Tesla Model 3 Rear Drive Unit Hacking

[mdrobnak]

Awesome progress! How will noise and such be handled when all is said and done? I would imagine large currents are going to cause an issue, right? I'm curious how the efficiency of these drivers stacks up to others given their exotic nature. (I want to say Silicon carbide for some reason, but that also sounds like PCCB brakes..)

-Matt

[clanger9]

This is such awesome progress! Thanks (as ever) for sharing, Damien.
I'm following with interest, as I'd like to follow a similar modboard approach with my Prius 4 inverter...

[Kevin Sharpe]

I want to say Silicon carbide for some reason, but that also sounds like PCCB brakes..)

Some useful info here;

viewtopic.php?f=10&t=69&start=30#p1792

[JaniK]

I took part my inverter and came here to tell I am ready to help, but it seems you allready found some time or got excited again about this. Better to see tests from the designer as troubleshooting goes much faster.

Anyways, I have my inverter now ready for the modchip.
If you have more of them in stock, I would like one.

[rbray89]

Oh wow, excellent progress. Very excited with this, as I'm eyeing using the full Model 3 rear subframe and drive assembly in a conversion.

[Jack Bauer]

Little more progress, lots more work. Wired up the heatsink temp sensor. Easy peasy as its read by a 3v3 adc on the TI micro anyway. Seems to be giving some reasonable readings with the "MBR600" setting in the inverter so we might get lucky. Bad luck with the HV bus monitor. Its a plain vanilla HCPL something something that provides a differential isolated output BUT Elon skimped on the summing amp to make it into a unipolar signal and they just use a pair of adcs on the TI micro to read it differentially. We don't have that option so we'll need a summing amp on the modboard. No big deal in any event.

Now the resolver was a real tour de force. Talk about over complicating something. At first it looked easy (doesn't everything), they use a DAC to pump out a nice 3v3 level sine wave, feed it to an exciter amp and all done..........but noooooo let's not do that. Instead lets use another DAC to make a sawtooth then a four channel op amp to do some funky summing/differentiating and send the result of THAT to the power amp. Makes perfect sense in MuskLand I'm sure. Anyway, good news is we can bypass that s$%tshow and go straight to the power amp. BAD news is the power amp has a fixed gain and needs about 700mv of signal to get max output amplitude. We're about ten times less than that after the filter so I'll be adding a nice cheap 4 channel opamp to the mod board to deal with all this.

GOOD news is they feed the sine and cosine through some nice signal conditioning straight to a pair of adcs Johannes style so we can just steal those signals and say thanks for the conditioning guys. So we do have some hope of a little closed loop run soon to prove it out then onto a V2 for the modboard, massive sales, big$$$ and retire to Lanzarote.

[clanger9]

That’s a deeply mad way of generating the exciter signal.
There must be a logic to it?
...
nope ...
not seeing it...

[JaniK]

Yep, it is better you did it.

Out ofmyleague stuff here.

Very nice for you to share the info, maybe Iearn something on the way. Thanks

[Jack Bauer]

My pleasure. 90% of the problem with Tesla stuff is 90% of the people involved don't share.

[Jack Bauer]

So, fun times. Did some analysis on the stock Tesla exciter parameters. I'm guessing Elon must be a lurker on here because it was VERY similar to the Johannes circuit. Only problem was they bias at a higher voltage before going into the adc on the TI mcu so it wouldnt work out of the box. Well what if we altered the bias going into the power amp? Bingo! We can use the bias of the exciter drive to alter the bias on the sine and cos processed signals and bring them into happy stm32 teritory. Played about on a breadbord with an opamp and some resistors and came up with the pictured circuit. Works perfectly and gives excellent angle plots on the web interface.

Next up I'll see if I can use the spare side of the mcp602 to do the dc link measurements and then its V2 time.

Oh and found out what they use the sawtooth for.......but I'm not telling! Time to make millions on patents...........Just kidding! its used to create the exciter amp bias.

[Jack Bauer]

Some good progress today. Made a bodge board for the resolver signal circuit and it works great. Can now rotate the drive unit with its own inverter. Chasing a possible bug in the foc firmware. V2 schematic attached.

Overcurrent shutdown and stator temp monitoring confirmed working also.

[rbray89]

Oh and found out what they use the sawtooth for.......but I'm not telling! Time to make millions on patents...........Just kidding! its used to create the exciter amp bias.

Computer engineer here, so I'm more familiar with the digital than analog, but curious why they did that. Is that to get more fidelity out of the amplifier?

[Kevin Sharpe]

Fascinating project update for patrons

https://www.patreon.com/posts/model-3-drive-39701785

[ChazFisher]

Nice work! I've got to admit, the modboard idea really intrigues me. Looking forward to seeing the schematic.

[Jack Bauer]

V2 schematic and pcb layout now available on github :
https://github.com/damienmaguire/Tesla- ... Drive-Unit

Please note design source files will be only available via Patreon for a period of time:

https://www.patreon.com/evbmw

[Kevin Sharpe]

Please note design source files will be only available via Patreon for a period of time:

https://www.patreon.com/evbmw

That's good news... I hope this makes things more financially stable for you

[Jack Bauer]

Now in production at JLCPCB.

[Jack Bauer]

[station240]

I should be able to help you with programming that particular C2000 micro.
Been programming the 379D version which is just the 377D with some minor changes TI made that didn't alter the code or pin out.
First you need to trace what GPIO72 and GPIO84 are wired to, as these set the boot mode.
It's possible JTAG has been disabled, in order to upload firmware over CAN, hence the need to find the boot mode select pins..

[JaniK]

Nice post Station240 great things.

[Jack Bauer]

GPIO72 (pin 139) goes to an led that flashes at about 10hz on power application.

GPIO84 (pin 154) goes to another led that flashes alternativly with the other. One red one green.

[Jack Bauer]

Just to be clear here while I am happy to explore the blank the TI device and port over the Openinverter system idea there are a few caveats:

1-Reading through the datasheet for the part, I am concerned about the code security module. I would bet my shiny new Keysight scope that Elon will be using that to prevent access to the memories. As to if it would stop the device being erased and reprogrammed with new code is uncertain.

2-the only option I will participate in is the porting of the openinverter. No instaspin or other nonsense.

3-My main focus is the modboard. I will (for as long as I have the drive units) be available to test TI device software options developed by the community.

[Jack Bauer]

So looks like the JTAG connector used on both front and rear inverters is : DF20F-10DP-1V(55) from Hirose. Available from RS :https://ie.rs-online.com/web/p/pcb-headers/6850722/

Now need to find a plug that fits.

EDIT : Matching plug : DF20A-10DS-1C
RS : https://ie.rs-online.com/web/p/wire-hou ... s/6850696/

Pins : DF20F-2830SCFA
RS : https://ie.rs-online.com/web/p/crimp-contacts/6850757/

[station240]

Ah GPIO72 and GPIO84 are tied to 3.3V via the LEDs then.
I was worried they wouldn't be attached to anything at all, given the size of the pins that would be an issue.

1. Yeah I worry about the various software locks that could be fitted also, but given the complete lack of information we have to try and see.
In theory it could be reprogrammed over CAN but I suspect there are encryption keys for that.

2. Instaspin isn't an option, TI didn't feel like porting it to this micro.
It's a pain to use anyway, took me 2 days just to get it to compile on a micro it is supported on.

3. Fair enough, it's a lot of work just figuring out the pin out of the device.

[Jack Bauer]

What JTAG tool would you recommend?