Tesla Model 3 Rear Drive Unit Hacking

[jon volk]

Thank you again Colin. Excellent work. I'm more than a little angry that on a forum of over 1100 members no one else could be bothered to even make an attempt.

There may be 1100, but once you start filtering the non-active accounts, the ones that are only here for support of purchased product, and then focus on the ones that actually took interest in this particular thread...then the ones that posses a skill set to understand the logs. Id say that pool shrinks to a rain drop pretty quick.

[collin80]

There may be 1100, but once you start filtering the non-active accounts, the ones that are only here for support of purchased product, and then focus on the ones that actually took interest in this particular thread...then the ones that posses a skill set to understand the logs. Id say that pool shrinks to a rain drop pretty quick.

Yes, I think you're correct. Like Damien I sometimes get frustrated by the fact that it's lonely up here. But, the problem is that most people are excited by progress but either can't help, don't feel like they could, or don't really want to. And, largely that's fine. But, yes, sometimes it gets frustrating to feel like you're doing it all on your own. So, I try to help out where I can because I know what it's like and because I want to see this happen. Like everyone else, I benefit if he can make the RDU work outside of the proper car.

Now, this is why my posts above include some aspects of "here is how I did it." The hope is that it might spark someone to try. I've posted many things in the past with the hope that it might spark someone to try. It seems Damien does as well. But, yeah, it's a steep learning curve. So, I understand that it seems daunting. For instance, these last things I decoded - you have to look at the SPI traffic and know that everything is in 16 bit transactions. The 16 bit transactions are broken into pieces that don't fall on even boundaries at all so it's really weird to decode. You find that out by reading the very horribly written data sheet for the chip. I had difficulty interpreting the data sheet and it took me perhaps a half hour to even really grasp what they were saying and how it was actually laid out. So, I documented that in my post so other people wouldn't have to do that.

How's this: If anyone wants to try I will help you. If you need help getting started just ask. If it would help if I posted a video explaining my way through decoding then I will do that. If something is unclear in my posts you can ask. If you want to try decoding something then, by all means, give it a shot. If you fail, you fail. You'll learn something in the process. Believe me, I wasn't born being able to decode protocol dumps. It takes time and patience. So, I personally don't expect I'm going to get 40 people taking me up on this offer. It can be tough, it can be tedious. If one or two more people want to try to get into it and that helps Damien then that's a good thing for everyone. I know people want a finished product that they can use but it takes a lot of work to get there. If you can help that speeds it up and gives the poor guy trying to do it some additional motivation and encouragement. Damien has gotten so much done that sometimes I feel like a slacker. I mean, wow, he's got a lot of retrofit boards! The Tesla community is much better for having him in it. So, I'd like to make his life easier. So, let me help you help him.

[New Electric Ireland]

There may be 1100, but once you start filtering the non-active accounts, the ones that are only here for support of purchased product, and then focus on the ones that actually took interest in this particular thread...then the ones that posses a skill set to understand the logs. Id say that pool shrinks to a rain drop pretty quick.

I agree the number of people who are capable of debugging at this level, and have the time, is close to zero.

However, this does not mean that people are not actively supporting open inverter projects. For example 158 people contribute financially to Damien on Patreon every month (Johannes 65 people) and many have donated drivetrains, inverters, charging stations, documentation, knowledge, etc., etc.

We also have lots test effort on the VCU's and other projects which is slowly delivering results with multiple cars close to driving on the road. Not everything is reported on open inverter but it is happening nonetheless (see here).

I do think one of the issues is the sheer volume of new development which forces everyone to focus on those projects they are personally interested in rather than those which might benefit others (like the Model 3 DU for example). I also think radical changes like the new GS450H VCU hardware/software architecture add to the burden when we're all trying to increase the number of open inverter cars on the road.

As others have suggested a single VCU that can talk to all the inverters, chargers, dcdc, rapid chargers, etc., would allow us to pool our hardware/software/test resources going forward. It would also be possible to select components that will be available for the next 10 years reducing the need for major redesigns until such time as we have a lot more resources at our disposal.

New Electric will continue to support open inverter development but we have no doubt that a more stable platform would allow us to scale up deployment quicker.

[Jack Bauer]

Thanks as always Colin. For the help and kind words:)

Here is a little teaser of whats on the way...

[collin80]

However, this does not mean that people are not actively supporting open inverter projects. For example 158 people contribute financially to Damien on Patreon every month (Johannes 65 people) and many have donated drivetrains, inverters, charging stations, documentation, knowledge, etc., etc.

That's absolutely a good point. If one cannot directly aid in development via hardware design, software design, decoding dumps, capturing dumps, etc then it's perfectly valid to contribute financially or through donating hardware. And, yeah, plenty of people do. I'm very happy to see the number of people who contribute to them on patreon. They deserve it.

As others have suggested a single VCU that can talk to all the inverters, chargers, dcdc, rapid chargers, etc., would allow us to pool our hardware/software/test resources going forward. It would also be possible to select components that will be available for the next 10 years reducing the need for major redesigns until such time as we have a lot more resources at our disposal.

New Electric will continue to support open inverter development but we have no doubt that a more stable platform would allow us to scale up deployment quicker.

Sure, that'd be awesome but so would having motorcycle with flames shooting out the back while wearing a cyborg suit and carrying a giant katana blade with skulls on the handle and making a living as a professional superhero. Alas, some things that are cool are not practical. I know it sounds simpler to create the one board that rules them all and in darkness binds them but it isn't realistic. The problem is the very different things that all those types of hardware need. You need far different hardware to drive an inverter than you do a battery charger. Sure, they might both turn one type of power into another, potentially bidirectionally. But, motor controllers / inverters must keep track of the spin of the motor. There are multiple strategies for doing so. So, maybe you put both encoder and resolver inputs on the board. Then you make sure you use current sensing on the A/C side that responds very quickly in case the motor in question is also driven at higher speed via position estimation based on current. So now you can support multiple inverters. Now, you need more inputs for various charge protocols - CHAdeMO, CCS, J1772, etc. This adds more hardware as they aren't compatible at a low level. Then you add in little things you need for DC/DC and such. In the end you have a board loaded with different inputs to handle anything. Now it's the size of a dinner plate and costs $2000.

But, this new board won't fit into the existing inverters, chargers, DC/DC, etc so now you have to figure out where to put it. Also, a universal board would require plug adapters to adapt the pins of the original device to the universal replacement. Damien's boards are custom built to fit where the old control board was placed so you can pretend it's still stock and everything fits super nicely. In reality he's more or less recycling the same schematic over and over just with little changes for the given device and a new layout with proper sizing and plugs so it fits where the original was placed. Personally I like this solution a lot better than trying to cram everything into a universal board. From the software side it would more or less have to be custom for each board anyway. I know it seems like a lot of complication to have so many different boards but it really does have several advantages.

[New Electric Ireland]

But, this new board won't fit into the existing inverters, chargers, DC/DC, etc so now you have to figure out where to put it.

The proposal is to have a single external VCU not replace the internal board. Mop up the external SAM3X8E VCU's (Leaf, GS450H, CHAdeMO, etc) into a single design that uses different physical build and software options. This has the advantage of production volume that allows a commercial option with support alongside the open source product. A lot of this work is already happening with several groups needing commercial warranty/support for their production EV's. Most of our course attendees also want a supported off the shelf solution.

Edit: I'll start a new thread once I get some feedback from the various groups using the existing VCU's

[jon volk]

Colin, Id definitely be interested in a short video on your methodology for decoding this stuff. I'm still pretty new to all this but trying to get my feet wet in as many aspects as I can since this really seams to be the future of the automotive aftermarket.

[Jack Bauer]

Ok we are little off topic and I fear I let my guard down a little and started this so I'd like to wrap up and get back on topic:) As Colin says it can be a frustrating experience working alone on this stuff. I am not in any way making out that I am not supported. I have acknowledged that in all possible ways and will continue to do so. Now regards a universal vcu and commercial options , I am amalgamating the lexus and leaf vcus into one during the present redesign. I'm not interested in , nor will I partake in any commercial products or support services. Twenty plus years working in startups and 2 heart attacks thought me that lesson. Quite happy with working as I am but I'm only human and sometimes the frustration seeps out. Finally, all my stuff on github is licensed in such a way that in no way precludes others from building a business around it. Nothing would make me happier in fact. As far as I know the only obligation is to acknowledge the original designers.

Right, no where were we.....oh yeah! Pushing the limits of pcb manufacture:)

[collin80]

For anyone interested in seeing the bowels of the beast I did my best at shooting a video explaining how to go about doing the decoding based on Logic traces and reading data sheets. It's not a terribly long video and somewhat assumes you know what bits and bytes are but hopefully it's helpful. It's probably not done with the worst production quality ever but don't expect a Hollywood production here either.

[Jack Bauer]

Thanks Colin. Now I have something to watch this evening:)

In other news began testing of the new modboard on a demo board with the 28377 footprint. Bad news first, its a little too small. I need to move out the pads about 1 to 1.5mm so the holes hit more of the "motherboard" pad surface. Good news : Once centered and drag soldered the joints are near perfect and rip the pads off when forced and don't bridge over. So we need some more refinement but the basic idea seems to be sound.

To do : increase spacing by about 1mm , increase pad drill to 0.25mm from 0.2mm to help solder flow, continue learning libopencm3 and codeblocks.

Other good news is I now have 2 SPI ports running on the STM32F103 along side the inverter firmware. Just spitting out test messages for now but will be using Colin's decodes soon once we have a board running in the inverter. Oh yeah, pro tip : The STM32 doesn't like you trying to use one DMA controller for two tasks. Who knew.....

[johu]

Not too shabby I wonder if you could fit some spring contact to the GND pad so that JLCPCB can fit that STM32 for you.
Yes DMA architecture isn't the most flexible on the STM32. DMA channels 1, 2, 3 and 6 are used. Whereas 6 is only used for single channel encoders, if that helps.

[FJ3422]

Would it be an idea to use castellated holes all around ? Might give a better view at what the solder paste is doing. Or is the pin spacing to small ?

[Jack Bauer]

Castellation is not possible on a 0.5mm pitch pad.

[mdrobnak]

Nice work!

[Jack Bauer]

Of course I had a guy on instagram today laughing at me and calling me a moron for ripping the pads off a model 3 drive unit:) Exact same pictures as posted above .....

[johu]

Since there are more experts on the internet than humans on earth, it must have been an expert chatbot

[MattsAwesomeStuff]

Of course I had a guy on instagram today laughing at me and calling me a moron for ripping the pads off a model 3 drive unit:) Exact same pictures as posted above .....

Y'know...

You often make comments about the idiodic, arrogant, ignorant, etc claims people make of you, about you, about what you're doing, etc. And yet I've never seen any. It's not like you're making it up, so I've wondered in the past "where is this happening?" I guess there's my answer, in part, as I only see Youtube and the forums here. Does Instagram net contribute to your happiness, or detract from it?

On the subject of people nowhere near knowledgeable enough to contribute, I understood maybe half of this video below. But, for what it's worth, if people are curious, it explains how the Model 3 motor is built and how it works.

[station240]

Castellation is not possible on a 0.5mm pitch pad.

Sure it is, but you'd need to sand the edges of the board down yourself.
JLC PCB and the like aren't going to do it, people would complain the edges aren't perfect.
Of course then you end up having to assemble the boards yourself, which would make the process suck even more.

Yes you could do it, but it's stupid and not worth the headache.

[Jack Bauer]

I've had quite a few off forum contacts on this topic over the past 2 ish weeks ranging from doubting that I'll ever "crack" this inverter to asking me to hurry up. As Johannes has said in the past this type of thing just causes interrupts that end up slowing the process but I will address a few of the topics here so that all can benefit.

1)Both the motor and inverter are "cracked" , "hacked" or whatever word you choose to associate with meaning we can run the drive unit outside of Tesla control using the openinverter system. There are multiple videos showing and proving this.

2)The original wired modboard is dead. I am actively working with both JLCPCB and PCBWay to find a manufacture process that best provides a working drop in board to replace the TMS320F28377D microcontroller. I already have some film shot on this and expect an update in the next few weeks and a release of a solution during the first quarter of 2021. In parallel with that I am working to port of the openinverter firmware to the TMS320F28xx mcu but this is neither easy nor free of cost.

3)If you want to speed me up then get involved here on forum , contribute financially via Patreon or Paypal or assist those who assist me in what ever way you can.

4)If none of that appeals then I recommend a commercial solution from the likes of ZeroEV (https://zero-ev.co.uk/).

Now we return to our regularly scheduled programming ......... get it? programming

[mdrobnak]

Well summarized. I hope people take point 3 seriously. Point 4 is also important - fully DIY isn't for everyone. Find a commercial vendor (ZeroEV in this case) and a local shop and make it happen.

[station240]

Spent the past two weeks persuading the C2000 library / examples to do useful things with my devboard.
Some 'interesting' omissions in the examples, and the string library has some funny ideas.

Code: Select all

// 12 bit adc input, converted to voltage.
// 0-3.3V input range, but treat as milivolts for accuracy reasons
voltage = ( (ADC value / 4096 ) * 3300mV);
// of course the above doesn't work, the value is rounded down to zero

// So need to do this instead
// 1 / 4096 * 3300mV = 0.805664062
voltage = (ADC value * 0.805664062);

Some of their other examples use the "IQ" library functions, and these floating point multiplier values.

[Jack Bauer]

Thanks for your work on this:) I'd just love to be able to run openinverter on the C2000.

[collin80]

Spent the past two weeks persuading the C2000 library / examples to do useful things with my devboard.
Some 'interesting' omissions in the examples, and the string library has some funny ideas.

Code: Select all

// 12 bit adc input, converted to voltage.
// 0-3.3V input range, but treat as milivolts for accuracy reasons
voltage = ( (ADC value / 4096 ) * 3300mV);
// of course the above doesn't work, the value is rounded down to zero

// So need to do this instead
// 1 / 4096 * 3300mV = 0.805664062
voltage = (ADC value * 0.805664062);

Some of their other examples use the "IQ" library functions, and these floating point multiplier values.

I would expect the result you got. ADCVal / 4096 is going to be an integer calculation. You have to promote the math to floating point when you know you need a fractional value. (ADCVal / 4096.0f) would have done it. Otherwise the compiler is smart enough to use the most efficient math possible. Integer division is way faster than floating point, especially since 4096 is a power of 2 so the division is almost certain to get optimized to a right shift instead. I would imagine the C2000 has a barrel shifter in the ALU so Value/4096 is going to be a single cycle operation. So, sometimes you do have to force the compiler not to optimize so well. Or, get the "do what I meant, not what I said" plugin.

[EV_Builder]

I found this movie and thought it was wise to share it:



Its explains very well the difference, it also states that we will need to adapt the software (if i'm correct) we need tobe able to tune the controller to the motor (not the normal tuneing if i'm correct).

@damien; Since i'm planning to use 2 motors i was thinking of going model 3 engine also. Can i help with anything to speed up M3 development?

[Jack Bauer]

Well, if your handy with software we need to continue the spi decoding that colin started on the gate driver and power supply. Work out what needs to be sent and implement an spi class that can be merged into the openinverter project. So simple stuff:)