Page 27 of 33

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Sun Jul 28, 2024 10:28 am
by RadioKot
Great idea! Soon I will review the entire topic to understand what local users have already managed to do. Together we will be able to create a unique ingenext. I would like to attach a photo of my installation, but I don't know how to do it

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Sun Jul 28, 2024 10:37 am
by AMP3R
here

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Sun Jul 28, 2024 11:07 am
by RadioKot
So there is my installation

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Sun Jul 28, 2024 6:17 pm
by davefiddes
That's an impressive setup. I'm jealous!

A open CAN based solution would be welcomed by many. If you guys can collaborate on it that would be fantastic.

The approach I'm taking to build a brand new firmware for the inverter is completely mad. Sort of equivalent to casting your own cylinder head and pistons for a hot-rod. Technically possible for some but very slow going and it might struggle to meet the OEM performance.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Tue Jul 30, 2024 11:41 am
by P.S.Mangelsdorf
davefiddes wrote: Sun Jul 28, 2024 6:17 pm Technically possible for some but very slow going
But how awesome it will be when it works!

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Sat Aug 03, 2024 12:00 pm
by RadioKot
davefiddes wrote: Sun Jul 28, 2024 6:17 pm The approach I'm taking to build a brand new firmware for the inverter is completely mad.
Tell us about your idea?
davefiddes wrote: Sun Jul 28, 2024 6:17 pm A open CAN based solution would be welcomed by many. If you guys can collaborate on it that would be fantastic.
Yes, I would like to work on creating a CAN controller, but I need someone's help with this

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Sat Aug 03, 2024 1:30 pm
by AMP3R
RadioKot wrote: Sat Aug 03, 2024 12:00 pm Tell us about your idea?

Yes, I would like to work on creating a CAN controller, but I need someone's help with this
Have you already "paired" your motor with the controller? If not, you can record the entire inverter flash procedure from ingenext support when you communicate via teamviewer. The main thing is that you have reliable CAN analyzer.

Can you do it yourself?

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Sat Aug 03, 2024 1:36 pm
by davefiddes
RadioKot wrote: Sat Aug 03, 2024 12:00 pm Tell us about your idea?
My github project: https://github.com/davefiddes/c2000-inverter explains the scope of what I'm working towards.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Sat Aug 03, 2024 1:43 pm
by RadioKot
AMP3R wrote: Sat Aug 03, 2024 1:30 pm Have you already started your motor with the controller?
I've already started the engine. Ingenext has already done everything that was needed with it two months ago, since then I have been developing a thermal controller
AMP3R wrote: Sat Aug 03, 2024 1:30 pm Can you do it yourself?
Yes, I can try to do it on my own. I already have the final CAN log. But I didn't risk sending messages to CAN. I could try to do it, but I need an experienced person. I have not encountered these programs before, but I would really like to learn

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Sat Aug 03, 2024 1:50 pm
by AMP3R
RadioKot wrote: Sat Aug 03, 2024 1:43 pm I've already started the engine. Ingenext has already done everything that was needed with it two months ago, since then I have been developing a thermal controller


Yes, I can try to do it on my own. I already have the final CAN log. But I didn't risk sending messages to CAN. I could try to do it, but I need an experienced person. I have not encountered these programs before, but I would really like to learn
What log do you have exactly? The inverter firmware procedure itself or did you just record what the controller sends to the motor?

What is your end goal? Do you want to make your own controller and then sell it or what?

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Sat Aug 03, 2024 2:06 pm
by RadioKot
AMP3R wrote: Sat Aug 03, 2024 1:50 pm What log do you have exactly?
Of course, I do not have the procedure for flashing the inverter. Ingenext keeps it a secret… I only have the signals that the controller sends
AMP3R wrote: Sat Aug 03, 2024 1:50 pm What is your end goal? Do you want to make your own controller and then sell it or what?
This controller will be useful to me in my other projects. It's more of a challenge to myself, but maybe I'll sell it piece by piece to interested people.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Sat Aug 03, 2024 2:40 pm
by AMP3R
RadioKot wrote: Sat Aug 03, 2024 2:06 pm Of course, I do not have the procedure for flashing the inverter. Ingenext keeps it a secret… I only have the signals that the controller sends

This controller will be useful to me in my other projects. It's more of a challenge to myself, but maybe I'll sell it piece by piece to interested people.
Will you share the logs? Many will thank you.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Sat Aug 03, 2024 10:46 pm
by RadioKot
I can't attach it.trc file because it is an invalid file extension. I can send it in other messengers

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Mon Aug 05, 2024 3:03 pm
by AMP3R
RadioKot wrote: Sat Aug 03, 2024 10:46 pm I can't attach it.trc file because it is an invalid file extension. I can send it in other messengers
Check PM

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Sun Aug 18, 2024 5:36 pm
by davefiddes
Been having a bit of fun this week programming in the garage to see how the Tesla M3 oil pump works. Turns out to be pretty simple. There's a single command being sent out by the inverter to the pump and although it's 2 bytes long only 1 seems to actually do anything. The value that's sent commands the pump to vary the output with 0 being off.

The Tesla inverter firmware traces taken before I accidentally nuked it showed 4 separate requests being sent to the pump. I've been able to decode a bunch of the values these return including: fluid and pump temperatures (and 4 other temps!), supply voltage and current, motor RPM, and suspected fluid flow and pressure.

A simple ESP32 Arduino sketch to drive the pump and the retrieve the status can be found here: https://github.com/davefiddes/Tesla-Model-3-Drive-Unit/

I'm sure that there's more to be found particularly on error states. I can only really see the Fluid Temp being useful in the short term.

Here's a graph of what a short 50 second run of the pump produces:
oil-pump-status-short-run.png

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Aug 30, 2024 9:36 am
by AMP3R
I have this scary setup with a computer power supply, from which I take 310V 6A max. It seems to be suitable for testing.
20240830_114833.jpg
Using prepared can logs and so far only VEHICLE CAN, I managed to achieve the inverter states IMMOBILIZER_STATE DISARMED and DI_SYSTEM_STATE IDLE.
Screenshot from 2024-08-30 23-08-30.png
I am sure that I am doing something wrong, because the ACTIVE DISCHARGE - ON error is active.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Aug 30, 2024 9:38 am
by RadioKot
:) Good job!

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Aug 30, 2024 10:05 am
by davefiddes
Do you have an intact HVIL loop with a 20mA current running through it? Without that the HV bus discharge circuit on the inverter will not deactivate.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Aug 30, 2024 10:22 am
by AMP3R
davefiddes wrote: Fri Aug 30, 2024 10:05 am Do you have an intact HVIL loop with a 20mA current running through it? Without that the HV bus discharge circuit on the inverter will not deactivate.
I haven't connected HVIL. Can you tell me how to emulate it? What voltage is there? Is PWM used?

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Aug 30, 2024 10:57 am
by davefiddes
It's quite simple to emulate on the bench. It is a simple 20mA current loop and you can use the same 12VDC supply you use for the main inverter (it is optically isolated from the main inverter electronics).

I use the following circuit with an LM317L regulator:
hvil.png
The HV DC connector is part of the loop. I see you have the official cable so you should be good. If anyone wants to jumper it out you need to do this:
IMG_20240830_113428_695.jpg
The HV discharge circuitry is completely automatic but the HVIL current is monitored by the main inverter MCU.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Aug 30, 2024 11:18 am
by AMP3R
davefiddes wrote: Fri Aug 30, 2024 10:57 am It's quite simple to emulate on the bench. It is a simple 20mA current loop and you can use the same 12VDC supply you use for the main inverter (it is optically isolated from the main inverter electronics).

I use the following circuit with an LM317L regulator:

hvil.png

The HV DC connector is part of the loop. I see you have the official cable so you should be good. If anyone wants to jumper it out you need to do this:
IMG_20240830_113428_695.jpg

The HV discharge circuitry is completely automatic but the HVIL current is monitored by the main inverter MCU.
Thank you. Do you think the transistor that turns on the resistor bank is still okay when I kept the HV for a few minutes?

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Aug 30, 2024 11:31 am
by davefiddes
Not sure. I suspect it'll probably be OK. IIRC Damien burned his out but he was running for quite some time.

I found you can see the operation of the discharge circuitry quite clearly with a current clamp on the HVDC input. With an idle inverter the two sources of current draw on the HVDC is the backup gate drive PSU and the HV discharge resistors. Turning on and off the HVIL circuit varied it quite significantly. You need a current clamp that is accurate in the DC mA range. My cheap UNI-T UT210E Pro seems to do the job OK.

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Fri Aug 30, 2024 8:11 pm
by AMP3R
davefiddes wrote: Fri Aug 30, 2024 11:31 am Not sure. I suspect it'll probably be OK. IIRC Damien burned his out but he was running for quite some time.

I found you can see the operation of the discharge circuitry quite clearly with a current clamp on the HVDC input. With an idle inverter the two sources of current draw on the HVDC is the backup gate drive PSU and the HV discharge resistors. Turning on and off the HVIL circuit varied it quite significantly. You need a current clamp that is accurate in the DC mA range. My cheap UNI-T UT210E Pro seems to do the job OK.
Active discharge alert has gone. Thanks!
Screenshot from 2024-08-30 23-09-41.png

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Wed Sep 25, 2024 1:54 pm
by AMP3R
So the immobilizer is unlocked, the inverter shows signs of life with a 10 kHz beep for a split second during power on and shows that it is in the IDLE state, the HVIL circuit is on.

I switch to D, the inverter shows N and the IDLE state doesn't change. That is, in order for D to be ENABLE, you first need to achieve STANDBY in P.
Screenshot from 2024-09-25 16-24-32.png
Does the motor need cell voltages? I think the problem lies somewhere in the messages from the BMS. What do you think?
20240925_162118.jpg
20240925_162010.jpg

Re: Tesla Model 3 Rear Drive Unit Hacking

Posted: Thu Sep 26, 2024 6:39 pm
by P.S.Mangelsdorf
AMP3R wrote: Wed Sep 25, 2024 1:54 pm The funny thing is that there is no info anywhere on google that anyone has even tried to run this motor as is, without messing with inverter, and in fact there is no one to even ask.
I met someone on Drag Week (a spectator) who said he had a build using one of the Canadian Model 3 controllers (I think it was Ingenext). It sounded like the drive units were unmodified.

From what I've seen it's only those of you here on OI trying to get these running without a commercial controller. It does look like those commercial controllers might reprogram something, but not clear what.