Tesla Model 3 Rear Drive Unit Hacking

[Jack Bauer]

Weigh in for the rear drive unit.

[Jack Bauer]

[MattsAwesomeStuff]

Awww yisss.

Every time a new project's motor spins, an angel gets his wings.

That first wiggle of movement where you pump your fist in the air, nod to your buddies, and say "Fuck yeah!"

[Jack Bauer]

So, first power up of the M3 rdu inverter on the bench. Elon flashed some nice coloured leds at me and pumped out massive amounts of CAN on TWO busses. I took a sample for posterity. Up on the github repo for the can hackers
https://github.com/damienmaguire/Tesla- ... Drive-Unit

[Jack Bauer]

Now we can start the real hacking. Phase one : eliminate the musk, eliminate the problem.

Pin 124 of the TMS main processor is the reset pin called XRS. Pulling that to ground puts Elon asleep and leaves everything else up and running. Easy pickings for the upcoming HubenAtor XM-3000 modchip:)

[Kevin Sharpe]

"time to get some sleep Elon... night, night"

https://twitter.com/EvBmw/status/123850 ... 38432?s=20

[Jack Bauer]

[JeanVapeur]

Hi Damian,
maybe this pictures helps you a little bit in your exploration...

[Jack Bauer]

Great to see the underside. Many thanks.

[Kevin Sharpe]

maybe this pictures helps you a little bit in your exploration...

Do you have any photo's of the power stage?

[Kevin Sharpe]

maybe this pictures helps you a little bit in your exploration...

Do you have any photo's of the power stage?

Some useful info in this article;

ABOUT THE SIC MOSFETS MODULES IN TESLA MODEL 3

[JeanVapeur]

Thats all I found, possible this can help...

[Jack Bauer]

Anyone find a high res shot of the rear of the board? I'm getting a feeling old Elon is using bootstrap gate drivers:)

[Jack Bauer]

Yep. D421,D422and D423. High side bootstrap diodes:)

[Jack Bauer]

So a little more investigation reveals a Viper16A based power supply section used to generate the low side iso voltages. Not 100% sure as yet but looks to be derived from the hv. Can't say I like this. They're building cars not cheap mobile phone chargers. A multi output dcdc wouldn't have put them out of more than a few $...

[Jack Bauer]

elon busted my chops on this one but we have control of the mosfets:)

[slow67]

elon busted my chops on this one but we have control of the mosfets:)

Great job Damien!

[Jack Bauer]

[Jack Bauer]

First spin of a motor using the rear drive unit inverter. Switching at 17.6khz.

[cloudy]

Excellent!!!

[Jack Bauer]

[Jack Bauer]

Current sensors seem to be easy. J2 header just below the phase terminals gives access.

Analog output of 2.5v at 0A. Measured the following :

Sensor B : 2.500V at 0A going to 2.487V at 1A and 2.4845V at 10A

Sensor A : 2.4980V at 0A going to 2.4964V at 1A and 2.4823V at 10A

[Jack Bauer]

And with Elon awake we get a 10khz sine wave as our resolver exciter that goes away when he sleeps .....hmmmm

[Jack Bauer]

Here we go ...

[Jack Bauer]

Decided to take the plunge and give Kicad a go for the model 3 modchip. Intermediate schematic attached. Still need to add a few things like changing Uart2 to LIN for oil pump control etc.