Tesla Model 3 Rear Drive Unit Hacking

[jrbe]

If you change R45 to 5K6 at the same time as the other BOM changes the HW can very much signal that it is running on an FDU rather than an RDU.

Worth adding in a solder jumper or 2 to swap between FDU and RDU? May be able to add in a second resistor to drop to the lower value. Or a shorted solder jumper to cut?

You guys haven't found the torroid part number yet, right? Is this a Tesla specific part?

r1ckyb0nd is local to me and has a 980 inverter but it sounds like there's at least a little potting compound to deal with. How much of a headache is it freeing the current sensor cover?

[r1ckyb0nd]

Could you add the little black jumpers like PC motherboards have and then silk screen RDU / FDU on the board as required.

[Jack Bauer]

We seem to be talking at cross purposes. If you change R45 to 5K6 at the same time as the other BOM changes the HW can very much signal that it is running on an FDU rather than an RDU.

Parameters have to be supported forever and as explained can get out of sync with the HW. It's a poor way to solve this problem.

Sorry Dave. Brain not firing on all phases. You are correct of course I can change the board detect resistor as well.

[davefiddes]

If you're happy, that's great. FWIW I'd managed to forget about the FDU would be using Sine not FOC firmware...

[Jack Bauer]

True but we could also have a scenario where someone uses and FDU inverter to drive and RDU and vice verse.

In other news am going to collect a Model y FDU (2022) from evbreakers when I do the logging road trip so we should be able to get the gate spi and oil pump LIN from that.

[davefiddes]

You guys haven't found the torroid part number yet, right? Is this a Tesla specific part?

r1ckyb0nd is local to me and has a 980 inverter but it sounds like there's at least a little potting compound to deal with. How much of a headache is it freeing the current sensor cover?

No we don't know the toroid details. Looking at the GRP housing it seems to be made of two parts and the top caps that secures the toroid into the housing appear to be ultrasonically welded. I don't think it would be possible to get one out non-destructively.

[Jack Bauer]

Folks, can I just say again how immensely grateful I am to all of you for helping to make this project a reality.

[r1ckyb0nd]

It is us who is grateful to you.

[Jack Bauer]

V3.2 board test fitting in the front inverter. Current sensor block is now a perfect fit as are dowels and all but one of the mounting holes! Sorry folks Still need to move H10 a mm left. Other that that the physical fit is great. I should have current sensors and 6R2 resistors early in the week and then we are good to go.

[davefiddes]

True but we could also have a scenario where someone uses and FDU inverter to drive and RDU and vice verse.

I hadn't considered that use case. I think that should work fine.

In other news am going to collect a Model y FDU (2022) from evbreakers when I do the logging road trip so we should be able to get the gate spi and oil pump LIN from that.

Great! Will be interesting to see what it puts out.

I have updated my Saleae Logic STGA1BS analyzer to V1.1.0. It now cleanly handles unknown register names which was causing a problem with the FDU capture. It also now validates the CRC in all SPI frames and reports any errors. Should be on their "marketplace" shortly after it has been reviewed by Saleae.

The FDU trace shows a lot of garbage on the data being sent by the gate driver chips (it is not a happy bunny) but this now clearly reported by the analyzer. The configuration commands sent by the Tesla MCU are all valid though which is great news.

A thought occurs on the LIN logging front (and this might be teaching grandma to suck eggs) but I think I saw different LIN frames being sent by the Tesla MCU when the oil pump wasn't connected vs when it was connected. It makes sense I guess that it would probe the bus with all the possible protocols it knew about before settling on the one that responds. Need to dig into the old captures I took some more.

[r1ckyb0nd]

I just picked up a FDU is there a model # or board revision number I can look for to see if it is the one you guys need information from?

[jrbe]

IMG_20251114_122440603_HDR.jpg
IMG_20251114_122427939_HDR.jpg

I'll get the current sensor block modeled this weekend. I pulled out one of them temp sensors from the original board and think it's pretty doable to make a 3D print. Damien, do you want a setup that matches the OEMs as close as possible or something we can adapt to the currently selected temp sensors?

I'll be working on the current sensor housing design, the temp sensor mentioned above has me confused though. Is the temp sensor part of the current sensor housing or a separate piece that needs something to be modeled? I looked in the wiki and found B57164K0473J000 but haven't figured out what's what yet.

r1ckyb0nd dropped off his 980 inverter yesterday. I'll be referencing parts from that, but haven't dug into it yet.

I also found this for the toroid search,

Current-Sensors-Design-Guide-Application-Note-Melexis.pdf

(2.29 MiB) Downloaded 5 times

I'll try to use this to figure out a part number and see if there's anything off the shelf available. I'll make a stock current sensor housing and I'll consider doing a modified version if theres something else close size wise that works properly for current sensing.

Sounds like I may need to destroy the current sensor housing to get the toroid out to measure it. if someone has a toroid out or one in a broken housing and can share accurate toroid measurements it would help me work through this piece.

My goal is to give Damien the option to sell a 3D printed current sensor housing, toroids, and current sensors all assembled with his board.

[Jack Bauer]

I just picked up a FDU is there a model # or board revision number I can look for to see if it is the one you guys need information from?

I'd need to see a picture of the inverter pcb.

[Jack Bauer]

Temp sensors are separate from the current sensor. Would be nice to have a holder for them but not critical.

[r1ckyb0nd]

I'd need to see a picture of the inverter pcb.

Please let me know if you need better pictures of anywhere else on the board.

[Jack Bauer]

Thanks. Looks like the inverter version I already have but who know what software is on it so yeah an oil pump LIN log would be great start.

[r1ckyb0nd]

Ok. I will order a tester. Do you already have instructions or a video on how to get the log?

[davefiddes]

To get a LIN capture we can use:

• Grab a USB logic analyzer like: https://www.amazon.com/DKARDU-Analyzer- ... B09BPV5QNQ
• Download the Saleae Logic 2 software from https://www.saleae.com/downloads
• Connect up the inverter permanent and switched 12V to a PSU and verify the activity LED flashes
• Back probe the oil pump with some long pins (proper back probes are nice but long dress pins will do). Hook up to the Black GND and Yellow LIN signals. Winding hookup wire around the pins is fine, alligator clips are better.
• Make a potential divider with a 33k and 10k resistors. Connect the logic analyzer GND to the inverter GND and one of the channels across the 10k resistor. The 33k should go to the yellow central pin of the oil pump.
• Start a capture using Logic 2
• Power on the inverter

A newer SPI gate driver initialisation capture would be useful too. This needs some soldering to the inverter PCB. To do this you'll need to hook up SDI (pin 3), /CS (pin 4) and CK (pin 5) from U303 and SDO (pin 2) from U291. Pin 1 of either chip is GND. To capture configure Logic 2 to trigger on /CS going low and then capture 30 seconds of data then power on.

If anything isn't clear or you need more detail let me know.

[r1ckyb0nd]

Ok. Analyzer ordered.
And I believe I have those resistors already.
So the inverter needs to be near the motor with the external plug plugged in so the oil pump gets power and sends the signal?
And the 10k resistor goes nowhere but is connected to one of the channels on the Analyzer.

[davefiddes]

The wiring should look something like this:

The potential divider reduces the 12V LIN signal to something that won't blow up the logic analyzer.

To test it's working you don't need to hook up to the oil pump. You should see something like this:

Once you get that going you can try hooking up to the oil pump in the main motor. To do this you'll need a good solid 12V PSU or battery as the pump is quite happy to draw 10A!

[tom91]

12V LIN signal to something that won't blow up the logic analyzer.

Not required (same chinese looking analyser) on the logic analyser I have used But it is good practice

[Jack Bauer]

V3.2 board installed in a front drive unit inverter. So far all works so seems the problem was on the oem board and not the actual igbts.

[davefiddes]

I've not made any progress on firmware for the FDU variant yet. Thought I had a couple of weeks. Will try to get to it this afternoon.

[Jack Bauer]

No rush Dave. Just fitted the board to make a video and be ready.

[Jack Bauer]

Spanner 3 : He's Back!