Reverse engineering a server CPU voltage regulator module

A recent ebay fishing expedition yielded an interesting little part for the very reasonable sum of about five pounds. It’s a voltage regulator module from a Dell PowerEdge 6650 Xeon server.

I originally bought this because I had the idea of salvaging parts from it to use in another project. These are high quality modules that will have very good inductors and sometimes an array of high value ceramic capacitors that could be re-used (ceramics of at least 22µF at 16V and above are rather pricey at the moment). So the VRM arrived and I was rather impressed with the build quality and decided to have a go at reverse engineering it.

First impressions

The board is at least 2 layers and I’m betting that the topology is a switching buck converter. If I peek under that big heatsink I can see a large inductor, a smaller inductor, Fairchild FDP7030L and FDB7030L power MOSFETs, a bank of ceramic and a bank of tantalum capacitors. Basically all the components you need for the power section of a buck converter. The inductors are Coiltronics UP2B-R47 and UP4B-1R5, both with maximum current ratings in excess of 10A. There’s also a MIC4420BM MOSFET driver with a peak current rating of 6A which gives us a clue as to the output current limit of this board.

The FDP7030L power MOSFET is screwed to the heatsink so I thought it’d be easy to get the heatsink off by just removing that screw. Not so. There are a number of ‘posts’ that prop the heasink up into position and I just couldn’t get these to budge without risking damage to the part.

They’re soldered to the board and fixed somehow to the heatsink. My attempts at desoldering failed probably due to the heat that I applied being wicked straight up the post into the heatsink itself. I don’t want to damage this board so I’m afraid you’ll have to make do with some shots from around the sides where I can see under the heatsink.

The control circuitry

Here’s where it gets interesting. There’s rather a lot happening on the control side of the board.




Click for larger

The big obvious 20 pin IC is an Intersil HIP6004B and sure enough the datasheet confirms that it is indeed a switching buck regulator with recommended applications that include the power supply for older generation CPUs.




Click for PDF

What makes this part interesting is the way that you select the output voltage. These days the typical method for setting the output voltage is to use a resistor divider but this device does it through a 5-bit digital input that feeds an onboard DAC.

The other IC up the top left is an LM324D quad op-amp. I honestly cannot think what that’s doing on here and my searching around to find example applications that include such an op-amp array in this configuration yielded nothing. Maybe I’ll be able to figure it out during testing.

There are a large number of test pads dotted around the board but unfortunately none of them are labelled with the expected value.

Reverse engineering the power connections

My aim is to power this VRM up using a bench power supply and then to probe the various parts to find out what’s what. To do that I need to locate the power input and ground. I don’t need to locate the power output because I can probe for that but I think it’ll be an easy one to guess anyway.

Firstly, let’s locate ground. Here’s the pinout of the IC.

Ground is on pin 11. I set my meter to the continuity testing buzzer and probed around the golden fingers. Easy. All the fat fingers on the heatsink side are ground. No worries.

Let’s move on to VCC, the power input. It’s on pin 18 and a big obvious hint on the control circuitry side is the presence of a white SMD fuse down at the bottom right. The ‘LF’ logo is Littlefuse and it’s rated at 15A.

Yes, that was it. The fat finger on the right is the power input. I could go ahead and power it up right now and probe for the power output but let’s see if it’s where I think it is.

Switching regulators like this one have an inductor in series with the output voltage so all I need to do is probe either pin of that big inductor under the heatsink and the suspect fat fingers on the control side that are unaccounted for.

Sure enough those pins confirm to be the power output. Those metal bars are interesting aren’t they? Each one of them bridges over some vias in a large copper fill. The silk screen label prefix of ‘BB’ probably stands for ‘bus bar’ which is a common engineering term for a big fat conductor. I assume that the designers were trying to ensure that the current delivery is as even as possible across all the golden fingers. It’s certainly an interesting design decision and does hint at a belt-and-braces design.

Now I can power it up and see what it actually does.

Power on

I rigged up my bench power supply to the board using crocodile clips to clamp to the power and ground connections. Wads of paper are used on the ‘other’ side of the crocodile clips to prevent unwanted short circuits.

The Intersil IC claims to operate at 5V and 12V, both of which are present on a computer motherboard so I dialled in the lower 5V value and powered up. I probed the power output to see what was there. Nothing. OK, time to try 12V. This time I got a much better result. 3.3V and change was present on the output pins.

That’s a really useful output voltage for hobby use. I had a quick probe around the pins of the Intersil IC with an oscilloscope to see if I could locate a waveform that would give away the switching frequency. There it was on pin 13, the PHASE pin.

The frequency of that PWM waveform is 296.3kHz with an amplitude of 12V.

What I need to do now is set up a test rig to see how stable the output is under load, and the best way to achieve that is to use a piece of test equipment called a DC Electronic Load.

These devices apply a load to a circuit under test. You’ll get some combination of constant current, voltage and power modes depending on how much you want to spend. The maximum wattage is also a price differentiator. I got this Itech IT8511+ on Ali Express. Itech are the OEM for BK precision loads so you know that this is a quality part.

I’ll test this circuit in constant current mode. That means I dial in a current on the load and the device will sink up to that current while burning it off as heat. My bench power supply is limited to 3A output but if you recall your basic physics you’ll remember that power is conserved throughout the system so if I put in 1A at 12V and get 12W then a perfect power supply would deliver 12W / 3.3V = 3.6A at the output.

In reality the power supply is far from perfect and some of those 12 watts will be lost. Typical efficiencies for switching power supplies range from 70 to over 90% depending on a number of variables including the load current.

I ran the test and applied a gradually increasing load up to 5A. I stopped there, not because it was getting hot – it wasn’t, the heatsink was just warm but because I know the MOSFET driver is rated at a maximum of 6A and there may be other, lower rated components that I don’t know about.

I have an accurate Keysight U3402A bench multimeter so I decided to take a number of readings at steadily increasing intervals of 100mA from zero to 5A to see how stable the output was and also to calculate the efficiency percentages.

I-loadI-inP-inVoutPoutPlossEfficiency
00.111.323.332101.320
0.10.131.563.33130.333131.2268721.35448718
0.20.161.923.33070.666141.2538634.69479167
0.30.192.283.32980.998941.2810643.81315789
0.40.222.643.32981.331921.3080850.45151515
0.50.242.883.32821.66411.215957.78125
0.60.273.243.32761.996561.2434461.62222222
0.70.33.63.32692.328831.2711764.68972222
0.80.333.963.32582.660641.2993667.18787879
0.90.364.323.32492.992411.3275969.26875
10.384.563.32473.32471.235372.91008772
1.10.414.923.32353.655851.2641574.30589431
1.20.445.283.32633.991561.2884475.59772727
1.30.475.643.32534.322891.3171176.64698582
1.40.563.32444.654161.3458477.56933333
1.50.536.363.32364.98541.374678.38679245
1.60.556.63.32335.317281.2827280.56484848
1.70.586.963.32345.649781.3102281.175
1.80.617.323.3235.98141.338681.71311475
1.90.647.683.3236.31371.366382.20963542
20.678.043.3226.6441.39682.63681592
2.10.78.43.31746.966541.4334682.935
2.20.738.763.31747.298281.4617283.31369863
2.30.769.123.31657.627951.4920583.63980263
2.40.799.483.31467.955041.5249683.91392405
2.50.829.843.31328.2831.55784.17682927
2.60.8510.23.31228.611721.5882884.42862745
2.70.8910.683.31088.939161.7408483.7
2.80.9311.163.31039.268841.8911683.05412186
2.90.9611.523.3099.59611.923983.29947917
30.9911.883.30779.92311.956983.52777778
3.11.0312.363.306610.250462.1095482.93252427
3.21.0612.723.30610.57922.140883.16981132
3.31.0913.083.305310.907492.1725183.39059633
3.41.1213.443.304811.236322.2036883.60357143
3.51.1513.83.304111.564352.2356583.79963768
3.61.1814.163.303811.893682.2663283.99491525
3.71.2114.523.303112.221472.2985384.16990358
3.81.2414.883.302112.547982.3320284.32782258
3.91.2815.363.300512.871952.4880583.80175781
41.3115.723.298713.19482.525283.93638677
4.11.3416.083.294513.507452.5725584.00155473
4.21.3716.443.293813.833962.6060484.14817518
4.31.416.83.29314.15992.640184.28511905
4.41.4317.163.292514.4872.67384.42307692
4.51.4617.523.291814.81312.706984.54965753
4.61.5183.291115.139062.8609484.10588889
4.71.5318.363.290215.463942.8960684.22625272
4.81.5618.723.2915.7922.92884.35897436
4.91.5919.083.288816.115122.9648884.46079665
51.6219.443.28816.44384.56790123

While collecting the data I noticed how the output voltage behaved at each level. The output voltage typically fluctuated by 500µV or so except around 1.8 to 2A where the fluctuations were more like 1 or 2mV. As the output voltage approached 3.3000V it appeared to become much more stable, often sitting without any fluctuation at all on my meter.

The data in the table can be visualised in these charts.

Analysing the rest of the board

It’s great that I can use the board as a 3.3V power supply as-is, but it would be really nice if I knew what the little golden fingers on the edge connector did. To help with this I photographed and printed out both sides of the PCB.

Having it down on a piece of paper really helps because you can jot down notes directly onto the image as you discover things. On the PCB side I labelled the little fingers A through F. Here’s what I managed to find out about them.

A B C D E F
3.3V NC 12V PGOOD 12V NC

The 3.3V and 12V outputs are a mystery to me. They snake off through many components in the direction of the op-amp and the values don’t seem to change with load.

PGOOD is an easy one. That’s an open-drain output from the Intersil IC that floats when everything’s fine and is driven to ground when it’s not. Apply a pullup resistor to your MCU’s IO supply to sense the output of this pin.

I did the same sort of thing on the heatsink side, labelling the pins G through K. Here’s what I could find out.

G H I J K
NC NC input NC input

Only two of the contacts are actually connected to anything. I probed them and found that they weren’t driven to any particular level so I measured the resistance to ground and found it to be more or less exactly 50Ω which would appear to make them input pins.

I guessed that perhaps these pins formed part of an external resistor-divider that might calibrate the output voltage so I tried applying various resistances to ground, to the output voltage and using a potentiometer to create a divider. The good news was that there was some response from the output voltage as I experimented, but only ever upwards. That is, all I could do was cause the output voltage to rise slightly, nothing I did caused it to fall which wasn’t much use.

Video

I put together a video on YouTube of me fumbling around trying to figure this thing out. Click below or better still browse to the YouTube site to watch it in glorious high definition.

Summary

It’s a tale of two halves really. I’m pleased that I’ve managed to power up the board and get a useful output voltage from it but I’m a little disappointed that I could not identify what most of the IO pins on the board are doing. I could easily mount one of these into an edge connector and build a little power supply around it, and I may yet do that. However I’m going to hold off for a while to see if anyone out there has any tips regarding the unknown functionality of the unknown contacts. Please leave a comment down below or visit the forum thread and post your suggestions there.

Update: breakthrough!

Thanks to some excellent work by a blog reader the Artesyn (as opposed to Dell) part number has been identified. It is an NXA66 and the datasheet is available with the complete pinout documented in it. Click here to download the datasheet.

Here’s a snapshot of the pinout table from the datasheet. This is very good news. I’ve already got some 2×25 2.54mm edge connectors so I can now go ahead and design a cheap little PSU board around this high quality module. More to follow in due course.

  • Iuliu Dărăban

    What bench power supply have you used for test ?

    PS : great job.

    • Hi, nothing fancy. Just a CSI 5003XE “DC Regulated Power Supply” from CircuitSpecialists.eu. I wish it had more than one output but other than that it does the job fine.

      • Iuliu Dărăban

        As long is doing the job , its great. Nice reverse engineering .

  • Nate_B

    Nice work. I noticed and purchased a lot of these same modules on ebay this morning thinking they would be fun to poke around for re-purposing and it’s great to find out that someone already has and documented it.
    One small note. Your Vout vs Iout graph has a nice linear trend to it, which is the sort of thing that would be expected from ohm’s law if there were a small bit of resistance between the regulator and the voltage measurement point. It looks like you’re measuring the voltage at the alligator clips, so the limited contact between the clips and the board might explain it (or maybe some internal resistance on the board).

    • Hi Nate, that’s certainly a plausible theory about the clip contacts. I intend to do some more measurements and general playing around with these modules once I get my custom PCB built. In the forum thread there are some more notes including the alternate voltage level that you can get by controlling the VSP pin.

  • Marcelo Dantas

    Hi Andy, this is really cool.
    I have 3 of these I pulled from some old Dell servers my company was throwing out. I kept them as I was sure they would have good use some day.
    I have also 3 of these called “PE2500 VOLTAGE REGULATOR VRM DD-1480-1D”. Which I can’t seem to find any documentation and/or pinout on.
    Maybe you have any idea about these ones? Or maybe someone here would have some information?

    Thanks a lot,
    Marcelo.

    • Hi Marcelo. It looks like a much simpler design than the Artesyn unit reviewed here. If you can guess the ground, input and output pins then you can try to power it up and see what the output voltage will be. Can you remove the heatsink from the main IC? Identifying that would give you a good insight into the function of the other pins.

      • Marcelo Dantas

        I didn’t pull the heatsink, but the chip seems to be the same HIP 6004B. At least I was able to trace the Gnd and Vcc pins to the edge connector, matching a LittleFuse on the (12V) input and negative of capacitors on the Gnd.
        The PGood pin is also directly connected to a pin on the edge, as well as the VIDn pins (via 0ohm resistors).
        The baby however gives me 1.35 volts instead of 3.33 when I plug 12V to it.
        I will do some more research to see what else I can find out.

        • Gibbly

          The lower voltage sounds more like modern cpus. I would say that vrm module came from an lga 775 motherboard (the older soccet 478 and 423 platforms had processors running up to 1.75v) although it is possible that it is something newer.