Apple ACE2 Controllers

The Apple ACE2 controllers are the second generation of USB-C PD controllers. They first appeared in 2019 with the release of the A2141 (Macbook Pro 16") and the A2159 (Macbook Pro 13" 2 Thuderbolt ports). They replace the previous generation ACE1 controllers (CD3215), and have various declinations: CD3217B12, CD3217B13 and CD3218B12, which all have the same working principles.

These controllers are also found on iPads, but due to the lack of experience of the author with these devices, this page is dedicated to ACE2 controllers on Macbooks. Whether some of that information can carry to iPads is very likely, but untested.

These chips are made specifically by Texas Instruments for Apple, and have no public documentation. However, the ACE1 controllers were an almost copy of the TPS65982 PD controllers, sold by TI to the public, and have a spec-sheet. Experience in studying the ACE2 shows that a lot of things explained in that document do carry over to these chips, and it can be used to reliably explain some of their behaviours.

On Apple laptops, every USB-C receptacle is connected to an ACE2 controller, and the Magsafe 3 connector, when present, as well. In this document, we will use the terminology "n-port device" to refer to a device that has n ACE2 controllers. For example:

Example 1: The A2159 has 2 USB-C receptacles and no Magsafe 3. It is a 2-port device.
Example 2: The A2242 has 3 USB-C receptacles and one Magsafe 3. It is a 4-port device.
Example 3: The A2681 has 2 USB-C receptacles and one Magsafe 3. It is a 3-port device.

I. Function

The ACE2 controller carries 3 main functions:

Inrush limiter, integrated inside the IC (as opposed to the ACE1, which controlled external MOSFETS).
PD controller, responsible for negotiating input voltage with the charger, according to the USB-C Power Delivery (PD) standard. The normal negotiated voltage on Macbooks is 20V.
USB-C multiplexer: Detecting the type of device connected, and redirecting the trafic to the appropriate subsystem of the logic board.

Apple made the choice of not having any kind of USB-C functionality if one ACE2 controller is missing: they are meant to work together.

II. Vanilla and OTP-ed controllers

The ACE2 controller is capable of acting as an I2C host to two masters, and can configure two I2C interfaces:

Port 1, carried by pins B5, A4 and D7, respectively for SDA, SCL and IRQ. This interface is controlled by the Thunderbolt controller, which is part of the Intel PCH or Apple Silicon SOC, depending on the architecture.
Port 2, carried by pins B7, A6 and C8, respectively for SDA, SCL and IRQ. This interface is controlled bu the SMC, which is part of the T2 SOC or Apple Silicon SOC, depending on the architecture.

The I2C interfaces are set up by the IC's boot code, after it is powered on either from VBUS or VIN_3V3. The way these interfaces are set up depends on the type of controller, of which there are two:

Vanilla: These are capable of acquiring up to 8 different addresses on Port 1, and 32 different addresses on Port 2, according to configuration resistors (straps) that are placed on the board, after they are powered up.
OTP-ed: These have their I2C addresses burned in, and once placed on any board, will ignore the straps that are near their landing pad.

"OTP" stands for "One Time Programmed" and appears in multiple instances in board schematics. The "vanilla" terminology is not official, and was just arbitrarily decided by David Lecomte, during the time he spent researching how to replace defective ACE2s.

II.1 Determination of type

Vanilla and OTP-ed controllers are indistinguishable physically: they all carry the same markings on the surface of the chip. When using an ACE2 to replace a defective one, it is important to know of what type it is, as using the wrong type on the wrong landing pad might create an I2C addressing conflict, that will take down the whole USB-C communication system.

II.1.1 ACE2s pulled from a donor board

If the origin of the ACE2 controller is known, the following rules apply:

2-port devices have vanilla controllers.
On 3 or 4-port devices, the ACE2 controllers for the two USB-C receptacles on the left are vanilla, the other ACE2s are OTP-ed.

II.1.2 ACEs purchased as new

Anecdotal evidence (from experience, with no counterexample so far) seems to indicate that these ICs are vanilla, if the seller is telling the truth.

II.1.2 ACE2 of unknown origin

When purchasing pulled ACE2s, or when harvesting them from donor boards and putting them all in a box, the origin of the chip becomes unknown. If intending to use one to replace a defective ACE2, there are methods that would allow you to determine whether it is OTP-ed or vanilla. But it is more time efficient to directly use it, following the procedure in this document: if the board is fixed, you had a vanilla; if the board is not fixed, you had either an OTP-ed, or something was damaged in the process, or your board diagnosis was incorrect (the board has another issue than the ACE2 you replaced).

II.2 I2C addresses decoding

The vanilla ACE2 controller uses 3 pins to encode the I2C addresses for Port 1 and Port 2. We refer to pin numbers, rather than net names or pin names, because these tend to depend on the author of each schematic. The names can change, but the pin numbers don't. These pins are:

M19, which we will call ADDR. This pin connected to GND through a resistor, or floating, and is assigned a binary value depending on the value of that resistor, according to the table:


Resistor value	`ADDR`
0Ω	000
38.3kΩ	001
84.5kΩ	010
140kΩ	011
205kΩ	100
280kΩ	101
374k	110
Infinite (floating)	111

B15, which we will call CNTL1. This pin is assigned the value 0, or 1, depending on whether it is pulled to GND or to LDO_3V3 respectively.
A16, which we will call CNTL2. This pin is assigned the value 0, or 1, depending on whether it is pulled to GND or to LDO_3V3 respectively.

The binary I2C addresses for ports 1 and 2 are then determined according to the following:

Port 1 address: 111ADDR

Port 2 address: 1CNTL2 CNTL2 ADDR

It is usually more convenient to then translate these addresses in hexadecimal, as this is how they are referred to in schematics.

II.3 Example of I2C address decoding

Refer to the schematic of the A2442, page 31. The ACE2 controller U5500 has

ADDR (UPC5_I2C_ADDR)floating, since this pin goes to R5650 which is not present on the board. This sets ADDR = 111.
CNTL1 (I2C_UPC5_SCL) pulled to LDO_3V3 (PP3V3_UPC5_LDO)through a 1MΩ resistor. This sets CNTL1=1.
CNTL2 (I2C_UPC5_SDA) pulled to GND through a 1MΩ resistor. This sets CNTL2=0.

Thus, if one were to install a vanilla ACE2 in that position, its I2C addresses would be:

Port 1 address: 111111b = 0x3F.

Port 2 address: 101111b = 0x2F.

III. Replacing ACE2 controllers

III.1 Rule 1: Don't be an idiot.

When replacing ACE2 controllers, the obvious first rule is to use the same revision: if the defective ACE2 is a CD3217B13, do not use a CD3217B12 or a CD3218B12.

III.2 Case 1: You have a donor board for the same device

If you have a donor board for the exact same device you are working on, then use the same controller (same position on the board), and it will work directly.

III.2 Case 2: You do not have a donor board for the same device

It might be difficult to have donor boards for every device that one has to fix, be it only on the matter of price: donor boards for Pro / Max boards can cost in the 200USD ballpark, or even more if the device is recent. In this case, your replacement ACE2 should be a vanilla one. Before proceeding, here are the things you should do:

First: Determine the I2C addresses of the controller you are replacing. These can be found in the schematic, which will contain a map for all the I2C buses on the board.

As an example, the following tables reproduce the maps for the AP I2C0 bus and the SMC I2C1 bus for the A2442 (due to licensing issues, the original table cannot be posted):

AP_I2C0
DEVICE	CARDS/REFDEF	7-BIT	8-BIT
ACE2 - 0 (DEBUG)	USB-C 0	0x3A	0x70
ACE2 - 1 (DEBUG)	USB-C 0	0x3F	0x7E
ACE2 - 2 (DEBUG)	USB-C 1	0x3B	0x76
ACE2 - 3 (DEBUG)	USB-C 1	0x3A	0x74
ACE2 - 4 (DEBUG)	USB-C 0	0x6B	0xD6

SMC_I2C1
DEVICE	CARDS/REFDEF	7-BIT	8-BIT
ACE2 - 0 (DEBUG)	USB-C 0	0x3A	0x70
ACE2 - 1 (DEBUG)	USB-C 0	0x3F	0x7E
ACE2 - 2 (DEBUG)	USB-C 1	0x3B	0x76
ACE2 - 5 (DEBUG)	USB-C 1	0x3A	0x74
BANK 1 ALL CALL	USB-C 0	0x6B	0xD6

Every schematic up to now has such a page