Tesla Model 3 Rear Drive Unit Hacking

[davefiddes]

Congratulations on getting your motor running!

The oil pump behaviour is concerning. At the moment the code is utterly minimal and just sets the pump to run at a fixed speed irrespective of operating mode, temps, motor rpm, etc. If LIN bus comms are working as you describe but the pump speed can't be changed then that implies that I'm not sending the right command PID for your oil pump or the PID is not correctly formatted. The pump goes into full blast limp home mode if you don't send the correct command PID for a second or two.

Edit: Would it be possible to get a LIN capture from your Tesla inverter PCB? It doesn't need much in the way of equipment just a Saleae Logic compatible logic analyzer (the cheap $10 clones from ebay are fine) and a potential divider to take the 12V LIN signal down to something that won't blow up the analyzer (say 33k and 10k). The Tesla firmware sends LIN requests out all the time and doesn't need the pump connected. Let me know if you need more details.

The Tesla firmware sends out a single command on PID 0xA and requests status on PIDs 0x2A, 0x30, 0x31 and 0x32.

[nathaniel]

I have a lin logger tool, never used it but i guess now is the time te try it out. I have also a picoscope or a digital scope that can decode lin so i give that a try.
Also I have a older model 3 motor, the 3D5 so i can plug that oilpump in and see what that is doing.
Also try the new parameters from Demian and report back my findings. I hope that i can do it tomorrow but otherwise i have friday some time to test it. I'll keep you posted. Thx for the feedback

Edit: for the syncoffset I run the "default" 34968 and that is working, so it looks like they aligned the resolve nicely with the motor stator. And the 3d7 motor has no wire windings bus flat bars instead. But looks like the resolve alignment it's still the same.

[davefiddes]

I have a bit of confusion about the current sensors. I bought MLX91209LVA-CAA-000 parts which are set to 50mV/mT sensitivity as that was what was listed on the schematic. I note that the install video (and now wiki) lists MLX91209LVA-CAA-002 as the part which is the 7.3mV/mT sensitivity variant.

Which of these is correct and how do we know this? The devices are not marked with what they are programmed to.

Technically the current sensors are programmable but this only appears to be possible with a $1000 programmer with a $200 adapter.

[johu]

The Tesla SDU inverter uses 7.3 mV/mT, so quite probable this one does, too

[Jack Bauer]

You can use almost any version Dave and just change the calibration parameter. Back a few years ago I compared the sensors in the SDU to a bunch of variants and found the "Tesla" version was bang on 7.3. I've not done so as yet for the M3 but will do when I have the next batch of boards as I have a front drive unit inverter that is still standard. I'm finding the transistors will desat at between 800 to 900A in any event. Sorry for the confusion.

[davefiddes]

Ah. Thanks for the background. It makes sense they would keep things the same.

I have the bits so I was going to try to get at the leadframe and resurrect one. It should be possible to compare both sensors for science.

[Jack Bauer]

So work on the V3.1 continues. Cleaning up on find from the beta boards as well as implementing some feedback. In doing so i decided to go for broke and have a try at the using the NCP1060 based HV derived power supply used on some of the newer revs of M3 board. As I don't have one of these boards am working from pictures and the NCP1060 datasheet. Unlike the the older boards that used the Viper16 chip and custom transformer, this version is all off the shelf at JLC.

[davefiddes]

That looks spicy. Might it be an idea to put that on a small mod board to test out before going for broke on one of your giant PCBs?

[Jack Bauer]

I'll do that Dave. Good plan. Have added a NCV8452 high side load switch to the resolver amp. This allows it to be powered down by the MCU for sleep mode.

[Jack Bauer]

A crude test board to see if the NCP1060 circuit behaves.

Does anyone have access to a board like the one in the pic? I believe it is fro ma "960" inverter.

[ted.walsh]

Latest firmware, cranked field weakening to 150Amps, tied the T3RD to the back of the JCB and opened up the taps. Sadly the 9kwh BMW hybrid pack aka "ScamBatt 9000" is sagging and limiting power but not much left of the tyres.

at my reconning you'll need at least 2 of the 9kw packs to feed the monster , I have 2 or the later 12kwh paralleled and together they will deliver around 500a. they may do more but my setup can only pull that hence my baited anticipation of everyone's amazing work

[davefiddes]

Here's the OEM to OpenInverter pin mapping if anyone needs it:

I've spotted a small error in the diagram. Pin 1 is Proximity Input on the OEM but is the Start Input on the OI board. Would be nice to get an update.

[nathaniel]

A crude test board to see if the NCP1060 circuit behaves.

Does anyone have access to a board like the one in the pic? I believe it is fro ma "960" inverter.

i have this inverter and also the one that have these parts populated, i have almost all of the different types (They all have a problem, that's why I have them, but perhaps they can still be used for reverse engineering.). what information from it are you looking for? or do you want me to send one to you?

also i finished the new laserscan 3D scan DXF pcb export, this one is very precise and I have very high confidence that this is 100% correct.

Regarding the oil pump, I haven't yet gotten around to testing my inverter with the other oil pump from the older Model 3 engine. Hopefully, I can do that tomorrow.

[outlandnish]

I've spotted a small error in the diagram. Pin 1 is Proximity Input on the OEM but is the Start Input on the OI board. Would be nice to get an update.

Oh good call out! Let me update that.

On that note, is the idea for the next board iteration to have HVIL? We may want to move the pins that re-use those to the unused pins on the connector instead so we have that option for the future.

Quick update - I'm hoping to get the motor turning today for at least basic testing. I've been delayed with some travels - hoping to get this moving before I have to jump on the road again on Wednesday.

[Jack Bauer]

@Nathaniel, the board scan is perfect thanks. I can highlight on a few pictures the measurements I need if thats ok?

On the "960" board with the missing parts, could you measure the values of R173 , R174 , R186 as circled in red? I suspect D56 is a zener diode. Could you measure its voltage? will probably need to be removed to measure properly.

[Jack Bauer]

Also on the 960 ,and this will be the tricky part, U31 gets its HV side 5v supply via R243. I need to know where R243 connects and how they derive the HV side 5v on this revision.

[Jack Bauer]

And finally on the board that uses the NCP1060 , I need to know how pins 3 and 5 of U36 (the NCP1060) connect and what value components are used.
Many thanks. If too much work am happy to pay postage for the boards and return them to you once measurments are complete.

[uhi22]

If this is a NCP1060, the red dots are not 3 and 5.

[nathaniel]

I will do the measurements tomorrow evening, but i have both of the versions of the boards you are looking for. But the u36 ncp1060 i found that only in a older board with the 3D1 and 980 making. Al the newer ones looks different in that part of the board.

[outlandnish]

Updated pin out:

[Jack Bauer]

Brilliant thanks a ton!

[davefiddes]

I've finally managed to get to the end of an initial draft of a written installation process: https://openinverter.org/wiki/Tesla_Mod ... CB_Install

The intent is that it will supplement the video version Damien produced. I've tried to retain the chronology and process. It would be good if the beta testers who have done this already could go through and see that I've got everything covered. I'm no Technical Author but I've tried to break things up into logical steps and use consistent terminology. It could do with some diagrams particularly around the wiring I think.

Feedback and improvements most welcome. Significant changes are best discussed here first, Damien has put a lot of thought into the process and things are done in a certain way for a reason.

[Jack Bauer]

That's brilliant Dave. I'll put a link in the video description.

[nathaniel]

was unexpectedly workshop time tonight so unfortunately no inverter component measurements but oil pump tests. I connected the oil pump from an older model 3 motor and it responds to various speeds and can also come to a complete stop at 0. I also noticed that my newer Model Y pump isn't reporting the supply voltage correctly. The battery is around 12 volts, but it only returned about 3.5 volts. The RPM, pressure, and temperature values ​​seem to be logical and match those of the Model 3. The Model 3 pump reports the supply voltage logically. So there are indeed differences between the pumps. There's no number on the Model 3 pump, but when I read the QR code, it says: P1108202-00-F followed by a serial number. There is a number on the Model Y pump: 1108202-00-M. only the letter seems to be different so maybe a revision version with different firmware.
I don't have my lin bus logger with me at the moment but I will definitely look into this further. and then we might have to make a log of a model y car, I know someone who has this car so I'll throw a ball out there.

to be continued

[Jack Bauer]

Thanks Nathaniel, typical musk!