Tesla Model 3 Rear Drive Unit Hacking

[AMP3R]

After playing with the motor for a while, I realized why the inverter doesn't switch into STANDBY mode.

Active errors: DIR_a144_configMismatch, DIR_a062_systemLimpMode, DIR_a092_bmsMIA.

Apparently, I will have to go to the junk yard where I bought my motor and record the logs from the MCU and BMS.

[AMP3R]

I noticed that DIR_a144_configMismatch is triggered by two messages 0×392 (info about battery) and 0×7FF (car config)

We can say that this is a fundamental error and because of it the motor will not spin.

[AMP3R]

I figured out the 0×392 BMS_packConfig message, which triggers the DIR_a144_configMismatch error.
Just corrected the maximum voltage to 387 and the error disappeared.

[AMP3R]

The first frame from the multiplexed message 0×7FF about the car config is ready. It turned out that all bits can be empty except bit 56

The second frame can be completely empty.

The third needs information about GTW_perfomancePackage, GTW_chassisType and GTW_packEnergy. Everything else can be zero.

The fourth can be completely empty.

The fifth can be completely empty.

The sixth is also empty.

DIR_a144_configMismatch goodbye

[AMP3R]

The main system errors have disappeared, but the inverter does not switch to STANDBY mode yet. Any ideas?

[davefiddes]

You look like you have a lot of happy systems there to my uneducated eyes. Have you got a capture of a working Tesla of a similar vintage to compared against?

[AMP3R]

You look like you have a lot of happy systems there to my uneducated eyes. Have you got a capture of a working Tesla of a similar vintage to compared against?

Please look.

[AMP3R]

vehicle can park.csv

(889.77 KiB) Downloaded 418 times

[davefiddes]

I'll have a peek though I'm not sure there's much I can make of it. I guess I was more asking as to whether you had access to enough in the way of captures. Just looked at the price of second hand Model 3s and they're really quite affordable...hoping that someone with one and a sense of adventure would be able to help you out with on-going CAN captures.

[AMP3R]

Ok

[AMP3R]

Can anyone tell what DI_limitVBatHigh, DIR_ssmState, DIR_usmState and DIR_fluxState are?

[LRBen]

Regarding unit oil. If you have the drive unit where oil is in the motor as well you need to use FUCHS BluEV EDF 7005. Apparently it has the correct additives for use inside the motor.
It is black in colour from new with additives in suspension as well as solution. So it needs a good physical mix before refilling.

I got this info from Fellten who spent a good bit of time researching it.

[davefiddes]

Wished I'd known about this before buying 3 bottles of Fuchs Titan ATF 6009 which was what Opie Oils were recommending last year.

[AMP3R]

[Jack Bauer]

Sooo, some updates on the musk. I must admit I had let the replacement pcb project lag. Thankfully, Artur Kustusch came onboard and reverse engineered the ENTIRE gate driver section This has given me a big push to get back on the project and I've since reversed the gate driver psu and other peripherial circuits to the point now that I'm laying out the pcb with a view to ordering some bare boards before year end for fit testing. So yeah its been slow but its a BIG project

Attached latest schematic for those interested. Note that like the MG drive unit logic board this design utilised the 100 pin VCT6 variant of the STM32F103.

Also, where is practical, oem component designators and positions are used on the OI board. The OI board will be 4 layer, single sided SMD. And just for fun I get to learn kicad along the way.

Github repo : https://github.com/damienmaguire/Tesla- ... Drive-Unit

Jeez, 5 years has flown:)

And some recent progress videos :





And of course I have my trusty Volvo V50 with a drive unit installed just waiting for some openinverter goodness:)

[Jack Bauer]

Huh.....something weird must have happened while I was away. Not been told I'm doing it wrong for a whole day .....

[AMP3R]

Huh.....something weird must have happened while I was away. Not been told I'm doing it wrong for a whole day .....

They are waiting for your new circuit board.

[AMP3R]

My drive unit probably has last one active error DIR_a155_vcfrontMIA (The DI ECU is not receiving the expected CAN communication from the VCFRONT, and considers it irrational or MIA)

I assume that this is due to the message 0×3A1. Who knows, does it definitely come from VCFront?

[Jack Bauer]

Sorry am not much help on the can front. Years ago I did look into it but as its not a repeatable solution for folks I didn't spend any further time at it. Hope you have success.

[Jack Bauer]

Early Christmas present should make life a bit easier:)

[Jack Bauer]

All parts placed.

[Jack Bauer]

Ok, Need a bit of advice here. Ol Elon is at it again. The best backup low side psu is ... None? So on my board with the Viper16 based HV psu the low side drivers are spoiled rotten. They can get their power from either the 12v transformer system (big thing in top center of board) OR from a HV derived psu like the Viper16. Diodes D491 and D74 in the pic above prevent back feeding. Great. BUT, the versions of the board that use the NCP1060 HV psu dont do any of this and the Low sides are just powered from the 12v system. Question is, what should I do?

[johu]

Have we ever understood the point of the backup PSU?

[Jack Bauer]

Sadly no. At least not by me. My only thought is this : The transformer has 4 secondaries. Elon dedicates one each to a high side leaving him only one for all the low sides. So is he using the 12v derived psu to just wake the drivers and keep the low sides off until HV comes up and the use the HV derived psu to provide the actual grunt when switching.

wont stop me ordering my fit and placement boards but its a fairly significant design "error" if i get it wrong later

[Jack Bauer]

But that doesnt work on the boards using the NCP1060....unless.........the best anti feedback diode is no diode?

Dammit. I need one of those boards with the 1060. Does anyone have an inverter with this psu and willing to make some measurements? I believe its a "980" type.