN map in the next page down.

The bootloader and inverter also need to agree on the location of the pindef page (top of flash - 3 pages) and none of that code knows about 2KB flash pages.

Try updating PINDEF_BLKSIZE in libopeninv/include/stm32_loader.h to 2048.