Tesla Model 3 Rear Drive Unit Hacking

Topics concerning the Tesla front and rear drive unit drop-in board
davefiddes
Posts: 381
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 157 times
Been thanked: 199 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

Congratulations on getting your motor running!

The oil pump behaviour is concerning. At the moment the code is utterly minimal and just sets the pump to run at a fixed speed irrespective of operating mode, temps, motor rpm, etc. If LIN bus comms are working as you describe but the pump speed can't be changed then that implies that I'm not sending the right command PID for your oil pump or the PID is not correctly formatted. The pump goes into full blast limp home mode if you don't send the correct command PID for a second or two.

Edit: Would it be possible to get a LIN capture from your Tesla inverter PCB? It doesn't need much in the way of equipment just a Saleae Logic compatible logic analyzer (the cheap $10 clones from ebay are fine) and a potential divider to take the 12V LIN signal down to something that won't blow up the analyzer (say 33k and 10k). The Tesla firmware sends LIN requests out all the time and doesn't need the pump connected. Let me know if you need more details.

The Tesla firmware sends out a single command on PID 0xA and requests status on PIDs 0x2A, 0x30, 0x31 and 0x32.
nathaniel
Posts: 102
Joined: Thu Jun 09, 2022 10:17 am
Been thanked: 66 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by nathaniel »

I have a lin logger tool, never used it but i guess now is the time te try it out. I have also a picoscope or a digital scope that can decode lin so i give that a try.
Also I have a older model 3 motor, the 3D5 so i can plug that oilpump in and see what that is doing.
Also try the new parameters from Demian and report back my findings. I hope that i can do it tomorrow but otherwise i have friday some time to test it. I'll keep you posted. Thx for the feedback

Edit: for the syncoffset I run the "default" 34968 and that is working, so it looks like they aligned the resolve nicely with the motor stator. And the 3d7 motor has no wire windings bus flat bars instead. But looks like the resolve alignment it's still the same.
davefiddes
Posts: 381
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 157 times
Been thanked: 199 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

I have a bit of confusion about the current sensors. I bought MLX91209LVA-CAA-000 parts which are set to 50mV/mT sensitivity as that was what was listed on the schematic. I note that the install video (and now wiki) lists MLX91209LVA-CAA-002 as the part which is the 7.3mV/mT sensitivity variant.

Which of these is correct and how do we know this? The devices are not marked with what they are programmed to.

Technically the current sensors are programmable but this only appears to be possible with a $1000 programmer with a $200 adapter.
User avatar
johu
Site Admin
Posts: 6986
Joined: Thu Nov 08, 2018 10:52 pm
Location: Kassel/Germany
Has thanked: 462 times
Been thanked: 1784 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by johu »

The Tesla SDU inverter uses 7.3 mV/mT, so quite probable this one does, too
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
User avatar
Jack Bauer
Posts: 3839
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 80 times
Been thanked: 707 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

You can use almost any version Dave and just change the calibration parameter. Back a few years ago I compared the sensors in the SDU to a bunch of variants and found the "Tesla" version was bang on 7.3. I've not done so as yet for the M3 but will do when I have the next batch of boards as I have a front drive unit inverter that is still standard. I'm finding the transistors will desat at between 800 to 900A in any event. Sorry for the confusion.
I'm going to need a hacksaw
davefiddes
Posts: 381
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 157 times
Been thanked: 199 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

Ah. Thanks for the background. It makes sense they would keep things the same.

I have the bits so I was going to try to get at the leadframe and resurrect one. It should be possible to compare both sensors for science.
User avatar
Jack Bauer
Posts: 3839
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 80 times
Been thanked: 707 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

So work on the V3.1 continues. Cleaning up on find from the beta boards as well as implementing some feedback. In doing so i decided to go for broke and have a try at the using the NCP1060 based HV derived power supply used on some of the newer revs of M3 board. As I don't have one of these boards am working from pictures and the NCP1060 datasheet. Unlike the the older boards that used the Viper16 chip and custom transformer, this version is all off the shelf at JLC.
Attachments
IMG_7656.jpg
Screenshot from 2025-11-30 12-56-25.png
Screenshot from 2025-11-30 12-56-49.png
I'm going to need a hacksaw
davefiddes
Posts: 381
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 157 times
Been thanked: 199 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

That looks spicy. Might it be an idea to put that on a small mod board to test out before going for broke on one of your giant PCBs?
User avatar
Jack Bauer
Posts: 3839
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 80 times
Been thanked: 707 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

I'll do that Dave. Good plan. Have added a NCV8452 high side load switch to the resolver amp. This allows it to be powered down by the MCU for sleep mode.
Attachments
Screenshot from 2025-11-30 14-46-13.png
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3839
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 80 times
Been thanked: 707 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

A crude test board to see if the NCP1060 circuit behaves.

Does anyone have access to a board like the one in the pic? I believe it is fro ma "960" inverter.
Attachments
Resdiv.jpg
Resdiv2.jpg
Screenshot from 2025-12-01 12-42-15.png
I'm going to need a hacksaw
ted.walsh
Posts: 36
Joined: Fri Jun 19, 2020 10:24 pm
Location: Ulverston UK Lakedistrict
Has thanked: 21 times
Been thanked: 20 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by ted.walsh »

Jack Bauer wrote: Fri Nov 21, 2025 2:37 pm Latest firmware, cranked field weakening to 150Amps, tied the T3RD to the back of the JCB and opened up the taps. Sadly the 9kwh BMW hybrid pack aka "ScamBatt 9000" is sagging and limiting power but not much left of the tyres.
at my reconning you'll need at least 2 of the 9kw packs to feed the monster :x , I have 2 or the later 12kwh paralleled and together they will deliver around 500a. they may do more but my setup can only pull that hence my baited anticipation of everyone's amazing work :D
davefiddes
Posts: 381
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 157 times
Been thanked: 199 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

outlandnish wrote: Tue Nov 18, 2025 12:01 am Here's the OEM to OpenInverter pin mapping if anyone needs it:
I've spotted a small error in the diagram. Pin 1 is Proximity Input on the OEM but is the Start Input on the OI board. Would be nice to get an update. :)
nathaniel
Posts: 102
Joined: Thu Jun 09, 2022 10:17 am
Been thanked: 66 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by nathaniel »

Jack Bauer wrote: Mon Dec 01, 2025 12:46 pm A crude test board to see if the NCP1060 circuit behaves.

Does anyone have access to a board like the one in the pic? I believe it is fro ma "960" inverter.
i have this inverter and also the one that have these parts populated, i have almost all of the different types (They all have a problem, that's why I have them, but perhaps they can still be used for reverse engineering.). what information from it are you looking for? or do you want me to send one to you?

also i finished the new laserscan 3D scan DXF pcb export, this one is very precise and I have very high confidence that this is 100% correct.

Regarding the oil pump, I haven't yet gotten around to testing my inverter with the other oil pump from the older Model 3 engine. Hopefully, I can do that tomorrow.
Attachments
tesla model 3 inberter pcb v2.dxf
(32.19 KiB) Downloaded 6 times
User avatar
outlandnish
Posts: 18
Joined: Thu Sep 01, 2022 2:23 pm
Has thanked: 25 times
Been thanked: 18 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by outlandnish »

davefiddes wrote: Mon Dec 01, 2025 6:20 pm I've spotted a small error in the diagram. Pin 1 is Proximity Input on the OEM but is the Start Input on the OI board. Would be nice to get an update. :)
Oh good call out! Let me update that.

On that note, is the idea for the next board iteration to have HVIL? We may want to move the pins that re-use those to the unused pins on the connector instead so we have that option for the future.

Quick update - I'm hoping to get the motor turning today for at least basic testing. I've been delayed with some travels - hoping to get this moving before I have to jump on the road again on Wednesday.
Post Reply