Reverse Engineering a Hybridpack 2 IGBT Driver Board

[mikka_e]

Hi all, long time listener first time caller.

I recently acquired a Infineon Hybridpack 2 IGBT set and driver board directly pulled from a full motor controller/inverter for automotive applications. Specifically, I determined it is from a Chinese company that makes inverters for cars and busses, and based on some other sleuthing this was likely an engineering sample for an inverter they were developing that could do 100-200kW. Picture of the full board attached below. It is difficult to photograph because of the conformal coating being so shiny. It looks very 'reference design'-ish to me, so if anyone recognizes the full topology, that would be great. The wires you see coming off it are from me, there just to probe/power things.



These IGBT part is an Infineon Hybridpack 2 FS800R07A2E3
Link to datasheet: https://www.galco.com/techdoc/eupc/fs800r07a2e3_dat.pdf

As you can see, these are pretty serious bits of kit. From what I understand, almost this exact Hybridpack IGBT is used in the Chevy Bolt.

I'm interested in reverse engineering this guy to use with my own logic board (something VESC-based maybe, in effort to make my own cheap 'Axiom'-controller). No specific application, just as an exercise. I've run up against a few roadblocks and thus figured I'd start cataloging my effort here and just to share the information. Also figured some people may be interested in how these are built.

What I have determined thus far:
This board is completely analog/dumb- that is, there is no MCU/FPGA/CLPD's. There are op-amps / comparators, there are driver IC's, isolation transformers, a flip flop IC, so other isolation ICs, along with some components on the backside that I unfortunately cannot see without desoldering the board from the IGBT's, but look to be voltage regulators. So this was very good news- the PWM signals from a seperate logic board most likely must pass to this board directly.

The main components of the board seem to stem from six individual isolated gate driver sections, all of which use:
ACPL-32JT
"Automotive 2.5 Amp Gate Drive Optocoupler with Integrated Flyback Controller for Isolated DC-DC Converter, Integrated IGBT Desat Overcurrent Sensing, Miller Current Clamping and UVLO Feedback"
Datasheet: https://docs.broadcom.com/doc/AV02-4256EN

Current sensing per phase is done with the HC5F900-S - an analog 0-5v output sensor, with each one being conditioned with some basic analog op-amp circuitry.

There are two IC's that straddle the isolated zone that are labeled as:
ACPL-C87BT
Broadcom Automotive High Precision DC Voltage Isolation Sensor
Datasheet: https://docs.broadcom.com/doc/AV02-3564EN

Which I take it are for the HV DC measurement as well as maybe phase voltage measurement (although there are only two? and I see none of that package on the backside of the board)

There is one logic IC, which is a SN74AHCT74, which is a Dual Positive-Edge-Triggered D-Type Flip-Flops With Clear and Preset - I have a feeling this is a catch-all fault mode latch, summing potential fault signals from the ACPL-32JT's? I cannot trace it out however.

There are only two power rails that I can see feed from the main connector- a +12V and a +5V. The 12V at some point drives a boost converter that raises that up to 16-18V for the ACPL-32JT opto driver IC's. I confirm that when I power up the 12v and 5v rails together, all the comparator/op-amps get their 5v rail, and the ACPL-32JT's all get powered by 18v (or around there).

The only connector on the entire board is a single 30-pin connector, and most of the pins on that connector are ganged in pairs, to the point that I think only 12 pins total can be used for current sensing/voltage sensing/fault detect/igbt temps/the PWM.

Unfortunately that is where I have stopped. I don't have good desoldering equip, not good enough to cleanly desolder the board from the IGBT's, and thus can't quite see what is on the other side (looks like mostly passives and more comparators, maybe a power regulator/boost IC and some 6 pin sot packages.

I can't quite figure out how to trace everything thru from the driver IC's to the main connector. The driver IC's look to have an anode and cathode connection to the LED that drives the opto-coupled connection, and I assume this would be the direct input point for the 6 hi/lo PWM signals for motor control. However, there is obviously some circuitry driving those inputs, and something I can't trace out easily to the connector. I've tried to trace out the current sensors' analog outputs to the main connector, as for sure it would have all 3 current readings as analog voltages present on 3 pints of the main connector, but I can't find them. I thought about running a loop of wire through each one and passing a large sinusoid of current thru the loop and scan the pins for that waveform present as a voltage with a scope, but I didn't get too far with that (need to build something that can drive more current to look for changes, the full scale output of those sensors can read hundreds of amps)

Anyone have any advice on going further... Short of desoldering and x-raying the board? Any tricks, anything you see? It has been so hard to try and trace individual traces, due to not having access to the back of the board and due to the conformal coating on everything.

 

[mxlemming]

This looks fun. The board looks relatively simple...

Few thoughts:

You don't need a huge current, try 10 turns of a current 1/10 the size. Or 100 turns or whatever.

Sharp probes and multimeter continuity is your friend.

Are there 15 or 30 pins on that connector, if 15 it'll be easy to work them out... 6pwm, 3 current, few ground, few power... Maybe a fault line and/or enable...

If 30 there will probably be a lot of ground pins.

As a last resort you could directly drive the gate driver pins and find the current sensor opamp outputs.

 

[mikka_e]

Yes! I was able to trace out the current sensor outputs to the main connector. Stuffing about 5 turns of wire thru the small gap it has under each sensor and then just abusing an old junk laptop charger with quick dead shorts on the wire produced about 20 amps apparent to the sensors, which was easy to see as blips on my scope for the different pins... and when DC-coupled, I could see positive and negative going blips depending on which direction current was flowing thru the loops, so they are reporting correctly.
The pins are centered with no current at 1.85v (except one phase, which reads slightly lower at 1.76v). I believe this isn't 1/2 of the 5V full range because the opamps aren't rail-to-rail and thus the offset isn't chosen as centered... maybe.

There are many ganged up pins on the 30 pin connector. Oddly enough, the V and W phase current sensors use 2 pins each (they double output), but the U sensor was only showing on one of the non-ganged outputs (a single pin). I mapped all the ganged outputs by checking for milliohm-resistance pairs and was able to map out the following so far.

With what I have, that leaves only 10 more pins total for all the rest of the signals. 6 of which are PWM? (or, could it be just 3 PWM, with maybe some logic I am not seeing to do the hi lo split? what is typical?) and I would imagine there is the phase voltages and dc link voltage somehow... plus a fault pin... this doesn't leave really much for the temp sensors (maybe the temp sensors are analog compared and muxed into a fault pin? hmmm)..

There is a really low impedance to gnd pin that I think is possibly a different ground specfically for the driver IC's.

Here is the pinout thus far, the pins connected across with lines are ones that read as ganged (shorted together):

 

[mikka_e]

Also of note... this sucker gets warm, just with the 12v and 5v powered it is pulling about 220mA from the 5V and 280mA from the 12V. Doesn't seem super high, but the driver IC's get warm, I am assuming because they are doing the flyback generation for the isolation transformers and so they are generating about half a watt each. The large inductor gets a bit warm, I think this is for the boost converter for the 12v to 16v step up....

The only other thing is that it needs a load of current upon startup to stabilize- my bench supply nearly tops out it's 3 amps at 12 volts for a brief second, and you can hear a high pitched charging-up whine (isolator transformers ringing?) so there is a huge inrush current, and then it levels off at 280mA. I am hoping I am not single-side supplying something that it is unhappy about. All the IC's seem single-supply though based on datasheets. Powering down the rails and bringing them back up, the come up instantly and there is no inrush, just levels off at 280mA, so the bulk of that inrush must just be these big caps...

I am also wondering if it actually wants something like 13.8-14.2 V on the VCC instead of the 12.5 I am giving it right now, since maybe it was designed for a straight car-battery typical positive voltage. Maybe that would make the converter and other regulators I am not seeing happier...?

 

[amberwolf]

no brain on board sounds like a great candidate for a powerstage of a lebowski, like an easier version of this:

https://endless-sphere.com/forums/viewtopic.php?f=30&t=105711&hilit=lebowski

 

[mxlemming]

Good findings.

You should tool up a bit of you're going to chase this one!
Lab power supply (I really like the riden dps5020, I have 2 of them and another in the post)

If you have a current limited power supply it's just far less likely to break. If you plug straight into a lipo, expect one go at getting it wrong.

Oscilloscope is incredibly useful... I use siglent sds1104x-e... you already have one i think?

Stm32 nucleo boards or the f407 discovery board is very useful and you can drive pwm from it easily by programming from cubeIDE.

VESC is based on the discovery board I mention above.

Connect to the pins using resistors initially... If you put a few hundred ohms (220R? Anything between this and 1kohm probably fine) between the MCU you're using and the board you should be fairly limited in the damage you can cause. If 3v3 logic, that limits the current to 15mA which the pins can (probably) drive all day without dieing. Connecting them to 12V will still be fatal.

Are the current outputs differential? The two pins the same polarity or inverted?

 

[mikka_e]

Oh I have all of that- 3 lab supplies, two scopes, 500k count meter, various STM boards here and there (will probably spin up something specific for this once I get close with the pinout). This is my first foray into motor control tech, my other electronics hobby is eurorack synthesizers, so this is a slight tangential detour.

This 30 pin connector is a 2x15 1.27mm pitch guy so I'm searching for something to break that out now.

The current sense outputs are not differential. The tied together pins are really tied together, at the connector. Why two of the current sense signals have 2 pins each and one is only one pin I have no idea.

I note that there is a label on this board that says 'rev 00' .... hopefully these were actually functioning at some time and there wasn't a design flaw from the start! I have reason to believe this was at least actually tested with real hardware as there was marks where screws had bolted down bus bars and posts on the 3 phase outputs and on the back cooling fin plate there is residue from sealant where it was sealed to a water jacket at some point, so, that is encouraging somewhat.


I think one of the ACPL-C87BT's is sensing the DC bus voltage and sending that across isolation, but I haven't determined what the other ACPL-C87BT is doing. And I haven't figured out how it could be passing voltage sensing of the 3 phases back across either - there are not any extra ACPL-C87BT's, not even on the back from what I can see.

 

[mxlemming]

Haha you're not exactly out of your depth if you've got so that stuff and have been building other electronics.

Regarding the phase voltages, it's only really VESC that needs them. All the other libraries just need current since you can't actually run the phase voltage measurement while the inverter is enabled anyway.

There are several strategies to start up from moving, single pwm pulse and see how much current build up there is, then back calculate voltage

Use hall sensors/encoder to know speed and calculate the voltage based on kV

Either works fine but isn't implemented on VESC. I can't remember if lebowski controller needs phase sensing.

St and infineon libraries do not.

 

[mikka_e]

That is super good to know, I was starting to wonder about voltage sensing. That makes sense that it isn't required during enabled running, only current.

I have spent a bit of time going over the various control schemes, from how VESC works to the Texas Instruments InstaSpin... I haven't really settled on what I want to interface with this. I've spent a LOT of time going over the paltatech github schematic for what became the Axiom controller as a few years ago I really wanted to build something along those lines, but then that project has turned a bit less DIY-able. From a hardware standpoint, that was invaluable in understanding the basic layout of the hardware.

Now my limitation is not having super sharp probes to pierce this damn conformal coating easily - it is very hard to scrape off, and I must be very careful because the passives are very small packages and so it is delicate to try and scrape away conformal coating but NOT damage these small resistors and caps. Most of these are simple filter networks on opamps for conditioning and differential to single ended stages for the signals I think. That and some signals disappear to the bottom of course that I can't get to.

Surprisingly I think this is only a 2-layer board. Ground plane is most of the bottom, with most everything routed on top including power rails.

Right now I'm happy that, when 12v and 5v rails are powered up, I have confirmed voltages on the IC's that are across the isolation gap- meaning the driver flyback and transformers are doing their thing correctly and the regulators on the HV side of the isolation are all powered correctly, delivering 15v and 5v rails on that side. So as far as I can tell, everything is powered fully.

So next steps.... find how the anode/cathode of the opto LED for the drivers is driven and trace that back to the connector. and figure out what the hell this flip flop is doing and how the enable / fault signals are passed to / from the driver ICs.

 

[Jrbe]

Have you looked through the different driver boards Infineon offers for those IGBT's? There's a chance whoever designed it used an Infineon driver board and possibly connector to develop it. Might be the same pin count / pinout / shifted and added to pinout but different connector.
Might get you a list of typical IO to work from at the least.

The other option, if it is from a Volt you might be able to find the pinout in Chevy diagnostic info.

Looking quick, there seems to be version a and b for sale. Do you have some way of knowing it's really tested and in good working order?

You can get different probe adapter tips that push over the end of your normal probes.

It's worth getting a pigtail for that connector so you don't accidentally short any pins out.

A desoldering pump will help you separate the board from the IGBT's. Access to the bottom of the board will likely be worth the effort.

 

[mikka_e]

I've looked through everything I can find on Infineon's dev kits and such and cannot find anything for this specific type of hybridpack II. The other gate driver reference designs I have found are all for either the 'six pack' style (like what Axiom was designed for) - or, there is one dev kit design out there but I have not found any schematics for it and it looks to be a completely different driver scheme.

The only Chevy Bolt image I have found that shows the inverter board is this one, which is the bottom side- it surely is a similar design but it probably wouldn't help my pinout tracing much. I would find it interesting to see the similarities but surprisingly I cannot find anyone who has torn down a Bolt (not Volt) inverter.
https://www.techinsights.com/sites/default/files/2020-07/Figure9.jpg

Yes the place that is selling these off has two designs, an "A" and a "B"- this is the "A" and I thought this design would be easier to reverse engineer as the driver sections looked all very separated and identical with separate transformers for each gate driver IC sending power across the isolation, whereas the "B" design looks like they ganged all the requirements for the transformers into a single, larger transformer.

I was really inspired by the Axiom guys as much of what is limiting my and people I know's automotive DIY builds is lack of suitable power controllers (and the OpenInverter based solutions are just not well documented or as interesting IMO). Unfortunately the Axiom now isn't something it looks like people will be able to DIY and their latest target pricepoint is about 10x more than what I could reasonably spend for a simple garage-build and thus my endeavor with an ebay special here.

Tonight's progress- found pin for the DC bus V sense, and measured it to output roughly 5.5mV/V. The measurement is taken off the "W" phase IGBT.

I had previously found that the +/- bus input resistance to the W phase IGBT was slightly different than the other two - across U and V's DC inputs read effective infinite ohm, but W read about 2.5 MegOhm, and I was worried that something may be toast, but now I see that it likely has to do with this giant resistor voltage divider that forms the basis for the input to the isolated DC voltage measurement IC, which is only found on the W phase section.