Tesla Model 3 Rear Drive Unit Hacking
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
Some good progress today. Made a bodge board for the resolver signal circuit and it works great. Can now rotate the drive unit with its own inverter. Chasing a possible bug in the foc firmware. V2 schematic attached.
Overcurrent shutdown and stator temp monitoring confirmed working also.
Overcurrent shutdown and stator temp monitoring confirmed working also.
- Attachments
-
- Tesla_M3_RDU_V2 - Schematic.pdf
- (268.49 KiB) Downloaded 110 times
I'm going to need a hacksaw
Re: Tesla Model 3 Rear Drive Unit Hacking
Computer engineer here, so I'm more familiar with the digital than analog, but curious why they did that. Is that to get more fidelity out of the amplifier?Jack Bauer wrote: ↑Thu Jul 23, 2020 2:40 pm Oh and found out what they use the sawtooth for.......but I'm not telling! Time to make millions on patents...........Just kidding! its used to create the exciter amp bias.
- Kevin Sharpe
- Posts: 1345
- Joined: Fri Dec 14, 2018 9:24 pm
- Location: Ireland and US
- Been thanked: 4 times
Re: Tesla Model 3 Rear Drive Unit Hacking
This is a personal post and I disclaim all responsibility for any loss or damage which any person may suffer from reliance on the information and material in this post or any opinion, conclusion or recommendation in the information and material.
-
- Posts: 53
- Joined: Wed Jul 03, 2019 1:32 am
- Location: Central Virginia, USA
Re: Tesla Model 3 Rear Drive Unit Hacking
Nice work! I've got to admit, the modboard idea really intrigues me. Looking forward to seeing the schematic.
Chaz Fisher
Slowly creeping up on that e-motorcycle.
Slowly creeping up on that e-motorcycle.
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
V2 schematic and pcb layout now available on github :
https://github.com/damienmaguire/Tesla- ... Drive-Unit
Please note design source files will be only available via Patreon for a period of time:
https://www.patreon.com/evbmw
https://github.com/damienmaguire/Tesla- ... Drive-Unit
Please note design source files will be only available via Patreon for a period of time:
https://www.patreon.com/evbmw
I'm going to need a hacksaw
- Kevin Sharpe
- Posts: 1345
- Joined: Fri Dec 14, 2018 9:24 pm
- Location: Ireland and US
- Been thanked: 4 times
Re: Tesla Model 3 Rear Drive Unit Hacking
That's good news... I hope this makes things more financially stable for youJack Bauer wrote: ↑Sun Jul 26, 2020 10:02 am Please note design source files will be only available via Patreon for a period of time:
https://www.patreon.com/evbmw
This is a personal post and I disclaim all responsibility for any loss or damage which any person may suffer from reliance on the information and material in this post or any opinion, conclusion or recommendation in the information and material.
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
- station240
- Posts: 12
- Joined: Wed Jul 29, 2020 11:04 pm
- Location: Australia
- Been thanked: 2 times
Re: Tesla Model 3 Rear Drive Unit Hacking
I should be able to help you with programming that particular C2000 micro.
Been programming the 379D version which is just the 377D with some minor changes TI made that didn't alter the code or pin out.
First you need to trace what GPIO72 and GPIO84 are wired to, as these set the boot mode.
It's possible JTAG has been disabled, in order to upload firmware over CAN, hence the need to find the boot mode select pins..
Been programming the 379D version which is just the 377D with some minor changes TI made that didn't alter the code or pin out.
First you need to trace what GPIO72 and GPIO84 are wired to, as these set the boot mode.
It's possible JTAG has been disabled, in order to upload firmware over CAN, hence the need to find the boot mode select pins..
-
- Posts: 391
- Joined: Sun Aug 25, 2019 12:39 pm
- Location: Finland
- Has thanked: 49 times
- Been thanked: 10 times
Re: Tesla Model 3 Rear Drive Unit Hacking
Nice post Station240 great things.
Any opinions are my own, unless stated otherwise. I take no responsibility if you follow my way of doing things and it doesn't work. Please double check with someone who knows what they are doing.
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
GPIO72 (pin 139) goes to an led that flashes at about 10hz on power application.
GPIO84 (pin 154) goes to another led that flashes alternativly with the other. One red one green.
GPIO84 (pin 154) goes to another led that flashes alternativly with the other. One red one green.
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
Just to be clear here while I am happy to explore the blank the TI device and port over the Openinverter system idea there are a few caveats:
1-Reading through the datasheet for the part, I am concerned about the code security module. I would bet my shiny new Keysight scope that Elon will be using that to prevent access to the memories. As to if it would stop the device being erased and reprogrammed with new code is uncertain.
2-the only option I will participate in is the porting of the openinverter. No instaspin or other nonsense.
3-My main focus is the modboard. I will (for as long as I have the drive units) be available to test TI device software options developed by the community.
1-Reading through the datasheet for the part, I am concerned about the code security module. I would bet my shiny new Keysight scope that Elon will be using that to prevent access to the memories. As to if it would stop the device being erased and reprogrammed with new code is uncertain.
2-the only option I will participate in is the porting of the openinverter. No instaspin or other nonsense.
3-My main focus is the modboard. I will (for as long as I have the drive units) be available to test TI device software options developed by the community.
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
So looks like the JTAG connector used on both front and rear inverters is : DF20F-10DP-1V(55) from Hirose. Available from RS :https://ie.rs-online.com/web/p/pcb-headers/6850722/
Now need to find a plug that fits.
EDIT : Matching plug : DF20A-10DS-1C
RS : https://ie.rs-online.com/web/p/wire-hou ... s/6850696/
Pins : DF20F-2830SCFA
RS : https://ie.rs-online.com/web/p/crimp-contacts/6850757/
Now need to find a plug that fits.
EDIT : Matching plug : DF20A-10DS-1C
RS : https://ie.rs-online.com/web/p/wire-hou ... s/6850696/
Pins : DF20F-2830SCFA
RS : https://ie.rs-online.com/web/p/crimp-contacts/6850757/
I'm going to need a hacksaw
- station240
- Posts: 12
- Joined: Wed Jul 29, 2020 11:04 pm
- Location: Australia
- Been thanked: 2 times
Re: Tesla Model 3 Rear Drive Unit Hacking
Ah GPIO72 and GPIO84 are tied to 3.3V via the LEDs then.
I was worried they wouldn't be attached to anything at all, given the size of the pins that would be an issue.
1. Yeah I worry about the various software locks that could be fitted also, but given the complete lack of information we have to try and see.
In theory it could be reprogrammed over CAN but I suspect there are encryption keys for that.
2. Instaspin isn't an option, TI didn't feel like porting it to this micro.
It's a pain to use anyway, took me 2 days just to get it to compile on a micro it is supported on.
3. Fair enough, it's a lot of work just figuring out the pin out of the device.
I was worried they wouldn't be attached to anything at all, given the size of the pins that would be an issue.
1. Yeah I worry about the various software locks that could be fitted also, but given the complete lack of information we have to try and see.
In theory it could be reprogrammed over CAN but I suspect there are encryption keys for that.
2. Instaspin isn't an option, TI didn't feel like porting it to this micro.
It's a pain to use anyway, took me 2 days just to get it to compile on a micro it is supported on.
3. Fair enough, it's a lot of work just figuring out the pin out of the device.
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
What JTAG tool would you recommend?
I'm going to need a hacksaw
- station240
- Posts: 12
- Joined: Wed Jul 29, 2020 11:04 pm
- Location: Australia
- Been thanked: 2 times
Re: Tesla Model 3 Rear Drive Unit Hacking
I've been using the XDS100-V2, as it's one TI build into their own Dev boards.
Not seen anyone selling a version with the HV isolation though.
https://www.olimex.com/Products/DSP/Emu ... XDS100-V2/
TI have also shared all the design files to make your own.
"Q: Where can I get the design / schematic / BOM for the XDS100v2"
https://processors.wiki.ti.com/index.ph ... mmended.29
Not seen anyone selling a version with the HV isolation though.
https://www.olimex.com/Products/DSP/Emu ... XDS100-V2/
TI have also shared all the design files to make your own.
"Q: Where can I get the design / schematic / BOM for the XDS100v2"
https://processors.wiki.ti.com/index.ph ... mmended.29
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
Ordered from Olimex. Also have what I hope is the right connector and pins for the jtag port on the way so we'll see what happens.
In other news , V2 modboards on the way from JLCPCB so should be with me in a few days.
In other news , V2 modboards on the way from JLCPCB so should be with me in a few days.
I'm going to need a hacksaw
-
- Posts: 391
- Joined: Sun Aug 25, 2019 12:39 pm
- Location: Finland
- Has thanked: 49 times
- Been thanked: 10 times
Re: Tesla Model 3 Rear Drive Unit Hacking
That was fast. Can I have 1?
Assuming it works out as you intented of course.
Assuming it works out as you intented of course.
Any opinions are my own, unless stated otherwise. I take no responsibility if you follow my way of doing things and it doesn't work. Please double check with someone who knows what they are doing.
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
Of course you can have one:) Will be on sale soon all going well :
https://www.evbmw.com/index.php/evbmw-w ... u-modboard
In other news in honor of the recent success at SpaceX I got me a LaunchPad:)
https://www.evbmw.com/index.php/evbmw-w ... u-modboard
In other news in honor of the recent success at SpaceX I got me a LaunchPad:)
I'm going to need a hacksaw
- johu
- Site Admin
- Posts: 5789
- Joined: Thu Nov 08, 2018 10:52 pm
- Location: Kassel/Germany
- Has thanked: 157 times
- Been thanked: 1023 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
Sounds interesting Due to lack of time I can't be of any assistance in porting the software to C2000. Quick and dirty solution would probably be porting the relevant parts of libopencm3 to C2000, I suppose.
Really cool solution would be to create an openinverter specific HAL that bundles all peripheral access. But again, I don't have time for that right now.
Really cool solution would be to create an openinverter specific HAL that bundles all peripheral access. But again, I don't have time for that right now.
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
That's why we have the modboard:)
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3563
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 1 time
- Been thanked: 87 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
I purchased this Launchpad I'd definitely be willing to help as well. Though I don't have a ton of experience programming TI parts. I'm going to try and figure out how to blinking the LEDs mentioned.
Hopefully, once we end up with these motors overflowing at junkyards the price will come down.
Hopefully, once we end up with these motors overflowing at junkyards the price will come down.
- station240
- Posts: 12
- Joined: Wed Jul 29, 2020 11:04 pm
- Location: Australia
- Been thanked: 2 times
Re: Tesla Model 3 Rear Drive Unit Hacking
One downside of that TI Launchpad board is not all the signals are available.
There is a very tiny connector on the underside with some extra signals, it's cell phone connector small, and TI never did release that addon board to break it out.
Oh and only CANB is connected to a transceiver, CANA needs an extra transceiver chip added (think I'd had bad luck getting that to work)
To be honest we probably need a custom made TMS320F28379D board, for development as Drive Unit PCBs are kinda expensive and come with a heavy lump attached.
I have my own custom TI board for a different processor, however it's just a block of blank PCBs and components till I get everything I need to assemble one. It does have Isolated CAN and JTAG over USB, which I could re-use.
There is a very tiny connector on the underside with some extra signals, it's cell phone connector small, and TI never did release that addon board to break it out.
Oh and only CANB is connected to a transceiver, CANA needs an extra transceiver chip added (think I'd had bad luck getting that to work)
To be honest we probably need a custom made TMS320F28379D board, for development as Drive Unit PCBs are kinda expensive and come with a heavy lump attached.
I have my own custom TI board for a different processor, however it's just a block of blank PCBs and components till I get everything I need to assemble one. It does have Isolated CAN and JTAG over USB, which I could re-use.
-
- Posts: 391
- Joined: Sun Aug 25, 2019 12:39 pm
- Location: Finland
- Has thanked: 49 times
- Been thanked: 10 times
Re: Tesla Model 3 Rear Drive Unit Hacking
Have you found anything in the resolver signaling "sawtooth" or other parts in inverter that would prevent running the M3RDU in reverse?
Any opinions are my own, unless stated otherwise. I take no responsibility if you follow my way of doing things and it doesn't work. Please double check with someone who knows what they are doing.