openinverter forum

bitMuse wrote: ↑Sun Mar 26, 2023 10:55 pm This is a different type of hacking, but unlike many others in this thread who have come, said a thing, and then vanished forever, I have gotten quite a bit further.

I'm exploring the boundaries of what can be done with hardware alone. While I have the motor spinning normally using an off the shelf solution, I am working to trick the motor into running in reverse like a lot of the LDUs have for Model S.



With the very limited space inside the motor I have designed in CAD a way to cross two of the bus-bar linkages for the AC feeding into the stator. I need to modify the oil seal housing next, but I'll be getting these milled out of copper here soon.

My 3D print shows the bus bar linkage SHOULD fit in the motor, but I will have to cut the leads to 35mm, so it's a one way ticket to destroying this motor. Should be fun.



I'll be reversing the resolver pins too which is the easy part. If nothing else this should be entertaining in the line of model 3 RDU hacking to see what's possible. It's a crude solution.

EV_Builder wrote: ↑Sun Feb 25, 2024 6:24 pm Maybe this is something for in the wiki?

kraln wrote: ↑Mon Oct 23, 2023 2:19 pm The Model 3 drive units are cryptographically paired with the VCSEC. Without the appropriate handshake, the inverter won't budge. Ingineerix and EV Controls collaborated on breaking (or going around, still not clear to me) this handshake, but they aren't willing to share--the stated reason is: "obviously giving out code to bypass this would be bad as then once it gets out people can use it to steal cars". If it involved extracting key material from the onboard microcontroller in the inverter, then it'd also likely pose a legal challenge to share it, but I don't want to guess.

I am however, nevertheless, also extremely interested in driving a Model 3 RDU without modifying any hardware. I'll dig through your CAN logs (and some I have access to here...). Feel free to reach out to me if you'd like to collab.

P.S.Mangelsdorf wrote: ↑Tue Oct 24, 2023 12:42 pm My understanding, and I could be wrong, is that it is less a "pairing" and more a encrypted call and response between the drive unit and other computers in the car. No one has (open source anyways) broken the encryption. Even on the LDU and SDU, when the call and response was implemented, the commercial conversion solutions required reprograming the inverter to an earlier firmware without it.

There might be some sort of initial key provided when vehicles are programmed at the factory to tie the computers together, but I have no idea, it's way above my head.

Also, and feel free to not answer this, but how in the world did you get a zero mile drive unit? I thought Tesla didn't sell those? Did it "fall off a truck"?

MartinN wrote: ↑Tue Feb 27, 2024 2:01 pmIf so, is it likely that I could get around this by listening to the interaction between the VCSEC/IDU and playing it back with my new drive unit?

dimonlipko wrote: ↑Sun Apr 14, 2024 1:07 pm Yes, I can make CAN BUS log from my M3 with fresh software.