Tesla Model 3 US – LTE modem replacement (And some reverse engineering)

Recently I bought a used Tesla Model 3 delivered from the US. It was an excellent deal. The car is in great shape and condition. Since I’m in Europe, there are few nuances with this car. One of them is an American LTE modem. American and European LTE frequencies are slightly different; that’s why the original modem is not working properly here (only EDGE, which is awful). Here I will show how I replaced the original modem with a European version + some details about the actual Tesla modem 🙂

The modem is a separate board installed in the car multi-media computer (MCU). I don’t know much about Model S and Model X, but for Model 3, there are currently two options for the MCU. Version 2.5 was in 2018 – 2019, and version 3.0 since 2019. My car is equipped with MCU version 2.5.

Both computers are mostly backward-compatible, but there is a difference in the modem PCB design and fastening.

MCU 3.0 modem is compatible with MCU 2.5. All required holes are in place.

Currently, all European modems are 3.0 style. However, there is a single major difference between American and European modems. eCALL connector (European emergency service call) is no used in the American version, and actually, there is no room for this connector (in the American MCU).

I know that someone is drilling a hole in the MCU cover, but I preferred to remove the eCALL connector at all.

Modem overview

Tesla modem is based on the big integrated module from Telit. Currently, there are different models for different markets.

Let’s take a look at the board.

88EA1514 is an automotive version of the 88E1514 “Alaska” Ethernet PHY. This chip is used for data (from/to the internet) communication with the MCU. Interestingly, they are not using actual Ethernet. All analog pins are not connected. Instead, there is an SGMII Serializer/Deserializer (SerDes) in this IC. The SGMII pairs are used to communicate with the MCU board.

The voltage regulator is automotive class LM53625 configured for 3.8 volts output. The Telit module requires this unusual voltage value.

Now the most interesting part. The Telit module is a complex device on a separate board with multiple ICs. Let’s remove the shield:

This module runs its own operating system and has a bunch of interfaces. At least, Tesla is using Ethernet, UART (for AT commands), control signals. Not sure about the audio interface, probably not.

There is an eSIM chip on the backside of the board. Actually, it’s just a regular SIM in a regular IC package.

This eSIM contains a phone number known for Tesla. Every eSIM number is associated with the actual vehicle. Tesla uses this information for the remote car wake-up (using SMS) when accessing mobile applications and mobile internet charges.

Sure, it’s a cool board, and I would like to do more reverse engineering of this device. Probably there will be more articles. Now let’s focus on the modem replacement.

Preparing the modem

The first important stage is to replace the eSIM chip with a regular SIM card of a local mobile operator.

The eSIM chip can be easily removed with hot air and a bit of flux.

The regular SIM card can be connected directly to the eSIM pins. Here is a wiring diagram:

I decided to create a small SIM wire-extender with a standard SIM holder. This holder can be mounted outside the modem/MCU for easier access.

The extender wires were soldered and secured with hot glue and Kapton tape. Now the modem is ready for installation.

Please note that there is an additional SIM card slot directly on the MCU board. In some software configurations, this slot is used instead of eSIM.

SIM card is installed with a cut edge top. This slot is placed directly under the modem. SIM contacts are directed to the back of the card. Pushed up to the click.

To remove this SIM card, push to the SIM with some tool like a plastic screwdriver.

eSIM/SIM configuration is changing with a Tesla proprietary instrument Toolbox. It was a stand-alone desktop program. Now it’s a web service. No further details at this point.

Modem installation

The first step is a complete shutdown of the vehicle. Go to the main menu/Safety & Security and press “Power Off”. Then don’t touch any buttons/pedals and display.
For safety reasons, open the windows and left open both right doors. If you close the doors after the shutdown, it will be tough to get inside the car…

Next, remove the plastic cover near the front trunk and disconnect the Negative terminal of the 12 Volts battery.

Then pull up and remove the back passengers’ couch and disconnect the high voltage battery.

The most complex task is to remove the front passenger airbag and the glove box. Sorry, I don’t have a lot of photos at this stage.

There is a simple plastic panel at the bottom of the glove box. There are light and ventilation holes on this panel.
The plastic panel can be extracted by removing 4 plastic clips. I used tweezers for this operation. Over the plastic panel is the passenger knee airbag.
It’s a big plastic-metal panel secured with two self-tappers and four 8 mm screws. Please hold the airbag panel and don’t let it fall.
Then gently disconnect the two-wires airbag cable.

The glove box is holding with five self-tappers. One is under the plastic cover on the right side, and four are under the top decorative panel. Those self-tappers can be easily unscrewed when the glove box is opened. Then pull the glove box, and the whole construction should come out. Please note that there are two wires connected.

Then locate four nuts on the front left of the car, under the hood. Let lose those nuts, but don’t remove them completely.

Now, the MCU can be accessed relatively easily.

The original 2.5 MCU modem is easy to remove. Just unscrew one screw on the modem metal bracket and pull down the modem just like an expansion card.

For the MCU 3.0, the whole aluminum cover should be unscrewed. At least the bottom part, don’t afraid to bend this cover.
In any case, the aluminum cover should be unscrewed for the new modem installation.

The new modem is pushed into a slot and secured with two screws (at least).

I placed the SIM holder on the aluminum cover. It can easily be accessed without disassembling everything.

Now, assemble everything back and connect the batteries in reverse order. Press the brake pedal; MCU should boot up in ~30 seconds. LTE should be available in a minute.

Winner winner chicken dinner!

Thanks for reading!