This repository contains the OpenVVVF Hardware designs. User-facing documentation, safety analyses, assembly guides, and test evidence now live in OpenVVVF/Documentation (rendered at https://openvvvf.github.io/Documentation/). The matching firmware, Real Time Examiner (RTE) host tool, and supporting configuration utilities (including node codegen and telemetry tooling) now live in OpenVVVF/RTE.
An open-source, high-power voltage-source inverter (VSI) for 3-phase AC drives. The design centres on a dual-MCU control board with an independent safety coprocessor, fully isolated gate drives and sensing, dual isolated CAN buses, and a control stack configurable through node-based codegen tools.
A note on the name: VVVF stands for Variable Voltage Variable Frequency — it describes the output, not the control strategy. This platform is not limited to scalar V/Hz control; it supports vector control (FOC), arbitrary modulation schemes, and any control scheme you can express through the node-based codegen tools.
The present hardware implementation (Chassis Size 2) is a 200–450 V class / 600 A build. The usable DC bus voltage is set by the installed DC link capacitors: 200 V class with the stock 200 V aluminium-electrolytic bank, or up to 450 V class with a capacitor-only swap to 450 V parts. The platform is designed to scale to higher voltage and current classes with appropriate gate-driver, DC link, and sensing-divider adaptations.
This project is currently being developed in Dr. Keith Corzine's Smart Power Lab at the University of California, Santa Cruz.
The hardware designs are modular and share a common control architecture and communication interfaces with the firmware in OpenVVVF/RTE. All hardware and software are released under open-source licenses.
The control board is designed as a reusable platform that is largely independent of the power stage. With isolation barriers rated for high-voltage power stages (CAN transceiver VIORM 2121 VPK; voltage-sense range 1.8 kV full-scale), the same inverter can be paired with a wide range of inverter classes; higher voltage classes are achievable with straightforward gate-driver and sensing-divider adaptations. The PWM and protection interfaces are also compatible with user-supplied gate-drive stages, allowing the inverter to be integrated into custom power-converter designs. Planned chassis variants include:
| Variant | Voltage Class | Phase Current | Status |
|---|---|---|---|
| Chassis Size 2 | 200 V class (stock 200 V capacitors); 450 V class (450 V capacitor swap) | 600 A | Implemented, under test |
| Chassis Size 3 | Up to 1200 V (capacitor-dependent) | 1400 A | In development |
Semiconductor ratings are selected with margin for the target DC bus: Chassis Size 2 uses 600 V rated IGBTs for the 200–450 V range, while future higher-voltage classes use 1200 V or 1700 V rated parts as appropriate.
- 3-phase 2-level IGBT bridge built from three Mitsubishi CM600DY half-bridge modules (six switches, 600 A class, 62 mm package). The recommended device for Chassis Size 2 is the CM600DY-13T (600 V), which matches the 200–450 V DC bus range. The CM600DY-24T (1200 V) is also electrically and mechanically compatible and may be used if a higher-voltage device is preferred.
- Phase current: 600 A design continuous rating (full-load dyno validation pending; peak capability dependent on thermal management)
- DC bus voltage: 200–450 V class, set by the installed DC link capacitors — 200 V class with the stock bank, up to 450 V class with a capacitor-only swap (see DC Link below)
- Gate drivers: Six onsemi NCV57100 isolated IGBT gate drivers (one per switch, AEC-Q100 automotive-qualified)
- Reinforced isolation: >5 kVrms (UL1577), 1424 VPK / 1000 Vrms working voltage (VDE 0884-11)
- DESAT short-circuit detection (1200 V fast-recovery diode + blanking) with soft turn-off
- Separate OUTH/OUTL gate outputs; active Miller clamp connected directly to the gate
- Complementary IN+/IN− inputs cross-wired between the high- and low-side switches of each leg — hardware shoot-through lockout
- All six ~FLT outputs wired-OR into a single FAULT net (→ TIM1_BKIN); all six ~RDY wired-OR into a READY net; common DRIVER_RESET line
- Gate drive power: Six Murata MGJ2D121509MPC-R7 isolated DC/DC converters
- 12 V input → isolated +15 V / −9 V bipolar output per gate driver
- Each supply fully isolated from logic and from each other
- 1oo2 power kill: the common 12 V feed passes through two series-connected BTS462T smart high-side switches — one controlled by the main MCU (GATE_DRIVE_PWR1_ENABLE), one by the coprocessor (GATE_DRIVE_PWR2_ENABLE). Either switch opening removes power from all six supplies simultaneously, forcing all IGBT gates off as the driver rails collapse into UVLO (gates discharge via the OUTL/Miller-clamp path). Resistor-divider feedback from both switch nodes (GATE_DRIVE_PWR1_FB / GATE_DRIVE_PWR2_FB) lets each MCU verify the other's path.
- Power-stage agnostic control board: The same inverter and firmware can be paired with alternative power stages with only gate-driver and sensing-divider scaling; higher voltage classes are achievable with straightforward adaptations, or the board can be interfaced to a user-supplied gate-drive stage.
- Capacitor bank (current build): 60× Nichicon UCS2D331MHD 330 µF / 200 V aluminium electrolytics in parallel → 19.8 mF total, 200 V class. The 450 V capacitor-only upgrade is a single part-number swap to 60× Nichicon UCS2W680MHD 68 µF / 450 V parts (4.08 mF total); the only mechanical change is 5 mm shorter standoffs (e.g., 55 mm → 50 mm) to match the shorter capacitors. This is what gives Chassis Size 2 its 200–450 V class range.
- Filter board: 6× 10 µF / 1000 V metallized polypropylene film capacitors (absorb high-frequency ripple and clamp switching voltage spikes, reducing RMS ripple current in the electrolytics) + 12× 0.25 µF / 900 V TDK CeraLink low-inductance ceramics at the module terminals + 18× 2.2 nF class-Y safety capacitors to chassis for common-mode / bearing-current (EDM) suppression
- Busbar-style construction: all power connections are M6 bolted mounting holes; the mounting hardware sits at bus potential — observe high-voltage precautions during assembly
- No onboard bleeder: the bank has no discharge resistor and remains at bus voltage for hours after power-down (discharge only via MΩ-scale parasitic paths). Verify bus voltage with a meter and discharge through a power resistor before any service.
- Capacitor cooling: the capacitor bank is thermally coupled to a 3.18 mm (1/8 in) aluminium heat-spreader plate, itself mounted to the heatsink via six 55 mm aluminium standoffs (13 mm OD). The thermal path is sized for a 40 W ripple-current heat load: ~40 °C total temperature rise with thermal paste (≈80 °C plate temperature at a 40 °C heatsink base). Full analysis: DC Link Thermal Analysis in OpenVVVF/Documentation. Use aluminium standoffs only — steel is not acceptable in this thermal path.
- Precharge: onboard high-side relay on the IO board with a user-supplied external resistor — size the resistor so precharge current stays below 2 A (input fuse limit)
- Four Tamura LA37S600S05KM hall-effect current transducers (3 phase + DC link)
- ±1200 A sensing range, centered at 2.5 V output
- Separate reference signal per sensor for fault detection
- ~70 mA/LSB quantization at 16-bit (≈300 mA effective resolution after oversampling/decimation); overall accuracy is dominated by the sensor's ±1.8% specification
- Analog ground kept separate and bonded at the STM32 for noise reduction
- MAX22530AWE+ 12-bit isolated ADC with 4 channels
- Measures DC bus voltage and all three phase voltages (U, V, W)
- 1001:1 high-voltage divider per channel (4× 250 kΩ nominal series + 1 kΩ shunt, zener-clamped) → measurable range to ~1.8 kV full-scale, ~0.44 V/LSB referred to the bus (continuous bus limited to ~800 V by the fitted divider resistors; higher-voltage builds need HV-rated divider parts)
- ~±1 V measurement accuracy at the 140 V build with calibration (divider tolerance dominates at higher bus voltages)
- SPI interface to STM32; isolation provided by the ADC's internal reinforced barrier
- Dual isolated CAN bus: ISO1042BDWVR isolated CAN FD transceivers (70 V bus fault protection)
- Two transceivers per bus (four total): the main MCU and the safety coprocessor each have an independent, galvanically isolated transceiver on both buses, so the coprocessor can snoop and cross-check all bus traffic
- Per-bus isolated 5 V supply with firmware-switchable power; jumper-selectable 120 Ω termination
- CAN1: Battery Management System (BMS) and IO board harness
- CAN2: display/dash, charger(s), diagnostic tools
- Expansion module connector (J2, IO board): plug-in expansion header carrying MD_FIBER_TX/RX/SYNC, +5 V, +12 V, and GND for future add-on modules. Planned modules include:
- Fiber IO multidrive module — distributed-drive coordination for 5+ phase motors, parallel power stages with current sharing and load balancing, or tightly synchronized multi-drive systems with hardware PWM sync between drives
- Fiber-optic gate-drive module — isolated PWM signaling directly to gate drivers
- WiFi/Bluetooth module — wireless telemetry and configuration
- Resolver interface module — resolver position feedback (native inputs support sin/cos encoder or Hall effect only)
- BMS heartbeat: 5-second timeout (HARA FSR-17; BMS external to this system; firmware implementation in progress)
- STM32H723ZG main MCU (550 MHz Cortex-M7)
- ECC-protected RAM, 1 MB flash
- FDCAN1 + FDCAN2, TIM1 advanced-control PWM, 16-bit ADCs
- Runs FOC motor control, sensor acquisition, CAN communication, safe state management
- GATE_DRIVE_PWR1_ENABLE — gate drive power kill Path 2a
- CY15B102Q-SXET 256 KB SPI FRAM (GPIO-controlled write-protect) for fault logs, configuration, hour meter, odometer
- STM32G474RCTx safety coprocessor (170 MHz Cortex-M4+FPU)
- 8 MHz crystal; powered from the shared 3.3 V rail (dedicated RD7-12S033R DC/DC converter)
- FDCAN2 + FDCAN3 (independent transceivers on both CAN buses for snooping/cross-check)
- Independent ADC access to all current sensors, temperatures, encoder, gate drive feedback
- Monitors all 6 PWM output pairs (high/low) for deadtime violations, stuck-on, stuck-off
- GATE_DRIVE_PWR2_ENABLE — gate drive power kill Path 2b (1oo2 with main MCU)
- Challenge-response watchdog with main MCU via inter-MCU UART
- Bidirectional NRST and mutual BOOT0 control — either MCU can reset or bootloader-force the other; own SWD and native USB debug ports
- Rail supervision: TI TPS389006-Q1 6-channel window supervisor with I2C-programmable thresholds (TI Functional Safety-Compliant component, supporting designs up to SIL 3 / ASIL D per TI)
- Monitors the 3.3 V, 5 V, 12 V, and sensor 5 V rails plus both gate-drive power feedbacks; thresholds are I2C-configured by the main MCU at boot
- On any rail fault — including brownout of the 3.3 V rail shared by both MCUs — it asserts DRIVER_RESET directly, forcing all NCV57100 outputs off while bypassing both MCUs. The actuation path is hardware-only: an independent mitigation for the shared-rail common-cause failure mode
- Isolated digital inputs: 8× ISO1212 24–60 V isolated input channels (2 populated in the current build, routed to the coprocessor) for e-stop, limit switches, and user inputs
- Onboard power: Cincon EC7BW-110S12 railway-grade DC/DC (mounted on the IO board, powered from the traction battery)
- 43–160 V input (4:1), 12 V / 1.67 A output
- EN 50155 compliant with external circuitry (per Cincon application note), 1500 V I/O isolation
- Control-board rails derived from 12 V: 3.3 V (RD7-12S033R), isolated 5 V (RKE-1205S), firmware-switched 12 V aux and CAN-bus power (BTS462T high-side switches)
- Fail-safe default: Six-switch-open (SSO) — all IGBTs off
- Dual redundant 5 kΩ potentiometers + end-travel limit switch (via isolated digital input)
- 0–5 V output scaled to 0–3.3 V via resistor dividers
- Both MCUs read throttle independently; discrepancy >5% triggers safe state
- TIM1_BKIN hardware break input to main MCU (<100 ns) — OR'd gate driver FLT → hardware clears MOE, all PWM disabled
- Coprocessor reset to main MCU via NRST (~100 ms) — challenge/response failure → coprocessor resets main MCU → SSO during boot
- Loss of shared 3.3 V rail (passive) — NCV57100 VDD lost → internal active pull-down → SSO; no software intervention
- Gate driver RESET line (<1 us actuation once asserted, either MCU or the TPS389006-Q1 rail supervisor) — asserts DRIVER_RESET → all NCV57100 outputs off → SSO
- 1oo2 gate-drive power disable — main MCU (
GATE_DRIVE_PWR1_ENABLE) or coprocessor (GATE_DRIVE_PWR2_ENABLE) opens its BTS462T; either alone removes 12 V → gate-drive UVLO → SSO. Feedbacks:GATE_DRIVE_PWR1_FB,GATE_DRIVE_PWR2_FB - Coprocessor independent fault trigger (<10 us) — coprocessor detects critical fault →
GATE_DRIVE_PWR2_ENABLElow + RESET → SSO without main MCU
Note: HARA v4.1 numbers these as Path 1, Path 5, Path 3, Path 4, Paths 2a/2b, and Path 6, respectively. The TPS389006-Q1 rail supervisor is an additional actuator on the RESET pathway (Path 4), not a separate SSO path.
Hardware for all mechanisms below is in place; firmware implementation of several monitors is in progress (see Project Status).
- Hardware PWM disable via TIM1_BKIN (<100 ns)
- NCV57100 DESAT short-circuit protection (<2 us)
- 1oo2 gate drive power kill with independent feedback (GATE_DRIVE_PWR1_FB, GATE_DRIVE_PWR2_FB)
- TPS389006-Q1 rail supervisor (Functional Safety-Compliant, up to SIL 3 / ASIL D per TI) — resets the gate drivers directly on brownout, independent of both MCUs
- Dual independent watchdog timers (main MCU windowed WDT + coprocessor challenge/response)
- HVIL (High-Voltage Interlock Loop) presence signalling — planned (TODO on IO board schematic)
- All six NCV57100 FLT outputs OR'd — monitored by both MCUs
- Overcurrent detection: ADC analog watchdogs in both MCUs (hardware threshold monitoring, no external comparators) + dual-MCU integrated monitoring — detection within 100 ms for regular overcurrent; SSO assertion within 1 PWM period (~100 µs) once detected — sufficient for safe torque off without hardware damage (DESAT handles hard shorts <2 us) + Analog watchdog on main processor and coprocessor for overcurrent.
- Target: ASIL D via ASIL B(D) + ASIL B(D) decomposition (DFA per ISO 26262-9 pending — LIMIT-08)
Note on Overcurrent Protection: Hardware overcurrent detection uses the ADC analog watchdogs built into both STM32s — comparator-equivalent threshold monitoring on each current channel with no external components. The control board also includes schematic provision for LM397 comparators for phase and DC link overcurrent detection, but these are not populated in the current build and are not required for the safety case. Hard short-circuits are handled by NCV57100 DESAT (<2 us). Regular overcurrent (non-DESAT) is detected within 100 ms by dual-MCU integrated monitoring and AWD — both the STM32H723 and STM32G474 independently sample all current channels at high rate. Once detected, either MCU asserts SSO within 1 PWM period (~100 µs) via its independent gate drive power kill — the full sense-to-safe-off path. The 100 ms detection latency is faster than the IGBT thermal time constant; junction temperature remains within module ratings for overloads sustained up to the 100 ms detection bound. The LM397 provision is retained in schematic, and may be removed in future versions pending testing and validation of current design.
Field-Oriented Control (FOC) running at PWM switching frequency with the following modulation strategies:
- SPWM — Sinusoidal Pulse Width Modulation
- SVPWM — Space Vector Modulation
- ARSVPWM — Alternating Reverse Sequence Vector PWM
- SHEPWM — Selective Harmonic Elimination
- RCFM — Random Carrier Frequency Modulation
- RSPWM — Random Sinusoidal PWM
- N-Pulse / N-Pulse Wide / N-Pulse Custom — Low pulse-count for high-speed operation
- RSVM — Random Space Vector Modulation
SPWM and SVPWM are implemented in the current firmware in OpenVVVF/RTE; the remaining schemes are architected and in development (see Project Status). The modulation framework is designed for live scheme switching via CAN bus, automatic selection based on speed/torque operating region with configurable hysteresis to prevent boundary jitter, and bumpless crossfade with di/dt gating during regen/acceleration transitions (framework features in development — see Project Status). All configurable via the Real Time Examiner (RTE) interface tool in OpenVVVF/RTE, which also hosts node codegen, telemetry, and other configuration utilities.
Model Predictive Control (MPC) is a planned addition to the control strategy set.
All safety documentation, user manuals, assembly guides, and software docs are maintained in OpenVVVF/Documentation (rendered at https://openvvvf.github.io/Documentation/).
Important: ASIL ratings are targets derived from the HARA process, not compliance claims. The dual-MCU architecture (STM32H723 + STM32G474 coprocessor) enables ASIL D for SG-01 and SG-13 via ASIL B(D) + ASIL B(D) decomposition. No formal ISO 26262 compliance audit has been performed. A Dependent Failure Analysis (DFA) per ISO 26262-9 is required before formal ASIL D claims can be substantiated — this is documented as the remaining P0 gap (LIMIT-08). This is a design-for-safety effort. Security follows a user sovereignty model: the project explicitly rejects anti-user OTP/DRM measures (no vendor lock-in, no encrypted bootloaders with unreplaceable keys). Protections target remote CAN bus attacks, not the legitimate hardware owner. Physical access = user is root.
| Milestone | Status |
|---|---|
| Main inverter schematic and PCB design | Complete |
| STM32 prototype assembly | Complete, under active test |
| FOC current-loop bench validation (±50 A Iq on Zero 75-10, 50 V bus, no heatsink/airflow, baseplate barely warm) | Complete |
| Voltage/current bring-up and longer-load bench testing | In progress — 100 V / 60 A continuous for 10 min and ±200 A Iq reversal for ~1 min survived on Zero 75-10; heatsink estimated ~70–85 °C with no airflow or heatsink; 400 A trial paused due to on-site power supply limitations, motor phase cables melting, and lorentz force moving phase leads > 4cm |
| 200 V-class variant bench test (120 V, 20 min, no heatsink) | Complete — heatspreader plate reached 41.6 °C measured by thermal camera |
| Full-load dyno testing (motor coupled) | Planned |
| Environmental and thermal validation | Planned |
Note: All high-current runs so far have been without a proper heatsink, forced airflow, or temp probes; temperatures are estimates. Proper thermal validation with temp sensors is planned in the next few days.
| Milestone | Status |
|---|---|
| Real Time Examiner (RTE) host tool | In development in OpenVVVF/RTE, which also includes node codegen and telemetry tools |
| STM32 low-level drivers (ADC, PWM, CAN, GPIO) | Implemented and tested |
| Communication protocol | Implemented |
| Sensor acquisition and filtering | Implemented |
| Field-Oriented Control (FOC) | Current loop implemented and validated at ±50 A Iq on Zero 75-10 (50 V bus, no heatsink/airflow); speed/torque loop in development |
| Torque command processing and safety limits | Architecture defined, implementation in progress |
| Fault handling and safe state management | Architecture defined, implementation in progress |
| Power-on self-test (POST) | Architecture defined |
| Deliverable | Status |
|---|---|
| HARA — Unified (Rev. 4.1, dual-MCU) | Complete |
| TARA — Threat Analysis (Rev. 1.2, anti-OTP/user-sovereignty) | Complete |
| SWAD — Software Architecture (Rev. 1.5, dual-MCU body update planned) | Complete |
| Technical Safety Concept | Not started |
| Component-level FMEA | Not started |
| Fault injection test plan | Complete (99 tests defined) |
The BOM, Gerbers, and manufacturing files are in the Hardware/Chassis2/ directory. Assembly is recommended for experienced builders only. This design involves high voltages (200–450 V class depending on the installed DC link capacitors; higher voltage classes require a different chassis/power-stage design) and currents (up to 600 A) that can be lethal. The DC link bank has no onboard bleeder and stays at bus voltage for hours after power-down. An active discharge command (using the motor windings as a bleeder resistor) is planned but not yet implemented — until then, always verify with a meter and discharge through a power resistor before service. Proper safety equipment and procedures are mandatory.
Prerequisites:
- Compatible battery pack (43–160 V for the current build's onboard supply; higher bus voltages require appropriate DC link capacitors and supply adaptation)
- 3-phase PMSM motor with sin/cos encoder or Hall effect position feedback
- Compatible BMS with CAN communication
- 12 V auxiliary supply (or self-powered via onboard DC/DC)
- Direct CAN interface for configuration (RTE host tool in development in OpenVVVF/RTE — includes node codegen and telemetry tools)
Contributions are welcome. This project uses KiCad for schematic and PCB design, FreeCAD for mechanical design, and STM32CubeIDE / GCC ARM for firmware (now developed in OpenVVVF/RTE).
When contributing:
- Maintain consistency with existing design conventions
- Include schematics, PCB layouts, BOMs, and documentation
- Reference relevant Safety Goals when modifying safety-critical code or hardware
- Update the HARA if your change affects hazard controls
Hardware designs are released under the CERN Open Hardware Licence.
Firmware and software are released under the MIT License.
Safety documentation is provided for reference and design guidance purposes.
A special thank you to our sponsors, Mouser Electronics, Mitsubishi Electric, and SendCutSend! Their support has been invaluable for making this project possible.
This project involves high voltages and currents that can cause serious injury or death. Do not attempt to build, test, or operate this equipment without proper training, safety equipment, and procedures. The authors and contributors accept no liability for any injury, damage, or loss resulting from the use of this design.