Tesla Model 3 Rear Drive Unit Hacking
-
davefiddes
- Posts: 381
- Joined: Mon Jan 18, 2021 12:39 pm
- Location: Edinburgh, Scotland, UK
- Has thanked: 157 times
- Been thanked: 199 times
Re: Tesla Model 3 Rear Drive Unit Hacking
Congratulations on getting your motor running!
The oil pump behaviour is concerning. At the moment the code is utterly minimal and just sets the pump to run at a fixed speed irrespective of operating mode, temps, motor rpm, etc. If LIN bus comms are working as you describe but the pump speed can't be changed then that implies that I'm not sending the right command PID for your oil pump or the PID is not correctly formatted. The pump goes into full blast limp home mode if you don't send the correct command PID for a second or two.
Edit: Would it be possible to get a LIN capture from your Tesla inverter PCB? It doesn't need much in the way of equipment just a Saleae Logic compatible logic analyzer (the cheap $10 clones from ebay are fine) and a potential divider to take the 12V LIN signal down to something that won't blow up the analyzer (say 33k and 10k). The Tesla firmware sends LIN requests out all the time and doesn't need the pump connected. Let me know if you need more details.
The Tesla firmware sends out a single command on PID 0xA and requests status on PIDs 0x2A, 0x30, 0x31 and 0x32.
The oil pump behaviour is concerning. At the moment the code is utterly minimal and just sets the pump to run at a fixed speed irrespective of operating mode, temps, motor rpm, etc. If LIN bus comms are working as you describe but the pump speed can't be changed then that implies that I'm not sending the right command PID for your oil pump or the PID is not correctly formatted. The pump goes into full blast limp home mode if you don't send the correct command PID for a second or two.
Edit: Would it be possible to get a LIN capture from your Tesla inverter PCB? It doesn't need much in the way of equipment just a Saleae Logic compatible logic analyzer (the cheap $10 clones from ebay are fine) and a potential divider to take the 12V LIN signal down to something that won't blow up the analyzer (say 33k and 10k). The Tesla firmware sends LIN requests out all the time and doesn't need the pump connected. Let me know if you need more details.
The Tesla firmware sends out a single command on PID 0xA and requests status on PIDs 0x2A, 0x30, 0x31 and 0x32.
Re: Tesla Model 3 Rear Drive Unit Hacking
I have a lin logger tool, never used it but i guess now is the time te try it out. I have also a picoscope or a digital scope that can decode lin so i give that a try.
Also I have a older model 3 motor, the 3D5 so i can plug that oilpump in and see what that is doing.
Also try the new parameters from Demian and report back my findings. I hope that i can do it tomorrow but otherwise i have friday some time to test it. I'll keep you posted. Thx for the feedback
Edit: for the syncoffset I run the "default" 34968 and that is working, so it looks like they aligned the resolve nicely with the motor stator. And the 3d7 motor has no wire windings bus flat bars instead. But looks like the resolve alignment it's still the same.
Also I have a older model 3 motor, the 3D5 so i can plug that oilpump in and see what that is doing.
Also try the new parameters from Demian and report back my findings. I hope that i can do it tomorrow but otherwise i have friday some time to test it. I'll keep you posted. Thx for the feedback
Edit: for the syncoffset I run the "default" 34968 and that is working, so it looks like they aligned the resolve nicely with the motor stator. And the 3d7 motor has no wire windings bus flat bars instead. But looks like the resolve alignment it's still the same.
-
davefiddes
- Posts: 381
- Joined: Mon Jan 18, 2021 12:39 pm
- Location: Edinburgh, Scotland, UK
- Has thanked: 157 times
- Been thanked: 199 times
Re: Tesla Model 3 Rear Drive Unit Hacking
I have a bit of confusion about the current sensors. I bought MLX91209LVA-CAA-000 parts which are set to 50mV/mT sensitivity as that was what was listed on the schematic. I note that the install video (and now wiki) lists MLX91209LVA-CAA-002 as the part which is the 7.3mV/mT sensitivity variant.
Which of these is correct and how do we know this? The devices are not marked with what they are programmed to.
Technically the current sensors are programmable but this only appears to be possible with a $1000 programmer with a $200 adapter.
Which of these is correct and how do we know this? The devices are not marked with what they are programmed to.
Technically the current sensors are programmable but this only appears to be possible with a $1000 programmer with a $200 adapter.
- johu
- Site Admin
- Posts: 6986
- Joined: Thu Nov 08, 2018 10:52 pm
- Location: Kassel/Germany
- Has thanked: 462 times
- Been thanked: 1784 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
The Tesla SDU inverter uses 7.3 mV/mT, so quite probable this one does, too
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
- Jack Bauer
- Posts: 3839
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 80 times
- Been thanked: 707 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
You can use almost any version Dave and just change the calibration parameter. Back a few years ago I compared the sensors in the SDU to a bunch of variants and found the "Tesla" version was bang on 7.3. I've not done so as yet for the M3 but will do when I have the next batch of boards as I have a front drive unit inverter that is still standard. I'm finding the transistors will desat at between 800 to 900A in any event. Sorry for the confusion.
I'm going to need a hacksaw
-
davefiddes
- Posts: 381
- Joined: Mon Jan 18, 2021 12:39 pm
- Location: Edinburgh, Scotland, UK
- Has thanked: 157 times
- Been thanked: 199 times
Re: Tesla Model 3 Rear Drive Unit Hacking
Ah. Thanks for the background. It makes sense they would keep things the same.
I have the bits so I was going to try to get at the leadframe and resurrect one. It should be possible to compare both sensors for science.
I have the bits so I was going to try to get at the leadframe and resurrect one. It should be possible to compare both sensors for science.
- Jack Bauer
- Posts: 3839
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 80 times
- Been thanked: 707 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
So work on the V3.1 continues. Cleaning up on find from the beta boards as well as implementing some feedback. In doing so i decided to go for broke and have a try at the using the NCP1060 based HV derived power supply used on some of the newer revs of M3 board. As I don't have one of these boards am working from pictures and the NCP1060 datasheet. Unlike the the older boards that used the Viper16 chip and custom transformer, this version is all off the shelf at JLC.
I'm going to need a hacksaw
-
davefiddes
- Posts: 381
- Joined: Mon Jan 18, 2021 12:39 pm
- Location: Edinburgh, Scotland, UK
- Has thanked: 157 times
- Been thanked: 199 times
Re: Tesla Model 3 Rear Drive Unit Hacking
That looks spicy. Might it be an idea to put that on a small mod board to test out before going for broke on one of your giant PCBs?
- Jack Bauer
- Posts: 3839
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 80 times
- Been thanked: 707 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
I'll do that Dave. Good plan. Have added a NCV8452 high side load switch to the resolver amp. This allows it to be powered down by the MCU for sleep mode.
I'm going to need a hacksaw
- Jack Bauer
- Posts: 3839
- Joined: Wed Dec 12, 2018 5:24 pm
- Location: Ireland
- Has thanked: 80 times
- Been thanked: 707 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
A crude test board to see if the NCP1060 circuit behaves.
Does anyone have access to a board like the one in the pic? I believe it is fro ma "960" inverter.
Does anyone have access to a board like the one in the pic? I believe it is fro ma "960" inverter.
I'm going to need a hacksaw
-
ted.walsh
- Posts: 36
- Joined: Fri Jun 19, 2020 10:24 pm
- Location: Ulverston UK Lakedistrict
- Has thanked: 21 times
- Been thanked: 20 times
- Contact:
Re: Tesla Model 3 Rear Drive Unit Hacking
at my reconning you'll need at least 2 of the 9kw packs to feed the monsterJack Bauer wrote: ↑Fri Nov 21, 2025 2:37 pm Latest firmware, cranked field weakening to 150Amps, tied the T3RD to the back of the JCB and opened up the taps. Sadly the 9kwh BMW hybrid pack aka "ScamBatt 9000" is sagging and limiting power but not much left of the tyres.
-
davefiddes
- Posts: 381
- Joined: Mon Jan 18, 2021 12:39 pm
- Location: Edinburgh, Scotland, UK
- Has thanked: 157 times
- Been thanked: 199 times
Re: Tesla Model 3 Rear Drive Unit Hacking
I've spotted a small error in the diagram. Pin 1 is Proximity Input on the OEM but is the Start Input on the OI board. Would be nice to get an update.outlandnish wrote: ↑Tue Nov 18, 2025 12:01 am Here's the OEM to OpenInverter pin mapping if anyone needs it:
Re: Tesla Model 3 Rear Drive Unit Hacking
i have this inverter and also the one that have these parts populated, i have almost all of the different types (They all have a problem, that's why I have them, but perhaps they can still be used for reverse engineering.). what information from it are you looking for? or do you want me to send one to you?Jack Bauer wrote: ↑Mon Dec 01, 2025 12:46 pm A crude test board to see if the NCP1060 circuit behaves.
Does anyone have access to a board like the one in the pic? I believe it is fro ma "960" inverter.
also i finished the new laserscan 3D scan DXF pcb export, this one is very precise and I have very high confidence that this is 100% correct.
Regarding the oil pump, I haven't yet gotten around to testing my inverter with the other oil pump from the older Model 3 engine. Hopefully, I can do that tomorrow.
- Attachments
-
- tesla model 3 inberter pcb v2.dxf
- (32.19 KiB) Downloaded 6 times
- outlandnish
- Posts: 18
- Joined: Thu Sep 01, 2022 2:23 pm
- Has thanked: 25 times
- Been thanked: 18 times
Re: Tesla Model 3 Rear Drive Unit Hacking
Oh good call out! Let me update that.davefiddes wrote: ↑Mon Dec 01, 2025 6:20 pm I've spotted a small error in the diagram. Pin 1 is Proximity Input on the OEM but is the Start Input on the OI board. Would be nice to get an update.![]()
On that note, is the idea for the next board iteration to have HVIL? We may want to move the pins that re-use those to the unused pins on the connector instead so we have that option for the future.
Quick update - I'm hoping to get the motor turning today for at least basic testing. I've been delayed with some travels - hoping to get this moving before I have to jump on the road again on Wednesday.