Hacking The Tesla Model S Rear Drive Unit

[Jason Hughes] is a big fan of Tesla, he’s spent a lot of time hacking on them to figure out what fancy things the automaker is up to. His most recent adventures are with the rear drive unit of a Tesla Model S.

[Jason] has had some fame in the Tesla community before; his most publicized hack was finding the model number for Tesla’s next edition of their car hashed away in the firmware. For this project he procured a rear drive unit from… somewhere, and with some help got it onto his bench at home.

His first steps were to hook it up to some power and start sniffing the CAN bus for commands. It took him a few hours but he was able to get the motor turning. He kept working at it until he had the full set of commands. So, he hooked up circulating water to the unit for cooling, and put it through its paces (at one point the unit announced it was now traveling at 117mph).

In the end he was able to get all the features working, including generation! He even made his own board for contrl. Just listening to the motor spin up is satisfying. Videos after the break.

37 thoughts on “Hacking The Tesla Model S Rear Drive Unit

    1. Gasoline would be preferable to diesel. And yes PHEV are one of the best concept for a less-consuming-and-polluting car but… Business must go on and we still have a shitload of gas to sell !

          1. Look at the VW crossblue, I am pretty sure after the scandal it has re-morphed into the Audi Q7 diesel / elec hybrid… actually makes sense… yes NOx is bad and all, but imagine a diesel running constant rpm charging batteries for those who drive daily in stop and go city traffic. depending on how I drive my TDI i can get 50 mpg or 30 mpg to work in city traffic… If I took it easy with a diesel elec hyb I bet I could manage ~ 65-70 mpg… or totally smoke the snot out of everyone and get 20 MPG and spend 10 minutes at every red light…. or go fast enough to beat them all… but 120 mph on a 45, with my kids in the backseat, might get me some pretty silver bracelets.

      1. Do anyone have the numbers for the S model? I would like to know the Watt hours / mile! It bothers me that the range is so poor. Old lead acid battery electric cars could go 60-100 miles on a charge. A tesla with Li-ion cells should go 300-500?

        1. Cars these days are heavy like tanks which uses more energy to move them. If you do a search you can find that and i believe the Tesla console displays this also.

        2. [q]Old lead acid battery electric cars could go 60-100 miles on a charge. [/q]

          They couldn’t, especially not in cold weather. The posted mileages were an artifact of the lacking testing standards and requirements because you can hypermile an electric car like you can a regular car. The EV1 for example had a 16.5 kWh battery, as compared to a Nissan Leaf with a 24 kWh battery, and neither car actually goes a hundred miles on a charge but in special conditions. The further trouble with lead batteries was that the discharge efficiency dropped to around 50% with any sort of high load, so putting your foot down would halve the range.

          Put otherwise: the long range of lead acid EVs were a combination of wishful thinking and hype in advertising.

          Ten years ago when the modern lithium electric cars started coming out, you would see manufacturers boast all the way up to 200 miles on a lithium battery, and real world tests turned it down to about 75. Why? Because the manufacturers chose to apply really easy testing regimes like the 10-15 where the average speed is 22 kph. After a certain minimum, the energy use per mile increases roughly proportional to the square of the average speed, and so in real driving the drain on the batteries was roughly 2-3x what the tests let you believe.


          And you can add another 2x for bad weather and cold temperatures thanks to heating demands, which is something that was completely neglected with the early electric cars because the whole 90’s electric car boom happened in sunny California.

    1. Absolutely awesome! This guy obviously knows what he’s doing! And the cost was not bad at all (at least excluding work hours…)
      This makes me wonder what will be possible regarding future mods of electronic cars! I came wait to see what’s next!

  1. Yay Tesla. It would be really cool to look inside the inverter residing next to the motor. Nobody has teared it down yet. There are teardowns of the the roadster inverter but not the Model S. It would be really interesting to see what kind of power electronics can pump 1000 amps into the motor (1200A in case of ludicrous mode)

    1. Doesn’t it rather depend on whether the bus is share (and if so with what)? I wouldn’t want it on the same bus as ICE, but both axels and battery management should be fine for example.

    2. The gas pedal has been completely electric for quite a few years now…
      I for one want complete mechanical isolation (would make a lot of things easier), but only if the CAN is not shared with the entertainment system.

      and btw – ALL new big airliners are fly-by-wire and have been for pretty much over 2 decades now.

      1. Yes, airliners have been FBW – but only Airbuses are fully fly-by-wire. Boeings are not and it is a major selling point for some clients. Also you are certainly not prepared to have your car serviced with comparable rigor and frequency as airliners are. Heck, many people find it too expensive/annoying to have their oil changed once a year. Now imagine if you had to have you car checked for safety every few months, because if a brake pedal sensor or steering conks out, you are dead.

        If your gas pedal breaks on today’s car you can still steer and stop the car, so it doesn’t quite compare. In the case of airliners, most have all critical system double-triple redundant, both electrical and hydraulic, often with a non-computerized fallback as the last defense (i.e. the yoke or trim controls drive the hydraulics directly should the computers die for any reason). That’s not going to happen on a car, nobody would pay for that.

        A fully drive-by-wire car would be an immense boon for the manufacturers – among other things it would completely eliminate 3rdparty garages/service (or reduce them to changing tires) Even today, if there is a problem with the electrics, most garages will shrug and send you over to the dealership, because they simply don’t have access to the required diagnostic tools (or they are so overpriced that it doesn’t make sense for them economically).

        I am not a-priori against the drive by wire, but not in the current “system”. The manufacturers today are impossible to trust to both not abuse their monopoly of information about how the car works (John Deere even claimed that farmers are not allowed to work on their tractors, because the firmware is copyrighted by them and tried to use DMCA to stop them) and to be sufficiently competent to not actually kill the owner of the car with their buggy software. In the situation where even the manufacturer often doesn’t have a clue what is going on inside of the various modules and control units that they have bought from a 3rdparty supplier, how can I trust the thing with my life? Just look at the serious issues that are being uncovered almost every day in the automotive systems.

        If someone like Mitsubishi is unable to make their ICE secure enough to not be a stalking tool and an attack vector, BMW’s keyless entry allows thieves to steal the cars with a $20 gadget from eBay, Toyota was causing crashes due to (among other things) buggy software for gas pedal, Jeeps could have brakes locked remotely (!) then why do you think your drive-by-wire car will not have issues like this – and on safety critical systems?

        1. bot Boeing and Airbus is fully fly-by-wire, the slight difference in philosophy is that in Airbus the computer will try to protect the plane from the pilot, Boeing just assume that the pilot knows what he’s doing

          1. A Boeing is built so that nothing a pilot can do with the controls (short of deliberately flying it into something) can damage the aircraft. Airbus’ design philosophy has long been to build to the design and no more. Look back to the Airbus crash in October 2001. The pilot was whipping the rudder back and forth, stop to stop. The tailfin could not withstand that and broke off. The manual for that plane says not to do that without pausing in the middle.

            In contrast, a Boeing is built to take that kind of abuse without the fin breaking off.

            When Airbus started their all fly by wire thing, they had a couple of computer contributed crashes at airshows. In one, a plane with just the flight crew aboard was landing when it was caught by a microburst and slammed into the ground. With the computer set in landing mode it would not allow manual override of the throttles. The other one, with passengers aboard, was doing a low flyby. The computer wouldn’t allow such a maneuver under its control. Rather than fly manually (they were demonstrating the autopilot’s capability) they set the plane into landing mode and did something so it wouldn’t touch down on the runway. As the plane went past the end, the pilots pushed the throttles forward and pulled back on the controls – the plane went “Nope! I’m landing!” and plowed into the trees. After those incidents, and some involving minimum power takeoffs, Airbus changed the software to always allow the pilots to have full manual override at any time. Pilots like to take off at full throttle so if anything happens the engines are already at full power. Airbus’ idea was to reduce noise and save fuel by having the engines set to produce just enough power to get off the ground – neglecting to account for sudden adverse weather phenomena, flocks of birds, stray aircraft or anything else a plane might need full power *right now* to have a chance to get through, around or away from.

      1. Many cars actually have. And they often have components that talk to several of those at the same time. Typically the dashboard unit that serves both to display car information and for entertainment. So all it takes is a bug in one of those and you are pwned.

    3. CAN is pretty bedrock reliable if you’re just using it to make a few critical systems talk to each other. And the advantage over analog signal transmission methods is that each end can decide if something’s gone wrong and shut down in case of a problem.

      Now, if they hooked that critical systems CAN bus up to, say, the car’s entertainment center, then THAT would be stupid. But nobody would be dumb enough to do that… right?

  2. So, he reverse engineered the API; that’s not illegal, but copy it before the DMCA hammer falls…
    (Because despite Google v decision, using an API designed for running a tesla model S motor to run a tesla model S motor is probably non-transformative)

  3. I think it would be interesting to see someone belt drive a lathe off of a tesla motor. cubans have fans running off of automatic window motors from cars or compressor motors. why hasn’t someone north of the gulf made an lathe out of an electric car?

  4. Hello, on my model Can-bus messages are not flowing anymore because of some wrong wiring. Pls let me know if I can fix it myself or can I give it someone to repair in usa? Tesla service does not do this.

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.