Chevy Bolt Motor Control Adventures

[collin80]

Got my Bolt inverter yesterday. Probably won't have a chance to take a look inside until Sunday.

I have a 2022 Bolt EUV. I also happen to know a bit about SavvyCAN and CAN reverse engineering. So, if you want to go down the CAN rabbit hole, I'm willing to help too. I can give captures of the full traffic on an EUV that is driving down the road.

Now, I'd love to look at the inverter firmware too. Technically one can do firmware updates on all the components in the car through GM's app so it could be possible to maybe do that and capture the traffic to try to decode that if getting it straight from the chip won't work. However, UDS firmware updates can be encrypted so that's a real possibility.

[P.S.Mangelsdorf]

I have a 2022 Bolt EUV. I also happen to know a bit about SavvyCAN and CAN reverse engineering. So, if you want to go down the CAN rabbit hole, I'm willing to help too. I can give captures of the full traffic on an EUV that is driving down the road.

I was just taking a look at your post on the Bolt forum yesterday; if you can share CAN logs without the identifying information, that'd definitely be a help. Have you done any digging into what messages are sent regarding actual control of the inverter?

I started to dig into mine, but don't yet have it at a point where I have anything to share. Hopefully will get there in the next couple days.

To be completely upfront, I barely have any idea what I'm doing here, so I'm trying right now to get to a point where I can share detailed photos of the internal components and we can figure out the best path from there. Figured I'll learn by doing.

[collin80]

Here is a log of the EUV driving around:



It seems kind of short. Here is a much longer one:


The Bolt is a GLOBAL-A vehicle which is a big head start. A lot of the generic GLOBAL-A messages are there on the bus and usually at least somewhat close to being conforming. There are places where the standard signals don't really make sense. But, it's a start. I don't know for sure what messages actually control the inverter.

That last capture is on three buses at once, one of which was the single wire CAN bus so there are a bunch of messages from the body control stuff and steering where in there. I think you can safely say the motor control messages aren't on that bus.

[P.S.Mangelsdorf]

Thanks, I'll try to take a look this weekend.

[P.S.Mangelsdorf]

Alright so I got my inverter torn just about as far apart as I want to go right now. I've basically taken the approach of "let's see what we can see, and take lots of photos." Here's what I've found:

First, here is the exterior, with the part numbers that I'm looking at. Who knows which numbers are actually the part number, thanks GM:

Once you pry off the lid (which has a very strong adhesive) it looks like this should be fairly simple to disassemble, but you'd be only partially correct. Yes, most of it is bolted in place, but the main 12V connection (bottom side of the image, black square) is soldered in after the board is installed, and must be unsoldered to remove the top board. The connections to the lower board are thankfully via a header, and no de-soldering is required there. Side note, fighting to remove this solder likely damaged some of the traces on this board, so unlikely I can play with the CAN logs on this unit.

Here are detailed photos of the upper board. Helpfully, they've even printed information on the board's fabrication on it.

Then there's the lower board. It looks like this can be unbolted, but once again, thwarted by soldering to the switching electronics below. But wait, can we unbolt those from the case, like we can the capacitor and bus bars? No, we cannot, as some of their bolts are covered by the lower PCB itself.

Here are detailed photos of the lower board.

In my uneducated opinion, it looks like we have a separate brain board and gate driver board, so maybe we can simply modify an existing Damien design to drop in place of the upper PCB. Anyone who knows what they're looking at, please chime in here, otherwise I'm going to have to actually go over the local community college and get another engineering degree to figure some of this out (only half joking here). If it would help to see the switching electronics, I can de-solder the lower PCB and pull it off. Also, if there's anything you see that I should probe/measure, let me know. I've recently gotten an oscilloscope, and I'm hoping to pick up a bench power supply soon. The joy of living alone is I can turn my entire guest room into an electronics lab for this silly hobby. I'm going to see what I can figure out from some googling and poking around, but I definitely am going to need some help with this.

[collin80]

Yes, the two boards are exactly as you described. One board does the master control and interfaces with the rest of the car. The other is a driver board that fires the transistors and reads current on the three phases. Those LEMs are high speed current sensors used for fine control of the motor.

And, yes, it is almost certain one could replace the upper board and leave the bottom driver board alone. This would require reverse engineering the pinout of the 20x2 connector on the lower right. There are six IGBTs to fire and each would have its own ground so that's 12 pins right there. Then probably desat for each of the 6 and some means of sending the three phase currents. 12 + 6 + (3 * 2) = 24 pins needed so far in my guess. Then you would also have power to drive things not isolated so probably two more pins for that. All in all, probably at least half of the pins do something.

Make no mistake, any path forward is a lot of work. To replace a board you still need to know what it did and how it worked. I have actually done this before though. I once reverse engineered an Azure Dynamics DMOC645 power section and used it to drive a custom permanent magnet motor by using my own control board. So, it's possible, it just takes some time. Basically you'd want to trace down the function of each and every pin in that 40 pin connector to see where it goes. It's fairly safe to probe around with a multimeter in continuity mode.

Another thing you'll want to do is try to determine the part # of every chip you can. It helps to take pictures from different angles to find one where the text is legible. Then try to get the pinout for the chips and see what makes sense for each pin. It's a long process but kind of interesting.

[P.S.Mangelsdorf]

Thanks! Good to hear I might have stumbled onto the right track.

Basically you'd want to trace down the function of each and every pin in that 40 pin connector to see where it goes. It's fairly safe to probe around with a multimeter in continuity mode.

Another thing you'll want to do is try to determine the part # of every chip you can. It helps to take pictures from different angles to find one where the text is legible. Then try to get the pinout for the chips and see what makes sense for each pin. It's a long process but kind of interesting.

I will start working on this, but likely not until next week. Headed out to Radford Racing School tonight, and not back until early Sunday. I'll try to take some photos before I go and study them on the flights, it'll give me something to do!

[P.S.Mangelsdorf]

Ok, I've made a little bit of progress, amid a bunch of other stuff going on. Let's start with the simple, I transposed over the pinout for the inverter module. (in the attached excel file with other Bolt pinouts)

It looks like the inverter is getting:

• 3 GMLAN Serial Data busses
• motor position sensor (4 different signals from the same sensor)
• transmission range switch signal (from transaxle/motor)
• Control and feedback for the aux transmission fluid pump
• Transmission fluid temp sensor
• motor temp sensor
• Positive
• negative
• run/crank
• wake up serial data

From the wire diagrams, it looks like the GMLAN busses have a 120 ohm termination resistor on each end. So I assume GMLAN is just GM speak for CAN bus - is that correct from what you've seen Collin?