Tesla Model 3 Rear Drive Unit Hacking

[RadioKot]

Great idea! Soon I will review the entire topic to understand what local users have already managed to do. Together we will be able to create a unique ingenext. I would like to attach a photo of my installation, but I don't know how to do it

[AMP3R]

here

[RadioKot]

So there is my installation

[davefiddes]

That's an impressive setup. I'm jealous!

A open CAN based solution would be welcomed by many. If you guys can collaborate on it that would be fantastic.

The approach I'm taking to build a brand new firmware for the inverter is completely mad. Sort of equivalent to casting your own cylinder head and pistons for a hot-rod. Technically possible for some but very slow going and it might struggle to meet the OEM performance.

[P.S.Mangelsdorf]

Technically possible for some but very slow going

But how awesome it will be when it works!

[RadioKot]

The approach I'm taking to build a brand new firmware for the inverter is completely mad.

Tell us about your idea?

A open CAN based solution would be welcomed by many. If you guys can collaborate on it that would be fantastic.

Yes, I would like to work on creating a CAN controller, but I need someone's help with this

[AMP3R]

Tell us about your idea?

Yes, I would like to work on creating a CAN controller, but I need someone's help with this

Have you already "paired" your motor with the controller? If not, you can record the entire inverter flash procedure from ingenext support when you communicate via teamviewer. The main thing is that you have reliable CAN analyzer.

Can you do it yourself?

[davefiddes]

Tell us about your idea?

My github project: https://github.com/davefiddes/c2000-inverter explains the scope of what I'm working towards.

[RadioKot]

Have you already started your motor with the controller?

I've already started the engine. Ingenext has already done everything that was needed with it two months ago, since then I have been developing a thermal controller

Can you do it yourself?

Yes, I can try to do it on my own. I already have the final CAN log. But I didn't risk sending messages to CAN. I could try to do it, but I need an experienced person. I have not encountered these programs before, but I would really like to learn

[AMP3R]

I've already started the engine. Ingenext has already done everything that was needed with it two months ago, since then I have been developing a thermal controller


Yes, I can try to do it on my own. I already have the final CAN log. But I didn't risk sending messages to CAN. I could try to do it, but I need an experienced person. I have not encountered these programs before, but I would really like to learn

What log do you have exactly? The inverter firmware procedure itself or did you just record what the controller sends to the motor?

What is your end goal? Do you want to make your own controller and then sell it or what?

[RadioKot]

What log do you have exactly?

Of course, I do not have the procedure for flashing the inverter. Ingenext keeps it a secret… I only have the signals that the controller sends

What is your end goal? Do you want to make your own controller and then sell it or what?

This controller will be useful to me in my other projects. It's more of a challenge to myself, but maybe I'll sell it piece by piece to interested people.

[AMP3R]

Of course, I do not have the procedure for flashing the inverter. Ingenext keeps it a secret… I only have the signals that the controller sends

This controller will be useful to me in my other projects. It's more of a challenge to myself, but maybe I'll sell it piece by piece to interested people.

Will you share the logs? Many will thank you.

[RadioKot]

I can't attach it.trc file because it is an invalid file extension. I can send it in other messengers

[AMP3R]

I can't attach it.trc file because it is an invalid file extension. I can send it in other messengers

Check PM

[davefiddes]

Been having a bit of fun this week programming in the garage to see how the Tesla M3 oil pump works. Turns out to be pretty simple. There's a single command being sent out by the inverter to the pump and although it's 2 bytes long only 1 seems to actually do anything. The value that's sent commands the pump to vary the output with 0 being off.

The Tesla inverter firmware traces taken before I accidentally nuked it showed 4 separate requests being sent to the pump. I've been able to decode a bunch of the values these return including: fluid and pump temperatures (and 4 other temps!), supply voltage and current, motor RPM, and suspected fluid flow and pressure.

A simple ESP32 Arduino sketch to drive the pump and the retrieve the status can be found here: https://github.com/davefiddes/Tesla-Model-3-Drive-Unit/

I'm sure that there's more to be found particularly on error states. I can only really see the Fluid Temp being useful in the short term.

Here's a graph of what a short 50 second run of the pump produces:

[AMP3R]

I have this scary setup with a computer power supply, from which I take 310V 6A max. It seems to be suitable for testing.

Using prepared can logs and so far only VEHICLE CAN, I managed to achieve the inverter states IMMOBILIZER_STATE DISARMED and DI_SYSTEM_STATE IDLE.

I am sure that I am doing something wrong, because the ACTIVE DISCHARGE - ON error is active.

[RadioKot]

Good job!

[davefiddes]

Do you have an intact HVIL loop with a 20mA current running through it? Without that the HV bus discharge circuit on the inverter will not deactivate.

[AMP3R]

Do you have an intact HVIL loop with a 20mA current running through it? Without that the HV bus discharge circuit on the inverter will not deactivate.

I haven't connected HVIL. Can you tell me how to emulate it? What voltage is there? Is PWM used?

[davefiddes]

It's quite simple to emulate on the bench. It is a simple 20mA current loop and you can use the same 12VDC supply you use for the main inverter (it is optically isolated from the main inverter electronics).

I use the following circuit with an LM317L regulator:

The HV DC connector is part of the loop. I see you have the official cable so you should be good. If anyone wants to jumper it out you need to do this:

The HV discharge circuitry is completely automatic but the HVIL current is monitored by the main inverter MCU.

[AMP3R]

It's quite simple to emulate on the bench. It is a simple 20mA current loop and you can use the same 12VDC supply you use for the main inverter (it is optically isolated from the main inverter electronics).

I use the following circuit with an LM317L regulator:

hvil.png

The HV DC connector is part of the loop. I see you have the official cable so you should be good. If anyone wants to jumper it out you need to do this:
IMG_20240830_113428_695.jpg

The HV discharge circuitry is completely automatic but the HVIL current is monitored by the main inverter MCU.

Thank you. Do you think the transistor that turns on the resistor bank is still okay when I kept the HV for a few minutes?

[davefiddes]

Not sure. I suspect it'll probably be OK. IIRC Damien burned his out but he was running for quite some time.

I found you can see the operation of the discharge circuitry quite clearly with a current clamp on the HVDC input. With an idle inverter the two sources of current draw on the HVDC is the backup gate drive PSU and the HV discharge resistors. Turning on and off the HVIL circuit varied it quite significantly. You need a current clamp that is accurate in the DC mA range. My cheap UNI-T UT210E Pro seems to do the job OK.

[AMP3R]

Not sure. I suspect it'll probably be OK. IIRC Damien burned his out but he was running for quite some time.

I found you can see the operation of the discharge circuitry quite clearly with a current clamp on the HVDC input. With an idle inverter the two sources of current draw on the HVDC is the backup gate drive PSU and the HV discharge resistors. Turning on and off the HVIL circuit varied it quite significantly. You need a current clamp that is accurate in the DC mA range. My cheap UNI-T UT210E Pro seems to do the job OK.

Active discharge alert has gone. Thanks!

[AMP3R]

So the immobilizer is unlocked, the inverter shows signs of life with a 10 kHz beep for a split second during power on and shows that it is in the IDLE state, the HVIL circuit is on.

I switch to D, the inverter shows N and the IDLE state doesn't change. That is, in order for D to be ENABLE, you first need to achieve STANDBY in P.

Does the motor need cell voltages? I think the problem lies somewhere in the messages from the BMS. What do you think?

[P.S.Mangelsdorf]

The funny thing is that there is no info anywhere on google that anyone has even tried to run this motor as is, without messing with inverter, and in fact there is no one to even ask.

I met someone on Drag Week (a spectator) who said he had a build using one of the Canadian Model 3 controllers (I think it was Ingenext). It sounded like the drive units were unmodified.

From what I've seen it's only those of you here on OI trying to get these running without a commercial controller. It does look like those commercial controllers might reprogram something, but not clear what.