Avionics reverse-engineering: spacecraft equipment

[D Straney]

Also, here's a few bare dies inside the large DC-DC module from the power supply board.


Mystery symmetrical STMicro part (rotate the right-hand side 180 degrees in your head to see it):


Texas Instruments LT10009 2.5V shunt voltage reference:

Mystery mostly-symmetrical STMicro part that may or may not be a dual op-amp:

Another Texas Instruments LT10009 2.5V shunt voltage reference: probably one for input side, one for output side.


Gate driver transistors:



One of the two paralleled primary-side power MOSFETs - when you get close enough, you can see the hexagonal cells (it's essentially a few hundred tiny MOSFETs in parallel).  This is where the (IR) HEXFET series name comes from, if I remember correctly:

[quince]

Yep that's right!  Haven't gotten the die under a microscope yet so can't confirm 100% yet that it's LTC, but you sure can see the big-ass pass transistor.

What's the big ceramic chip with serrated edges and an L, a ceramic inductor?

[electr_peter]

That is a laser trimmed resistor.

[D Straney]

Broad Reach I/O Board
I don't know much about this board's function besides that it's made by Broad Reach, and the latest date codes I can see are from 2009 (with some going back to 2002).  Broad Reach, now part of Moog (no, not the synthesizer company), seems to make general-purpose spacecraft & satellite electronics.



This looks like an I/O board, judging by what's on it - the blue connector at one end looks like it goes to a common backplane, while the small D-sub connector at the other end seems like external I/O.
The board isn't conformal coated, but with a lot of tightly-packed components and most of the traces being internal, there's a limit to how much I was willing to figure out with continuity checks alone.  So sticking to a sanity-retaining number of strategically-placed continuity checking and applying a lot of educated guessing, this is my best guess at how things are connected.

Unlabeled ICs are all Linear Technology RH1014 quad op-amps, except the gold package which is an Intersil OP470 quad op-amp.
1. Power Supply: An isolated power supply, based on the classic UCx845 PWM controller series, creates the logic & analog supply voltages.  Input is probably from a 28VDC bus.  The metal box on the bottom side is the primary-side power MOSFET.  The vertical cylinder is the bobbin & core of a flyback inductor.  An ST RHFL4913 LDO on the bottom side probably provides a low FPGA core voltage or something like that.
2. Analog Outputs: 2x identical channels, each with an NPN Darlington & PNP Darlington pair for some class-B analog-output action; all in metal cans.  NPNs are 2N5667, PNPs are 2N5416.  Diodes on the bottom offset the NPN & PNP bases (with a substantial voltage gap for no idle current), and the 5th metal-can transistor per channel creates a current source for biasing.  Because of the inherent inaccuracy of a straight class-B emitter-follower, esp. with the large NPN/PNP conduction gap, I assume some of the op-amps wrap feedback loops around these.  There's current limiting and common biasing involving some smaller SMT transistors.
3. Push-Pull Digital Outputs: 3x identical channels, each with an IRHNM57110 N-MOSFET & IRHNM597110 P-MOSFET with their drains connected to each other, and to an output pin.  Outputs are clamped to ground & supply by diodes on the bottom and top.  Gate drive & level-shifting seems to be done by small transistors on top side.  The last un-paired P-MOSFET at one end gates the positive supply voltage to all the channels' P-FETs, as a global power enable.
4. Open-Drain Digital Outputs: 2x identical channels, each with an IRHNM57110 N-MOSFET on the bottom side (with its drain connected to an I/O pin) and gate drive circuitry on the top side.
5. Current Sense: 6x separate current sense channels, with Kelvin-connected current sense resistors & op-amps to differential-amplify the current sense voltages; these seem to measure the current draw on various supply voltages, probably ones that get used for driving outputs to monitor total output current.  These connect to analog mux inputs (discussed next) and so these current draw readings are probably read by the ADCs along with all the other analog input values.
6 & 7. Mystery: I have no idea what these do.  #6 has 2 NPN power transistors on the bottom, with 7 smaller transistors on the top.  #7 has a single NPN power transistor & 2 optoisolators, the Mii 66183.  The top-side 2N5339 only has connections to the input-power bus and has a zener to its base, so may be for something like fast discharge on power-down, or crowbarring the power supply's input voltage.

The FPGA, an Actel part, likely provides an interface between a processor bus from a controller card elsewhere, and all the peripherals here.

Besides the digital outputs and various controls, the main peripherals here are 3 DACs (the 12-bit Analog Devices AD667S) and 3 ADCs (the 16-bit Maxwell, now DDC, 7809LP).

DACs: 2 of these likely create the setpoints for the analog output drivers (#2 in the list above).  The 3rd may drive a general-purpose low-power analog output.
ADCs: 3x Analog Devices MUX-16 16:1 muxes seem to feed up to 48 analog channels to the ADCs, such as this one on the bottom side with a thermistor attached to it:

Some of the muxed ADC channels are definitely used for power-supply current sensing (#5 in the list above), and the rest are probably for general-purpose analog inputs from the outside world.
Reference voltage: The "pattern-breaking" metal can near the analog outputs is a Linear Technology LT1021 5V voltage reference; I'm guessing this creates a common reference voltage for the ADCs & DACs.

The ADCs themselves are the ones in the interesting extra-thick packages:

From reading the 7809LP datasheet, it looks like the radiation-induced latchup protection is implemented by using a commercial ADC die, with a rad-hard power control circuit wrapped around it to detect fault conditions and cycle its power.  I considered opening one of the packages to see this hybrid construction inside, but decided to read up on the Rad-Pak packaging first, covered by US Patent # 6455864, and realized it would probably be full of goop and therefore not worth it.  The core of the Rad-Pak shielding method, if I'm reading the patent correctly, is a conformal coating consisting of tungsten particles held together by an adhesive binder.  The high density of tungsten helps block ionizing radiation, similar to lead shielding used with nuclear reactors, medical X-rays, etc.

Here's some better close-up views of...

The power supply:


...including the stack of ceramic caps, given a lead frame to trade vertical space for horizontal space, and to avoid some cracking issues created by mismatched thermal expansion between the ceramic & the PCB material.  The ADCs have some pretty large SMT ceramic caps too, but not quite as large (horizontally) as these.

The external-I/O connector:


...with a metal-can LM117 adjustable regulator next to it (I haven't figured out where the LM117's output voltage goes to: not to the I/O connector)

Current-sense circuitry, where you can see the Kelvin-sense terminals on the series resistors:



The LDO:


Misc. things on the bottom side:





You can see the impressive amount and quality of reworks applied, in some of these photos, which makes me wonder if this was a prototype of some kind.  There was also an impressive amount of polyimide tape applied to every single wire and "floating" component, to hold them all securely in place - I removed most of the tape though to see the board (& reworks) better.

Anyways, hope this was interesting - wish I could provide a schematic for this one.

[T3sl4co1l]

Mystery symmetrical STMicro part (rotate the right-hand side 180 degrees in your head to see it):

Wonder if LM319. Anyone got a comparison pic?

Tim

[D Straney]

Oh shit.  Good call!

[D Straney]

Meant to mention, in the context of the ADCs:
Ionizing radiation, which there's a lot of in space in the form of cosmic rays etc., causes havoc with electronics and ICs in particular by ionizing things that shouldn't be ionized, creating carriers in what's supposed to be an insulator, and therefore creating leakage currents where they're not supposed to be.  This means that sometimes you'll get unexpected spikes of current - but also has a secondary effect called "latchup", which essentially crowbars the IC's power supply when this leakage happens to turn on a parasitic transistor that's inherent to how the transistors are constructed on a shared conductive silicon substrate.  The high current draw resulting from a supply-to-ground short then generates a ton of heat and destroys the IC, if you're not careful.  Radiation damage also accumulates over time, permanently adding leakage, but that's a separate issue.

The ways to deal with all radiation-induced effects are:
Suck it up: With a cheap cubesat that's only expected to work for a couple days, this is a common option.  Use normal commercial parts, it's fine, hope you don't get unlucky.
Shielding: Add dense materials, such as steel, lead, or tungsten to block/attenuate the ionizing radiation.  Nobody enjoys doing this on space equipment though, considering how expensive per pound it is to put something in space.

The normal way to deal with the transient current-spike events (especially in digital circuits, memory in particular) known as "single-event upsets" is:
Circuit design: Add redundancy (to logic circuits) & error-check bits (to memory; really just another form of redundancy).  The cross section of a cosmic ray is pretty small and so it's not going to affect half your IC at once - the unaffected majority of the circuitry can correct for the affected minority.

The normal way to deal with latchup in particular is:
IC process: Get rid of the shared silicon substrate that enables latchup in the first place, and replace it with an insulator, in a Silicon-on-Insulator (SOI) process.  Sapphire is a popular option; this is expensive.

I thought it was interesting though that the rad-hard ADC here explicitly takes a "tolerate and reset" approach to latchup, quickly shutting off the power before the high supply current can do any damage, and resetting the chip.  It makes a lot of sense for an ADC - this approach wouldn't work for something like a processor, where there's a whole lot of "state" associated with it (the contents of all the registers, progress of the instruction currently being executed, etc.) that can't be recovered if it's randomly reset.  With an ADC though, you're likely taking continuous readings anyways, and so the worst that can happen is that you miss one measurement due to a latchup-induced reset, and have to wait until the next reading cycle to get that measurement.  If you can plan your circuit & system design around that, then that's an easy constraint to deal with!  This means it's easier if all the ADC settings are done with voltages on external pins, rather than having a serial interface (SPI or I2C) to set up internal settings registers, but that's a small price to pay for not having to use an expensive special-purpose SOI part.

[T3sl4co1l]

FYI, SoS used to be used, but oxygen ion implantation is the common method today AFAIK.

Might well still be using it for space applications, heh, I have no idea.

Tim

[coppice]

There is a whole section of the military electronics business concerned with ensuring that the in flight energy in all the inductors and capacitors in a system is incapable of damaging any silicon that goes into heavy conduction due to EMP. If it isn't actually damaged, it might do unfortunate things in the moment, but Microsoft knows how to recover the situation - turn it off and turn it on again.

[D Straney]

Interesting, bet that drives a lot of power supply design decisions!  I'd always thought of the (now-long-passed) move from voltage-mode to current-mode control of power converters as a less directly visible thing from the system level, but can see how that would be a huge help for that criteria: go with minimal energy storage directly on the power rails, have fast-responding peak-current-controlled buck(s), and lump all the bulk capacitance on the buck's input where it's safely behind that cycle-by-cycle current limit.

FYI, SoS used to be used, but oxygen ion implantation is the common method today AFAIK.

Huh cool, my knowledge is not particularly up-to-date - for anyone else who doesn't know oxygen ion implantation (SIMOX) already, looks like they implant oxygen ions in the surface of a wafer to create an insulating SiO2 layer (sand, essentially) and then grow an epitaxial silicon layer on top of that to use for the transistors.

[T3sl4co1l]

These modules are also wrapped in several layers of shielding (the craft, perhaps; outer module, PCB, inner module), so we can quite safely assume any surge is conducted in on device pins alone.

Current mode also minimizes component size by decoupling the LC resonance; DCM is perfectly reasonable, and the control pole can be above 1/sqrt(LC). Quite handy here, as well as the inherent current limiting, which can be rolled into a limit detect and fault signal, or automatic (hiccup mode, etc.), further avoiding damage.

SIMOX is even cleverer than that: the trick with implantation is, ions are deposited at a range of depths, depending on ion mass and energy.  Si can be cleaved into very thin wafers by implanting H+ (annealing --> coalesces into a boundary layer of Si-H bonds and free gas --> tape and peel), or basically the same thing but bonded by SiO2 still (this way).  The top layer is crystal-aligned with the substrate and subsequent epitaxy, diffusion, etc. will remain coherent with it.  Thus very small transistors (in terms of depth as well as width and height) can be made, without any yield loss due to random crystal orientation.

Tim

[AnalogTodd]

Meant to mention, in the context of the ADCs:
Ionizing radiation, which there's a lot of in space in the form of cosmic rays etc., causes havoc with electronics and ICs in particular by ionizing things that shouldn't be ionized, creating carriers in what's supposed to be an insulator, and therefore creating leakage currents where they're not supposed to be.  This means that sometimes you'll get unexpected spikes of current - but also has a secondary effect called "latchup", which essentially crowbars the IC's power supply when this leakage happens to turn on a parasitic transistor that's inherent to how the transistors are constructed on a shared conductive silicon substrate.  The high current draw resulting from a supply-to-ground short then generates a ton of heat and destroys the IC, if you're not careful.  Radiation damage also accumulates over time, permanently adding leakage, but that's a separate issue.

The ways to deal with all radiation-induced effects are:
Suck it up: With a cheap cubesat that's only expected to work for a couple days, this is a common option.  Use normal commercial parts, it's fine, hope you don't get unlucky.
Shielding: Add dense materials, such as steel, lead, or tungsten to block/attenuate the ionizing radiation.  Nobody enjoys doing this on space equipment though, considering how expensive per pound it is to put something in space.

The normal way to deal with the transient current-spike events (especially in digital circuits, memory in particular) known as "single-event upsets" is:
Circuit design: Add redundancy (to logic circuits) & error-check bits (to memory; really just another form of redundancy).  The cross section of a cosmic ray is pretty small and so it's not going to affect half your IC at once - the unaffected majority of the circuitry can correct for the affected minority.

The normal way to deal with latchup in particular is:
IC process: Get rid of the shared silicon substrate that enables latchup in the first place, and replace it with an insulator, in a Silicon-on-Insulator (SOI) process.  Sapphire is a popular option; this is expensive.

I thought it was interesting though that the rad-hard ADC here explicitly takes a "tolerate and reset" approach to latchup, quickly shutting off the power before the high supply current can do any damage, and resetting the chip.  It makes a lot of sense for an ADC - this approach wouldn't work for something like a processor, where there's a whole lot of "state" associated with it (the contents of all the registers, progress of the instruction currently being executed, etc.) that can't be recovered if it's randomly reset.  With an ADC though, you're likely taking continuous readings anyways, and so the worst that can happen is that you miss one measurement due to a latchup-induced reset, and have to wait until the next reading cycle to get that measurement.  If you can plan your circuit & system design around that, then that's an easy constraint to deal with!  This means it's easier if all the ADC settings are done with voltages on external pins, rather than having a serial interface (SPI or I2C) to set up internal settings registers, but that's a small price to pay for not having to use an expensive special-purpose SOI part.

Fortunately when designing chips for spacecraft a lot of these effects are known. Ionizing radiation tends to shift MOSFET thresholds lower (charge buildup in the oxide) meaning NMOS devices are easier to turn on and PMOS devices take more voltage to turn on. It also can do crystal damage over time, causing leakage currents that can change biasing or other operating conditions in an IC.

There's a whole slew of effects that occur from a number of different things happening. Ionizing radiation is actually one of the easier things to deal with, whereas Single Event Effects (SEE) items are one of the tougher things to design for. Redundancy is great since, as you pointed out, you're not likely to get multiple heavy ion/cosmic rays hitting your chip at once. It's easy to do in digital, not so much in analog. Process of course can help with a number of things as well, such as avoiding gate rupture on large MOS devices.

There's a lot of things to think about when designing for these environments, and very few IC designers that understand them enough to develop devices for them.

[D Straney]

SIMOX is even cleverer than that: the trick with implantation is, ions are deposited at a range of depths, depending on ion mass and energy.  Si can be cleaved into very thin wafers by implanting H+ (annealing --> coalesces into a boundary layer of Si-H bonds and free gas --> tape and peel), or basically the same thing but bonded by SiO2 still (this way).  The top layer is crystal-aligned with the substrate and subsequent epitaxy, diffusion, etc. will remain coherent with it.  Thus very small transistors (in terms of depth as well as width and height) can be made, without any yield loss due to random crystal orientation.

Now that's a good trick!
And yes with the voltage-mode control, I distinctly remember doing my first voltage-mode buck compensation (as an exercise, learning how to use a TI DSP-MCU dev kit), seeing the giant Lbuck & Cout resonant peak, and getting a sinking feeling as I realized I was going to have to give my loop a super-slow crossover just to squash that - one of those "how did people get anything done before this?" moments.

[D Straney]

Here's a much older piece of spacecraft equipment:
Hughes Traveling Wave Tube & HV Power Supply
If you're not familiar with Traveling Wave Tubes (TWTs), these are vaccuum-tube RF amplifiers which work by modulating a beam of electrons across a multi-wavelength distance (similar to a klystron).  Before microwave-frequency transistors were available and reliable (esp. in 10W+ or 100W+ power levels), these were the main way to build a multi-Ghz RF amplifier.  Accelerating the electron beam requires a high (multi-kV) DC voltage, and generating the free electrons in the vacuum requires a low-voltage filament - generating both these voltages, as well as health monitoring etc. is the job of the attached power supply (called the "Electronic Power Conditioner" or EPC in the TWT world).

According to the seller (who has another of these, and was kind enough to give me a good discount), this particular unit came from Intelsat, and was originally part of a life test rack - normally this is where production electronics are exercised continuously, sometimes under elevated temperatures or other rough conditions, to check for early failures.  The Intelsat V family of communications satellites were built by Ford Aerospace: it seems strange for a car company to have a satellite business, but at some point in the early 60's they acquired wide-ranging electronics company Philco and aerospace company Aeronutronic, to form their military & aerospace business.  This aerospace division produced several families of communications satellites and various military projects, but was later sold off to become "Space Systems/Loral" and then Lockheed Martin, all part of the big, dumb game of "military-industrial-complex trading cards".
The TWT & power supply were built by Hughes Aircraft, though, who had their own thriving communications satellite business (the first entry in this thread came from them as well).

There's not much to see with the TWT itself, esp. as the label warns about the beryllium oxide inside.  Combining high thermal loads (esp. at the "collector" in a TWT which dissipates the leftover energy in the electron beam after coupling to the RF output) with high voltages means that this is a prime place for very thermally-conductive but electrically-insulating ceramics.
There's also a little RF module which the input(?) RF signal passes through, before reaching the TWT.  No idea what this is, as I wasn't able to get it open, but it's 2-port & passive.


So, let's look inside the power supply.
Power Supply Board


The 10-20W RF output of the TWT means the power supply is probably rated for well under 100W, so there's nothing crazily high-power here.  The box is a thin metal shell with the PCB attached at both top & bottom with angle brackets, for rigidity.  After taking out a lot of screws, snipping the output wires to the TWT, and un-sticking a bit of adhesive, I was able to pull the PCB out of the box to get a better view:


They really did not skimp on the conformal coating here!  There's a very thick layer of yellow coating over both the bottom and the top sides of the board, which gives the components an interesting "underwater" look because of the refraction.  The orange and yellow of the board nicely matches the fall colors of the leaves where I took the photos outside my apartment though.

At the right-hand side, there's a 15-pin D-sub connector for interfacing to the outside world, plus 3 power transistors in interesting packages (with Texas Instruments logos).



I can't connect the part numbers on these unusual power transistors to anything publicly accessible, but the '72 TI power device catalog shows this as their standard "QQ" package (p.93).  The 2N3263-3266 (p.192) seems like a good candidate for what parts these might be, as they're meant for "high-speed switching applications", which fits the switch-mode power supply application here.  Rated power dissipation is 67W even at 100°C case temperature, which shows that the Rth-jc is nice and low at ~1.5 K/W, and that they can dissipate a lot of power if properly heatsinked.  The only other place I've seen this type of transistor package is in the both fascinating-and-horrifying Minuteman III guidance system.

On the bottom, underneath this control and switching section, are three ICs:


2 have the AMD logo and are labeled LH2823; I can't find any references to this part number, but from the pinout & connections (discussed later) these seem like op-amps, likely one of the AM102/AM112/AM216 series.  The 1 remaining IC is also from AMD and has some kind of custom part number, but may be digital logic(?).

The most noticeable feature of the board is the big orange potted block in the middle.  This likely has all the high-voltage stuff inside.  You can see below...

• (top-right) a large toroidal transformer, probably for voltage step-up
• (top-middle) a dark-colored mystery block, which may contain high-voltage diodes and/or a voltage multiplier on the transformer output
• (top-left) a yellow-colored block of film capacitors, which probably provide the DC filtering for the high-voltage output(s)
• (bottom-right) a mystery cordwood module with some transistors
• (bottom-left) a small toroidal transformer

Here's a better view of the cordwood module and 2nd transformer:

The first 3 items in the list seem pretty clear as to function, but I'm not sure what the cordwood module and 2nd transformer are for: these might be over-current protection in series with the HV output, or maybe regulation for the filament voltage.

At the other side of the block, you can see some wires exiting: these are 4 of the 6 wires that go to the TWT.


I'd like to get a better view of what's inside this block to figure out what the extra parts are doing, but unfortunately the orange material is too hard to cut or peel away easily without damaging the components inside.  I'd also settle for being able to get a smoother finish on the top face, so that it's optically clearer like the side face shown before, but it turns out this material is also too soft to use sandpaper effectively.

Finally, at the left-hand/output side of the board, there's some additional circuitry that includes:

• another LH2823 op-amp on the bottom, for some kind of secondary-side control
• a mystery Caddock resistor network up against the orange block, possibly used for sensing one of the output voltages?
• a high-voltage film cap on the bottom

Connections
Now let's talk about how it works!  At a minimum, the TWT needs a low filament voltage, a cathode voltage (usually shared with one side of the filament), and an anode/collector voltage - go read the Wikipedia article linked earlier to see what these do inside the TWT.  The seller's description also mentions that this TWT has additional collectors (which each have their own different HV potential, if I remember correctly) for higher efficiency.

The power supply has 4 wires coming out of the potted HV block (2x yellow, brown, & red) and 2 wires coming off the PCB (blue & black).  On the TWT side, there's 3.4Ω from brown to yellow (filament), and both yellow wires are connected together: this suggests the yellows are a combined filament & cathode common connection.  Black connects to the TWT housing.  This leaves the blue & red wires for collector voltages.
Since the collectors & anode have to be positive relative to the cathode & filament, and the majority of the power dissipation is in the collectors, if I were designing a TWT I would want to make the collectors as close to enclosure-ground potential as possible.  This would give me an easier time conducting heat away from the collectors, with less insulation (and therefore thermal resistance) needed between the collectors and the enclosure.  So my best guess is that the cathode & filament are at a high negative voltage, while the various collector voltages get closer and closer to 0V (relative to enclosure ground); the black wire may even be the final collector, at 0V.  This would also explain why the filament wire (brown) comes directly out of the HV block: the voltage across the filament is low, but it has to float at a very high common-mode voltage.

Circuit Analysis
Unfortunately, I wasn't able to do as thorough of a job of reverse-engineering this one as I'd like.  The unfriendly HV-block potting material didn't help, and there's 5 different pieces of magnetics on the board with many windings each: I made educated guesses on the schematic below at how the windings are arranged internally, but not being able to do continuity tests through the thick conformal coating, I can't be sure and so some of the transformer connections are still a mystery.

Let's look at the auxiliary power supplies first though: these are the low voltages to power the op-amps and other control circuitry.

The DC power (likely 28V, by transistor & capacitor ratings) enters through an EMI filter, and charges the primary-side auxiliary supply ("+VauxPri") through a 220K resistor for startup.  This auxiliary supply takes its input from the main power converter through a couple diodes, once that's running.  There's also a nested switching arrangement, where aux. power to some devices is switched on and off separately ("+VauxPriSw").  One of the op-amps and a control-transformer winding are supplied through an additional switch ("+VauxPriSwSw").

One of the small transformers is part of a push-pull blocking oscillator, which uses two transistors in a self-oscillating configuration to generate an isolated bipolar power supply for the secondary-side/output-side op-amp.  An additional winding seems to be tapped off and goes to a mystery location on the HV module, possibly to be used as a power supply for the cordwood module judging by location.  One of the collector waveforms also gets filtered to power one of the op-amps.

The powertrain consists of another much larger push-pull converter, with those unusual-looking transistors, feeding the primary side of the HV transformer inside the potted HV module.

This push-pull is current-fed, with a series inductor on the input, which gives it a boost-like characteristic, useful for stepping up the voltage on the primary side (and reducing the HV transformer's winding ratio).  There's also an additional power supply that involves two of the metal-can transistors, powered from an additional winding on that boost inductor; I'm not sure what exactly they would feed inside the HV module: maybe a separate isolation transformer for the filament supply?

The control scheme is confusing, as it involves 4 separate transformers, none of which I can continuity-check as discussed before.  The "small transformer (right-hand)" has its own self-oscillating converter to generate the auxiliary supplies, but the roles of the "small transformer (left-hand)" and the two series emitter transformers ("CT 1", "CT 2") are less clear.  CT 1 & 2 probably provide some positive feedback to help switch the main power transistors on or off faster, but I'm not sure if they actually control the switching, because "small transformer (left-hand)" also has a charge pump which puts a negative voltage on the power transistor bases to switch them off.  The "small transformer (left-hand)" also either is driven by or drives a separate connection to CT 1 & 2 (see the 2 series diodes), and these are also both connected to the self-oscillating aux. supply collectors via "Aux_C1" and "Aux_C2" - I don't know if the aux. supply actually generates the switching frequency for the whole system, or if this is just a startup mechanism and the main power supply self-oscillates via some combination of CT 1 & 2, and "small transformer (left-hand)".

One of the op-amps generates a control voltage that connects to CT 1 & 2, and likely somehow controls the duty cycle or frequency of switching.  I don't see any reflected-transformer-voltage primary-side sensing of the output, so either the power supply runs open-loop (and the op-amp control voltage is for soft-start and/or protection), or there's some feedback path inside the HV module, maybe through the small toroidal transformer.

The secondary-side output circuitry was too thickly coated for me to be able to follow the connections, so all that I was able to tell is that the blue wire is some kind of high-voltage output from the HV module, fed through a 100KΩ+ series resistance and filtered with the 1kV(?) film cap on the bottom side of the board.  This could be one of the intermediate TWT-collector voltages.  I was completely unable to figure out how the black wire & the Caddock resistor network connect to anything, unfortunately.

Wrap-Up
Anyways, I hope this was interesting!  Please let me know if you have any insights into how the surprisingly-complicated main powertrain's controls work.