Sevcon Gen 4 Hardware decompile

Things that fly
Post Reply
User avatar
methods   10 GW

10 GW
Posts: 4385
Joined: Aug 08 2008 12:08pm
Location: Santa Cruz CA
Contact:

Sevcon Gen 4 Hardware decompile

Post by methods » May 23 2017 9:50am

The tooth fairy dropped 2pcs of Sevcon Gen 4 on me that indicate hardware failure.
And so we begin:

These controllers will likely be in the air over our heads soon... so lets make sure they are Fail-Safe (meaning they fail to a RUN condition)
Existing Sevcon Firmware and Software is set up Fail-Fast... meaning with any ladder logic error you lose power... this is not how OEM is generally designed (*a)
Hardware001.jpg
Hardware003.jpg
Hardware002.jpg

Order of operations:
1) First flash known good with DLD and DCF to ensure its not a bad burn
2) Reverse engineer and repair

Errors reported:
1) Contactor welded (probably a short in the precharge circuit) - Swap Fets
2) Shorted analog I/O (Probably a protection diode that went short) - Remove Diode

Value of Hardware:
1) Apx $400 per unit... which is more than I have made trying to support Sevcon professionally... so there is a business case for this hardware repair work.

First Impression:
1) The hardware is extremely simple. No attempts to sand chips, pot proprietary areas, or otherwise impede design reversal. Straight forward design and manufacturing.
2) It would be impossible to catch up to Sevcon in a business sense... but in a DIY sense one could duplicate this hardware in less than a week and run the distributed code set.
3) The Sevcon's value is in the PID loop work they have done... and this same work has been their undoing as its extremely fussy to get working (in comparison to a Curtis)

Details:
1) If there is a hardware breakdown please link it through. I cant make a dime supporting Sevcon so this is a private effort that burns my hours.
2) Board is conformal coated with a UV indicating spray - similar to what I used on my BMS.
3) Top of board has all the magic with just caps and resistors on the bottom. There is only one board - the rest is just heat sink
4) Sections are very clear... I will start by pin-mapping and part ID'ing to box off functional areas.

Objective:
1) To not go broke (as Zero Motorcycles will not hire me back after officially and unofficially supporting them for years... politics? Ego? I am skilled, experienced, and educated and they are funded by a multi-billion dollar investment company)... so I am doing this work for $200 in hardware for a Boat project.
2) To understand their circuits, break them down, and use the design in power switching efforts like my low cost SSR. I am a formally trained Electrical Engineer and have been exposed to every circuit in this "hardware implementation of documented theory" -- in every flavor imaginable through my schooling... so nothing here is proprietary to me. These are COTS parts configured in clever ways. I consider this a review of what I already know... and I consider what I know to be the peoples knowledge... since the tax payers flipped the bill (indirectly) for my masters at Stanford. (so cheers to you brother... ask away and I will answer. I am at your service)

Timeline:
1) My son is still in town (and I pay for 12 plane airline tickets a month + + + + ... just to have my parenting time with him after my baby mama decided she had other plans...) and I need to go collect some 24V DC controllers for my boat project. A very cool Ex-Zero employee laid a box full of 35C 6S (22V) packs on me... and I want to run them on my 12V trolling motor... so I am going to grab an old PRE-2012 Zero controller (that I got from LukeMan which was previously part of a Zero test station and may or may not be DOA) and see if any of them will run a low enough LVC to support 18V - 25V.

2) Once that stuff is done I need to go grovel around for some reasonably paying contract work... and until I land a contract... I will keep my pencil sharp with activities like this. My existing contracts are slow to pay invoices so that indicates that its time to move on. Note: Recruiters approached me again on a Facebook project that nobody could be a better fit for... can we just get the show on the road guys? Goes like this: You hire me. I do good work. If at any time you think I suck... you fire me. I respect NDA's... proof of which I can produce. I have suffered financially to keep the secrets of many going back to 10 years with a top secret clearance.

Eh hem!

-methods




(*a) Look at any car on the road... it will give you ever last drop of propulsion until the motor overheats, the oil runs dry, and the parts fly off the motor. This needs to be an option on anything running high reliability or military. Hey... if I lose precharge or an IO port... that does not mean I want to be dead in the water or stuck half way through an intersection in my NEV.
Increasing battery voltage and controller current limit will result in a non linear experience

User avatar
methods   10 GW

10 GW
Posts: 4385
Joined: Aug 08 2008 12:08pm
Location: Santa Cruz CA
Contact:

Re: Sevcon Gen 4 Hardware decompile

Post by methods » May 23 2017 9:51am

Reserved for breakouts

EDIT 001: I am going to ID 1 circuit a day with breakfast.

TODAY I DISCOVERED THAT CONTACTOR DRIVE 1 MOSFET IS SHORT CIRCUIT AND THIS IS THE CAUSE OF THE WELDED CONTACTOR ERROR.
HERE IS WHAT I POKED AROUND TO FIND THAT (of course you could go right to it.. but at the end of this we want a schematic)


We know that there are three contactor outputs on the Gen 4
We see on the board (upper left hand corner) three power resistors, three heavy mosfets, three gnarly diodes, gate drive circuitry, so I will start there.
The Contactor drive circuitry of the Gen4 is known to be a PWM of Batt voltage... and this is why it blows out active components on low voltage contactors.

Pin 3 is Contactor Out (Open Collector, Active low, basically an Nchannel Mosfet switching to ground)
Pin 4 is Contactor Power (up to 2 A)

Pin 7 Same for #2
Pin 8

Pin 11 Same for #3
Pin 12

So... a first guess is that we are expecting to see Pins 4,8, and 12 tied to a Vbat (Switched) rail via the large resistors.
They are rated at 2A continuous... short circuit would be 116V/15ohms= ~8A... safe enough for the D2pak to handle and enough punch for any contactor.
(note: The large resistors seem to be part of another circuit, perhaps precharge)


Visual:

* Three large resistors feed into a thermal pad which goes to a 4th strapped switch.
* Probably a 4 layer board and I can see shadows
* Going on assumption that mcu and others are sitting right over ground
* Going on assumption that some heavy copper must come over from Vbat+
* Conformal coating is pretty thick/tough - need needle points...

(REMEMBER - if you are doing it right... you are going back and nail-polishing all the points in the conformal coating that you penetrate. This is a HIGH VOLTAGE board ... in an adverse environment... and with 120V kicking around even a pinhole to another point in the board and a path of moisture can start electrolysis to eating things away. Dont fool around unless you like chemistry experiments)


BEEPER:

Expecting to find a low side PWM switcher, may be surprised, will show process here

Contactor sink, i.e. a path to ground
Pin 3 goes to D111 (which is part of a set including D112 and D113 I presume)
D111 straps to ground
Pin 3 goes directly to the TOP of the three mosfets which I believe is labeled Q1.
Top in is the gate and I read 30 ohms on the trusty Fluke
Strange I read 0ohms in either lead configuration from Pin 3 to the Source and Drain... ok - lets look from the other direction

Contactor source, i.e. Positive comes from here
Pins 12, 8, 4 all go to a large pad which ties in to cathode of D37, D38, D66
These diodes anode jump right over to the Dpack Drains

(at this point I get out a piece of paper and start drawing what I believe the circuit looks like based on measurements - with no assumption of a reference design)

Power Resistors
Visually they are all in parallel and marked 15 ohms
Measured is 5ohms which adds up

Power resistors tie to the single small fet, Source of that fet tied to Vbat+
Drain tied to Resistors
Souce is tied to Vbat+ so must be a P-Channel
Gate tied to Vbat+ via 10K so confirmed P-Channel (drawing...)

At this point I am considering it strange that the source and drain are short circuit on the trio of Dpack Mosfets... was this the board which had a WELDED CONTACTOR Error?
Sure would make sense.
Need a known-good to measure against - or need to peel/clip the source leg.
Doubtful that all three mosfets would pop

CONFIRMED

Of the trio of Contactor switching Mosfets... The top is SHORTED and this is the problem with the Controller
The next two in line are as Expected between the Drain and Source

Now we map pins 7 and 11 to confirm Nchannel
Pin 7 goes directly to the Drain of the middle fet... (drawing, and confirmed N-Channel by configuration)
Source goes directly to Gnd
We have a low side switcher capable of 10A

Now the last thing to confirm is that the other end of the power resistors go to pin 4 etc .... ehh...

Pins 4, 8, and 12 must find Vbat+
mapping Pin4 we are not seeing stray voltage on the lines (caps)

arg... where are they grabbing Vbat???
Not a direct connection
Must be short circuit protected
Must be a shunt in there someplace to read overcurrent... high or low

Re-thinking that the power resistor trio may just be the pre-charge circuit.. but such a small fet for that large job. I figured the fet on the right side of the board...

Losing interest as the failed component was already found... but in the interest of following thru...

Ah - pins 4, 8, and 12 map directly to the heatsink of Dpak Q2 on the right side of the board... so some sort of switched power
SUM85N15 - thats a 150V N-channel mosfet (as expected ) so the heat sink is the drain
Since the pins tie to the Drain and not the source I am thinking we found a power rail of some sort
Who is switching that N-channel all the way up on the rail?!?


I gotta go to work...
The failed mosfet is likely a FQB19N20L
Thats a 200V, 21A, N-channel mosfet with 140mOhms of ON resistance
Reporting to customer and moving on to second failed Sevcon


-methods

KEY WORDS:
Sevcon Gen 4 Welded Contactor Error
Diagnosis and solution - Sevcon Gen 4 - Hardware Issues
Increasing battery voltage and controller current limit will result in a non linear experience

User avatar
methods   10 GW

10 GW
Posts: 4385
Joined: Aug 08 2008 12:08pm
Location: Santa Cruz CA
Contact:

Re: Sevcon Gen 4 Hardware decompile

Post by methods » May 23 2017 9:51am

Reserved for answers to questions, updates, etc

(as my threads always go sideways with OT content... AAAASSSSS I like it)
Increasing battery voltage and controller current limit will result in a non linear experience

User avatar
methods   10 GW

10 GW
Posts: 4385
Joined: Aug 08 2008 12:08pm
Location: Santa Cruz CA
Contact:

Re: Sevcon Gen 4 Hardware decompile

Post by methods » May 26 2017 11:55am

Please no questions over PM.
I want to help as many people as possible so we need to do it on the open forum.

In the last week or three I committed to several large and complex non-paying efforts.

* A new LTC based BMS that scales including power switching, balancing, and hooks to expand out to Android apps.

* Reverse engineering the Sevcon Hardware design with emphasis on being able to repair broken units in the field.

* A Sevcon support thread to help people get around the most common bullchit issues which slow them down.

* An Electric boat effort that is currently at "trolling motor status" but is going to end up as 75-7 + Sevcon Gen 4 status

I am going to pull all of those on my free time.

I have spent the last few years re-aligning my life. I went through a gnarly divorce, worked crazy startup companies, started a contracting business, ... I trained for over a year and started body-boarding insane waves next to pro surfers on huge days. I almost died like 30 times learning how to drop into 20' waves with fiberglass missiles (surf boards with razor sharp fins) bobbing all around me, guys who HATE me (surfers hate boogie boardiers...), and a relentless ocean that breaks on a reef then into the rocks. I was jumping off a cliff at night into double overheat waves that I could barely see to get practice when it was not crowded. Hardcore shit that gives a man perspective. Thats no bullshit or exaggeration. I have pictures and witnesses who will attest that I drop in on the biggest days where you HAVE to catch your wave or get pounded against the reef and drown.

Now - that said...

I am here to do fun stuff, keep busy, help out...
I am going to deliver on my promises.

In my personal life I am struggling with cash-flow issues. I make a ton, it gets spent. I go some time between contracts... get hella broke. I have major expenses revolving around divorce lawyers, parenting my son who now spends half his time 400 miles away (I book 12 flights a month, rent 4 cars a month, hotels, food on the road...) shit I have to do to raise my son.

So - I need steady money.
I applied at:

Facebook
Tesla
Nest
Lockheed Martin
and a bunch of other companies like Zero

I am going to lock in for at least a couple years on steady income and do my contract work on the weekends or evenings... as I have ENDLESS energy and my mind never stops grinding... I am going to do it Elon Musk style and just bust out on 3+ things at once.

Yep - so...
This Hardware Decompile...
Its sitting on my Bench over at the spot I have been working. As soon as I have a minute I will identify hardware sections in this order:

1) The Precharge circuitry - Mosfets, Resistors, mosfet drivers, back to the chip, out to the pins. I will repair the Sevcon sent to me and return it to its owner.

2) Analog inputs - from the pin, protection diodes, signal conditioning, to the chip. We will ID the primary and secondary components, repair, and return to its owner (or keep it for a while for my boat)

3) Answer Questions - if you circle some part of the PCB I will map out what it does, voltages, current running, components values, optional replacement parts, test procedure, etc.

4) And whatever comes next.

I can reverse engineer anything simple like this. It just takes some prior knowledge, understanding of fundamentals, and some guess work. I only chose the Sevcon for this exercise because its what fell into my lap by an enthusiast who is trying to get his Motorcycle running and has had a hell of a go at it.

If Sevcon gets pissed about it they shouldn't. They have been in the market a long time and its still a total f'ing pain point for most people who are trying to promote their product. Its only a matter of time before Curtis or some other company figures out the market need and moves in. I like Sevcon - I want them to flourish. To flourish their stuff has to work. Currently it works for golf carts and some motorcycle applications... but its still a major pain in the ass. It would not take much work on their end to loosen up a bit and move into some emerging markets.

There is major vacuum in the Electric Flight arena right now. I am feeling it.. its gonna happen hell or high water. People want to use the Sevcon and it is almost reliable enough to do it. Last issue to address is how easily the controller locks up and faults out. That is non-compliant with any sort of high reliability application - requiring heavy, expensive, and complex redundancy to be built in.

People are doing it
I support them - its time to fly electric

I dont like flying small aircraft... so I will have my fun in a boat. Requirements are just the same... dont leave me stranded half way across the Monterrey Bay over some bullshit non-critical errors. If it aint on fire... I want the phases cranking out. Golf carts are soggy-sauce. Motorcycles must NEVER fault out at a critical time.

K - enough coffee blather... I am off to work.

-methods
Increasing battery voltage and controller current limit will result in a non linear experience

User avatar
methods   10 GW

10 GW
Posts: 4385
Joined: Aug 08 2008 12:08pm
Location: Santa Cruz CA
Contact:

Re: Sevcon Gen 4 Hardware decompile

Post by methods » Jun 06 2017 4:17pm

Sevcon Hardware Diagnose and Repair Status 001

* Confirmed, that the "Welded Contactor" error was the Contactor 1 mosfet and not the protection diode.
* Pulled the fet
* For lack of resources on site... pulled the Contactor #2 Mosfet
* Reflowed #2 mosfet into #1 position
* Now controller should be plug and play compatible with is previous life

Concerns:

* We have yet to ID the green heatsink compond used on the fets. I did a heat test... and it reflows a bit... so hoping I can just reassemble and the first time it gets hot it will settle
* I did not re-conformal coat. My PCB setup was just pulled from deep storage a few days ago and I have no conformal coatings on hand here.

Learnings

* The repair looks like $hit as the thick conformal coating balls up and just mucks things up. This is just a reality... just like mods to ICE ECU's etc.
* So... no pics! Unless you like ugly... nothing to see here.

When the rubber hits the road what we have is a controller that used to be FUBAR and is now Operational
I will report back when I actually test it... as the heat sink etc is at home.

Next up will be the Analog I/O fault.

thanks,
-methods
Increasing battery voltage and controller current limit will result in a non linear experience

User avatar
methods   10 GW

10 GW
Posts: 4385
Joined: Aug 08 2008 12:08pm
Location: Santa Cruz CA
Contact:

Re: Sevcon Gen 4 Hardware decompile

Post by methods » Jul 17 2017 7:41pm

Update:

I finally got around to running through a stack of dead Sevcon Gen 4 Size 4's.
Here are the failure modes I discovered in hardware:

(NOTE - these may have been destructive test units or otherwise abused!)

Contactor Welded Error: 2 modes

Mode 1) The contactor coil is (for reliability and safety reasons) driven on both the high and low end. There is one high side switch for all three contactors (it does not PWM, just turns on) and three low side switches... one for each coil drive. We have seen the low side driver short. I presume (tho I have not probed) that during startup the Sevcon blips the high side fet, which pumps B+ out to the coil, and looks to see that its low side fet is open. If it is not it throws an error. Yes, the contactor coil sees a hundred volts for a brief second... but it wont hurt anything. Repair of that failure mode is either switching to another contactor channel, swapping the fet. Its an N-Channel on the edge of the board and a hot air gun brings it right up. Be careful of the SOT-23 parts that ride right next to it.

Mode 2) The precharge PWM fet (127? smaller than a 220) goes short or semi-short. One read 80 ohms. This is on the edge of the board located near the stack of three precharge power resistors. I have not swapped one of these yet but I have the part number and will post them once I do some ordering. N-Channel, 18A, 200V (or maybe 150V) - standard stuff and near any low on resistance fet will work. I WOULD HAVE USED A LARGER FET... but cost reduction is cost reduction.

We are looking for a good way to open up the springs and re-assemble the controllers. We can repair them without removing the power board from the heat sink but its sloppy and not pro. To do a pro job I have to pop the fets out of the springs. Obviously a jig is needed to get them back in. Possibly a set of stiffeners with zip ties... but zip-ties alone wont do it. The TO-220's are standing on LONG legs... so they will bend, crush, and otherwise go FUBAR if you apply too much force to them. The Kapton Tape that insulates the heat sink is also very vulnerable to scratching and tearing. Its a tradeoff... thick is tough but poor heat transfer... so thin is for the win... but BE CAREFUL.

We are also looking at the best way to re-apply thermal compound. Most of the green goop comes off on the fet bodies. I need to test if it reflows. If it can be cleaned off we will probably replace the tape and good and clean the fet bodies before re-assembly. If so much as a single fet gets a crappy thermal path it will greatly lower reliability.

As for the IP rating... man... those controllers are buttoned up tight!

-methods
Increasing battery voltage and controller current limit will result in a non linear experience

romelec   10 W

10 W
Posts: 91
Joined: Mar 11 2011 3:46pm
Location: Marseille, France

Re: Sevcon Gen 4 Hardware decompile

Post by romelec » Jul 22 2017 12:24pm

They are not perfectly waterproof, the Peugeot E-Vivacity scooters (they use size 2) have issues when used/parked under rain: http://www.vehiculeselectriques.fr/post ... ml#p222721 (in french)
But they made a bad design choice, some water goes directly on the connectors.

http://fs5.directupload.net/images/170708/jg8dtoq7.jpg
http://fs5.directupload.net/images/170708/iz6rengv.jpg
http://fs5.directupload.net/images/170708/3acect4e.jpg
http://fs5.directupload.net/images/170708/eb6ndpl9.jpg

User avatar
methods   10 GW

10 GW
Posts: 4385
Joined: Aug 08 2008 12:08pm
Location: Santa Cruz CA
Contact:

Re: Sevcon Gen 4 Hardware decompile

Post by methods » Jul 22 2017 12:48pm

Excellent post and epic pictures.
Thank you.

That layout is near identical at the seals to a Gen 4... so unless molds, o-rings, and procedures have changed... this issue is relevant.

The controller is rated IP66

(IP54 when 35-way connector unmated – size 2
models only)

"IP66 Powerful water jets Water projected in powerful jets (12.5 mm nozzle) against the enclosure from any direction shall have no harmful effects."

So the manufacturer is free to mount the controller in a place where it gets hammered by wind and water... tho... if water is POOLING... that is a different story. Heating and cooling cycles may create vacuum that sucks in standing water. It would need to be IP67 to start to address that

For IP67 you can immerse underwater

"Ingress of water in harmful quantity shall not be possible when the enclosure is immersed in water under defined conditions of pressure and time (up to 1 m of submersion)."

-methods
Increasing battery voltage and controller current limit will result in a non linear experience

Post Reply