@bitMuse - have you had any more progress on the switching cables & the resolver pins? - working on a similar project here at the moment.Working with Ingenext and their controller as well.
Thanks
bitMuse wrote: ↑Sun Mar 26, 2023 10:55 pm
This is a different type of hacking, but unlike many others in this thread who have come, said a thing, and then vanished forever, I have gotten quite a bit further.
I'm exploring the boundaries of what can be done with hardware alone. While I have the motor spinning normally using an off the shelf solution, I am working to trick the motor into running in reverse like a lot of the LDUs have for Model S.
With the very limited space inside the motor I have designed in CAD a way to cross two of the bus-bar linkages for the AC feeding into the stator. I need to modify the oil seal housing next, but I'll be getting these milled out of copper here soon.
My 3D print shows the bus bar linkage SHOULD fit in the motor, but I will have to cut the leads to 35mm, so it's a one way ticket to destroying this motor. Should be fun.
I'll be reversing the resolver pins too which is the easy part. If nothing else this should be entertaining in the line of model 3 RDU hacking to see what's possible. It's a crude solution.
I moved across the country before I could get them made. Essentially the problem I ran into is I need them machined as I lack the tooling. I contacted a couple places but they never got back to me. I started looking into sintering services, and theeeeeen I moved across the US. Now I have JUST arranged to have a place to work, but the car and motor are elsewhere having other repairs done while I work on the traction pack.
So suffice to say.. I haven't made much progress beyond confirming that the model DOES fit. And it SHOULD theoretically work. I am happy to share the model for free.
I think, that good idea is use Tesla VCSEC and OEM inverter. In last software in service mode, available function change rear motor, so i think that it will be not hard to pair VCSEC to inverter. Next step is only send other CAN message from car to spin motor.
In Ukraine i see solution to write new key in VCSEC via CAN, without old key. So steal M3 is not to hard)))
I have the possibility to buy a 3D7 motor from MY 2023 for 800 euros with a broken rear mount. Is this a good price? How to check it with a multimeter for broken mosfets? Or are there no problems with inverters in this generation of motors?
kraln wrote: ↑Mon Oct 23, 2023 2:19 pm
The Model 3 drive units are cryptographically paired with the VCSEC. Without the appropriate handshake, the inverter won't budge. Ingineerix and EV Controls collaborated on breaking (or going around, still not clear to me) this handshake, but they aren't willing to share--the stated reason is: "obviously giving out code to bypass this would be bad as then once it gets out people can use it to steal cars". If it involved extracting key material from the onboard microcontroller in the inverter, then it'd also likely pose a legal challenge to share it, but I don't want to guess.
I am however, nevertheless, also extremely interested in driving a Model 3 RDU without modifying any hardware. I'll dig through your CAN logs (and some I have access to here...). Feel free to reach out to me if you'd like to collab.
P.S.Mangelsdorf wrote: ↑Tue Oct 24, 2023 12:42 pm
My understanding, and I could be wrong, is that it is less a "pairing" and more a encrypted call and response between the drive unit and other computers in the car. No one has (open source anyways) broken the encryption. Even on the LDU and SDU, when the call and response was implemented, the commercial conversion solutions required reprograming the inverter to an earlier firmware without it.
There might be some sort of initial key provided when vehicles are programmed at the factory to tie the computers together, but I have no idea, it's way above my head.
Also, and feel free to not answer this, but how in the world did you get a zero mile drive unit? I thought Tesla didn't sell those? Did it "fall off a truck"?
Can anyone provide any good sources of info regarding the inverter "pairing"? Most of the discussion seems to be about using the Tesla motor in alternative applications, and how it is unusable with other controllers, but I'm working on a project where I plan to replace the existing drive unit of an M3 with an alternative inverter/motor and I'd like to retain compatibility with the rest of the Tesla architecture. Is the VCSEC likely to block this at the vehicle end? If so, is it likely that I could get around this by listening to the interaction between the VCSEC/IDU and playing it back with my new drive unit?
MartinN wrote: ↑Tue Feb 27, 2024 2:01 pmIf so, is it likely that I could get around this by listening to the interaction between the VCSEC/IDU and playing it back with my new drive unit?
Hey. Now I have a 3D7 drive unit that traveled only 895 km, "go" pedal, keycard and matching VCSEC from the 2023 Tesla MY.
Today I've checked, how the pedal works. And it works fine.
Tomorrow I want to connect the VCSEC module to the vehicle can bus of the drive unit and fingers crossed it will appear the message DI_immbilizerState: DI_IMM_STATE_DISARMED.
Unfortunately I have the can logs only from 2019 M3 Perf and very old model 3 can dbc file. It seems to me that my motor has newer software and nothing is going to happen.
MartinN wrote: ↑Tue Feb 27, 2024 2:01 pm
Can anyone provide any good sources of info regarding the inverter "pairing"? Most of the discussion seems to be about using the Tesla motor in alternative applications, and how it is unusable with other controllers, but I'm working on a project where I plan to replace the existing drive unit of an M3 with an alternative inverter/motor and I'd like to retain compatibility with the rest of the Tesla architecture. Is the VCSEC likely to block this at the vehicle end? If so, is it likely that I could get around this by listening to the interaction between the VCSEC/IDU and playing it back with my new drive unit?
Looking at the Service documents for the Model 3 "Drive Unit - Rear (3DU) (Remove and Replace)" the Install step 115 deals with using toolbox for "Secure pairing (immobilizer pairing) between the Security Controller and Drive Inverter and Vehicle Odometer Pairing to UI".
CAN specialist - Vector/PEAK-System/Kvaser/Ixxat/Softing
Finally catching up - 2 used Model S as of last year and one conversion project in progress.
BMS_u029 Fan Club on both...
Hello, colleagues.The next step was to write software for Tesla Plaid rear-wheel drives.A special feature of Plaid is the locked control chip and the rejection of direct measurement of the temperature of the electric machine.The task was difficult but interesting.The parameters of the Plaid and Tesla 3 electric cars are different.Currently, the 190 kW Tesla3 rear drive and the 410-420 kW Plaid drives have been tested.I plan to make a YouTube channel.I will be glad to cooperate on this topic and other topics of power electronics. dsp1108@mail.ru
davefiddes wrote: ↑Sun Jul 14, 2024 1:20 pm
Great. Do you have a link to the code? I'd be interested to compare with my own efforts. Thanks!
Somewhere on this forum I have already shown an example code for working with a tlf chip.
Vector control is used.I use MPTA algoritm.MPTV is reaching now.The second core handles the resolver processing.For Tesla Plaid, it was necessary to resolder the Tms chip and solder the one that was not locked.The gear oil pump for Plaid has other IDs for the LIN protocol.I had to investigate the operation of the oil pump....There is interest in implementing a standard protocol for exchanging the drive and other devices...As far as I understand, Tesla does not have a VCU unit....But maybe I'm wrong.
Hello everybody!
Is anyone working on creating their own cortroller to start the engine? I am only at the beginning of this difficult path, so I would like to listen to already experienced users.. However, I have already managed to pair the TM3 rear motor with the TM3 battery using the ingenext controller. I also implemented a cooling and heating system using TMS components, but I would like to control the engine myself.
Can anyone suggest something about this?
RadioKot wrote: ↑Sun Jul 28, 2024 4:43 am
Hello everybody!
Is anyone working on creating their own cortroller to start the engine? I am only at the beginning of this difficult path, so I would like to listen to already experienced users.. However, I have already managed to pair the TM3 rear motor with the TM3 battery using the ingenext controller. I also implemented a cooling and heating system using TMS components, but I would like to control the engine myself.
Can anyone suggest something about this?
Let's collaborate and reverse engineer your ingenext controller.
