Tesla Model 3 Rear Drive Unit Hacking

Topics concerning the Tesla front and rear drive unit drop-in board
jrbe
Posts: 766
Joined: Mon Jul 03, 2023 3:17 pm
Location: CT, central shoreline, USA
Has thanked: 360 times
Been thanked: 249 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by jrbe »

I drew up the current sensor.
https://github.com/jrbe/Tesla-Model-3-C ... nsor-Block

But I do not have the toroids in hand, they are inside the housing. So assumptions, hesitations, and changes I made:
- min wall thickness is 1mm to be able to get these printed by say JLC3DP.
- shortened the pins to 3mm tall, 5.25mm tall 2mm dia. pin is begging to be be broken easily, 3mm is more than enough
- spacers are drawn up to what Tesla used, may need to adjust slightly for what you can get
- no toroid in hand so made assumptions of the toroid area, if someone has one and can share accurate dimensions it would be appreciated
- stock is PBT glass reinforced I believe, gluing the lid on may be tricky if printing these in nylon
- stock design has nothing to hold the toroid lid on if the glue fails, may make sense to add some mechanical features to help hold the glue / snap the lid in place
- note this is a high voltage source that can inject hv to the board if something goes wrong with cracking or failing, do not print this in cheap or conductive plastic
image.png
image.png
image.png
The temp sensors are next. I'm thinking of making the little towers then holding the sensor itself at the right height.
User avatar
Bratitude
Posts: 1154
Joined: Thu Jan 02, 2020 7:35 pm
Location: Canada
Has thanked: 246 times
Been thanked: 469 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Bratitude »

davefiddes wrote: Wed Mar 18, 2026 7:00 pm Seems like now is the time to go through the install documentation and simplify it by removing the beta specific steps. Any objections to me just getting on and doing that? I don't think there's anyone with a beta board out there that hasn't finished their install.

might be good to keep for legacy/ anyone thats building they're own boards
https://bratindustries.net/ leaf motor couplers, adapter plates, custom drive train components
jrbe
Posts: 766
Joined: Mon Jul 03, 2023 3:17 pm
Location: CT, central shoreline, USA
Has thanked: 360 times
Been thanked: 249 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by jrbe »

I drew up the temp sensor towers and the melt rivets.
image.png
image.png
Same spot, https://github.com/jrbe/Tesla-Model-3-C ... nsor-Block
davefiddes
Posts: 416
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 206 times
Been thanked: 256 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

As discussed above I have formally released the M3_DU_v5.40.0 firmware. This can be downloaded from https://github.com/davefiddes/stm32-sin ... 57d165b13f

This firmware release matches up with the firmware Damien used for testing and is shipping in his 3.2 PCBs. I would recommend everyone upgrade to these firmware binaries.

The firmware package contains updated tesla-m3-rdu-foc-bench-params.json and tesla-m3-rdu-sine-bench-params.json parameter sets. These are cleaned up versions of the files Damien posted the other day with the correct temperature sensors configured. There are no changes to motor parameters. These should be suitable for bench testing.

Support for the FDU variant is included in the firmware but is still under development.
jrbe
Posts: 766
Joined: Mon Jul 03, 2023 3:17 pm
Location: CT, central shoreline, USA
Has thanked: 360 times
Been thanked: 249 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by jrbe »

Temp sensor tower for pcb style is now drawn up along with a dxf of the pcb style temp sensor.
image.png
Note the temp sensor faces the tower face.

image.png
Both sides of the legs have copper plating on the pcb.
PCB is about .4mm wide.

All on GitHub here, https://github.com/jrbe/Tesla-Model-3-C ... nsor-Block

This is the melt rivet and some reference temp sensor images.
Attachments
20260320_104014.jpg
20260320_103756.jpg
20260320_103729.jpg
20260320_103718.jpg
jrbe
Posts: 766
Joined: Mon Jul 03, 2023 3:17 pm
Location: CT, central shoreline, USA
Has thanked: 360 times
Been thanked: 249 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by jrbe »

I dont mean to make more work for this, finding a NTC is proving to be problematic for the pc board version temp sensor. It looks to be a 0402 on the tesla temp sensor board but all I'm finding on Digikey are 0805s with the specs of NTC, 47KOHM, 4450K B25/100 from the B57164K0473J000 reference.

JLC seems to have nothing in stock in this range, can pre-order some in 0805 but not sure 0805 will fit the tower yet.. https://jlcpcb.com/parts/2nd/Sensors/NT ... spm=search

The thermistor pcb I pulled out seems to have cut a trace on removal. From that failure, I changed how tesla did this slightly on the copy I made, added a bit more copper at the connector tabs and an extra via for each.

I have the board drawn up, just stuck on sourcing the thermistor for it.
image.png
My plan was to panelize 3 with vcuts between them.

I did some admittedly poor testing as I have the meter probes touching the thermistor and had a temp sensor in the same area. I gave it about 2 minutes for the probe tips to normalize to the hot air for each and got the following temps / resistances:
53.7k @ 19.78°C
13K @ 61.11°C
11.7k @ 69.44°C

I'll work on fixing the trace with some solder and try to get better reads. Looking for info on what you guys got for values to compare and look at alternatives / options.
User avatar
Jack Bauer
Posts: 3999
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 153 times
Been thanked: 1114 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Wow thats amazing progress. Picked up a new fdu on my logging trip to evbreakers. From a 2024 highland m3 am told. Will pull off the inverter tomorrow and see what story it tells.
Attachments
20260321_161047.jpg
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3999
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 153 times
Been thanked: 1114 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

I have updated the first post of this thread to hopefully better reflect the project status.
I'm going to need a hacksaw
davefiddes
Posts: 416
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 206 times
Been thanked: 256 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

I have completed the updates to the written installation procedure https://openinverter.org/wiki/Tesla_Mod ... CB_Install to reflect the updates for the V3.2 PCB. Lots of steps have been deleted which simplifies it somewhat. Still a very complex process.

I've left the pre-install power-on check and gate driver voltage tests. It seems a good idea to check everything is in place and works before soldering to the MOSFETS and chassis.

For anyone with the older boards the old procedure is still available in the wiki history: https://openinverter.org/wiki/index.php ... oldid=5979
User avatar
Jack Bauer
Posts: 3999
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 153 times
Been thanked: 1114 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

So seems I got lucky with the highland M3 front inverter from evbreakers. Looks to be the "newer" rev pcb so with luck will have gate spi and lin info for us :)
Attachments
New_M3FDU.jpg
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3999
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 153 times
Been thanked: 1114 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Sitting here wiring up to the gate driver spi of the M3 FDU that I dont need but bought at evbreakers to help the project and boom. I knew it wouldn't take long. Thankfully I neither sold many nor at a higher price. Have asked paypal to issue a refund. Of course the person never tried to contact me or work anything out.

Edit : all refunded.
Attachments
Screenshot from 2026-03-24 11-17-47.png
Screenshot from 2026-03-24 11-17-47.png (11.02 KiB) Viewed 515 times
Screenshot from 2026-03-24 10-59-47.png
Screenshot from 2026-03-24 10-59-34.png
I'm going to need a hacksaw
davefiddes
Posts: 416
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 206 times
Been thanked: 256 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

That's disgusting behaviour. The levels of toxic entitlement and outright harassment around FOSS/HW seem to be going off the scale at the moment.
User avatar
Jack Bauer
Posts: 3999
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 153 times
Been thanked: 1114 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Anyway, after the drama good news is we have some gate spi from this inverter :) Just had to force the gate psu on. Will do oil pump lin after lunch.
Attachments
Highland_M3FDU_gatespi.zip
(9.37 KiB) Downloaded 3 times
HL_M3_FDU.jpg
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3999
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 153 times
Been thanked: 1114 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Lin capture from the highland fdu and also a longer capture on the gate spi.
Attachments
Highland_M3FDU_longCapture.zip
(43.37 KiB) Downloaded 2 times
Highland_FDU_LIN1.txt
(32.65 KiB) Downloaded 5 times
I'm going to need a hacksaw
r1ckyb0nd
Posts: 38
Joined: Sun Dec 22, 2024 1:34 pm
Has thanked: 11 times
Been thanked: 9 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by r1ckyb0nd »

Everyone may know this information already. but here is a AI breakdown of the lin File posted above.

## Overview

| Property | Value |
|----------|-------|
| Tool | Highland Technology LIN analyzer |
| Total frames | 618 (+ header) |
| Capture duration | ~12.2 seconds (from WAKEUP to last frame) |
| Frame interval | ~20ms (50 Hz bus rate) |
| Bus events | 1 SLEEP, 1 WAKEUP, 616 data frames |
| Unique frame IDs | 7 (0x0A, 0x2A, 0x30, 0x31, 0x32, 0x3C, 0x3D) |

## Bus Sequence

The capture shows a clear pattern:

1. Bus starts asleep (frame 1: SLEEP)
2. Wakeup event (frame 2: WAKEUP)
3. Diagnostic initialization — 11 request/response pairs on IDs 0x3C/0x3D querying multiple PIDs (0x0D, 0x0A, 0x09,
0x14)
4. Steady-state schedule repeating: 0x0A → 0x2A → 0x32 → 0x30 → 0x31 in a 100ms cycle (5 frames × 20ms)

## Frame-by-Frame Analysis

### Frame 0x0A — Status/Command Frame (120 occurrences)
- Byte 0: Always 0xFF — likely a node address or broadcast marker
- Byte 1: 0x00 initially, then 0x1E (30 decimal) after initialization — possibly a mode/state indicator
- Bytes 2–7: All zeros throughout — unused or reserved

### Frame 0x2A — Sensor/Measurement Data (120 occurrences)
This frame shows the most dynamic behavior — likely sensor readings:
- Byte 0: Transitions from 0x00 → 0x01 (active flag)
- Bytes 1–2: Gradually increasing values (e.g., 0x00,0x00 → 0x21,0x27) — could be current/power measurements ramping
up
- Bytes 3–4: Slowly decreasing (0x40,0x32 → 0x39,0x23) — possibly voltage dropping under load or temperature rising
- Bytes 5: Decreasing (0x3E → 0x34) — another declining measurement
- Bytes 6–7: Increasing values — possibly accumulated energy or duty cycle

### Frame 0x30 — System Measurements (118 occurrences)
- Byte 0: Constant 0x28 (40 decimal) — possibly a node ID or fixed parameter
- Byte 1: Ramps up from 0x00 → 0x3F then stabilizes around 0x35 — looks like a duty cycle or power level (0–63 range,
~55% steady state)
- Bytes 3–4: Large values that shift over time — possibly RPM, frequency, or multi-byte sensor reading
- Byte 6: Increases from 0x00 → 0x04 then holds — could be a state counter or operating mode

### Frame 0x31 — Temperature/Thermal Data (118 occurrences)
- Byte 0: Steps up 0x00 → 0x04 → 0x08 → 0x0A → 0x09 → 0x08 — possibly a fan speed or cooling stage
- Byte 1: Increases then stabilizes (0x00 → 0x0E → 0x0B) — related measurement
- Bytes 3–6: Four bytes that all decrease together from 0x3B,0x3A,0x3A,0x39 down to 0x34,0x34,0x34,0x34 — strongly
suggests 4 temperature sensors cooling down or being read in sequence (values 59→52 in decimal, plausible for °C)
- Byte 7: Constant 0x4D (77 decimal, ASCII 'M') — possibly a unit marker or checksum

### Frame 0x32 — Empty/Reserved (118 occurrences)
- All 8 data bytes are 0x00 throughout the entire capture
- Likely a placeholder frame in the schedule, or a slave that isn't responding with data

### Frames 0x3C/0x3D — LIN Diagnostic Frames (11 pairs)
These are standard LIN diagnostic frames (Master Request / Slave Response):
- All use NAD 0xD0 — the slave node address
- Queried PIDs: 0x0D (4 sub-IDs), 0x0A (2 sub-IDs), 0x09 (4 sub-IDs), 0x14 (1 sub-ID)
- Notable responses:
- PID 0x0D, sub 0xFF → response 0x05 (total count of something)
- PID 0x0A, sub 0x00 → response 0x21,0xDC (8668 decimal — could be a serial number or calibration value)
- PID 0x0A, sub 0x01 → response 0x18,0xCE (6350 decimal)
- PID 0x14 → response 0x01 (version or config flag)

## Key Observations

1. This appears to be an FDU (Fan Drive Unit) — the data patterns strongly suggest a cooling system controller:
- Ramping power/duty cycle (0x30 byte 1)
- 4 temperature channels declining together (0x31 bytes 3–6)
- Current/power measurements increasing (0x2A)

2. The capture shows a startup sequence: sleep → wake → diagnostic query → normal operation with the fan ramping up

3. No errors detected — all frames use direction flag S (successful), no checksum errors or framing issues noted

4. The 4 temperature values in frame 0x31 are the most interesting — they track closely together but aren't identical,
suggesting 4 separate thermal sensors (possibly motor, ambient, heatsink, and coolant)
davefiddes
Posts: 416
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 206 times
Been thanked: 256 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

Back to the engineering!

So I've been through the Gate driver SPI capture. It's a bit different from the earlier capture (which was a bit messed up) and the RDU. Salient differences between the RDU and FDU:
  • CFG2: DESAT_CUR_500UA | DESAT_TH_8V becomes SENSE_100MV | DESAT_CUR_1000UA | DESAT_TH_6V
  • CFG4: Rather than being split between high-side and low-side it is UVLO_LATCHED | VLON_TH_NEG_3V | VHON_TH_12V for all drivers
The update gate driver code has been desk tested on my board configured as an FDU.
davefiddes
Posts: 416
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 206 times
Been thanked: 256 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

I've had a look at the LIN capture. It starts out querying PID 0x3c and 0x3d which seem to be some sort of LIN diagnostic query/response mechanism that I need to do some reading up on.

Based on the reply it gets from your pump it quickly switches to the 0xa command, 0x2a, 0x32, 0x30 and 0x31 request sequence we know from the capture I took back in 2022. So presumably it should work fine with the current code. Would be good to test this. Can you plug one of your boards into the pump and see that it is happy with the response?

I suspect you have a newer pump than our 2019/2020 pumps but not new enough to be problematic like the Model Y pump that was giving someone problems.

The Saleae Logic software has a half way decent LIN analyzer that I've built tooling on to off. Any chance of a Saleae Logic capture of the oil pump LIN? A capture of without the pump connected as well as with would be useful.
User avatar
Jack Bauer
Posts: 3999
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 153 times
Been thanked: 1114 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Yep I can do all that tomorrow. tbh at this stage if someone has a problem with a pump they will have to provide a lin capture.
I'm going to need a hacksaw
jrbe
Posts: 766
Joined: Mon Jul 03, 2023 3:17 pm
Location: CT, central shoreline, USA
Has thanked: 360 times
Been thanked: 249 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by jrbe »

I panelized the temp sensors,
image.png
12 v-cuts to pop them apart
image.png
5 panelized pcbs at .6mm thick is under $10 USD and under $50 assembled, this is for 40 inverters worth (120 individual) temp sensor pcbs.
image.png
for some reason JLC jumps the price up 6x if you drop to .4mm. Will have to look at modding Damien's boards to fit these as a .6mm pcb.

Same place, https://github.com/jrbe/Tesla-Model-3-C ... nsor-Block

Should be everything to do this as Tesla did besides verifying the temp sensor I dropped in these works.
image.png
image.png
I'm going to 3D scan the Model 3 inverter board and make KiCAD temp sensor footprints for the towers / pcb style temp senosrs.
User avatar
Jack Bauer
Posts: 3999
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 153 times
Been thanked: 1114 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

That is a crazy amount of work. Thank you. Very much in the spirit of an opensource project :)

Board scan here : https://grabcad.com/library/tesla-model ... rter-pcb-1
I'm going to need a hacksaw
jrbe
Posts: 766
Joined: Mon Jul 03, 2023 3:17 pm
Location: CT, central shoreline, USA
Has thanked: 360 times
Been thanked: 249 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by jrbe »

Jack Bauer wrote: Mon Mar 30, 2026 7:44 pm That is a crazy amount of work. Thank you. Very much in the spirit of an opensource project :)

Board scan here : https://grabcad.com/library/tesla-model ... rter-pcb-1
Happy to help, thanks for all of your efforts in this Damien. The one piece for you to think about is the thermistor, what I have is close-ish and is a placeholder for now.

Thanks for the scan!

Panelization was with KiKit, https://github.com/yaqwsx/KiKit It takes some time learning to use it but then it panelizes the boards very quickly.
jrbe
Posts: 766
Joined: Mon Jul 03, 2023 3:17 pm
Location: CT, central shoreline, USA
Has thanked: 360 times
Been thanked: 249 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by jrbe »

I made a symbol, footprint, and a step file of the pcb tower assembly for KiCAD 10
https://github.com/jrbe/Tesla-Model-3-C ... ibrary.zip
image.png
Damien, Dave, and anyone else helping with the PCB side of things, this should be able to swap the place of the through hole thermistor and should also work with the other version of the 3D printed towers for the through hole temp sensor.

The center point of the assembly is the center of the 2 slotted through holes to make it easy to use / reference.
image.png

Besides finding the right 0402 thermistor / one you guys are happy with, both this temp sensor PCB and the 3D printed tower are ready to order a test batch.
Melt rivets and the through hole temp sensor towers are good to test too. Melt rivets are 7 all stuck together in the 6 around the outside, one in the middle. They're small and easy to lose, should easily separate with cutters.

If / when someone gets toroid dimensions or wants to mail me one (PM me) to reverse engineer, I'll update the current sensor block to hold them properly, mod the caps and housing with snaps to help hold it in place.
User avatar
Jack Bauer
Posts: 3999
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 153 times
Been thanked: 1114 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

I've ordered the temp sensor boards and holders from JLC. thanks again to jrbe. I'll uprev to V3.3 and see how we go.
Attachments
Screenshot from 2026-04-02 11-56-28.png
I'm going to need a hacksaw
davefiddes
Posts: 416
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 206 times
Been thanked: 256 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

Have you been able to identify an SMD NTC with the same curve as the EPCOS B57164K0473J000?
User avatar
Jack Bauer
Posts: 3999
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 153 times
Been thanked: 1114 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Not yet. Will investigate.
I'm going to need a hacksaw
Post Reply