Page 44 of 48

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Tue Feb 24, 2026 3:29 pm
by Jack Bauer
V3.2 boards have arrived :)

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Wed Feb 25, 2026 4:22 pm
by Jack Bauer
The V3.2 is alive. Have ordered the current sensors from mouser so will now ship with those also. Mods done with the 10K as per Dave's instruction. Planning to fit to a front inverter tomorrow for full testing and release. I'll then uprev the design to have those 2 resistors fitted. Silly mistake on my part. I only have 5 of the gate drive transformers here and more wont be available for about a month so 5 boards will come with and 5 without from this current batch. Those without will have to harvest from the OEM board.

I have a request. Could someone scan and perhaps make a 3d printable model of the plastic current sensor block? I know it wont work as a current sensor without the torroid but I would like to use something like that so the boards can be shipped with the current sensors soldered to the board.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Wed Feb 25, 2026 5:04 pm
by jrbe
Jack Bauer wrote: Wed Feb 25, 2026 4:22 pm

Could someone scan and perhaps make a 3d printable model of the plastic current sensor block?
If someone can point me to the part numbers / files dimensions of the current sensor & torroid I can do the CAD side.

- Are the board files shared current?
- MLX91209LVA-CAA-002-SP = current sensors?
- Anyone have accurate dimensions / part number of the torroids?

Looking for this, right?
image.png

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Thu Feb 26, 2026 6:50 am
by Jack Bauer
Yes that is the current sensor block.

Sensor is : MLX91209LVA-CAA-002-SP. 7.3mV/mT.

V3.2 schematic and board layout are on Github : https://github.com/damienmaguire/Tesla- ... ter/Design

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Thu Feb 26, 2026 10:27 am
by Jack Bauer
Finally got around to grabbing a gate driver spi capture on a front inverter.

Another difference are the switching voltage levels : -8V and +16V

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Thu Feb 26, 2026 11:27 am
by davefiddes
I'll go through that in a bit and see what's going on and if there is any differences compared to the RDU.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Thu Feb 26, 2026 11:36 am
by Jack Bauer
So I asked the Grokster. Now keep in mind this is as trustworthy as cartoon physics but it may prove useful.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Thu Feb 26, 2026 12:17 pm
by davefiddes
Unfortunately it looks like the capture only catches the end of the configuration process. Any chance you could have another go? I usually use a Trigger capture on the falling edge of CS and then run for 30 seconds. Powering up the board then gets a clean capture of everything up to the first couple of status checks.

Also, the capture looks a bit suspect as it only seems to have data for U303. Did you hook up SDO from U291? I capture SDI (pin 3), /CS (pin 4) and CK (pin 5) from U303 and SDO (pin 2) from U291 to get a complete capture.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Thu Feb 26, 2026 12:23 pm
by Jack Bauer
Yep I have MISO from U291 and the rest from U303. Will run another shot with a few power cycles. 1 min.

Attached.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Thu Feb 26, 2026 12:43 pm
by Jack Bauer
Its possible this inverter is damaged as had water ingress by the look of things.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Thu Feb 26, 2026 2:19 pm
by davefiddes
Yeah. Looks like something is unhappy and the driver chain is returning very suspect data. The unit is retrying the configuration process and getting nowhere.

Good news is that the capture contains the configuration that the FDU is sending to the gate drivers and it is consistent and similar enough to the RDU for me to be confident it's correct. The changes are:

Code: Select all

 diff --git a/include/teslagatedriver.h b/include/teslagatedriver.h
index 94403cd..3eeefc0 100644
--- a/include/teslagatedriver.h
+++ b/include/teslagatedriver.h
@@ -147,7 +147,8 @@ const typename GateDriver<SpiDriverT>::Register
           All,
           STGAP1AS_REG_CFG1_MASK },
         { STGAP1AS_REG_CFG2,
-          STGAP1AS_REG_CFG2_DESAT_CUR_500UA | STGAP1AS_REG_CFG2_DESAT_TH_8V,
+          STGAP1AS_REG_CFG2_SENSE_100MV | STGAP1AS_REG_CFG2_DESAT_CUR_1000UA |
+              STGAP1AS_REG_CFG2_DESAT_TH_6V,
           All,
           STGAP1AS_REG_CFG2_MASK },
         { STGAP1AS_REG_CFG3,
@@ -156,12 +157,12 @@ const typename GateDriver<SpiDriverT>::Register
           STGAP1AS_REG_CFG3_MASK },
         { STGAP1AS_REG_CFG4,
           STGAP1AS_REG_CFG4_UVLO_LATCHED | STGAP1AS_REG_CFG4_VLON_TH_NEG_3V |
-              STGAP1AS_REG_CFG4_VHON_TH_12V,
+              STGAP1AS_REG_CFG4_VHON_TH_10V,
           LowSide,
           STGAP1AS_REG_CFG4_MASK },
         { STGAP1AS_REG_CFG4,
           STGAP1AS_REG_CFG4_UVLO_LATCHED | STGAP1AS_REG_CFG4_VLON_TH_DISABLED |
-              STGAP1AS_REG_CFG4_VHON_TH_12V,
+              STGAP1AS_REG_CFG4_VHON_TH_10V,
           HighSide,
           STGAP1AS_REG_CFG4_MASK },
         { STGAP1AS_REG_CFG5,
It occurs to me that the capture we used for the RDU gate drivers is now very old. If you (or anyone) had a newer RDU board that still runs it would be useful to confirm Tesla hasn't changed anything in the intervening years.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Thu Feb 26, 2026 2:27 pm
by Jack Bauer
So it gets a bit more confusing. The FDU I have and took that log from is an older rev. I have a much newer pcb from a "960" inverter here but sadly the gate driver chips and transformer were removed and I cannot get any spi out of it despite pulling TP43 low etc. Likewise I have a much newer RDU "980" board but the same result :( It could be that the inverters now don't configure the drivers until the inverter is more ready but I can't be sure.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Thu Feb 26, 2026 2:40 pm
by davefiddes
Maybe someone with one of the new boards could help out? It just needs a $10 Saleae Logic USB logica analyzer clone from ebay, aliexpress, etc and a little bit of soldering. It would also be helpful to get a fresh LIN capture from a newer board too. This would help unlock the newer "Model Y" pump that seems to be around.

If it's not clear what to do Damien or I can explain in more depth.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Thu Feb 26, 2026 2:46 pm
by Jack Bauer
No chance I'd say Dave but I would dearly love to be wrong....

I'll try and source a model y drive unit. Two birds.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Thu Feb 26, 2026 6:53 pm
by davefiddes
So. Now we know how the FDU gate drive differs from the RDU I come to think about how we identify this in software. IIRC you said there were various component value changes for the FDU IGBTs. Would the thing be to ask johu for a new variant resistor? That way I can automatically program the gate drivers with the correct config. The other approach would be to add a parameter but I can guarantee that we'll have FDUs wandering about with RDU gate driver configs and vice versa.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Thu Feb 26, 2026 8:43 pm
by Jack Bauer
Yeah the changes are fairly simple. I ended up down a bit of a rabbit hole thinking it would involve changes to the gate driver psu but it boils down to removing the steering diodes and changing the on/off resistors to all 6R2 for the FDU inverter. All 2012 parts. So it won't be detectable by the mcu. I can put instructions on the back of the board silkscreen as I'm sure we'll end up with people doing mix and match. I'll go over it in the next video and add info to the wiki page is all I can think of right now so a param is prob the least worst imho.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Thu Feb 26, 2026 9:02 pm
by jrbe
Jack Bauer wrote: Wed Feb 25, 2026 4:22 pm I have a request. Could someone scan and perhaps make a 3d printable model of the plastic current sensor block? I know it wont work as a current sensor without the torroid but I would like to use something like that so the boards can be shipped with the current sensors soldered to the board.
I drew up a current sensor shipping block,
image.png
tabs into the bus bar hole.
image.png
Currently allows for a 8.5mm total current sensor height. (blue is cutaway)
image.png
I haven't seen any pictures of the current sensor installed in this thread yet, I'm currently assuming a bottomed out current sensor. Thought was tape or a zip tie on each to hold them in place. Walls are 6mm / 3mm. If you want any changes let me know.
Also, if you'll use PLA to print these I can add that embossed in the bottom / build plate face so it can be identified / recycled if that's something that can happen where it gets shipped.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Feb 27, 2026 2:16 am
by jrbe
I can draw up the current sensor block but it would be ideal to get the torroid size, wall thicknesses, etc. If someone wants to mail me a current sensor block, even a broken one I can 3D scan / model it up and share it here. I'm in Connecticut USA, PM me.

May be able to get them printed from say JLC3DP in PA11 or something actually usable. But for shipping I think the one I drew up makes sense, less plastic waste.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Feb 27, 2026 2:48 am
by r1ckyb0nd
jrbe wrote: Fri Feb 27, 2026 2:16 am I can draw up the current sensor block but it would be ideal to get the torroid size, wall thicknesses, etc. If someone wants to mail me a current sensor block, even a broken one I can 3D scan / model it up and share it here. I'm in Connecticut USA, PM me.

May be able to get them printed from say JLC3DP in PA11 or something actually usable. But for shipping I think the one I drew up makes sense, less plastic waste.
I am also in CT and have a 980 inverter board that you can borrow. If the part you need is on there.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Feb 27, 2026 6:11 am
by Jack Bauer
That's ideal thank you very much. The sensor does drop down into the block. I'll measure by how much and let you know.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Feb 27, 2026 10:16 am
by Jack Bauer
Boards and design files now available on the evbmw webshop. Usual caveats apply. This should still be considered a beta design until more testing and validation.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Feb 27, 2026 11:22 am
by davefiddes
Jack Bauer wrote: Fri Feb 27, 2026 6:11 am That's ideal thank you very much. The sensor does drop down into the block. I'll measure by how much and let you know.
The current sensor sits above the PCB with 4.7mm of exposed lead. The total height above the PCB is 8.4mm.

The pocket in the sensor block is 5mm x 7.5mm with the long axis being in line with the sensor. It is 10.5mm deep (with all the potting compound removed). The gap in the ferrite core is narrower at 3mm.
current-sensor-block.jpg

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Feb 27, 2026 6:53 pm
by davefiddes
Jack Bauer wrote: Thu Feb 26, 2026 8:43 pm So it won't be detectable by the mcu.
We seem to be talking at cross purposes. If you change R45 to 5K6 at the same time as the other BOM changes the HW can very much signal that it is running on an FDU rather than an RDU.

Parameters have to be supported forever and as explained can get out of sync with the HW. It's a poor way to solve this problem.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Feb 27, 2026 9:09 pm
by outlandnish
davefiddes wrote: Thu Feb 26, 2026 2:40 pm Maybe someone with one of the new boards could help out? It just needs a $10 Saleae Logic USB logica analyzer clone from ebay, aliexpress, etc and a little bit of soldering. It would also be helpful to get a fresh LIN capture from a newer board too. This would help unlock the newer "Model Y" pump that seems to be around.

If it's not clear what to do Damien or I can explain in more depth.
I have two 980 boards but no idea if they are the old / new generation. Happy to take some logs of the SPI communications and/or LIN capture this weekend.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Feb 27, 2026 9:38 pm
by jrbe
Jack Bauer wrote: Wed Feb 25, 2026 4:22 pm I have a request. Could someone scan and perhaps make a 3d printable model of the plastic current sensor block?
10.5mm deep current sensor shipping plug with and without "PLA" in the bottom. There are .3mf files in there that should work for any slicer plus a few other file types. Forum was complaining about file extension types so they're all in a zip folder.
Model3_ShippingPlug-CurrentSensor.zip
(24.93 MiB) Downloaded 7 times