Tesla Model 3 Rear Drive Unit Hacking

[GuyH]

@bitMuse - have you had any more progress on the switching cables & the resolver pins? - working on a similar project here at the moment.Working with Ingenext and their controller as well.

Thanks

This is a different type of hacking, but unlike many others in this thread who have come, said a thing, and then vanished forever, I have gotten quite a bit further.

I'm exploring the boundaries of what can be done with hardware alone. While I have the motor spinning normally using an off the shelf solution, I am working to trick the motor into running in reverse like a lot of the LDUs have for Model S.



With the very limited space inside the motor I have designed in CAD a way to cross two of the bus-bar linkages for the AC feeding into the stator. I need to modify the oil seal housing next, but I'll be getting these milled out of copper here soon.

My 3D print shows the bus bar linkage SHOULD fit in the motor, but I will have to cut the leads to 35mm, so it's a one way ticket to destroying this motor. Should be fun.



I'll be reversing the resolver pins too which is the easy part. If nothing else this should be entertaining in the line of model 3 RDU hacking to see what's possible. It's a crude solution.

[bitMuse]

Good question!

I moved across the country before I could get them made. Essentially the problem I ran into is I need them machined as I lack the tooling. I contacted a couple places but they never got back to me. I started looking into sintering services, and theeeeeen I moved across the US. Now I have JUST arranged to have a place to work, but the car and motor are elsewhere having other repairs done while I work on the traction pack.

So suffice to say.. I haven't made much progress beyond confirming that the model DOES fit. And it SHOULD theoretically work. I am happy to share the model for free.

https://www.dropbox.com/scl/fi/a6hz1s71 ... r5fd9&dl=0

Here's the file for the bus bars. Totally open source, providing with no guarantees.

[dimonlipko]

I think, that good idea is use Tesla VCSEC and OEM inverter. In last software in service mode, available function change rear motor, so i think that it will be not hard to pair VCSEC to inverter. Next step is only send other CAN message from car to spin motor.

In Ukraine i see solution to write new key in VCSEC via CAN, without old key. So steal M3 is not to hard)))

[AMP3R]

According to this table does it mean that 3D7 has a "full mosfet" inverter? Not like old 3D5 without 3 mosfets?

[AMP3R]

I have the possibility to buy a 3D7 motor from MY 2023 for 800 euros with a broken rear mount. Is this a good price? How to check it with a multimeter for broken mosfets? Or are there no problems with inverters in this generation of motors?

[EV_Builder]

Always best to measure it; at least you are best informed then.

This is what I would do:

Get to the motor phases and measure between them for Ohm.
Between each phase and housing. Ohm.

Diode setting on multi meter between battery positive and each phase. Red leg on battery positive / black on each motor phase.
All should be endless.

Then reverse the Pens and measure IGBT forward diode per phase.

To check negative side red leg to phase and black to negative battery.

Final check : diode setting red pen on batt + , BLK on bat - and confirm voltage buildup and endless will pop-up on your multimeter.

Please correct me if I'm wrong guys.

Maybe this is something for in the wiki?

[johu]

Maybe this is something for in the wiki?

The quick check is already described: https://openinverter.org/wiki/Electronics_Basics

[MartinN]

The Model 3 drive units are cryptographically paired with the VCSEC. Without the appropriate handshake, the inverter won't budge. Ingineerix and EV Controls collaborated on breaking (or going around, still not clear to me) this handshake, but they aren't willing to share--the stated reason is: "obviously giving out code to bypass this would be bad as then once it gets out people can use it to steal cars". If it involved extracting key material from the onboard microcontroller in the inverter, then it'd also likely pose a legal challenge to share it, but I don't want to guess.

I am however, nevertheless, also extremely interested in driving a Model 3 RDU without modifying any hardware. I'll dig through your CAN logs (and some I have access to here...). Feel free to reach out to me if you'd like to collab.

My understanding, and I could be wrong, is that it is less a "pairing" and more a encrypted call and response between the drive unit and other computers in the car. No one has (open source anyways) broken the encryption. Even on the LDU and SDU, when the call and response was implemented, the commercial conversion solutions required reprograming the inverter to an earlier firmware without it.

There might be some sort of initial key provided when vehicles are programmed at the factory to tie the computers together, but I have no idea, it's way above my head.

Also, and feel free to not answer this, but how in the world did you get a zero mile drive unit? I thought Tesla didn't sell those? Did it "fall off a truck"?

Can anyone provide any good sources of info regarding the inverter "pairing"? Most of the discussion seems to be about using the Tesla motor in alternative applications, and how it is unusable with other controllers, but I'm working on a project where I plan to replace the existing drive unit of an M3 with an alternative inverter/motor and I'd like to retain compatibility with the rest of the Tesla architecture. Is the VCSEC likely to block this at the vehicle end? If so, is it likely that I could get around this by listening to the interaction between the VCSEC/IDU and playing it back with my new drive unit?

[AMP3R]

What are the chances that the pyrofuse didn't break 2 phases in the inverter of 3D7 motor whose rear mount was torn off?

[EV_Builder]

If so, is it likely that I could get around this by listening to the interaction between the VCSEC/IDU and playing it back with my new drive unit?

Easy to check I would say. Why not check?

[AMP3R]

Hello. Now I have a 3D7 drive unit, "go" pedal, keycard and matching VCSEC from the 2023 Tesla MY.

Today I've checked, how the pedal works. And it works fine.

Tomorrow I want to connect the VCSEC module to the vehicle can bus of the drive unit and fingers crossed it will appear the message DI_immbilizerState: DI_IMM_STATE_DISARMED.

Unfortunately I have the can logs only from 2019 M3 Perf and very old model 3 can dbc file. It seems to me that my motor has newer software and nothing is going to happen.

[johu]

Good luck! Various proprietary solutions exist, would be nice to have an open source one

[AMP3R]

I wired the VCSEC with Vehicle can bus of the drive unit and nothing happened like I had guessed before. Need help. Maybe can logs from fresh M3/Y?

[dimonlipko]

Yes, I can make CAN BUS log from my M3 with fresh software.

[AMP3R]

Yes, I can make CAN BUS log from my M3 with fresh software.

I would appreciate it.

[AMP3R]

Applied 309V DC to the inveter but in Savvycan is only 154V? Why?