I think I’m following this.
There is an RPM sensor in the AC traction motor that is used to detect motor speed directly and road speed indirectly.
The RPM sensor, via 4-pin connector, goes to the Sevcon Motor Controller (MC).
The Throttle Position Sensor, via 6-pin connector, goes to the Bosch Vehicle Control Module (VCM).
The Speedometer needle is driven by a digital stepper motor (servo) with speed data from the CAN bus.
The MC and VCM are both connected to the CAN bus.
Since the Dashboard Display has multiple indicators besides the Speedometer, it is likely the road speed signal is provided by the Motor Controller and simply decoded by the Dashboard Display while providing no limiting function. Therefore I conclude the Speedometer will read to 35mph with no programming needed.
The MC vice VCM relationship is a bit more complicated because the motor/road speed sensor is connected to the MC and the throttle position sensor is connected to the VCM. Where is the speed limiter?
As I will explain, I conclude the speed limiter is programmed into the VCM.
GEM offers a Speed Key (https://gem.polaris.com/en-us/shop/accessories/additional-accessories/2883054/) for which “Dealer installation and re-flash required.” The key’s only connection is to the CAN bus for both signal and power.
Therefore the speed limit is communicated on the CAN bus. Since the throttle position sensor is connected to the VCM, it seems most likely the VCM commands the MC according to throttle position and road speed within the programmed speed limit. It is possible the VCM simply passes the throttle position to the MC which provides the speed limiting function but this is unlikely because Polaris seems to have centralized the GEM’s “brains” within the VCM.
The other two limits on speed are maximum motor RPM and reserve duty cycle (ie, AC phases).
If 25mph is at maximum motor RPM, then a gearbox change is required (not an option for me).
Using the 80/20 rule as an example, if 25mph on level ground is 80% duty cycle then that leaves 20% for additional speed. I haven’t tested this possibility by driving uphill at 25mph so this is just hypothetical now.
From what I’ve read at this forum, it appears the VCM programming hasn’t been cracked so changing its 25mph speed limit is currently not possible. And apparently that programming has been obfuscated to some extent so it might not ever be possible to change it.