Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Wed Nov 26, 2025 11:32 am
Congratulations on getting your motor running!
The oil pump behaviour is concerning. At the moment the code is utterly minimal and just sets the pump to run at a fixed speed irrespective of operating mode, temps, motor rpm, etc. If LIN bus comms are working as you describe but the pump speed can't be changed then that implies that I'm not sending the right command PID for your oil pump or the PID is not correctly formatted. The pump goes into full blast limp home mode if you don't send the correct command PID for a second or two.
Edit: Would it be possible to get a LIN capture from your Tesla inverter PCB? It doesn't need much in the way of equipment just a Saleae Logic compatible logic analyzer (the cheap $10 clones from ebay are fine) and a potential divider to take the 12V LIN signal down to something that won't blow up the analyzer (say 33k and 10k). The Tesla firmware sends LIN requests out all the time and doesn't need the pump connected. Let me know if you need more details.
The Tesla firmware sends out a single command on PID 0xA and requests status on PIDs 0x2A, 0x30, 0x31 and 0x32.
The oil pump behaviour is concerning. At the moment the code is utterly minimal and just sets the pump to run at a fixed speed irrespective of operating mode, temps, motor rpm, etc. If LIN bus comms are working as you describe but the pump speed can't be changed then that implies that I'm not sending the right command PID for your oil pump or the PID is not correctly formatted. The pump goes into full blast limp home mode if you don't send the correct command PID for a second or two.
Edit: Would it be possible to get a LIN capture from your Tesla inverter PCB? It doesn't need much in the way of equipment just a Saleae Logic compatible logic analyzer (the cheap $10 clones from ebay are fine) and a potential divider to take the 12V LIN signal down to something that won't blow up the analyzer (say 33k and 10k). The Tesla firmware sends LIN requests out all the time and doesn't need the pump connected. Let me know if you need more details.
The Tesla firmware sends out a single command on PID 0xA and requests status on PIDs 0x2A, 0x30, 0x31 and 0x32.