Jason Hughes, who become a celebrity of sorts, after a few rounds hacking the Tesla Model S (most famously revealing the "P100D" sign in the Tesla 7.1 firmware), recently put his efforts into exploring/"hacking" a salvaged Model S rear drive unit.
According to the description, it only few hours took to take control of the motor:
"Received this motor this afternoon. First one I've gotten my hands on, finally! :)
From scratch, got it spinning this evening. Took me longer to get it down here to my work area (waited on some help... this is heavier than it looks) than it did to get it actually get it hooked up and to decipher the data needed and write the software that makes it spin. Still some work to do in that area to make everything nice and functional, but the hard stuff is done. I've had the unit in my possession for about 12 hours, many of which were spent out running errands and other unrelated stuff.
From the time I had it physically in place and hooked up to the time I cracked the needed CAN messages and their structures: less than 3 hours.
Oh, and the motor was pulled from a car with firmware 7.1, so has the latest security items that would normally prevent this sort of thing... ;)"
...and few hours more to take full control:
"Spent a few more hours with this beast. Hooked up a little cooling loop just to make sure I could run it a bit harder without fear of damage.
Took it up to 13k RPMs (which showed at 117 MPH in the CAN data).... got grease from the hubs everywhere...
Got regen working and working well.
I can set the maximum regen and discharge currents and power, as well as the max regen output voltage... definitely important since this might not be used with exactly a Tesla pack. Wouldn't want to over charge the battery pack.
Basically finished with the figuring out part. Now I need to make a cheap box that does all of the control and hook it up a an LCD or something and it's a done deal. Probably will use the Tesla instrument cluster for an instrument cluster. :)"
“My next step in the drive unit hacking process: Getting it to work completely with a custom standalone controller.
So, I built this one on perf board from scratch.
Works quite well so far! :)
LM - Limp Mode, NP: No Power, NB: No BMS detected (all 0's = good).
Forward, reverse, and neutral. What more could you need? :D
In my code I have the maximum amperage set pretty low (50A regen, 60A power) just to keep things a little sane on the bench.... for now.”
It's not the first time that Tesla Model S drive units were awakened to life this way. Michal Elias did it nearly year ago, however he used only the motor and his own controller.
An ongoing project to commercialize salvaged Model S drive units is presented by the EVTV.
source: Tesla Updates