A Target Rich Environment – Tesla Reverse Engineering

The Tesla Drive Unit continues to shock and awe – at least us in the shop. And of course, no sooner had we posted the last video than our “Jack Rickard wannabes” sprang to action to note METOO so it is genuinely an area of interest.

We did learn a bit in dismantling the drive unit quite beyond what we’ve done before. Frankly, I was treating it as a black box. Doug Yipp kind of drew us into an examination of the differential. His interest was racing performance and ours more safety. Let me again reiterate that if you DO get a drive unit working, stepping on 350 kw at 35 miles per hour with the open differential in the drive unit IS going to result in a launch from pavement into wooded glen rather inevitably. We have NOT tested this but it is my belief that the Quaiffe Automatic Torque Biasing Differential will address this in Bristol fashion.

The growl has drawn us in a bit further. Jarrod Tuma and a few others have correctly corrected my explanation of the voltage differential between the rotor and frame causing current leaks in the bearings. IF I understand this correctly, it is more a capacitive issue between the common mode voltage on the stator and the rotor – resulting in a significant difference in potential between the rotor and ground. And as the only connection between rotor and ground is the bearings, there you have it. The brush bearing does indeed appear to be there for grounding purposes. Yet we growl.

Jehu Garcia posted a marvelous video announcing EVWEST’s initiative to develop their own open source controller board for the Tesla Drive Unit. Wouldn’t that be marvelous? As always, Jehu is a little in the weeds technically and factually. It APPEARS that this is Michal ELias long awaited Universal Motor Controller board, thus far NOT open source. And of course EVWEST is developing nothing. But this may be a California alt-left libtard thing that I just don’t understand. Elon Musk seems to subscribe to it. If somebody DOES develop something interesting, and you buy it and incorporate it, then in some sense YOU developed it having had the astute sense to incorporate it. I get it. Cool.

Mr. Elias actually promised us almost immediate delivery of the UMC three years ago. So his timeline management isn’t even as good as Elons, which is famously poor. And even there, the self aggrandizing “I invented a sensorless Universal Motor Controller board is slightly overwrought as well. Texas Instruments introduced a chipset and a reference design to do just that, which appears to be mostly what the UMC is.

All that said, I personally think it’s a great idea. Actually I thought so three years ago But in this application, perhaps more so. Actually what he is talking about now is a little different. A simple CAN controller much like ours but instead of delivering drive units, he flashes the memory of the existing Tesla inverter control board with a known compatible firmware version. In this way, changes to the firmware cannot effectively disable the CAN control or require rework of it.

Most of these FLASH memory controller chips have some sort of “fuse” that can be blown once it is flashed. This is deliberate to prevent people from downloading the firmware in the chip. But it is always optional. And it appears Tesla elected not to set it. Of course once it is set, you also cannot reflash it, and so it is actually pretty common not to set it.

Without doubt, Tesla has the ability to replace the firmware in the drive unit control board via CAN. And indeed there is a bootrom in the multicontroller on the Tesla inverter control board. SO my first choice would be to be able to flash the drive unit over CAN.

Jason Hughes and Michal Elias are rather desperate for us to be stuck in LIMP mode. Indeed, they are telling anyone who will listen that we ARE stuck in limp mode, having no information on what we are doing at all other than what they see in the videos. Their motive here does not seem to be furthering electric vehicles but again – self aggrandizement without apology. They have offered no solutions. Simply accusations based on fantasy.

But we did come across a more recently manufactured drive unit version that indeed would go into drive and reverse and neutral but did not develop any power to speak of when we put on the throttle. It was really lame. And so I assume similarly “limp”. And that was the drive unit we swapped the DOKA inverter into, leaving the remaining DOKA drive unit as the one we disassembled to find the growl – and as it happens in this video to diagram the cooling system.

But that also leaves us with the more recent inverter which we do show in this video. Curious, we took it completely apart. I should have shot a video of this. But it started at taking a peek with a couple of screws and we just sort of accidentally kept at it until it was all in pieces. Opportunity missed I guess. Some photos.

One surprise that wasn’t really a surprise, but is surprising is that the power switching electronics eschews the current fashion in largish very integrated modules such as SkiM in favor of the very common TO247 transistor package. Of course that then requires a number of them for each phase. Again, I have to admire Tesla’s engineering. The TO247 allows them to array the switches along the length of the designed coolant tubes in very Bristol fashion. And so coolant flow per unit of package heat sink area is really quite well optimized in a still very compact package. Comparing the size of this inverter to the DMOC645 or UQM’s behemoth it is a marvel. But three coolant flows going both directions through the heart of the package. Really quite cunning.

The current sensor is also very interesting. They have copper bars as current carriers befitting the high current levels (up to 1350 amps in some of the later models) required for each phase. Two of the phases have current measurement devices. But again, a little designed circuit bridging a manganin metal bridge in the copper bar performs the necessary current sensor duties.

And of course the most interesting part is of course the control board. All the external communications and throttle signals and encoder signals come through the AMPSEAL connector directly to this board, which then drives the power switching circuitry. The brains of the operation.

The task of figuring out the CAN bootloader is a little ambitious. But the multicontrollers on the board feature two 14-pin JTAG connectors. JTAG is the Joint Action Task Group and many years ago came up with this shortcut connector to directly access pins on a chip for programming purposes.

And so, after examining the pile, we sacked it all up and shipped it to Collin Kidder in Sparta, Michigan. The mission is to see if we can download the firmware from these chips, and subsequently reflash it onto these chips. If so, we could download one from one of our working drives, and reflash this later manufacturer “limp” inverter back into useful duty.

Actually, Collin has test benches in Sparta and of course has Siemens motors there. The common Siemens motor we have sold for years out of the Azure Dynamics bankruptcy is actually a pretty sturdy 100kW AC induction motor. And so I’m thinking this inverter could be resurrected, connected to the Siemens, and perhaps with a bit of encoder modification, be made to serve as a Tesla test bench without the Tesla motor.

The actual chips used on the Tesla inverter control board are heavily ensconced in a protective conformal coating. This inures it to the vagaries of weather but also has the added feature of totally obscuring the part numbers on the chips. But Collin has already dug into the board and identified the rather expensive Texas Instruments chipset used.

Note that one of the three chips identified thus far is the MicroSemi ProASIC3 A3P125. FPGA’s are Field Programmable Gate Arrays. Early computers were basically logic devices based on AND gates and OR gates and NAND gates and NOR gates and logic inverters etc. I guess modern computers are as well deep in the die. These chips provide massive numbers of them and allow you to write code to configure them in various ways. Picture a hardwired application specific computer. The advantage is that it is lightning fast at performing very defined logic and switching tasks. Tasks such as desaturation detection mayhaps?

The Texas Instruments chip set consists of the TMS320F2811PBQ Digital Signal Processor and the TMS320F280PAGQ Piccolo Microcontroller. Each are gratefully equipped with 14-pin JTAG connectors. We are more likely to find the code of interest of course in the Piccolo Microcontroller – the smaller of the three chips. This is the brains with the DSP and FPGA providing the brawn of the design. (I’m making all of this up, but I’m pretty good at it. Better to baffle you with bullshit than try to dazzle you with brilliance).

Recall, if you will, our battery work of just a few weeks ago. Jarrod Tuma had a kind of stalled out HACKADAY project to reverse engineer the BMS boards on the individual battery modules of the Tesla. On our announcement of our project, which referenced his earlier work, he was reinvigorated on the project and so we collaborated with him on this project.

Not certain what eventually comes of that, but for the present, seeing this video Tuma contacted us to note that he actually works in Oregon for a company doing Inverter design work. I think we even gave a shout out to the company in our battery coverage. He further noted that IF a junk inverter was to be found at EVTV, he would graciously accede to receive it and store it properly in his garage.

While Tesla drive units don’t quite grow on trees around here. As it so happens, I did get taken on a drive unit that had obviously been flooded and apparently blown up as well. SOmetimes good things come from bad behavior and experience. I’m personally wounded that anyone would be so dishonest as to deliberately sell me a damaged inverter and gleefully take off with the money, on the other hand…. We learned a lot from THAT mess as well. And so we have shipped the inverter to Mr. Tuma.

In all honesty I expected the battery project to go on for months. And indeed, properly putting together an actual device you can use is going to take a few weeks. But the reverse engineering fell into place with almost alarming speed. And so I agreed to forward the inverter in exchange for Mr. Tuma’s continued collaboration on the drive unit. The inverter is a mess. But the control board is likely operational, if a tad encrusted with crap. He is busy with the conversion of a 95 Mitsubishi Eclipse and is reverse engineering the Zytek drive train out of Daimler’s SMART ED. Our buddies at Illuminati Motor Werks are involved in that project as well. Indeed, I think EVWEST sent me one of those and I sold it to Nate and Kevin. Or maybe gave it to em. I disrecall. I personally think it’s a dead end. But at $400 a drive unit, an inexpensive one.

In any event, we are hopeful of his participation at least at the kibitz level with our firmware flashing project. And we may have hidden ambitions regarding a perhaps slow and laborious disassembly of the firmware code itself.

Disassembly of the firmware in the inverter control board is non-trivial. This is not 8051 code. Indeed it is one of the most advanced embedded processors out there, and pricey at that. I think they’re about $32 each in single quantities. But there are those that like to do disassembly as an exercise. Having done some, I’m not one of them. But if you are, we’d be pleased to add you to the hack team. I probably am old and senile at this point, but if I can enable some young tech stallions to carry on the work, might be good things to come of it for all.

If you are all into self aggrandizement and overawing the aborigines with your hacker magic, posing as an expert and one upping anyone you can find in a forum to listen, you probably won’t be happy with us. But if you sincerely want to further the EV and custom EV DIY end of the world, and enjoy the process and learning along the way, do contact me. No Tesla employees please.

Similarly, in this episode I introduce the Tesla charger. We have for several years done a brisk trade in Chevy Volt chargers. This is actually a charger made by Lear and it was used in the Coda automobile. We obtained some after their bankruptcy. With different firmware it was also used in the Chevy Volt. We decoded the CAN messages needed to set the termination voltage and current. Actually the bare minimum required.

And have then sold them as an inexpensive but very high quality and durable 3.3kw charger – slightly more powerful than the Brusa we had sold and somewhat less expensively.

We have accumulated 10 of the Tesla Chargers intending to do the same but have never really had time to fool with them. I guess we still don’t. But I have one wired up and I’m playing with the CAN and the startup sequence of what has to be hooked up first and before the other thing, which then enables the third thing etc. etc. I get these chargers for $400 or $500 because they are totally useless boat anchors. Nobody has made one work that I know of. It is only rarely they show up. Generally they get SHREDDED with the rest of the car that can’t be sold off in the salvage parts market. Which is a crying shame. It’s a GREAT charger, 11kw in a very efficient and compact package. While I don’t know the current architecture, in the early Tesla Supercharger stations they simply had a dozen of these things stacked up inside running on 3phase.

It’s actually very versatile, effectively working on any wall power commonly available in the world. I suspect it would work on a DC input as well up to a point. It’s 336% more powerful than the Volt charger. And so it would charge any EV from 50 to 430 volts in less than 1/3 the time.

But like everything in the Tesla, it is very tightly integrated with the MCU gateway, the BMS, and even the EVSE on the wall. And as always, so many projects, so little time. Plenty of bizarrely bad advice, and so little actual help. I actually had a man comment on this video offering us the condescending and very knowledgable expert advice on what kind of LIGHT BULB to put in our drop light. Thank you. I didn’t know any of that. Look at me.

I shouldn’t complain. Actually many viewers are quite generous and much more knowledgeable than I. We recently hosted a visit from Randy Lee of Toronto. Randy has a CNC machine shop there and built us 3 sets of stub axles with VW flanges for the DOKA. Very high quality. And so Bill Bayer, in this episode, installs the Tesla Drive Unit and axles into the DOKA using Randy’s pieces.. A very different kind of build with no transmission.

Some yet to go I guess. But I heard an airplane roaring under the DOKA this week and I can only assume a cooling system is going and that indeed the radiator fan in the DOKA is a monster. Even using the wrong drop light configuration, this build is getting very close.