Tesla Model 3 Rear Drive Unit Hacking

[AMP3R]

After playing with the motor for a while, I realized why the inverter doesn't switch into STANDBY mode.

Active errors: DIR_a144_configMismatch, DIR_a062_systemLimpMode, DIR_a092_bmsMIA.

Apparently, I will have to go to the junk yard where I bought my motor and record the logs from the MCU, BMS and, possibly, from the front motor. But this is not necessary, because there are no errors for it. All the parts are from one car, a 2023 Model Y, so there shouldn't be any problems.

[AMP3R]

I continue to study inverter errors and noticed that DIR_a144_configMismatch is triggered by two messages 0×392 (information about battery weight, its voltage, etc. from BMS) and 0×7FF (car configuration from gateway)

We can say that this is a fundamental error and because of it the motor will 100% not spin.

[AMP3R]

I figured out the 0×392 BMS_packConfig message, which triggers the DIR_a144_configMismatch error.
Just corrected the maximum voltage to 387 and the error disappeared. Apparently, the car from which my drive unit was with an LFP battery.

[AMP3R]

The first frame from the multiplexed message 0×7FF about the car config is ready. It turned out that all bits can be empty except bit 56

The second frame can be completely empty.

The third needs information about GTW_perfomancePackage, GTW_chassisType and GTW_packEnergy. Everything else can be zero.

The fourth can be completely empty.

The fifth can be completely empty.

The sixth is also empty.

DIR_a144_configMismatch goodbye

[AMP3R]

The main system errors have disappeared, but the inverter does not switch to STANDBY mode yet. Any ideas? Maybe someone knows, although it is unlikely.

[davefiddes]

You look like you have a lot of happy systems there to my uneducated eyes. Have you got a capture of a working Tesla of a similar vintage to compared against?

[AMP3R]

You look like you have a lot of happy systems there to my uneducated eyes. Have you got a capture of a working Tesla of a similar vintage to compared against?

Please look.

[AMP3R]

You look like you have a lot of happy systems there to my uneducated eyes. Have you got a capture of a working Tesla of a similar vintage to compared against?

Here is mine

[davefiddes]

I'll have a peek though I'm not sure there's much I can make of it. I guess I was more asking as to whether you had access to enough in the way of captures. Just looked at the price of second hand Model 3s and they're really quite affordable...hoping that someone with one and a sense of adventure would be able to help you out with on-going CAN captures.

[AMP3R]

I'll have a peek though I'm not sure there's much I can make of it. I guess I was more asking as to whether you had access to enough in the way of captures. Just looked at the price of second hand Model 3s and they're really quite affordable...hoping that someone with one and a sense of adventure would be able to help you out with on-going CAN captures.

I have access to the setup with the ingenext controller, which was on the previous pages. Have already checked and corrected a lot of things. Even the voltages in each cell. But most likely this info isn't needed by the motor, because if you turn off these messages, the bms error does not appear.

[AMP3R]

Can anyone tell what DI_limitVBatHigh, DIR_ssmState, DIR_usmState and DIR_fluxState are?

[LRBen]

Regarding unit oil. If you have the drive unit where oil is in the motor as well you need to use FUCHS BluEV EDF 7005. Apparently it has the correct additives for use inside the motor.
It is black in colour from new with additives in suspension as well as solution. So it needs a good physical mix before refilling.

I got this info from Fellten who spent a good bit of time researching it.

[davefiddes]

Wished I'd known about this before buying 3 bottles of Fuchs Titan ATF 6009 which was what Opie Oils were recommending last year.

[AMP3R]

Well, is there anyone here who knows about Teslas? From the screenshots it is clear that the gate drivers are configured, the immobilizer is unlocked and the inverter is waiting for something. What else does it need?

[Jack Bauer]

Sooo, some updates on the musk. I must admit I had let the replacement pcb project lag. Thankfully, Artur Kustusch came onboard and reverse engineered the ENTIRE gate driver section This has given me a big push to get back on the project and I've since reversed the gate driver psu and other peripherial circuits to the point now that I'm laying out the pcb with a view to ordering some bare boards before year end for fit testing. So yeah its been slow but its a BIG project

Attached latest schematic for those interested. Note that like the MG drive unit logic board this design utilised the 100 pin VCT6 variant of the STM32F103.

Also, where is practical, oem component designators and positions are used on the OI board. The OI board will be 4 layer, single sided SMD. And just for fun I get to learn kicad along the way.

Github repo : https://github.com/damienmaguire/Tesla- ... Drive-Unit

Jeez, 5 years has flown:)

And some recent progress videos :





And of course I have my trusty Volvo V50 with a drive unit installed just waiting for some openinverter goodness:)

[Jack Bauer]

Huh.....something weird must have happened while I was away. Not been told I'm doing it wrong for a whole day .....

[AMP3R]

Huh.....something weird must have happened while I was away. Not been told I'm doing it wrong for a whole day .....

They are waiting for your new circuit board.

[AMP3R]

My drive unit has last one active error DIR_a155_vcfrontMIA (The DI ECU is not receiving the expected CAN communication from the VCFRONT, and considers it irrational or MIA)

I assume that this is due to the message 0×3A1. Who knows, does it definitely come from VCFront? I have already tried to play dozens of logs with different firmware versions and so far without success. In addition, when sending, the error DIR_a094_canDataBusA lights up (The DI ECU is receiving corrupted CAN data. Alert log signal data provides the affected CAN message ID with the error detected) If you stop sending, the error disappears after 5 seconds.

Apparently, this message is indispensable and prevents from turning on D.