Tesla Model 3 Rear Drive Unit Hacking

[Jack Bauer]

Sorry Dave

[davefiddes]

There's a saying in motorsport that "yellows breed yellows". I have often observed that in a similar way "releases breed releases". The act of shipping something causes the wider planet to more closely inspect the operation of said software and find things not quite to their liking...

Anyway it's forced me to carefully review the DigIo config again and I'm finding yet more bugs. Hope to get it sorted shortly.

[JaniK]

Have fun tinkering with the boards. Do keep us randomly bored with the update videos when you have the time. To the beta testers too, we all like to see them spinning motors.

PS. I still have the stock inverter here, but no project to put it atm.

[davefiddes]

After a bit of a delay I've managed to push a fix to ensure HV discharge is turned off as soon as the inverter boots. Proven it works by fitting an LED in place of U33.

Unfortunately I found a bunch of problems in the GPIO configuration that took a while to figure out. I've combed through the M3_DU and MG_DU schematics and made sure that everything is now accounted for. The code now makes it clear which inputs and outputs are not relevant for these inverters.

The over-current sense input on both the M3_DU and MG_DU were misconfigured. This doesn't affect the operation of the over-current trips which is all done with hardware. With this fixed the "din_ocur" spot value now reflects the state of the over-current input. I still have a problem where the inverter doesn't post the correct error. It should post "OVERCURRENT" but it always posts "DESAT". I'm working on a fix for this.

The other problem related to the configurable fan/contactor output. If this had been configured it could have broken the gate driver monitoring and tripped the inverter. You now can't do that on the M3_DU and MG_DU.

[Jack Bauer]

[davefiddes]

Some notes from V3 board testing and SW integration work:

The T15 switched ignition input half works as desired. It turns on* OK but fails to turn off (with the shipped firmware). On investigation the MAIN_PSU_EN signal was floating at 2.6V as you would expect with the GPIO pin unconfigured. I've put together a basic power off sequence which works fine for now *but* there's a possibility that if the device gets stuck in a bootloop it'll sit there and drain the battery. Looks like a pull-down is needed on MAIN_PSU_EN to get it to behave.

I'm still working on PWM_INHIBIT error processing. The GATE_DIAG signal doesn't look too healthy even with no gate driver open-drain outputs connected (chips still on order). It gets to 3.6V which is still a high but it's not great and obviously the source of the dim fault LED glow in the video. Tesla has a decent pull up to 3.3V on their board. Seems that is missing from the V3 board.

Power consumption when turned off seems quite high at 70mA. On investigation it seems that PS1 is still spitting out 12V when turned off. I've checked this with a cold start as well as after the CPU has turned itself off. The GATE_PSU_EN is low as expected.

Nothing earth shatteringly bad but some stuff to look into for sure.

* - Of course on the first power up I had the board on a bench PSU. Almost had a heart attack when nothing happened, no power LED, nothing...then it dawned on me that having the switched ignition input wired up might be a good idea...that being the point of having the board on my desk in the first place. Muppet.

[Jack Bauer]

Thanks Dave. On your last point first : the exact same thing happened to me. I'm sitting there staring at the board and finally the penny drops

Regards the DCDC yep spotted that a bit too late. Those traco ones need some weird current injection to switch off. I have a meanwell version here that is a drop in replacement and should solve that problem. Will test shortly and report back.

All the beta boards have now shipped out so the plan is to get the car driving asap (big saga with dcdc converters but thats a subject for another thread) and trash it around the field until something breaks. Next board order will catch the physical stuff like some holes still slightly misalligned and the circuit design problems. I'm going to suggest the beta testers tie T30 and T15 together and just use the "old" power on / off method. Thats what I'm going to do in the car for now.

[davefiddes]

I've been thinking (dangerous I know) and I think I've found a potential gotcha with the HV discharge behaviour on the current boards.

As long as the inverter MCU has power the HV discharge is disabled. The MCU switches off (or is switched off externally) and the HV discharge kicks on. This is all good. The problem I percieve is what happens when the vehicle is being charged? The inverter may not be powered up but there is a need for HV to be live. In this circumstance the HV discharge will operate continuously getting toasty as above.

The Tesla inverter handles this better IMHO. The HV discharge is an autonomous system which is controlled by the HVIL current loop. As long as you have 20mA flowing through it the HV discharge is disabled. The inverter MCU can only monitor the HVIL loop but has no need to control it. You don't need to have 12V on the inverter at all to have functioning HV but it'll safely discharge the bus cap as soon as HV is gracefully or ungracefully removed. Of course you need a 20mA HVIL loop controller integrated with your contactor control somewhere.

Tesla also have a charger input on their inverter. Persumably they use this to inhibit the inverter going into Drive allowing it to be powered up safely while charging. Perhaps this would be a way to tackle it? Hook it directly into the PWM_INHIBIT NAND gate and the would be no doubt of it functioning.

Edit: Or the KISS option. With a 680 uF bus cap and the permanently connected 123k discharge resistor you're looking at 162 seconds to get from 350V to 50V. Do we need an HV discharge?

[Jack Bauer]

Yeah fair point but damn it looks cool Will add it to the to do list.

[johu]

Yeah Nissan just whack a constant 100k cement resistor across the bus
Keep the resistors, just makem higher value. Still looks cool but doesn't burn off

[AMP3R]

The Tesla inverter handles this better IMHO. The HV discharge is an autonomous system which is controlled by the HVIL current loop. As long as you have 20mA flowing through it the HV discharge is disabled. The inverter MCU can only monitor the HVIL loop but has no need to control it. You don't need to have 12V on the inverter at all to have functioning HV but it'll safely discharge the bus cap as soon as HV is gracefully or ungracefully removed. Of course you need a 20mA HVIL loop controller integrated with your contactor control somewhere.

Tesla also have a charger input on their inverter. Persumably they use this to inhibit the inverter going into Drive allowing it to be powered up safely while charging. Perhaps this would be a way to tackle it? Hook it directly into the PWM_INHIBIT NAND gate and the would be no doubt of it functioning.

Edit: Or the KISS option. With a 680 uF bus cap and the permanently connected 123k discharge resistor you're looking at 162 seconds to get from 350V to 50V. Do we need an HV discharge?

They removed physical hvil loop and charger input a few years ago. Its status transmits via can and everything works fine. Maybe it's better to copy these things from tesla?

[muehlpower]

There is a regulation on this subject in Germany and presumably throughout Europe.

https://www.miba.com/de/produktbereiche ... k-entladen
"
Welche Vorgaben gibt es für ein ordnungsgemäßes Entladen?
Laut Vorschrift müssen der Zwischenkreiskondensator und andere Kapazitäten nach dem Ausschalten der Zündung innerhalb von 5 Sekunden unter 60 V entladen werden."

translated:

"
What are the requirements for proper discharge?
According to regulations, the intermediate circuit capacitor and other capacitors must be discharged to below 60 V within 5 seconds after the ignition is switched off."

[Jack Bauer]

I'm just really glad we are finding these problems in beta. I've been so focused on getting the motor running. Many thanks to everyone who has and continues to contribute to this project.

[davefiddes]

Plugging the numbers from the MIBA website into the handy Digikey calculator you get a discharge time of 4.8 seconds with a 680uF bus cap going from 350V to 60V. So that's the regulation that Tesla were designing to it seems.

Looks like a charger inhibit input would play nice with the Foccci LevelOnValidPp output. It also looks like we have a spare bit on the canio bitfield that would allow CAN only integration. ZombieVerter VCU would need extending to understand that it was OK to keep the inverter powered on when charging but asserting the charger inhibit signal via canio.

I think both methods of inhibition would be required. People using the inverter start/fwd/rev inputs would need a wired connection. Zombie would be fine with existing safe CAN integration used for start/dir/throttle control. Code wise it seems straightforward to add.

[jrbe]

Could potentially use a logic gate to be controlled by a few inputs and not have to worry about software as much or maybe at all.

[davefiddes]

Today's discovery, the two throttle inputs are swapped around compared to other OI boards. I'm able to swap them back in the firmware so have opted to do that. The MG DU is also affected but I haven't swapped them as they don't need a custom analog input config for other things.

Damien, can you confirm that the thermistors you have on the board are JCurve and the motor conforms to the KTY83 curve? I wasn't going to make the temp sensors configurable to reduce the likelihood of errors in the same was as the Tesla SDU/LDU boards do. Can do if you think that's better? Edit: Will continue to be configurable. Having config params that do nothing is just confusing.

Edit: Also note that uaux is not connected to anything. Not a deal breaker but it's useful to measure what's going on with the 12V line in my experience.

[nathaniel]

hi all, recieved my beta board so I'm very excited to test it. I have installed the ICs, transformer and current sensors and everything seems to be fine so far. The power supply is working and all the gate drivers are reporting ok, so I'm now about to install the PCB on the inverter. However, the temperature sensors weren't included, and I can't seem to find the correct type to order. Only the older version of the schema is on git, so I can't find it there either (I think these will only be released when the definitive version is available?)

So my question is, what type of temperature sensor do I need so I can order it and continue testing?

Once I get the motor running, I'll report further on my findings, but so far everything is super clear. Very impressive PCB!

I'll create a new thread about the conversion soon and post the link here for those interested.

[davefiddes]

I'm sure that Damien meant to provide the thermistors. They were included with my board. Unfortunately I can't find any helpful identification beyond "47K" on the part. I too am waiting for info on the part number to make sure the firmware has the correct calibration curve.

The most recent schematic and the one I am working to with the firmware is this one: https://github.com/damienmaguire/Tesla- ... V3_SCH.pdf

Hopefully Damien will be along shortly to update us.

[nathaniel]

Thanks for your reply. Given the schematic, various sensors could certainly be installed. For example, an NTC 10k, but then the question is whether that curve is included in the firmware. At this point I would really like to get something mounted so I can start testing. I have an NTC 10k lying around, so if that could be made to work with a proper curve, that would be good too. But the ones currently in the selection list don't have that one.
otherwise we'll just wait for Demain's reaction and order the right part

[davefiddes]

If you are able to create a new tab on the spreadsheet https://github.com/davefiddes/stm32-sin ... ensors.ods with the expected ADC readings at different temperatures. The reference voltage is 3.3V and the "load" resistor is 10k.

I can easily add in a new temp curve temporarily. I wouldn't want to do it long term as the tables are quite big.

If you only have 1 thermistor then I would suggest fitting it to ST3 or ST4 as these are going to get the hottest. ST1 is the coolant inlet. The current firmware will pick whichever one has the highest temperature. If a sensor isn't fitted it'll read -20 or something similar.

[Jack Bauer]

My apologies they should have been included. I can post on Monday if you contact me offline. Parts are Epcos B57164K0473J000.

https://ie.rs-online.com/web/p/thermistor-ics/1912285P

[Jack Bauer]

Sorry been off air a bit. Some health problem at home. Great to hear boards are arriving. Nathaniel , did you buy new parts or harvest from the oem board?

[nathaniel]

No problem, it's the beta batch so something can go wrong right;) Thanks for the offer to send them, but I need more stuff, so I'll just order them myself no problem.
I removed all the parts from the Tesla PCB, why buy them if you already have the parts anyway.
The connector was the most challenging part to remove, I ended up using a mega-thick 200 watt soldering iron and it came off really quickly in the end, you just need a large heat mass.

@davefiddes, Thanks for your offer to add a table to the software, but for now I'll just order the correct component and solve it that way.

I'll keep you updated when I get the motor running

[davefiddes]

I added support for the correct thermistors to the firmware today. Just pick "TeslaM3" for the "snshs" parameter.

Still working on the motor temp sensor. There was some data from the early days of the project but it doesn't look great. I'll see if I can get a cleaner set of readings.

[Devon8000]

Sign me up for the next round! Model 3 inverters are really cheap now. It looks like the same/ similar inverter is used in the model Y and Model S Plaid, as well.
The new inverters have this explosive fuse that physically breaks the bus bars, rendering the inverter unusable.


I don't yet know what conditions have to be met for the fuse to go off, but it might not take very much... Maybe even small a fender-bender is enough to set it off.

I got a couple of these "broken" model 3 inverters. If we find a good way to repair the bus bars, we can bring these back to life with Damien's board.

Here's a video about these explosive fuses:
(explanation starting at 22:25
The set the fuse off at 24:30)