Tesla Model 3 Rear Drive Unit Hacking

Topics concerning the Tesla front and rear drive unit drop-in board
User avatar
johu
Site Admin
Posts: 6968
Joined: Thu Nov 08, 2018 10:52 pm
Location: Kassel/Germany
Has thanked: 454 times
Been thanked: 1771 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by johu »

The day of working inverters :) viewtopic.php?p=82795#p82795

Persistence paying off, great job!
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
User avatar
Jack Bauer
Posts: 3831
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 75 times
Been thanked: 696 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Sorry for the late update folks. Been down with a stomach bug. But hey , its been 5 years so whats another week. Anyway, before running any real power through the inverter I decided to scope the gate-source waveforms just in case. High sides looked fie but all THREE lowsides showed this sort of a weird ground bounce effect of the other 2 low sides switching. Did dome probing around and narrowed into the "56Ohm" source resistors. Hmmm. Guess what? They are not 56 Ohms on the OEM board.... rather 0.56Ohms!!!

Got the right ones ordered but still feeling very happy about progress on this 1st prototype.
Attachments
20250525_110339.jpg
20250525_110254.jpg
Screenshot from 2025-05-26 10-41-50.png
I'm going to need a hacksaw
User avatar
johu
Site Admin
Posts: 6968
Joined: Thu Nov 08, 2018 10:52 pm
Location: Kassel/Germany
Has thanked: 454 times
Been thanked: 1771 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by johu »

Nicely caught in time!
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
User avatar
Jack Bauer
Posts: 3831
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 75 times
Been thanked: 696 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Just a model 3 inverter with an OI board running a model 3 motor.... nothing interesting:)
Attachments
20250528_135901.jpg
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3831
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 75 times
Been thanked: 696 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

For those interested current V2 board schematic. Not finalised yet but has corrections from V1 and now all component values and types populated. Basically the current board minus the bodges:)
Attachments
M3DU_BoardV2_Schematic.pdf
(2.5 MiB) Downloaded 76 times
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3831
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 75 times
Been thanked: 696 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

I'm going to need a hacksaw
User avatar
Beatbuzzer
Posts: 6
Joined: Wed Apr 23, 2025 2:26 pm
Been thanked: 11 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Beatbuzzer »

Do you have any thoughts about the sort of pyrofuse, placed in the newer rear inverters? Would you transfer it to your design or remove it? I mean, it simply goes away by removing the pcb ;) Only attached with two screws in the frame of the hall sensor.
Pyrofuse.jpg
Seems its not only placed in plaid, but also in Model 3 long range and standard range from 2022. My rear inverter is a 3D5 from 2022 and has it.

I'm in a little research at the moment. There is an additional circuit on the right side of the pcb. Connection of the squib is wired in parallel to the two bigger 499R resistors.
pyro circuit.jpg
davefiddes
Posts: 375
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 149 times
Been thanked: 195 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

Managed to get my JTAG connection working again so I can make some improvements to the Tesla M3 gate driver support:

https://github.com/davefiddes/stm32-sin ... provements

So far I've included the various fixes from above and a new version of the gate driver class. This has a correctness fix in the initialisation verification process. It also pipelines SPI requests when polling the status which makes it substantially more efficient. Both changes more accurately reflect the behaviour of the original Tesla firmware.

I'm planning on parsing out the gate driver failures and reporting them as spot values shortly.
User avatar
Jack Bauer
Posts: 3831
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 75 times
Been thanked: 696 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Thats excellent Dave. Thanks. I've been cleaning up the board and getting ready to order V2. By the time it arrives I'll have the Volvo V50 test mule in the barn and ready for full up tests.
I'm going to need a hacksaw
davefiddes
Posts: 375
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 149 times
Been thanked: 195 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

Meanwhile in Open Source development... I have finished making the updates to the Tesla M3 gate driver support code to pull out the detailed fault information:

https://github.com/jsphuebner/stm32-sine/pull/51

@crasbe was absolutely correct in their analysis as to the order in which replies are received from the gate driver SPI chain. My new code now pulls out the details of any fault on a chip by chip basis. If you are having a good day it looks like this:

Code: Select all

...
uptime              : 22820 [10ms]
cpuload             : 2 [%]
m3_phaseA_hi        : OK
m3_phaseA_lo        : OK
m3_phaseB_hi        : OK
m3_phaseB_lo        : OK
m3_phaseC_hi        : OK
m3_phaseC_lo        : OK
Given the sorts of issues with the high-side SENSE pins being not connected properly to ISOGND we saw the other week it would look like:

Code: Select all

...
uptime              : 22820 [10ms]
cpuload             : 2 [%]
m3_phaseA_hi        : OK
m3_phaseA_lo        : DESAT
m3_phaseB_hi        : OK
m3_phaseB_lo        : DESAT
m3_phaseC_hi        : OK
m3_phaseC_lo        : DESAT
If the gate drive PSU turns off unexpectedly:

Code: Select all

...
uptime              : 22820 [10ms]
cpuload             : 2 [%]
m3_phaseA_hi        : REGERRR, REGERRL
m3_phaseA_lo        : REGERRR, REGERRL
m3_phaseB_hi        : REGERRR, REGERRL
m3_phaseB_lo        : REGERRR, REGERRL
m3_phaseC_hi        : REGERRR, REGERRL
m3_phaseC_lo        : REGERRR, REGERRL
It's probably bolting the door after the horse has departed but hopefully it'll be helpful should anything go wrong. Some of the errors it can report I don't think will ever be reported (ASC and SENSE) but better to have the decoding in there than be left in the dark if something weird happens.
User avatar
johu
Site Admin
Posts: 6968
Joined: Thu Nov 08, 2018 10:52 pm
Location: Kassel/Germany
Has thanked: 454 times
Been thanked: 1771 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by johu »

I have moved the now closed source CAN hacking here: viewtopic.php?t=6497
Support R/D and forum on Patreon: https://patreon.com/openinverter - Subscribe on odysee: https://odysee.com/@openinverter:9
User avatar
Jack Bauer
Posts: 3831
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 75 times
Been thanked: 696 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Thanks Dave. I'll get this in the board. Should have the V50 ready for tests this week. So far I once accidently (and once on purpose) shorted two phases with a screwdriver during low voltage bench tests. Trips off the inverter and restarts no problem.
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3831
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 75 times
Been thanked: 696 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

V50 is in the barn at last. Will setup for a closed loop spin in the next few days.
Attachments
20250702_140409.jpg
20250702_122122.jpg
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3831
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 75 times
Been thanked: 696 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Little sneak peek. VCU is now reasonably emulating the V50 ECM and keeping the car side happy. Forwards mode control to the M3 inverter via can. Throttle comes next.
Attachments
Screenshot_from_2025-07-16_15-31-30.png
20250716_152946.jpg
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3831
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 75 times
Been thanked: 696 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

So moving into FOC firmware now to commence tuning. The new gate driver error routine from Dave works well. A 100ms delay is required on startup between starting up the gate driver isolated side psu and running the init routine.
Attachments
Screenshot from 2025-07-17 13-41-12.png
Screenshot from 2025-07-17 13-38-33.png
Screenshot from 2025-07-17 12-52-09.png
I'm going to need a hacksaw
davefiddes
Posts: 375
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 149 times
Been thanked: 195 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

I wished I had built the error reporting from the beginning. It makes debugging so much easier. Good to see it behaving similar on your board to the Tesla board.
User avatar
Jack Bauer
Posts: 3831
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 75 times
Been thanked: 696 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Yeah its super handy thanks Dave. I increased the delay between psu enable and gate driver init to 200ms as the od time one driver would give an init fault. Resolver feedback is now working on the board.
Attachments
Screenshot from 2025-07-17 14-19-39.png
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3831
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 75 times
Been thanked: 696 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

So one things that needs addressing is the resolver vs pwm frequency. As we dont know what pwm frequency Tesla use (perhaps the chap with the board running vai can could measure?) I've been running with 8.8khz. Problem is this creates by default a 4.4khz exciter which is too low. Tesla use 10khz. Johannes gave me a workaround hack that fixes the software to 8.8khz pwm and resolver but this will need to be implementd properly if this crazy board project actually works.
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3831
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 75 times
Been thanked: 696 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Does anyone have a part number or source for the coolant quick connectors on the M3 Drive unit?
I'm going to need a hacksaw
Davidk
Posts: 14
Joined: Sat Feb 12, 2022 9:50 pm
Has thanked: 32 times
Been thanked: 15 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Davidk »

Jack Bauer wrote: Fri Jul 18, 2025 5:08 pm Does anyone have a part number or source for the coolant quick connectors on the M3 Drive unit?
NW18, had it in my notes for whatever reason. please meassure/verify before ordering.
https://media.araymond.com/raygroup/ima ... EN_Web.pdf
User avatar
Jack Bauer
Posts: 3831
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 75 times
Been thanked: 696 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Thanks. Do you know of a supplier?
I'm going to need a hacksaw
Davidk
Posts: 14
Joined: Sat Feb 12, 2022 9:50 pm
Has thanked: 32 times
Been thanked: 15 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Davidk »

i was looking into coolant connectors a bit more.

Generally we have 4 connectors on drive unit, 2 on heat exchanger and 2 on inverter manifold.

Heat exchanger - Aluminium, internal diameter 18mm no any marks
Inverter manifold - plastic, internal diameter 18mm, Tesla part numbers 1102191-00-b (straight) and 1102194-00-0 (45 degree angle).

Connectors are "VDA NW18", I dont have cooling hoses so can not check manufacturer of female connector(s) used by Tesla.
From Internet i was able to find few companies making these connectors:

Araymond - https://media.araymond.com/raygroup/ima ... EN_Web.pdf - Not able to find supplier
Erreka - https://plastics.erreka.com/product/quick-connectors/ - Not much info, not able to find supplier
AFT - https://www.aft-automotive.de/vda-connectors.html - Not much info, not able to find supplier
ITW - https://www.itwautomotive.com/products/ ... connector/ - Not much info, not able to find supplier

Norma Group - https://www.normagroup.com/norma.nsf/re ... PS3_en.pdf - not making NW18
TI Fluid Systems - https://tifluidsystems.com/quick-connect-catalog/ - Not making NW18
Parker - https://ph.parker.com/us/en/product-lis ... ech-series - no NW18, not able to find supplier

Many of them can be found in Alibaba etc

From what i can find these connectors should be used also by BMW, Honda na VW So there needs to be suppliers and after market for these for sure i am maybe just using google wrongly (



Edit:
I was able to find identification of connector on internet, FIP NW18-90 PA66. This is not bringing any details at all. From part number we can be sure that it is not tesla part as it doesnt follow tesla usual part numbers. After some googling i suspect that FIP means FRÄNKISCHE Industrial Pipes (https://www.fraenkische-ip.com/en/produ ... automotive) but there is minimal info on their page and also no supplier (
davefiddes
Posts: 375
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 149 times
Been thanked: 195 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

Jack Bauer wrote: Thu Jul 17, 2025 1:44 pm So one things that needs addressing is the resolver vs pwm frequency.
It has been my understanding that Tesla run 10kHz PWM and that this is synchronous with the resolver. A quick sanity check with some YouTube videos of people running M3 drive units on the bench seems to show a clear peak at 10kHz when analysed in Audacity. Somebody will no doubt prove me wrong at this point...

The C2000 really wants to have all it's PWM and ADC slaved off a single PWM module. I'm sure I've not done things the way that Tesla have but things work quite nicely for me with the following clock-synchronisation chains:
  • EPWM1 -> EPWM4 -> EPWM5 -> EPWM6
  • EPWM1 -> EPWM4 -> EPWM7
EPWM1 is the master clock in this case. To keep the fixed-point maths from stm32-sine working I have to run at 12.207 kHz. The resolver works fine at this frequency but it has a lower response than at 10kHz. 8.8kHz is similarly reduced response but it tails off very quickly as you have discovered.

EPWM4 inserts a phase delay to pick the optimum sample time for the resolver which is affected by the analogue filtering Tesla use. This is also when the phase currents are sampled at theoretically the optimum time (the centre point of the PWM cycle). The main PWM outputs are EPWM5, 6 and 7 which are all high-resolution units.

FWIW.
User avatar
Jack Bauer
Posts: 3831
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 75 times
Been thanked: 696 times
Contact:

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by Jack Bauer »

Thanks Dave. 10KHz pwm makes sense. Hope to be turning wheels in the car in the next few days.

Also think I may have found the coolant connector : https://www.aliexpress.com/item/1005007457411094.html

Bought one of each straight and 90 degree to test fit. Will report back.
I'm going to need a hacksaw
davefiddes
Posts: 375
Joined: Mon Jan 18, 2021 12:39 pm
Location: Edinburgh, Scotland, UK
Has thanked: 149 times
Been thanked: 195 times

Re: Tesla Model 3 Rear Drive Unit Hacking

Post by davefiddes »

Had a rummage in the garage. The Tesla hoses use 90-degree fittings marked:

FIP-NW18-90°-3
>PA66 GF30<

and straight fittings marked:

FIP-NW18-180°-1
>PA66 GF30<

The dimensions on them match the connectors from your AliExpress listing in as far as they go. I think you're in with a good shout.
Post Reply