Organize and Share your Electronics the way you want. Sign-Up for a free account now. It takes only 30 seconds!

Reverse engineering a server CPU voltage regulator module

Reverse engineering a server CPU voltage regulator module

A recent ebay fishing expedition yielded an interesting little part for the very reasonable sum of about five pounds. It’s a voltage regulator module from a Dell PowerEdge 6650 Xeon server.

I originally bought this because I had the idea of salvaging parts from it to use in another project. These are high quality modules that will have very good inductors and sometimes an array of high value ceramic capacitors that could be re-used (ceramics of at least 22µF at 16V and above are rather pricey at the moment). So the VRM arrived and I was rather impressed with the build quality and decided to have a go at reverse engineering it.

First impressions

The board is at least 2 layers and I’m betting that the topology is a switching buck converter. If I peek under that big heatsink I can see a large inductor, a smaller inductor, Fairchild FDP7030L and FDB7030L power MOSFETs, a bank of ceramic and a bank of tantalum capacitors. Basically all the components you need for the power section of a buck converter. The inductors are Coiltronics UP2B-R47 and UP4B-1R5, both with maximum current ratings in excess of 10A. There’s also a MIC4420BM MOSFET driver with a peak current rating of 6A which gives us a clue as to the output current limit of this board.

The FDP7030L power MOSFET is screwed to the heatsink so I thought it’d be easy to get the heatsink off by just removing that screw. Not so. There are a number of ‘posts’ that prop the heasink up into position and I just couldn’t get these to budge without risking damage to the part.

They’re soldered to the board and fixed somehow to the heatsink. My attempts at desoldering failed probably due to the heat that I applied being wicked straight up the post into the heatsink itself. I don’t want to damage this board so I’m afraid you’ll have to make do with some shots from around the sides where I can see under the heatsink.

The control circuitry

Here’s where it gets interesting. There’s rather a lot happening on the control side of the board.




Click for larger

The big obvious 20 pin IC is an Intersil HIP6004B and sure enough the datasheet confirms that it is indeed a switching buck regulator with recommended applications that include the power supply for older generation CPUs.




Click for PDF

What makes this part interesting is the way that you select the output voltage. These days the typical method for setting the output voltage is to use a resistor divider but this device does it through a 5-bit digital input that feeds an onboard DAC.

The other IC up the top left is an LM324D quad op-amp. I honestly cannot think what that’s doing on here and my searching around to find example applications that include such an op-amp array in this configuration yielded nothing. Maybe I’ll be able to figure it out during testing.

There are a large number of test pads dotted around the board but unfortunately none of them are labelled with the expected value.

Reverse engineering the power connections

My aim is to power this VRM up using a bench power supply and then to probe the various parts to find out what’s what. To do that I need to locate the power input and ground. I don’t need to locate the power output because I can probe for that but I think it’ll be an easy one to guess anyway.

Firstly, let’s locate ground. Here’s the pinout of the IC.

Ground is on pin 11. I set my meter to the continuity testing buzzer and probed around the golden fingers. Easy. All the fat fingers on the heatsink side are ground. No worries.

Let’s move on to VCC, the power input. It’s on pin 18 and a big obvious hint on the control circuitry side is the presence of a white SMD fuse down at the bottom right. The ‘LF’ logo is Littlefuse and it’s rated at 15A.

Yes, that was it. The fat finger on the right is the power input. I could go ahead and power it up right now and probe for the power output but let’s see if it’s where I think it is.

Switching regulators like this one have an inductor in series with the output voltage so all I need to do is probe either pin of that big inductor under the heatsink and the suspect fat fingers on the control side that are unaccounted for.

Sure enough those pins confirm to be the power output. Those metal bars are interesting aren’t they? Each one of them bridges over some vias in a large copper fill. The silk screen label prefix of ‘BB’ probably stands for ‘bus bar’ which is a common engineering term for a big fat conductor. I assume that the designers were trying to ensure that the current delivery is as even as possible across all the golden fingers. It’s certainly an interesting design decision and does hint at a belt-and-braces design.

Now I can power it up and see what it actually does.

Power on

I rigged up my bench power supply to the board using crocodile clips to clamp to the power and ground connections. Wads of paper are used on the ‘other’ side of the crocodile clips to prevent unwanted short circuits.

The Intersil IC claims to operate at 5V and 12V, both of which are present on a computer motherboard so I dialled in the lower 5V value and powered up. I probed the power output to see what was there. Nothing. OK, time to try 12V. This time I got a much better result. 3.3V and change was present on the output pins.

That’s a really useful output voltage for hobby use. I had a quick probe around the pins of the Intersil IC with an oscilloscope to see if I could locate a waveform that would give away the switching frequency. There it was on pin 13, the PHASE pin.

The frequency of that PWM waveform is 296.3kHz with an amplitude of 12V.

What I need to do now is set up a test rig to see how stable the output is under load, and the best way to achieve that is to use a piece of test equipment called a DC Electronic Load.

These devices apply a load to a circuit under test. You’ll get some combination of constant current, voltage and power modes depending on how much you want to spend. The maximum wattage is also a price differentiator. I got this Itech IT8511+ on Ali Express. Itech are the OEM for BK precision loads so you know that this is a quality part.

I’ll test this circuit in constant current mode. That means I dial in a current on the load and the device will sink up to that current while burning it off as heat. My bench power supply is limited to 3A output but if you recall your basic physics you’ll remember that power is conserved throughout the system so if I put in 1A at 12V and get 12W then a perfect power supply would deliver 12W / 3.3V = 3.6A at the output.

In reality the power supply is far from perfect and some of those 12 watts will be lost. Typical efficiencies for switching power supplies range from 70 to over 90% depending on a number of variables including the load current.

I ran the test and applied a gradually increasing load up to 5A. I stopped there, not because it was getting hot – it wasn’t, the heatsink was just warm but because I know the MOSFET driver is rated at a maximum of 6A and there may be other, lower rated components that I don’t know about.

I have an accurate Keysight U3402A bench multimeter so I decided to take a number of readings at steadily increasing intervals of 100mA from zero to 5A to see how stable the output was and also to calculate the efficiency percentages.

I-load I-in P-in Vout Pout Ploss Efficiency
0 0.11 1.32 3.3321 0 1.32 0
0.1 0.13 1.56 3.3313 0.33313 1.22687 21.35448718
0.2 0.16 1.92 3.3307 0.66614 1.25386 34.69479167
0.3 0.19 2.28 3.3298 0.99894 1.28106 43.81315789
0.4 0.22 2.64 3.3298 1.33192 1.30808 50.45151515
0.5 0.24 2.88 3.3282 1.6641 1.2159 57.78125
0.6 0.27 3.24 3.3276 1.99656 1.24344 61.62222222
0.7 0.3 3.6 3.3269 2.32883 1.27117 64.68972222
0.8 0.33 3.96 3.3258 2.66064 1.29936 67.18787879
0.9 0.36 4.32 3.3249 2.99241 1.32759 69.26875
1 0.38 4.56 3.3247 3.3247 1.2353 72.91008772
1.1 0.41 4.92 3.3235 3.65585 1.26415 74.30589431
1.2 0.44 5.28 3.3263 3.99156 1.28844 75.59772727
1.3 0.47 5.64 3.3253 4.32289 1.31711 76.64698582
1.4 0.5 6 3.3244 4.65416 1.34584 77.56933333
1.5 0.53 6.36 3.3236 4.9854 1.3746 78.38679245
1.6 0.55 6.6 3.3233 5.31728 1.28272 80.56484848
1.7 0.58 6.96 3.3234 5.64978 1.31022 81.175
1.8 0.61 7.32 3.323 5.9814 1.3386 81.71311475
1.9 0.64 7.68 3.323 6.3137 1.3663 82.20963542
2 0.67 8.04 3.322 6.644 1.396 82.63681592
2.1 0.7 8.4 3.3174 6.96654 1.43346 82.935
2.2 0.73 8.76 3.3174 7.29828 1.46172 83.31369863
2.3 0.76 9.12 3.3165 7.62795 1.49205 83.63980263
2.4 0.79 9.48 3.3146 7.95504 1.52496 83.91392405
2.5 0.82 9.84 3.3132 8.283 1.557 84.17682927
2.6 0.85 10.2 3.3122 8.61172 1.58828 84.42862745
2.7 0.89 10.68 3.3108 8.93916 1.74084 83.7
2.8 0.93 11.16 3.3103 9.26884 1.89116 83.05412186
2.9 0.96 11.52 3.309 9.5961 1.9239 83.29947917
3 0.99 11.88 3.3077 9.9231 1.9569 83.52777778
3.1 1.03 12.36 3.3066 10.25046 2.10954 82.93252427
3.2 1.06 12.72 3.306 10.5792 2.1408 83.16981132
3.3 1.09 13.08 3.3053 10.90749 2.17251 83.39059633
3.4 1.12 13.44 3.3048 11.23632 2.20368 83.60357143
3.5 1.15 13.8 3.3041 11.56435 2.23565 83.79963768
3.6 1.18 14.16 3.3038 11.89368 2.26632 83.99491525
3.7 1.21 14.52 3.3031 12.22147 2.29853 84.16990358
3.8 1.24 14.88 3.3021 12.54798 2.33202 84.32782258
3.9 1.28 15.36 3.3005 12.87195 2.48805 83.80175781
4 1.31 15.72 3.2987 13.1948 2.5252 83.93638677
4.1 1.34 16.08 3.2945 13.50745 2.57255 84.00155473
4.2 1.37 16.44 3.2938 13.83396 2.60604 84.14817518
4.3 1.4 16.8 3.293 14.1599 2.6401 84.28511905
4.4 1.43 17.16 3.2925 14.487 2.673 84.42307692
4.5 1.46 17.52 3.2918 14.8131 2.7069 84.54965753
4.6 1.5 18 3.2911 15.13906 2.86094 84.10588889
4.7 1.53 18.36 3.2902 15.46394 2.89606 84.22625272
4.8 1.56 18.72 3.29 15.792 2.928 84.35897436
4.9 1.59 19.08 3.2888 16.11512 2.96488 84.46079665
5 1.62 19.44 3.288 16.44 3 84.56790123

While collecting the data I noticed how the output voltage behaved at each level. The output voltage typically fluctuated by 500µV or so except around 1.8 to 2A where the fluctuations were more like 1 or 2mV. As the output voltage approached 3.3000V it appeared to become much more stable, often sitting without any fluctuation at all on my meter.

The data in the table can be visualised in these charts.

Analysing the rest of the board

It’s great that I can use the board as a 3.3V power supply as-is, but it would be really nice if I knew what the little golden fingers on the edge connector did. To help with this I photographed and printed out both sides of the PCB.

Having it down on a piece of paper really helps because you can jot down notes directly onto the image as you discover things. On the PCB side I labelled the little fingers A through F. Here’s what I managed to find out about them.

A B C D E F
3.3V NC 12V PGOOD 12V NC

The 3.3V and 12V outputs are a mystery to me. They snake off through many components in the direction of the op-amp and the values don’t seem to change with load.

PGOOD is an easy one. That’s an open-drain output from the Intersil IC that floats when everything’s fine and is driven to ground when it’s not. Apply a pullup resistor to your MCU’s IO supply to sense the output of this pin.

I did the same sort of thing on the heatsink side, labelling the pins G through K. Here’s what I could find out.

G H I J K
NC NC input NC input

Only two of the contacts are actually connected to anything. I probed them and found that they weren’t driven to any particular level so I measured the resistance to ground and found it to be more or less exactly 50Ω which would appear to make them input pins.

I guessed that perhaps these pins formed part of an external resistor-divider that might calibrate the output voltage so I tried applying various resistances to ground, to the output voltage and using a potentiometer to create a divider. The good news was that there was some response from the output voltage as I experimented, but only ever upwards. That is, all I could do was cause the output voltage to rise slightly, nothing I did caused it to fall which wasn’t much use.

Video

I put together a video on YouTube of me fumbling around trying to figure this thing out. Click below or better still browse to the YouTube site to watch it in glorious high definition.

Summary

It’s a tale of two halves really. I’m pleased that I’ve managed to power up the board and get a useful output voltage from it but I’m a little disappointed that I could not identify what most of the IO pins on the board are doing. I could easily mount one of these into an edge connector and build a little power supply around it, and I may yet do that. However I’m going to hold off for a while to see if anyone out there has any tips regarding the unknown functionality of the unknown contacts. Please leave a comment down below or visit the forum thread and post your suggestions there.

Update: breakthrough!

Thanks to some excellent work by a blog reader the Artesyn (as opposed to Dell) part number has been identified. It is an NXA66 and the datasheet is available with the complete pinout documented in it. Click here to download the datasheet.

Here’s a snapshot of the pinout table from the datasheet. This is very good news. I’ve already got some 2×25 2.54mm edge connectors so I can now go ahead and design a cheap little PSU board around this high quality module. More to follow in due course.

Read more Here







 

More Articles to Read

G-code controlled drawing plotter
G-code controlled drawing plotter
An Arduino round word clock
An Arduino round word clock
The Sandwich-o-Matic will make your lunch automatically
The Sandwich-o-Matic will make your lunch automatically
Scalar Network Analyser Jr
Scalar Network Analyser Jr
An Arduino-controlled automated whiskey distillery
An Arduino-controlled automated whiskey distillery
The Rex800 looks like a dinosaur Terminator
The Rex800 looks like a dinosaur Terminator
Home Environment Monitor
Home Environment Monitor
Understanding the Operation of the Frequency Synthesizer in Maxim’s RF Transceivers
Understanding the Operation of the Frequency Synthesizer in Maxim’s RF Transceivers
App note: EPIC: Electro-Pyrotechnic Initiator Chip Resistor
App note: EPIC: Electro-Pyrotechnic Initiator Chip Resistor
Noisy ESP8266
Noisy ESP8266
Noisy ESP8266
Noisy ESP8266
App note: Noise analysis for high-speed op amps
App note: Noise analysis for high-speed op amps
Skill Sunday: Arrays
Skill Sunday: Arrays
App note: Infrared remote control implementation with MSP430FR4xx
App note: Infrared remote control implementation with MSP430FR4xx
Gesture Controlled Smart Home
Gesture Controlled Smart Home
Design for a Wideband, Differential Transimpedance DAC Output
Design for a Wideband, Differential Transimpedance DAC Output
Wrist thrusters let you fly through the water effortlessly
Wrist thrusters let you fly through the water effortlessly
Bertan/Spellman 225-20R HV power supply teardown
Bertan/Spellman 225-20R HV power supply teardown
Blinking Christmas Lights
Blinking Christmas Lights
Adjusting clock with alarm, hygrometer & thermometer on 1.8″ ST7735 display
Adjusting clock with alarm, hygrometer & thermometer on 1.8″ ST7735 display

Top


Shares