ioc.exchange is one of the many independent Mastodon servers you can use to participate in the fediverse.
INDICATORS OF COMPROMISE (IOC) InfoSec Community within the Fediverse. Newbies, experts, gurus - Everyone is Welcome! Instance is supposed to be fast and secure.

Administered by:

Server stats:

1.3K
active users

A few weeks ago I replaced a pair of 20 amp Eaton CH AFCI/GFCI circuit breakers from my panel that had started nuisance tripping with the "internal fault" error code after some power blips we had earlier in the year.

Finally got around to drilling out the rivets on one (challenging, as they tried to free spin the moment the drill touched them) and opened it up.

Let's have a look inside!

Still fooling around with lighting trying to get the shadows to not be too dark, but here's an overview of the innards showing the major functional blocks. Had to play with curves a bit to try and compensate for the iffy lighting.

At the bottom left, we see the phase input connection, where the breaker clips onto the bus bar.

This makes contact with a matching pad on the switch arm (seen here in the open/tripped position), carrying power up through the copper braid wire and to the bottom end of what appears to be a bimetallic strip.

At the top end of the strip another copper braid transitions to a black wire, carrying the power into a current transformer which also connects to the neutral input pigtail and output screw terminal.

This breaker has three different sources of trip and two different actuation mechanisms:

1) If too much current flows through the breaker, the bimetallic strip will heat up and flex, releasing the spring which pulls the switch open. This is the standard overcurrent trip used by thermo-mechanical breakers for decades.

2) If the current through the phase and neutral disagree by more than 5 mA, the output of the current transformer will trigger the electronics on the control board to activate the solenoid, releasing the spring and opening the circuit. This is the GFCI/RCD.

3) If some complicated DSP algorithms running on the control board detect waveforms characteristic of electrical arcing, the solenoid will be activated to open the circuit. This is the AFCI.

The switch in the closed position

Andrew Zonenberg

This little orange piece is the "tripped" flag. Haven't figured out exactly how it's triggered yet.

Slightly blurry pic (macro mode on my phone sucks) of the current transformer from the end showing the hot and neutral conductors.

A few quick phone shots of the board removed from the breaker before I grab high res pics.

Back side. Poor component alignment, lots of PTH stuff, clearly cost optimized.

Maybe wave soldered? The test points seem to not have much solder on them which is interesting though, unless they were masked during the wave process.

Fairly loose drill alignment tolerances too, many annular rings are close to breaking out.

Also I think this is the first time I've seen black silkscreen on a green board instead of the far more common white. Wonder why? It seems less legible.

The big copper pours with thermal vias are probably related to the power supply? These things do run kinda warm so it makes sense they'd pay attention to thermals when they're being packed close into a panel.

It's hard to see in the microscope photos but the board is conformal coated on both sides.

Under 365nm UV illumination it fluoresces bright blue.

Front side of the board at high res seen with two different focal planes.

The black and white wires coming off the north side go to the test button - and, interestingly, also the indicator LED that flashes out trip codes. I'll have to look into how *that* works with only two wires.

Brown goes to hot on the input side of the current transformer, maybe power for the breaker? Very ugly connection, looks maybe a bit corroded? or flux residue?

Red goes to hot on the output terminal side.

The other white wire goes to the neutral.

Main processor is made by STMicro, but can't tell the part number without removing some of the wires and the big blue... MOV? blocking my view.

So I went and did that.

Definitely have a better view but the focus was a little off on this scan and the conformal coating and weird white paint messed up my view of the MCU.

The big heatsunk component is a 150 ohm resistor. I wonder if maybe they're using it as part of the power supply to forcibly current limit how much power the breaker's internals can draw? That would certainly explain it running warm.

Had to switch to the 5x objective to get a better shot of the MCU.

Still tricky to read through the conformal coating but after playing around a bit I think it says

8S903K3
GH206VG
CHN 7 10
(ST logo) (E3) Y

I wonder what the white paint is for, maybe supposed to make the markings more legible for AOI or something? It's more than you'd expect if it were just to denote the chip had been programmed. It does make the markings easier to see, they just missed a lot of the interesting bits...

Which I think makes it a st.com/en/microcontrollers-mic