← AXA-004

Circuit review & bench-test guide

AXA-004 — Discrete H-bridge lab PMOD module

Document purpose#

This document explains the axa-004-hbridge-lab module at component level and turns the design intent into a practical manual-review and bench-test plan. It is based on the generator (generate_design.py), the module README, the actuator-line rules in ../README.md, and the AO3400A/AO3401A manufacturer datasheets.

This is an unfabricated prototype design. Status at time of writing: schematic generated, ERC clean (0/0), netlist reviewed, PCB layout not started, no board built, no bench evidence of any kind, and the mandatory deadtime_gen HDL and testbench do not exist yet. Every number below is a design target or a datasheet-derived estimate to verify — nothing here is proof that an assembled board is safe.

This is the most dangerous board in the actuator family. It is a discrete H-bridge with no driver IC, no dead-time hardware, no interlock, no fuse, no current sensing, and no protection other than resistors, body diodes, and your own logic. Shoot-through — a direct short of the motor supply through two FETs — is physically possible by design, because teaching that hazard honestly is the module's purpose. Treat every instruction in sections 4, 8, and 9 as mandatory, not advisory.

1. What the board does#

The module is a two-half-bridge (full H-bridge) motor driver built from six SOT-23 FETs on a 3.3 V PMOD interface. The FPGA fabric generates all four gate signals (HS1, LS1, HS2, LS2 — all active-high). Each half-bridge has an AO3401A P-channel high-side FET and an AO3400A N-channel low-side FET; a third small AO3400A per channel acts as a level inverter so the 3.3 V PMOD pin can control a P-FET gate that lives near VM. Motor power VM (5–12 V) enters only on the J2 screw terminal, never through the PMOD. The bridge output OUT1/OUT2 goes to the J3 screw terminal. Flyback is handled by FET body diodes only.

There is no fault output, no current sense, no thermal feedback, and no enable pin. The module is deliberately dumb; the curriculum pairs it with a sense module for closed-loop work.

Functional block diagram#

PMOD J1 (3.3 V logic only, all host-driven, all ACTIVE-HIGH)
 │
 ├─ HS1 ─100R(R1)─> Q3 AO3400A inverter ─┐            VM 5–12 V ── J2 ──┬── C1 C2 C3
 │   └10k(R5) to GND                     │ drain = HG1_PD               │   bulk+HF
 │                              10k(R4) series                          │
 │                    HG1 ──────────┴──── 10k(R3) pull-up to VM ────────┤
 │                     │                                                │
 │                     v  gate                                          │
 │                Q1 AO3401A  P-FET  (source = VM) ──────────────────---┤
 │                     │ drain                                          │
 │                     ├──────────────> OUT1 ──> J3 pin 1               │
 │                     │ drain                                          │
 ├─ LS1 ─100R(R2)─> Q2 AO3400A  N-FET  (source = GND)                   │
 │   └10k(R6) to GND                                                    │
 │                                                                      │
 ├─ HS2 ─100R(R7)─> Q6 inverter ── R10/R9 ── Q4 AO3401A ──┐             │
 │   └10k(R11) to GND                                     ├─> OUT2 ──> J3 pin 2
 ├─ LS2 ─100R(R8)─> Q5 AO3400A ───────────────────────────┘
 │   └10k(R12) to GND
 └─ 3V3 / GND (PMOD pins 5, 6, 11, 12; grounds join on the module)

HSx = LSx = 1  ==>  VM shorted to GND through Q_high + Q_low. NO INTERLOCK.

2. Safety and scope boundaries#

• The FPGA gate-drive logic must be proven in a self-checking testbench before any bitstream ever drives this board (section 5). This is a hard precondition, not a recommendation.
• Dead time must be measured on the real board with VM disconnected (section 4.4) before the motor supply is ever connected.
• First power is VM = 5 V through a bench supply set to a 100 mA current limit, with no motor attached (section 9.D).
• Never hot-plug motor leads. Never connect or disconnect anything at J2 or J3 while VM is energized. An interrupted inductive circuit arcs and spikes.
• Rail sequencing: logic 3.3 V (PMOD host) up before VM; VM off before logic goes down. The 10 k idle pull-downs cover the unpowered-host case, but a half-configured FPGA with floating or contending I/O is not a defined state — never rely on it.
• "Hands clear" convention for first spin: when VM is first raised with a motor attached, nobody touches the board, wiring, or motor. Stand back; kill power at the supply, not at the board.
• Wear safety glasses for all powered bridge tests. A SOT-23 failing in shoot-through can crack or eject its package.
• There is no reverse-polarity protection on J2. Reversed VM conducts through the Q1/Q2 (and Q4/Q5) body diodes in series as a near-short. Verify supply polarity with a meter before every first connection.
• The bench supply's current limit is the only fuse this board has. Use a supply with a real, fast CC limit; a large lab supply in CV mode with a 10 A limit will destroy the bridge before you can react.
• This is an educational lab module. It is not designed, reviewed, or intended for anything safety-relevant, unattended, or load-bearing.

3. Topology and control review#

3.1 Low-side path (fast, direct)#

LSx drives the AO3400A gate directly through 100 Ω (R2/R8). The AO3400A is a logic-level FET: worst-case RDS(on) is 48 mΩ at VGS = 2.5 V and 32 mΩ at 4.5 V, so 3.3 V drive lands between those, comfortably enhanced. Gate RC is roughly 100 Ω x 630 pF Ciss ≈ 63 ns, so the low-side switches in the sub-microsecond range. LSx = 1 → low side ON.

3.2 High-side path (slow, two-stage)#

A 3.3 V pin cannot swing a P-FET gate referenced to VM, so HSx (through 100 Ω, R1/R7) drives a small AO3400A inverter (Q3/Q6). The inverter's drain pulls the AO3401A gate down through a 10 kΩ series resistor (R4/R10) against a 10 kΩ pull-up to VM (R3/R9):

• Inverter OFF → gate = VM → VSG = 0 → high side OFF (default).
• Inverter ON → the 10k/10k divider parks the gate at VM/2 → VSG = VM/2 → high side ON. The inversion is cancelled: HSx = 1 → high side ON.

Gate-rating math: VSG = VM/2 is 6 V at VM = 12 V (inside the AO3401A ±12 V absolute maximum with 2x margin) and 2.5 V at VM = 5 V, exactly the AO3401A's specified enhancement point (RDS(on) is rated at VGS = −2.5 V, < 85 mΩ). Below 5 V the high side barely enhances; above 12 V the divider erodes the gate-rating margin. VM range is therefore 5–12 V, hard.

3.3 The timing asymmetry — read this before choosing a dead time#

The low-side gate sees ~100 Ω; the high-side gate sees 10 kΩ networks. Using datasheet Ciss values as first-order estimates (Miller charge makes reality slower, not faster):

• High-side turn-on (gate discharged toward VM/2 through R4 with R3 fighting): Thevenin ≈ 5 kΩ into ≈ 645 pF → τ ≈ 3.2 µs, plus the inverter stage delay.
• High-side turn-off (gate recharged to VM through R3 alone, R4 path open): τ ≈ 10 kΩ x 645 pF ≈ 6.5 µs. The channel only stops conducting once VSG falls below VGS(th) (as low as 0.5 V), i.e. the gate must climb to within ~0.5 V of VM — several time constants. Expect high-side turn-off to take on the order of 15–30 µs. This estimate must be replaced by a measurement (section 4.4).

Consequences: the datasheet nanosecond switching times (measured at RGEN = 3 Ω) do not apply to this board; dead time must cover the slow, asymmetric high-side edges (the dangerous edge is high-side-off → low-side-on); and usable PWM frequency is low — plan on hundreds of Hz to a few kHz, not tens of kHz.

3.4 Idle and default states#

All four PMOD nets have 10 kΩ pull-downs (R5, R6, R11, R12). An unpowered, unconfigured, or tri-stated host therefore leaves the inverters off, the P-FET gates at VM, and the N-FET gates at GND: all four power FETs off. This is the module's only hardware safety feature and it protects only against inactive hosts — it does nothing against a host actively driving wrong levels.

3.5 Honest protection audit#

What exists: 10 k idle pull-downs; the VM/2 divider bounding VSG; 100 Ω gate resistors (ringing damping and PMOD pin current limiting); FET body diodes for flyback; VM kept off the PMOD with grounds joined on the module.

What does NOT exist: dead-time hardware, cross-coupled or logic interlock of any kind, gate-driver IC, undervoltage lockout, fuse, current limit, current or fault sense, temperature sense, TVS or clamp beyond body diodes, reverse input protection, and dedicated flyback diodes. If HSx and LSx are both high, nothing on this board intervenes. That is the design.

4. SHOOT-THROUGH: the physics, the numbers, and the mandatory dead-time verification#

4.1 What shoot-through is#

Each half-bridge is a totem pole from VM to GND. If the high-side and low-side FET of the same leg conduct simultaneously — even for tens of nanoseconds while one is still turning off as the other turns on — the motor supply is short-circuited through the two channels. Nothing limits the current except the two RDS(on) values and the source impedance of VM (bench supply plus C1/C2/C3, which are sitting right at the bridge precisely to deliver current fast).

4.2 The numbers for this board#

At VM = 12 V with the high side at VSG = 6 V (RDS(on) ≈ 47–60 mΩ) and the low side at VGS = 3.3 V (≈ 24–48 mΩ), the cross-conduction path is roughly 70–110 mΩ. Ignoring supply impedance, the prospective current is 12 V / ~0.09 Ω ≈ 130 A — the local ceramic capacitors alone will source a large fraction of that for the first microseconds. Compare the datasheet limits: AO3400A IDM = 30 A pulsed, AO3401A IDM = −27 A pulsed, both in SOT-23 packages rated 1.4 W.

Energy scale: a single 50 ns overlap at ~100 A and 12 V dissipates on the order of E ≈ V x I x t ≈ 60 µJ per edge, split between two dies. That sounds small, but at a 20 kHz PWM rate with overlap on both edges it is 2 x 20,000 x 60 µJ ≈ 2.4 W of continuous extra dissipation — above the 1.4 W absolute package rating before the motor draws a single milliamp. The FETs heat, RDS(on) rises roughly 1.6x by 125 °C (datasheet Fig. 4), VGS(th) falls with temperature, switching slows, overlap widens, and the failure runs away. Escalation with VM is quadratic: power in the short scales as VM²/R.

A static logic bug — both gates simply held high, the classic FPGA mistake at reset, during configuration, or in an unreached-state default — shorts VM continuously. At 130 A prospective (or even at a 5 A bench-supply limit sustained into 0.09 Ω once the caps are drained) the SOT-23s exceed their pulsed and thermal ratings within microseconds to milliseconds: instant, unrecoverable destruction, sometimes with package rupture. This board deliberately exposes raw gates to the FPGA; there is no hardware interlock of any kind (section 3.5). The only thing standing between a bitstream and a fireball is your deadtime_gen and its testbench.

4.3 Why the body diodes make dead time visible (and necessary)#

During correct dead time, the motor's inductive current cannot stop; it freewheels through a FET body diode (VSD ≈ 0.7 V typical, 1.0 V max, 2 A continuous diode rating on both parts). On a scope you will see OUTx fly one diode drop above VM or below GND during the gap. That step is the signature of healthy dead time — and also why dead time should be shortened (never eliminated) once measured: diode conduction dissipates ~0.7 V x I instead of RDS(on) x I², and the AO3401A body diode Qrr of 3.5 nC is recovered as a small extra current spike at every transition.

4.4 MANDATORY dead-time verification procedure (before VM ever carries real current)#

Do this before the motor supply is connected at full capability. Two acceptable VM configurations for this test:

• VM disconnected entirely. Gate waveforms of the low side and inverter are observable; high-side gate is not meaningful without VM.
• VM fed through a series resistor (e.g. 1 kΩ from a 5 V supply, or the bench supply at 5 V / 100 mA limit). This energizes the 10 k pull-ups so high-side gate waveforms are real, while limiting any overlap fault to harmless current.

Procedure, per leg (leg 1 = Q1/Q2, leg 2 = Q4/Q5):

1. Load the testbench-proven bitstream (section 5). Configure complementary PWM on HSx/LSx with the designed dead time.
2. Scope both gates of the same leg simultaneously: channel A on HGx (the AO3401A gate, referenced to VM — use math VM−HGx or a differential probe to display VSG), channel B on LGx (the AO3400A gate to GND). Ground-referenced probing of HGx is acceptable here because VM is current-limited.
3. Trigger on each PWM edge in turn and measure the non-overlap gap at both edges: from VSG falling below 0.5 V (AO3401A VGS(th) minimum) to LGx rising past 0.65 V (AO3400A VGS(th) minimum), and the mirror-image gap on the other edge. Use the thresholds, not the 50% points — the high-side edges are slow ramps, not steps.
4. Sweep duty cycle across the full commanded range, including 0%, 100%, and abrupt duty/direction changes, and confirm non-overlap never collapses. Repeat for both legs. Repeat at VM(test) corresponding to 5 V and 12 V if the resistor-fed method allows, because the VM/2 gate swing and thus effective thresholds change with VM.
5. Record the worst-case measured gap and the measured high-side turn-off time in the bench record (section 11).

Acceptance: the measured non-overlap gap at every edge, every duty, both legs, must be at least 2x the measured high-side turn-off time (the slowest transition in the system, estimated ~15–30 µs in section 3.3, but the measurement rules). Given the estimates, a first-pass dead-time setting of 50–100 µs is the sensible starting point; shorten it later, with the scope watching, once real numbers are in hand. The datasheet ns-class switching times must not be used to justify short dead times — they were measured with a 3 Ω generator, three orders of magnitude stiffer than this board's 10 k high-side network.

Never connect an unlimited motor supply until this procedure has passed and is recorded.

5. FABRIC-TESTBENCH-FIRST RULE (hard precondition)#

No bitstream may drive this board until the gate-drive HDL has passed a self-checking testbench demonstrating, at minimum:

1. No-overlap invariant: under any input sequence (random stimulus plus directed corner cases), HSx and LSx of the same leg are never asserted simultaneously, including for a single clock cycle.
2. Dead-time counter: every HSx↔LSx handover inserts at least the programmed dead time, and the programmed value covers the asymmetric high-side timing with the section 4.4 margin.
3. All-off default: all four outputs are deasserted at reset, from power-up/configuration until explicitly enabled, and on any estop or illegal-state condition; unreached FSM states trap to all-off.
4. Glitch-free duty/direction changes: mid-period command changes never bypass the dead-time state machine.

The testbench must fail loudly (assertion, non-zero exit) on violation. Also verify the FPGA constraint file: the four PMOD pins must not have pull-ups enabled, must be driven (not tri-stated) once configured, and the configuration-time state of the chosen pins must be checked against the FPGA family's documentation. This rule exists because section 4.2 shows a single bad state is destruction, not degradation. deadtime_gen and this testbench are listed as a release gate in the README and do not exist yet — that alone blocks all powered testing.

6. Component-by-component review#

Every reference designator in the design is covered below. #FLG01–#FLG03 are ERC power-flag symbols only; they place no physical part.

6.1 Power FETs#

Note the pattern: every single-FET short converts one PMOD signal into a shoot-through trigger. This is why the unpowered resistance checks in section 9.A are done before anything else, every session.

6.2 Gate network resistors (channel 1 / channel 2)#

6.3 Decoupling#

These capacitors are also what makes shoot-through instantly destructive: they are low-ESR ceramics placed to deliver current fast, and they do not care whether the load is a motor or a fault.

6.4 Connectors#

7. Datasheet summary and design interpretation#

Sources (fetched 2026-07; check the latest revision before procurement):

• AO3400A datasheet (Alpha & Omega Semiconductor, Rev 3.1 July 2023): <https://aosmd.com/res/data_sheets/AO3400A.pdf>
• AO3401A datasheet (Alpha & Omega Semiconductor, Rev 3.1 December 2023): <https://aosmd.com/res/data_sheets/AO3401A.pdf>

Values not extracted here (SOA curve coordinates, transient thermal impedance curves) must be checked against the datasheet pages directly before any test that depends on them.

8. Actuator-specific safety (mandatory)#

• Current-limited first power, always. The bench supply limit is the board's only fuse. Section 9 gives the ladder: 100 mA → 500 mA → 1 A → 2 A, each step gated on clean captured waveforms.
• Know your stall current before connecting a motor. A stalled or shorted-rotor DC motor draws VM divided by winding resistance. Typical estimates (verify for the actual motor by measuring winding resistance cold): N20-class gearmotors ~0.36–1.6 A stall depending on winding and voltage; JGA25-class up to ~4 A. A 4 A stall equals the AO3401A's entire 25 °C continuous rating and doubles the body-diode rating — a JGA25 at 12 V on this board must be treated as an overload experiment, not a drive application. Set the supply current limit at or below the intended test current, always below stall.
• Flyback / inductive-kick verification. There are no clamp diodes; body diodes are it. On first motor tests, scope OUT1/OUT2 and VM: confirm the dead-time diode drops (~0.7 V beyond the rails), confirm OUTx never rings past ±30 V (VDS rating), and confirm VM does not pump up when braking or reversing (a supply that cannot sink current lets regenerated energy charge C1/C2 upward — watch VM at every direction change).
• Never hot-plug motor leads. Breaking an inductive circuit at a screw terminal makes an arc and an unclamped voltage spike. Power down VM, wait for the supply to read zero, then touch J2/J3.
• Rail sequencing. Logic 3.3 V and a configured, testbench-proven bitstream first; VM second. Shutdown in reverse: VM to zero, then logic. Never leave VM applied while reconfiguring the FPGA — configuration-time pin states are the host's problem and the pull-downs are the only guard.
• Hands clear for first spin. First motor rotation happens with hands away and the supply's output switch as the kill point.
• Secure the motor body before it can spin (a gearmotor on a bench walks, twists its leads, and shorts them).

9. Ordered bench-test procedure#

Stop at the first abnormal result. Record everything in the section 11 template. Prerequisites for anything past step B: section 5 testbench proof recorded; section 4.4 dead-time plan ready.

Bench contexts#

• (a) PMOD host FPGA board: the normal case. The host provides 3.3 V and drives the four gates. VM comes from a separate current-limited supply; grounds join on the module via the PMOD.
• (b) Standalone (no FPGA): 3.3 V bench supply to PMOD 3V3/GND is pointless by itself (nothing on the module consumes 3.3 V); what standalone testing really means is stimulating HSx/LSx with a signal generator. Warning: a generator gives you no interlock either, and it is easier, not harder, to create overlap with two free-running channels or a mis-set complementary output than with proven HDL. If you stimulate standalone: drive only ONE gate signal at a time with the other three grounded, or use a two-channel generator with hardware-verified complementary + dead-time mode, keep VM resistor-fed or ≤ 100 mA limited throughout, and never attach a motor under generator stimulus. Ground the generator to module GND at one point.

A. Unpowered inspection and resistance tests (every session, before anything)#

1. Nothing connected. Inspect under magnification: Q1–Q6 orientation (SOT-23 pin 1), no solder bridges on the FET pads, resistor values against section 6.2, C1–C3 present, screw terminals tight.
2. Diode-mode meter, both polarities, record values:

• VM to GND: must not be a short. Expect one body-diode drop (~0.5–0.7 V) in one polarity through Q1+Q2 / Q4+Q5 series pairs and high resistance in the other.
• OUT1 to VM, OUT1 to GND, OUT2 to VM, OUT2 to GND: one diode drop in the body-diode direction, open the other way. A hard short in any of these is a failed FET or a solder bridge — do not power; find it.

1. Ohmmeter: HS1, LS1, HS2, LS2 each to GND ≈ 10 kΩ (pull-downs present). HG1/HG2 to VM ≈ 10 kΩ. Anything wildly off means a wrong or open resistor in the gate network — the most safety-critical passives on the board.
2. PMOD pinout buzz-out from J1 pin 1 through to the host connector.

B. Logic-only functional test (VM absent or resistor-fed)#

1. Context (a): host powered, testbench-proven bitstream loaded, VM disconnected. Scope HS1/LS1/HS2/LS2 at the PMOD: clean 3.3 V levels, correct complementary pattern, dead-time gaps visible, all-off at reset and on estop input.
2. Feed VM through 1 kΩ from 5 V (or 5 V at 100 mA limit). Verify HG1/HG2 sit at VM when the high side is commanded off and at ~VM/2 when commanded on. Verify IG1/IG2 (inverter gates) follow HSx.
3. Run the full section 4.4 dead-time verification now. Record the worst-case gaps and the measured high-side turn-off time. Do not proceed until the 2x acceptance margin holds everywhere.

C. First power ladder, no motor#

1. VM = 5.0 V, supply current limit 100 mA, J3 empty. Idle (all-off): input current should be ≈ VM leakage only, well under 1 mA (the 10 k pull-ups carry no DC when the inverters are off). More than a few mA at idle is a fault — stop.
2. Run complementary PWM at low frequency (≤ 1 kHz). Supply current should stay in the low-mA range (gate divider draws VM/20k ≈ 0.25 mA per active high side, plus switching charge). Scope OUT1/OUT2: clean rail-to-rail swings.
3. Watch for the shoot-through signature: current-limit LED flicker or supply current spikes synchronized to PWM edges. Any sign → stop, re-measure dead time.
4. Raise VM to 12.0 V, limit still 100 mA. Repeat 1–3. Verify VSG ≈ 6 V on an active high side (differential or VM-referenced measurement).
5. Only after clean captures at both voltages: raise the limit to 500 mA and re-run. Nothing should change — there is no load yet.

D. Resistive load#

1. VM = 5 V, limit 500 mA. Power a ~22 Ω / 5 W resistor across J3. Verify OUT1−OUT2 waveform polarity matches the commanded direction table (HS1+LS2 = OUT1 positive; HS2+LS1 = negative).
2. Step VM to 12 V, limit 1 A, load sized for ≤ 1 A. Capture OUTx edges; confirm no ringing beyond ±30 V absolute on any FET drain.
3. Measure FET package temperatures after 10 minutes. Compare with the RθJA-based estimate for the measured current.

E. First motor test (small motor first)#

1. Motor: N20-class first, never JGA25-class for first spin. Measure its winding resistance; compute stall current; set the supply limit below it and at or below 1 A.
2. Motor secured, hands clear, safety glasses on. VM = 5 V. Command low duty (~20%). Observe rotation, listen, watch supply current.
3. Scope OUT1/OUT2 during running PWM: confirm body-diode conduction steps during dead time, no rail excursions beyond one diode drop, VM stable (no pump-up) on start, stop, and direction reversal at low duty.
4. Step through duty range, then direction reversals, then VM = 12 V with the limit raised only as far as the measured running current requires (≤ 2 A until a thermal soak has passed).
5. Deliberate stall test (optional, instrumented): only with the supply limit set to a value the section 7 thermal math supports (≤ 2 A recommended), for seconds not minutes, with FET temperature watched.
6. 30-minute soak at the intended operating point; record FET, terminal, and motor temperatures.

F. Not covered by this plan#

Repetitive-avalanche characterization, EMC, long-term reliability, JGA25 stall-level (4 A) operation, and any operation without the testbench gate remain out of scope. The module has no release claim until the README's release checklist (layout, DRC, fab outputs, HDL deliverable) is complete.

10. Expected values#

11. Troubleshooting map#

12. Bench record template#

13. Review conclusion#

The design is internally consistent and does what it claims: a minimal discrete H-bridge whose only safety features are passive defaults (10 k pull-downs, VM/2 gate divider) and whose active safety is delegated entirely to FPGA fabric. The gate-rating math checks out against the AO3401A datasheet (VSG = 6 V max at VM = 12 V against a ±12 V rating; 2.5 V at VM = 5 V matching the specified enhancement point), and the AO3400A is genuinely logic-level at 3.3 V. The 10 k high-side gate network makes switching slow and asymmetric by three to four orders of magnitude relative to the datasheet's 3 Ω test conditions — that is the pedagogical point, and it dictates dead times in the tens of microseconds and PWM in the low-kHz range, both of which must be established by measurement, not by this document's estimates.

The principal risks, in order: (1) any bitstream reaching the board without the not-yet-written self-checking deadtime_gen testbench — this is the single gate that prevents instant destruction; (2) dead time sized from datasheet nanosecond switching numbers instead of the measured slow high-side turn-off; (3) unlimited or high-limit supplies — the bench current limit is the only fuse; (4) motor stall current versus the 4 A / 2 A-body-diode / 1.4 W SOT-23 envelope, especially JGA25-class motors at 12 V; (5) no reverse protection at J2; (6) PCB layout does not exist yet — the bridge commutation loop, gate-network placement, and thermal copper will materially change every switching and thermal number above and this guide must be revisited after layout. Nothing in this document substitutes for the release checklist in the README.