Chevy Bolt Motor Control Adventures

[collin80]

Got my Bolt inverter yesterday. Probably won't have a chance to take a look inside until Sunday.

I have a 2022 Bolt EUV. I also happen to know a bit about SavvyCAN and CAN reverse engineering. So, if you want to go down the CAN rabbit hole, I'm willing to help too. I can give captures of the full traffic on an EUV that is driving down the road.

Now, I'd love to look at the inverter firmware too. Technically one can do firmware updates on all the components in the car through GM's app so it could be possible to maybe do that and capture the traffic to try to decode that if getting it straight from the chip won't work. However, UDS firmware updates can be encrypted so that's a real possibility.

[P.S.Mangelsdorf]

I have a 2022 Bolt EUV. I also happen to know a bit about SavvyCAN and CAN reverse engineering. So, if you want to go down the CAN rabbit hole, I'm willing to help too. I can give captures of the full traffic on an EUV that is driving down the road.

I was just taking a look at your post on the Bolt forum yesterday; if you can share CAN logs without the identifying information, that'd definitely be a help. Have you done any digging into what messages are sent regarding actual control of the inverter?

I started to dig into mine, but don't yet have it at a point where I have anything to share. Hopefully will get there in the next couple days.

To be completely upfront, I barely have any idea what I'm doing here, so I'm trying right now to get to a point where I can share detailed photos of the internal components and we can figure out the best path from there. Figured I'll learn by doing.

[collin80]

Here is a log of the EUV driving around:



It seems kind of short. Here is a much longer one:


The Bolt is a GLOBAL-A vehicle which is a big head start. A lot of the generic GLOBAL-A messages are there on the bus and usually at least somewhat close to being conforming. There are places where the standard signals don't really make sense. But, it's a start. I don't know for sure what messages actually control the inverter.

That last capture is on three buses at once, one of which was the single wire CAN bus so there are a bunch of messages from the body control stuff and steering where in there. I think you can safely say the motor control messages aren't on that bus.

[P.S.Mangelsdorf]

Thanks, I'll try to take a look this weekend.

[P.S.Mangelsdorf]

Alright so I got my inverter torn just about as far apart as I want to go right now. I've basically taken the approach of "let's see what we can see, and take lots of photos." Here's what I've found:

First, here is the exterior, with the part numbers that I'm looking at. Who knows which numbers are actually the part number, thanks GM:

Once you pry off the lid (which has a very strong adhesive) it looks like this should be fairly simple to disassemble, but you'd be only partially correct. Yes, most of it is bolted in place, but the main 12V connection (bottom side of the image, black square) is soldered in after the board is installed, and must be unsoldered to remove the top board. The connections to the lower board are thankfully via a header, and no de-soldering is required there. Side note, fighting to remove this solder likely damaged some of the traces on this board, so unlikely I can play with the CAN logs on this unit.

Here are detailed photos of the upper board. Helpfully, they've even printed information on the board's fabrication on it.

Then there's the lower board. It looks like this can be unbolted, but once again, thwarted by soldering to the switching electronics below. But wait, can we unbolt those from the case, like we can the capacitor and bus bars? No, we cannot, as some of their bolts are covered by the lower PCB itself.

Here are detailed photos of the lower board.

In my uneducated opinion, it looks like we have a separate brain board and gate driver board, so maybe we can simply modify an existing Damien design to drop in place of the upper PCB. Anyone who knows what they're looking at, please chime in here, otherwise I'm going to have to actually go over the local community college and get another engineering degree to figure some of this out (only half joking here). If it would help to see the switching electronics, I can de-solder the lower PCB and pull it off. Also, if there's anything you see that I should probe/measure, let me know. I've recently gotten an oscilloscope, and I'm hoping to pick up a bench power supply soon. The joy of living alone is I can turn my entire guest room into an electronics lab for this silly hobby. I'm going to see what I can figure out from some googling and poking around, but I definitely am going to need some help with this.

[collin80]

Yes, the two boards are exactly as you described. One board does the master control and interfaces with the rest of the car. The other is a driver board that fires the transistors and reads current on the three phases. Those LEMs are high speed current sensors used for fine control of the motor.

And, yes, it is almost certain one could replace the upper board and leave the bottom driver board alone. This would require reverse engineering the pinout of the 20x2 connector on the lower right. There are six IGBTs to fire and each would have its own ground so that's 12 pins right there. Then probably desat for each of the 6 and some means of sending the three phase currents. 12 + 6 + (3 * 2) = 24 pins needed so far in my guess. Then you would also have power to drive things not isolated so probably two more pins for that. All in all, probably at least half of the pins do something.

Make no mistake, any path forward is a lot of work. To replace a board you still need to know what it did and how it worked. I have actually done this before though. I once reverse engineered an Azure Dynamics DMOC645 power section and used it to drive a custom permanent magnet motor by using my own control board. So, it's possible, it just takes some time. Basically you'd want to trace down the function of each and every pin in that 40 pin connector to see where it goes. It's fairly safe to probe around with a multimeter in continuity mode.

Another thing you'll want to do is try to determine the part # of every chip you can. It helps to take pictures from different angles to find one where the text is legible. Then try to get the pinout for the chips and see what makes sense for each pin. It's a long process but kind of interesting.

[P.S.Mangelsdorf]

Thanks! Good to hear I might have stumbled onto the right track.

Basically you'd want to trace down the function of each and every pin in that 40 pin connector to see where it goes. It's fairly safe to probe around with a multimeter in continuity mode.

Another thing you'll want to do is try to determine the part # of every chip you can. It helps to take pictures from different angles to find one where the text is legible. Then try to get the pinout for the chips and see what makes sense for each pin. It's a long process but kind of interesting.

I will start working on this, but likely not until next week. Headed out to Radford Racing School tonight, and not back until early Sunday. I'll try to take some photos before I go and study them on the flights, it'll give me something to do!

[P.S.Mangelsdorf]

Ok, I've made a little bit of progress, amid a bunch of other stuff going on. Let's start with the simple, I transposed over the pinout for the inverter module. (in the attached excel file with other Bolt pinouts)

It looks like the inverter is getting:

• 3 GMLAN Serial Data busses
• motor position sensor (4 different signals from the same sensor)
• transmission range switch signal (from transaxle/motor)
• Control and feedback for the aux transmission fluid pump
• Transmission fluid temp sensor
• motor temp sensor
• Positive
• negative
• run/crank
• wake up serial data

From the wire diagrams, it looks like the GMLAN busses have a 120 ohm termination resistor on each end. So I assume GMLAN is just GM speak for CAN bus - is that correct from what you've seen Collin?

[collin80]

It looks like the inverter is getting:

• 3 GMLAN Serial Data busses

From the wire diagrams, it looks like the GMLAN busses have a 120 ohm termination resistor on each end. So I assume GMLAN is just GM speak for CAN bus - is that correct from what you've seen Collin?

Yes, GMLAN is canbus. It's CAN with the GMLAN protocol which in this case is GLOBAL-A. GMLAN could also refer to single wire CAN which the car most certainly has. The obvious way to figure out which is which is that SWCAN is, well, a single wire. There is no CAN_H and CAN_L it's just one wire. Otherwise it's CAN but it runs at 33.3k speed instead of 500k.

[P.S.Mangelsdorf]

Yeah it looks like its only two wire CAN heading into the inverter. The only single line I see is the serial wakeup.

I have done some work digging into the part numbers of various components on the board and figuring out what stuff does what, but I haven't had time to put that all together to share here. Hoping to do so over the long weekend, but no promises. I'm a bit behind at work so getting that caught up comes first.

[P.S.Mangelsdorf]

Alright, some real progress (I think)

I scratched off the lacquer on a bunch of components, and got part numbers for them. They're in the photos below.

I also fed them into ChatGPT, to see if that would help track down information/teach me a bit about this stuff. Here's what it had to say:

FULL COMPONENT IDENTIFICATION (Using your PDF Markup)
1. MCU / Logic Interface: Freescale (NXP) — MPC5777C

Marking:
SGMPPC7361F8MVU 3N23A QFW2136H

This is an NXP MPC5777C, a 32-bit Power Architecture automotive MCU.

Specifically designed for traction inverters

Features dual lockstep cores, motor-control peripherals, safety functions

Loads of ADC channels

Built-in PWM modules for 3-phase gating

Often used in GM powertrain applications

This confirms GM did not use an external DSP — the MCU directly generates all PWM timing and reads the gate-driver faults and current sensors.

This will guide your replacement controller design.

2. Gate Drivers: Infineon 1ED020I12-F

Marking on PDF:
Infineon 1ED020I12FTA

These are Infineon EiceDRIVER™ 1ED020I12-F devices.

Key points:

26 A / 52 A peak gate drive capability (very strong)

Single-channel isolated gate driver

Designed for IGBT/SiC high-voltage modules

Has DESAT protection, Miller clamp, and soft turn-off

Reinforced isolation

~1200 V isolation rating

On this board, each phase has two of these —
one for the high-side switch, one for the low-side switch.

This means the Bolt inverter uses discrete isolated drivers, not dual-channel integrated drivers.

This also tells us each driver needs its own isolated power (which matches the transformer windings you observed).

3. Current Sensors: LEM HC5F / HASS-HT Family

Marking:
HC5F700-S SP3

This is a LEM Hall-effect current transducer, likely >700 A nominal.

Fully isolated

Analog output

Integrated magnetic core

Provides the current feedback for each phase

These feed into the MCU ADC channels via analog conditioning.

4. Isolation / Gate Driver Power DC-DC Module: EBJ62390103

Marking:
EBJ62390103 SJ2153

This is a custom LG/GM-specific transformer module.

The part is not sold retail but is clearly:

Multi-output

High-frequency

Providing isolated rails

≥3 separate secondaries (one for each gate-driver pair)

Based on the Infineon 1ED020I12-F requirements, each driver needs +15V and possibly –5V rails.

This transformer supplies the isolated power for all 6 gate drivers.

5. SMPS Primary Controller / MOSFET driver: MC33730EK

Marking:
MC33730EK

This is a NXP MC33730, a multi-channel gate-driver power supply controller.

Designed for powering isolated gate drivers

High-frequency switching

Automotive-qualified

Often used with multiple isolated secondaries

Matches SMPS topology visible on your board

This is the master controller that drives the large transformer.

6. Secondary-side rectifiers/regulators: ADW71205

Marking:
Analog Devices ADW71205

This is a secondary-side synchronous rectifier controller or isolated regulator (Analog Devices makes several ADWxxxx families for DC-DC regulation).

Given placement:

It sits on the secondary side near the gate-driver capacitors

Regulates the isolated gate-drive rails

Ensures stable voltage under fast gate-charge spikes

7. Miscellaneous parts you marked

SS08SG16 – likely 8-bit shift register or digital isolator

RRH 60600, RRQ 60601 – internal GM/LG codes for MOSFETs or rectifiers

HC365 / TXD21 – may be a logic buffer or level shifter (74HC365 family)

As well as:

1. MCU (MPC5777C)

↳ sends 6 PWM signals + enable, fault reset, etc.

2. Digital isolation / shift-register buffering

(SS08SG16, HC365)

3. Driver power supply system

MC33730EK (primary switching controller)

Large custom transformer EBJ62390103

Synchronous rectification (ADW71205)

Bulk filter banks (100–220 µF caps)

Produces:

+15V isolated (per phase, per driver)

Possibly –5V turn-off rails

4. Gate drivers (Infineon 1ED020I12-F)

Two per phase (HS + LS).
Provide:

DESAT detection

Miller clamp

Soft turn-off

Fully isolated control

5. Current sensors (LEM HC5F)

Analog return to MCU.

I'm hoping to use this, plus some more digging on these part numbers and tests with a multimeter to begin work on the pinout for the connector between the gate driver board and the control board.

[P.S.Mangelsdorf]

Happy New Year everyone!

I got some more work done today, thanks to a new desoldering iron I got for Christmas. I pulled the gate drive board off so that I could get a look at the bottom and the IGBT module itself. Starting with the IGBT module, it's an Infineon FS800R07A2E3. Data sheet attached.

And here's the bottom of the board. I didn't do any digging into the newly revealed part numbers yet.

I did do some digging on pinouts for the previously identified components (attached excel file) and I'm hoping to do some tracing this weekend in order to make headway on the pinout between the two boards.

[P.S.Mangelsdorf]

Happy New Year everyone!

I got some more work done today, thanks to a new desoldering iron I got for Christmas. I pulled the gate drive board off so that I could get a look at the bottom and the IGBT module itself. Starting with the IGBT module, it's an Infineon FS800R07A2E3. Data sheet attached.IMG_9880.jpg

And here's the bottom of the board. I didn't do any digging into the newly revealed part numbers yet.
IMG_9867.jpg

I did do some digging on pinouts for the previously identified components (attached excel file) and I'm hoping to do some tracing this weekend in order to make headway on the pinout between the two boards. EDIT: There are some errors in this excel sheet - working on fixing them.

[P.S.Mangelsdorf]

Alright, revised internal pinouts attached. The gate driver was wrong, I previously had a 16 pin variant in the sheet, when the actual driver is a 20 pin variant.

I have made progress identifying some pins on the board to board connection. Many grounds, as well as the current sensors' 5V supply and their 3 output signals. Hopefully with this updated pinout I can get the gate drive signals identified. One weird thing is that I have not found any pin that carries 12V positive to the gate driver board. Need to do more digging on the power supplies.

[P.S.Mangelsdorf]

Alright so connector pin progress!

This is the 40 pin connector between the main control board and the gate driver board. It took me a bit to realize there was a buffer chip in between the connector and the gate driver chips themselves (data sheet attached, its a TI HC365). Once I figured that out, I made more progress. Here's what I have for now, hoping to do some more throughout the week, including identifying each specific gate driven by the inputs listed below.

1 ground
2 ground
3 Vcc power pin on buffer - note: need to do more investigation on where else this is connected
4 Vcc power pin on buffer - note: need to do more investigation on where else this is connected
5 ground
6 ground
7
8
9
10
11 1A input to buffer
12 2A Input to buffer
13 3A Input to buffer
14 4A Input to buffer
15 5A Input to buffer
16 6A Input to buffer
17
18
19
20
21
22
23
24 Current sensor output, furthest phase from connector (will check specific letter)
25 ground
26 Current sensor output, closest phase from connector (will check specific letter)
27 Current sensor output, middle phase (will check specific letter)
28 5V supply to current sensors
29
30 ground
31
32 ground
33
34 ground
35
36
37
38
39 ground
40 ground

These were identified by finding continuity with a multimeter. There may be some nuances or intermediary components I still need to identify.

[collin80]

One weird thing is that I have not found any pin that carries 12V positive to the gate driver board. Need to do more digging on the power supplies.

There are two possibilities.

1. They are feeding just one power source and using DC/DC converters to generate the gate drive voltages
2. They are stealing 400V DC from the power going to the IGBTs and using a DC/DC converter from that to get to the gate voltages.

You basically always need to float your gate drivers so either way, the voltages being generated will be done specially. Depending on how it's done, you might need +15V for the low side drivers and HV voltage + 15V for the high side or HV voltage - 15V for the high side. Either way, the high side drivers are floating up near the HV voltage and thus can be generated based on the incoming high voltage. You might find that there are transformers or special capacitors need the high side drivers. They may live on the other side of an isolation barrier of some sort. You mention buffers so I'm thinking this is what you're finding. There are buffers and isolation barriers at appropriate places.

[P.S.Mangelsdorf]

You might find that there are transformers or special capacitors need the high side drivers. They may live on the other side of an isolation barrier of some sort. You mention buffers so I'm thinking this is what you're finding. There are buffers and isolation barriers at appropriate places.

Yeah, there is what looks to be a transformer, but the part number is clearly not an off the shelf part, as Googling it brings up nothing relevant.

The image below shows the buffer chip and the transformer. I think the whole section directly above the connector is related to the power supply. I need to learn a bit more about this and do a bit more probing.

There's also a smaller yellow transformer up on the main control board, so I may start by tracing the 12V on that board, and from there figure out what's headed to the connector.

[P.S.Mangelsdorf]

Alright, I need some help with this transformer. The transformer on the gate driver board is a 19 pin, likely LG-made transformer. I was able to trace a few pins to the connector going up to the main board. Transformer pins 1,2,3,4 all have continuity to pins 31, 33, and 35 of the board connector. Transformer pins 5,6,7 are connected to ground.

The transformer is marked "EBJ62390103 SJ2153" but I can't find any information on this or a similar transformer. I'd like to figure out what it's expecting on pins 1,2,3,4. Does anyone have a source for this information?

In the meanwhile, I'm working on tracing the power supply on the main control board, but haven't gotten far.

[jrbe]

The transformer needs to work with the voltage regulator. The MC33730EK looks to be obsolete, it may be best to rethinking the voltage regulator section and it's isolation transformer. Ti has some decent tools for designing them but there may be a design reference from one of the other oi boards you could use.

[collin80]

The transformer is marked "EBJ62390103 SJ2153" but I can't find any information on this or a similar transformer. I'd like to figure out what it's expecting on pins 1,2,3,4. Does anyone have a source for this information?

The unfortunate truth is that transformers are often custom made for the application. Those numbers may only be meaningful to the original manufacturer.

It would be best to see if you can trace out the way the transformer works by figuring out which pins have continuity to other pins (on the transformer). The idea is to determine how many wires there really are in there. If there are 19 pins, are there 9 separate spools of wire in there or what? Are some pins just duplicates of other pins? If you have the means, trying to figure out the resistance and inductance of all the separate spools would be interesting. The transformer looks to probably only have one or two cores. So, likely most all of the spools are more or less on the same core and thus magnetically coupled. But, they do this because they aren't galvanically coupled. That is, there is no short circuit path between the various windings. They can have magnetic coupling which allows signals to flow back and forth but only through magnetism, not via a direct connection. That can be useful in a variety of circumstances. For one, you could have one or more input windings that then power the others, probably with voltage step up or down. Or, you could send signals from one place to the other but isolated from each other. That does not look like a signal transformer, it's way too big for that. I'd guess it's more for something like generating isolated gate drive voltages.

[P.S.Mangelsdorf]

It would be best to see if you can trace out the way the transformer works by figuring out which pins have continuity to other pins (on the transformer).

I'll take a look at this over the weekend. I'm also planning to try to power up the main board and see if it will output voltage on the pins that go to that transformer.

That does not look like a signal transformer, it's way too big for that. I'd guess it's more for something like generating isolated gate drive voltages.

I think that's correct.

The transformer needs to work with the voltage regulator. The MC33730EK looks to be obsolete, it may be best to rethinking the voltage regulator section and it's isolation transformer. Ti has some decent tools for designing them but there may be a design reference from one of the other oi boards you could use.

I'm hoping that we won't need to redesign this board. From what I've seen so far, I think we just need to figure out what the control board is providing it, and then design a control board. I'm hoping that it could be a (relatively) simple port over of the Tesla LDU board, with adjustments for the specific sensors in use, etc.

[jrbe]

I'm hoping that we won't need to redesign this board. From what I've seen so far, I think we just need to figure out what the control board is providing it, and then design a control board. I'm hoping that it could be a (relatively) simple port over of the Tesla LDU board, with adjustments for the specific sensors in use, etc.

Agreed, should be able to reuse the driver board, I missed what you were trying to do. And also agreed, I think you could skip the transformer specs and look at how the driver is connected / what signals it requires / gets and avoid that whole headache.

Does that 2x20 connector have a common pitch? You may be able to get an extension cable (ide cable?) with a tap that you can carefully setup and use to tap signals / readings from carefully while powered up.

[P.S.Mangelsdorf]

Does that 2x20 connector have a common pitch? You may be able to get an extension cable (ide cable?) with a tap that you can carefully setup and use to tap signals / readings from carefully while powered up.

Need to measure that, that's a good idea!