Tesla Model 3 Rear Drive Unit Hacking

Topics concerning the Tesla front and rear drive unit drop-in board
davefiddes
Posts: 213
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 14 times
Been thanked: 38 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

I've pushed my new driver for the TLF35584 PMIC to my tree https://github.com/davefiddes/stm32-sin ... ate-driver. Complicated chip but I've got a basic driver that should be enough to get an inverter up and running safely. I figured that detailed supply rail fault monitoring was a nice-to-have for now.

To progress further it would be great to know the planned pin/peripheral mapping:
  • I've been assuming that SPI1 and SPI2 are available
  • I'm driving both SPI CS lines as GPIO so they can be anything convenient
  • I think it makes sense to hook the gate driver interrupt/fault line up to the existing DESAT line (GPIOC/GPIO9) as it'll automatically do good things in the existing openinverter FW.
  • PMIC fault monitoring will need a GPIO interrupt line though unused for now
  • Gate driver enable GPIO
  • Gate drive PSU enable (when to turn this on? All the time OR only when the inverter is running?)
I was planning on getting hold of an ST NUCLEO-F103RB eval boards for on-going development. I think this uses the same STM32F103RBT6 as the new modboard. Does this sound sane?

Next up I was going to hack on the temperature monitoring. Looks similar to the existing tesla temperature stuff.
User avatar
johu
Site Admin
Posts: 5788
Joined: Thu Nov 08, 2018 10:52 pm
Location: Kassel/Germany
Has thanked: 157 times
Been thanked: 1022 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by johu »

I have lately added SPI code for the i3 inverter and it uses SPI1 remapped to PB3, 4 and 5 (AFIO_MAPR_SPI1_REMAP). Not sure if Damien used that same mapping on the modboard?
https://github.com/jsphuebner/stm32-sin ... bmw-i3-adc
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Excellent. I'll be back on this soon.
I'm going to need a hacksaw
davefiddes
Posts: 213
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 14 times
Been thanked: 38 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

Been trying to reverse engineer the C2000 peripheral mapping. I think there might be a mistake in the pinmap spreadsheet. The spreadsheet has Resolver Excitation on ADCIND4. Snag is that is an ADC input only.

On the basis of Tesla using the 4 ADC on the C2000 to simultaneously sample Resolver Sine/Cosine and Phase A Current and Phase B Current I think that the Resolver Sine and Resolver Excitation pins are swapped. This would map Resolver Excitation to DACOUTA/ADCINA0 and Resolver Sine to ADCIND4. The alternative of DACOUTC/ADCINB1 being used for Resolver Excitation is also possible though not as logical as the other pin mappings seem to be.

On another topic: I think we're short of a capture of the LIN traffic to the oil pump. Can anyone with a working Tesla M3 drive unit obtain a capture?

I've looked at the On Semi LV8907 and the LIN component is just a transceiver. The actual protocol used is down to whatever MCU is embedded in the Tesla Oil Pump. From Damien's experiments I would guess that the pump is in limp home mode. If we want better control then we'll need to figure out the protocol being used. Not exactly top priority but good to know before everyone goes all medieval on their M3 inverters and de-Elons them.
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

@davefiddes sent you a pm
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Ok so the funny thing is I am 99% certain the resolver exciter is on the correct "side " of the chip if that makes sense. Anyway I'll verify on the front drive unit. Going to mod the modboard for now but won't push the button on an order until we make sure...
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

So looking at the STM32F1 line it seem we have the 32f103RDT6 that has a DAC! Quick play in cubemx shows no reason it can't be used along with the other needed peripherils. Any reason we can't run the inverter on this part? Would REALLY simplify the modboard.
I'm going to need a hacksaw
User avatar
johu
Site Admin
Posts: 5788
Joined: Thu Nov 08, 2018 10:52 pm
Location: Kassel/Germany
Has thanked: 157 times
Been thanked: 1022 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by johu »

Yes, should work
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
davefiddes
Posts: 213
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 14 times
Been thanked: 38 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

The idea being to ditch the analog exciter and do as Tesla do and drive it from a DAC output?

I'm no STM32 expert but it looks like this chip gives us an extra timer (or two) to drive the DAC. Looks like it would be possible to use the existing SineCore look up sine table to drive the DAC (16-bit table, 12-bit DAC). The additional compute overhead should be pretty minimal as it just needs to shuffle DMA buffer pointers. Will be more IO bandwidth used up. If I'm doing the maths right we'd need a sample rate of 2.048MHz so 4MB/sec.
User avatar
johu
Site Admin
Posts: 5788
Joined: Thu Nov 08, 2018 10:52 pm
Location: Kassel/Germany
Has thanked: 157 times
Been thanked: 1022 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by johu »

Seems like the RDT6 also has 2 DMA controllers where the DACs are mapped to the second one. So no conflicts there either.
Then with 12-bit left align we can use the existing sine table as is. To run through the entire sine table at 4.4 kHz we need to send a new half-word over at a 9 MHz rate, so 18 MB/s. Will have to see if that bogs down the bus. I reckon a 256-entry 8 bit table would be sufficient as well.
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Perfect! yes if I can ditch the extra parts for the square wave filter, op amp etc the modboard works much better.
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

New version using the RD part and onboard DAC. Also changed the mounting pads to bottom only so no need for expensive edge plating. I'll run some checks and then get a few made from PCBWAY. With luck this is the final version:)
Attachments
2021-05-03 15.11.06.jpg
2021-05-03 15.10.50.jpg
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Schematic and board layout for those interested. Just need to verify the resolver exciter pin before pushing the button with pcbway.
Attachments
Tesla_M3_RDU_V3A - Schematic.pdf
(128.69 KiB) Downloaded 109 times
Tesla_M3_RDU_V3A - PCB.pdf
(57.27 KiB) Downloaded 103 times
I'm going to need a hacksaw
JaniK
Posts: 391
Joined: Sun Aug 25, 2019 12:39 pm
Location: Finland
Has thanked: 49 times
Been thanked: 10 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by JaniK »

It looks clean. Like a computer processor without heat shield.

Well done 👍
Any opinions are my own, unless stated otherwise. I take no responsibility if you follow my way of doing things and it doesn't work. Please double check with someone who knows what they are doing.
Doig5710
Posts: 44
Joined: Wed Apr 22, 2020 6:41 am
Location: Rangiora, New Zealand
Has thanked: 44 times
Been thanked: 1 time

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Doig5710 »

Its a work of art that, shame people cant see it once its in behind the case there.

On a side note just noticed that there's 2 tesla model 3 rear drive units?
1120980-00-F 3D1 239 KW 100 KW 30 min
1120990-00-F 3D5 208 KW 88 KW 30 min

Just wondering if anyone else had noticed this or had a look to see what the physical differences were?
Maybe both the same size + mounting just lower power output?
As well as what models would the mod chip fit once its up and running.
There's a few of the 3D5 units coming up on Ebay a bit cheaper than the 3D1 units and wouldn't want someone buying one buy mistake like I almost did.
davefiddes
Posts: 213
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 14 times
Been thanked: 38 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

The best list of M3 drive unit part numbers I've come across is this: https://www.reddit.com/r/teslamotors/co ... 80_vs_990/
The part number is significant if you want to get a Tesla or third party power upgrade unlock working. There is a lot of confusion as to whether there is any signficant HW difference between the builds (fewer/lower spec mosfets) or if it's just market segmentation at a code level. Hopefully we'll find that out as we get the new board running assuming that people share their findings.
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Last piece of the puzzle thanks to Johannes. Going to verify the DAC pin on the inverter tomorrow and then get some boards made:)
viewtopic.php?p=27246#p27246
I'm going to need a hacksaw
davefiddes
Posts: 213
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 14 times
Been thanked: 38 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

Good stuff. Busy sorting out the changes to my two SPI drivers so that I can send them Johannes' way for review.

There are a lot of changes needed around GPIO, 10kHz PSU drive, etc. Am I OK to assume you are both best to negotiate this work and don't need my help?
User avatar
johu
Site Admin
Posts: 5788
Joined: Thu Nov 08, 2018 10:52 pm
Location: Kassel/Germany
Has thanked: 157 times
Been thanked: 1022 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by johu »

Yes will do.
There is quite a lot of extra M3 logic, so I'm starting to wonder how to cause the least "pollution" (for lack of a better term) to the main branch. E.g. if for some reason someone enables the DAC logic their processor will just crash because there is no DAC.
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
User avatar
johu
Site Admin
Posts: 5788
Joined: Thu Nov 08, 2018 10:52 pm
Location: Kassel/Germany
Has thanked: 157 times
Been thanked: 1022 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by johu »

Now, looking at the super complicated schematic I found the clock comes from outside. What speed crystal is it?
Looking at all the pin changes I think it will live on a different branch for now and can be unified later.
What is a good way to detect that we're on an M3? Like what pins behave differently than all other hardware variants?
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

The Musk uses a 10Mhz crystal but very easy to change to an 8Mhz. Will have a look at some schematics re pin detection.
I'm going to need a hacksaw
User avatar
johu
Site Admin
Posts: 5788
Joined: Thu Nov 08, 2018 10:52 pm
Location: Kassel/Germany
Has thanked: 157 times
Been thanked: 1022 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by johu »

We'll see. PLL allows multiplication of 7, so we could run at 70 MHz. Everything becomes a bit slower, e.g. 8.5 kHz PWM instead of 8.8
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
User avatar
zilion
Posts: 58
Joined: Tue Feb 02, 2021 7:50 am
Location: Poland

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by zilion »

I haven't read this topic, because I have no Tesla parts :), but seeing how you are expanding to DAC now maybe it's time to change F1 family to F4.
As I understand the reason for F1 it was a price, but now all prices gone up around 10x. I don't know the reason, but it could be a climate change thing. "HOW DARE YOU!"
Anyway, F1 is now at the price of F4 or even higher, so I think it's a good time to move.

And yes Johannes, new code :D
I smell lithium in the air. It's not lithium, it's glycolium.
User avatar
johu
Site Admin
Posts: 5788
Joined: Thu Nov 08, 2018 10:52 pm
Location: Kassel/Germany
Has thanked: 157 times
Been thanked: 1022 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by johu »

The primary reason for the F1 is recursive: we use the F1 today because we used the F1 yesterday. The primary reason to stick with the F1 is code base. The secondary reason is requirements: its resources are more than adequate for what we do, the added performance of the F4 won't make any motor run smoother or car run faster.

That said, fork the project, port it to the F4, show us all how much better it is ;)
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
User avatar
zilion
Posts: 58
Joined: Tue Feb 02, 2021 7:50 am
Location: Poland

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by zilion »

johu wrote: Fri May 07, 2021 9:17 am That said, fork the project, port it to the F4, show us all how much better it is ;)
Haha, at some point I'll do, but now I'm porting your HW to HAL and FreeRTOS. Once I'm done, I'll try with F4, and not because it'll run faster or sth., but because F1 will be stopped sooner or later and price today at AliExp is not different.
I smell lithium in the air. It's not lithium, it's glycolium.
Post Reply