Best guess so far on the new 15V circuit. Resistor vals are just place holders. Still cant figure out from pics how they are doing the 5V hv side supply for the udc circuit. Now at V3.2 board, can we make it to TREE point TREE for release:)
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Tue Dec 09, 2025 8:37 pm
by nathaniel
Jack Bauer wrote: ↑Tue Dec 02, 2025 6:35 pm
@Nathaniel, the board scan is perfect thanks. I can highlight on a few pictures the measurements I need if thats ok?
On the "960" board with the missing parts, could you measure the values of R173 , R174 , R186 as circled in red? I suspect D56 is a zener diode. Could you measure its voltage? will probably need to be removed to measure properly.
I have desoldered and measured the requested components
R173 49,8 kohm
R174 49,8 kohm
R186 49,9 kohm
D56, series resistor of 12k
pin 3 negative, pin 1 positive,
supply 1 volt -> 0,67v
supply 2 volt -> 0,7v
supply 4 volt -> 0,73v
pin 1 negative, pin 3 positive,
supply 13 volt -> 12,57v
supply 14 volt -> 13,55v
supply 15 volt -> 14,51v
supply 16 volt -> 15,08v
supply 17 volt -> 15,09v
supply 18 volt -> 15,10v
supply 24 volt -> 15,15v
So it looks to me like a 15 volt zener diode
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Tue Dec 09, 2025 8:55 pm
by nathaniel
Jack Bauer wrote: ↑Tue Dec 02, 2025 6:49 pm
Also on the 960 ,and this will be the tricky part, U31 gets its HV side 5v supply via R243. I need to know where R243 connects and how they derive the HV side 5v on this revision.
This is indeed a tricky one, it goes towards the MCU and comes to a filtering with L13 and C160, This is actually the case on all versions of the PCB that I have seen, the value of R243 was 11.5 ohms when it was still on the PCB and unfortunately it was lost during desoldering.
Do you want me to do some further research on this part?
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Tue Dec 09, 2025 9:01 pm
by nathaniel
Jack Bauer wrote: ↑Tue Dec 02, 2025 6:52 pm
And finally on the board that uses the NCP1060 , I need to know how pins 3 and 5 of U36 (the NCP1060) connect and what value components are used.
Many thanks. If too much work am happy to pay postage for the boards and return them to you once measurments are complete.
I took some pictures with a microscope, hopefully this is clear, otherwise please let me know.
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Fri Dec 12, 2025 4:39 pm
by Jack Bauer
nathaniel wrote: ↑Tue Dec 09, 2025 8:55 pm
This is indeed a tricky one, it goes towards the MCU and comes to a filtering with L13 and C160, This is actually the case on all versions of the PCB that I have seen, the value of R243 was 11.5 ohms when it was still on the PCB and unfortunately it was lost during desoldering.
Do you want me to do some further research on this part?
Apologies for the late response. Yes I'd need to know how they derive this power. I'd be happy to pay for shipping the inverter to me and return it back when finished. That is if its a bit of a pain for you?
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Sat Dec 13, 2025 6:44 pm
by davefiddes
Been working on some improvements to the firmware:
The inverter will derate in the case of high oil temperatures and reduce the throttle. This will address the problem of drive units which don't have a working motor temp sensor (this already happens for heatsink and motor temps).
A pair of CAN maps have been added for drive units with and without a motor temp sensor. Those without substitute tmpoil for tmpm in the CAN frame.
The default parameters for the M3 RDU have been updated with the latest one from Damien's integration testing.
Firmware builds now come in a single ZIP archive with the binaries, parameters and CAN map all packaged together
Lower temperature limits for heatsink, motor and oil have been raised to -30°C. This fixes an integer underflow that would cause weird behaviour with ZombieVerter or other CAN VCUs should a temperature sensor fail or not be fitted.
Added a basic oil temperature controller (see below for details)
Integrate the quadratic throttle support from stm32-sine v5.40.R with the new potlinearity parameter
The oil pump and temperature control has seen a lot of work. There are now 4 parameters which affect the operation of the oil pump:
tmpoillow - Temp below which the pump runs at nominal speed
tmpoilhigh - Temp above which the pump runs at maximum speed
pumpspeedidle - Nominal pump speed to use when not running
pumpspeed - Nominal pump speed when running normally
The pumpspeed default comes from Damien's testing. The pumpspeedidle comes from Tesla's firmware and ensures that there is always some oil flowing round even when stationary. The tmpoilhigh and tmpoillow temp limits allow the speed to be ramped up as the temperature increases. These defaults along with tmpoilmax I pulled out of my butt so probably need refinement when vehicles start diving around in something other than a soggy cold winter.
Hello fellow developers, i am one of the beta testers on the m3 logic board and I think I have messed up the soldering pads on the gate drivers I don't know how salvageable it is. I have not got past the first power up and my gate driver fault led has continued to stay lit up . Here I tried to pull off one gate driver back off the board to realign and replace one at a time in hopes of getting to the source of the issue. I had no trouble leading up to this point pulling the o.e.m. board off and neccasary components but feeling maybe the batch of logic boards ought to be sent out with gate drivers already installed and tested for the future boards. Thank you guys for your continuous informative support!
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Sun Dec 14, 2025 2:44 pm
by davefiddes
Urgh. That's sad. Lifting pads is about as much fun as shearing cylinder head bolts. It should fix though.
What I'd do is to use a tiny amount of superglue to stick down each lifted pad. Clean the remaining pads with flux and solder braid. I'd probably leave the one on the chip and essentially glue the chip down. Once the glue had time to set I'd solder all of the intact pins again. Finally, I'd use 30swg kynar wire-wrap wire to repair each of the traces to the nearest via or component. This'll need good magnification, patience and a steady hand obviously.
When powering up the board if you see the fault LED permanently on it's important to get more info from the MCU as to what the fault is. Some info on how to do this is here: https://openinverter.org/wiki/Tesla_Mod ... leshooting. Once you have info on the reported failure(s) we can help advise as to the best next steps.
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Sun Dec 14, 2025 3:21 pm
by Jack Bauer
Brilliant work Dave. I'll test as soon as I can.
In terms of the damaged board it will be the new year realistically before I have any new boards in stock. Worst case I'll send a replacement. Do please be careful and most importantly take your time.
I don't intend to offer a "built and tested" option as then i'll be responsible for every problem up to and including Elon's tweets
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Wed Dec 24, 2025 9:25 am
by Jack Bauer
@nathaniel any luck with that inverter board?
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Thu Dec 25, 2025 7:14 am
by outlandnish
I finally had a chance to revisit testing the motor. Here's where I'm currently stuck:
The setup:
OEM harness for the 30 pin connector + oil pump
"HV" Power supply currently set at 42V / 5A output
14.2V supplied to power up the inverter
A Canipulator ESP32-C6 running a heavily modified version of the openinverter web interface connected via CAN
I'm using CAN to set the start, brake, and forward/reverse signal and am using a Tesla Model 3 pedal to test the throttle. I see the operating mode change to Run and I hear the oil pump RPM change.
However, I get a GATEDRIVERFAULT with a Desat error on Phase A High. I don't see any current draw from my power supply. I also see a Throttle2 error. Any ideas of what might be going on here? One thing I remembered is that I didn't have a pre-charge resistor on it initially, but there is one on it now. Hoping I didn't do anything to the hardware.
I made a quick video illustrating the issue:
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Thu Dec 25, 2025 10:40 am
by crasbe
outlandnish wrote: ↑Thu Dec 25, 2025 7:14 am
I also see a Throttle2 error. Any ideas of what might be going on here?
The Throttle and Desat errors are most likely not related to each other. Is the M3 throttle pedal a dual pot throttle? If not you might have set the throttle mode incorrectly or the throttle ranges are not calibrated correctly.
Please always attach the parameters to any post related to errors/issues.
crasbe wrote: ↑Thu Dec 25, 2025 10:40 am
The Throttle and Desat errors are most likely not related to each other. Is the M3 throttle pedal a dual pot throttle? If not you might have set the throttle mode incorrectly or the throttle ranges are not calibrated correctly.
Please always attach the parameters to any post related to errors/issues.
Looking at it with fresh eyes today, it looks like the ranges for pot1 and pot2 are flipped for the OEM wiring harness + Ingenext harness that I've been using. I've addressed the throttle issues but now still have the Phase A Hi desat error when applying throttle.
I've attached my parameters here
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Thu Dec 25, 2025 6:47 pm
by Jack Bauer
I don't see anything weird in the params on a quick look. I'd check you have -5v on all mosfets when the inverter is in off and have a good look around phase A hi for any solder blobs etc. Also worth checking your Phase A +12v and -5v lines are present and correct. Is the red gate fault led off?
edit : Ok sorry I missed the video just watched now. Basically when you select a direction the MCU starts a 50% pwm (0 current) so seing a desat event at that time points to the driver chip seeing an erroneous signal like from a pin not soldered or bridged etc. Desat will only be looked for in the gate driver once pwm is applied.
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Thu Dec 25, 2025 7:07 pm
by outlandnish
Sounds good, I'll take a look! I have the inverter mounted in the motor so I can't see the fault LED. I'll rig up a setup similar to yours so I can test it with it outside of the motor to inspect that.
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Fri Dec 26, 2025 6:03 pm
by outlandnish
The motor spins - yay!
Interestingly, it doesn't *stop* spinning even after releasing the accelerator pedal. But at least it's rotating EDIT: it just takes a really long time to respond to the pedal being released. It does eventually slow which sounds like some tuning to get it right.
Thanks for all of the help! I'm going to do a quick video demo of my setup for anyone else who is using the OEM harness / wants to try out CAN control.
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Fri Dec 26, 2025 7:08 pm
by crasbe
What was the issue?
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Fri Dec 26, 2025 7:25 pm
by outlandnish
There was a little solder blob that I found on one of the components near the Phase A High gate driver. It must've been a remnant from removing the board the second time for some fixes.
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Fri Dec 26, 2025 8:41 pm
by Jack Bauer
Excellent So in the param set you are using regen is disabled so that impacts spindown time. Also I don't see lqminusld or fluxlinkage set correctly but that won't really matter for a bench test. Also make sure to upgrade to Dave's latest firmware as the one I loaded on the board is well "old" by now. Anyway, congrats on getting it running and thanks to everyone on the beta program
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Fri Dec 26, 2025 9:07 pm
by outlandnish
Noted re: the regen - that would do it! I'll wait to enable that - gotta get my HV pack all setup with my fun new Taycan module BMS + HV system.
Re: firmware - yep, this was on the latest firmware. It was a good test of my redone web interface to be able to do firmware updates
Thanks for making such an awesome kit of hardware + software between you Damien and Dave!
I've got crazy ideas about stuffing an STM32F4 onto it to use VESC to auto-tune the FOC parameters, but that's maybe a stretch goal once the rest of my EV setup is more stable. The work that Benjamin Vedder did for tuning FOC is really impressive - it works like a charm in e-skate / Onewheel world on a wide variety of motors
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Sat Dec 27, 2025 1:37 pm
by Jack Bauer
I just noticed you are running the "old" syncofs value of 2200. This will also contribute to the running on. Please change it to 34968 (2200+32768) as I had this wrong at first meaning the rotor field is running in the opposite direction to the resolver. You will see this in spot values as Rotordir and selectedDir will not agree.
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Wed Dec 31, 2025 1:39 pm
by Jack Bauer
Got my bench setup again. Compiled and loaded Dave's latest firmware. All runs perfectly. Attached parameter file with correct syncofs etc.
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Sat Jan 03, 2026 11:36 pm
by Gr8adventures
Hello again, My pcb beta board may officially be stuck i wanted to see if there was a fuse or some kind of replacement order of components if the voltage was spiked to the pcb beta board. I went to power up again on the chance to connect the web interface and I'm pretty sure the board has been overpowered i turned my power supply on and had the board already hooked up to the power leads. Unfortunately It was set to 28v by mistake and there was a short burst of white smoke. I feel a little like an idiot. It almost looks like the board may have shorted here in the picture (r25,r6,c1 area)but I thought I would see if there is a chance of rehabilitation. I don't consider myself that careless but I know this is not a good look on my part. Hope this fix is relatively easy.
Re: Tesla Model 3 Rear Drive Unit Hacking
Posted: Sun Jan 04, 2026 1:33 am
by royhen99
It has reverse and over voltage protection. It has probably blown F1 which is below / next to D14 in your picture, part number JFC2410-0500TS.