Power Supply Hacking – Part 1

I’ve really liked my Tenma 72-10480 power supply which I’ve been using for the last couple of years. Main plus points for me have been:

  • Fairly cheap – currently £60 on CPC
  • Amazing voltage accuracy (especially for the price)- setting the output to 20V still reads 20.00V on my Fluke 87V. Numerous checks over using it have me pretty convinced that the voltage it says is actually what it is putting out. This reassurance is worth a lot when connecting to expensive stuff and is something I don’t get with eBay specials.
  • Current limiting – saved me on more than one occasion!
  • Nice user interface – it’s really simple and “just works™”

The main downside is the obnoxiously loud fan which I’ve been meaning to replace since I bought it.

Recently, I decided that I needed another supply in the shack, I have been running with just 1 for a long time and it’s been slightly limiting on several occasions. Given how much I’ve liked the Tenma, I basically decided to buy the same thing again. This time, I splashed a little bit more cash (£84) and get the programmable version (Tenma 72-2535). Same power supply inside (I suspect) but now has a USB / Serial port on the back to allow the power supply to be configured by a computer. This will be a requirement in a future project to convert a lot of my testing to be handled by a Python script rather than me manually pressing buttons and taking readings. Given everything else in my shack supports remote control, it felt lacking to not be able to adjust power conditions and turn things on/off as required. The fan is still loud (though does pump a lot of air through the unit) and they’ve changed the binding posts from the “sticky-out” (apologies for technical language!) kind that could have a wire directly inserted to insert sockets that are still fine for banana plugs but useless to shove a wire in. Solution long-term is probably just to buy a load of banana leads off eBay and cannibalise as needed.

Old power supply (Left), New power supply (Right)

Given how similar they look, I was hopeful that they had the same hardware inside and making my original PSU programmable was just a case of finding the right header / bit of firmware prodding. I was made more confident by having a working programmable unit as a reference. IF not (assuming nothing gets broken in the process!) I haven’t lost anything.

Hello World

Step 1 was to ensure I was able to communicate with the new PSU before I started breaking anything. I was a bit surprised that Tenma haven’t jumped onto the bandwagon of GPIB, instead offering a normal COM port with a command set that looks supiciously like GPIB but just not quite: *IDN? is still a thing but other than that, they’ve gone a bit rogue. Datasheet on Farnell is here. Anyway, once I’d got over being deafened by the fan preparing for take-off, a few minutes of Python and everything looked to be working:

import serial


with serial.Serial(PORT, BAUDRATE, timeout=TIMEOUT) as ser:

resulted in:
b'TENMA 72-2535 V2.1'
The unit beeps when it transitions from local (buttons) to remote (USB) control and takes roughly 5s to return to local control once the serial port has been closed. The buttons are disabled while the unit is under remote control, however the main power button is a physical switch that does allow the unit to be shutdown instantly when the unit is under remote control. This is a definite plus if something goes wrong and your device under test starts smoking.

Don’t turn it on, take it apart!

Usual disclaimer about working on stuff that has mains electricity in it: Don’t work on any electrical device, especially ones containing high voltage, unless you are suitably trained and competent. You do any activity entirely at your own risk and high voltage can be fatal. This is not a guide, I will not document every step I take and I do (surprisingly) know what I’m doing!

Boring stuff aside, I wanted to open up both of these units and see how different they looked inside. I did have the slight extra complication of one unit being 5 years older than the other as well as being different models so wasn’t really sure what to expect.

Overall, both look incredibly similar. What is very interesting is that the old unit has a unpopulated 4 pin header just above (what I’m guessing) is the microcontroller. In the programmable unit, this header has a cable going to the rear USB port with a small adapter board. Ooh, this just got exciting! I’m also going to stick my neck out and guess its running UART. If this is the case, a cheap USB-UART adapter should allow us to test if the old unit can be programmable or if the firmware doesn’t support it. Firstly, let’s remove the USB adapter board and have a look.

The two pin header is clearly power, it comes straight from the transformer. I’m not quite sure what the coil on the board does but a bridge rectifier and voltage regulator are obvious. Sorry but some of this “just spotting what they are” is experience and I don’t know how to explain how I guessed certain things. The two 4 leg SMD parts under the 4 pin communications header are most likely optocouplers based on how they look. It’s not normal for a 4 pin device to be so physically large. The text FPT2 can also be seen on these parts, small amount of Googling returns that these are Isocom IS181 optocouplers – datasheet here. This makes some sense, USB board is floating compared to everything else and prevents conducted USB noise getting in.

Pin connections

Bit of tracing later and I appear to be correct. Combing what is traced out above with the pinout for a IS181GB:

Optocoupler Pinout

This gives Pin 1 on the header goes through the LED on the left optocoupler (pale blue line), through a 510R resistor and back to pin 2 (orange line). The output emitter is connected to 0V (black circle) and the collector goes off somewhere (purple line) but has that resistor marked 30B (I think but it measures 2k exactly) going up to the supply voltage on the USB board. The opposite happens in the TX path, a trace comes out from the IC, through a 510R resistor (dark blue trace), into pin 2 of the right hand optocoupler with the LED anode connected to V+ on the USB board (brown circle). Pin 4 of the optocoupler goes to pin 4 of the header (green trace), pin 3 goes to the collector (red trace) with a 2k pullup to pin 1. This would suggest pin 1 is the logic supply voltage on the other board. That nicely means that circuit is symmetrical which is a nice design touch. This is quite hard to convey in words so schematically:

Schematic form of optoisolators

Fairly nice, quite elegant and means that both RX and TX paths always have normal polarity. Standard feeding of the data signal into the anode means the UART gets inverted as a high into the LED causes the output to be pulled low but this problem doesn’t exist here. It does mean that we should find normal polarity UART signals at the point marked TX and RX above. Now I’m fairly happy that this USB board should not damage the old power supply, the acid test is plugging the USB board into the old supply’s control board and seeing if we can talk to it. There is the slight issue of there being no extra winding on the transformer but that’s nothing a bit of Frankensteining can’t fix. Note, what is shown in the next picture is seriously dangerous. PLEASE DON’T DO THIS YOURSELF.

Old PSU (left) getting the data feed while the new PSI (right) powers the USB board

Oh it’s a good job I spent loads on my education, right? Incidentially, I did replace the fan in the old PSU with a random one I found but it didn’t solve fan noise. Most power supplies don’t come looking as trashy as this.
However, this was vaguely successful. Running the same script as above, the old PSU did not return an identity string but did beep to indicate it was being controlled remotely and locked all the front panel buttons while the script was running. Control was then nicely set back to manual once the script finished. Think we need to write a bit more code to see if we can actually do something as it’s not surprising that a PSU without remote control doesn’t have an identity string. So let’s query the voltage on channel 1. Same code as before but send “VSET?” instead of “*IDN?” and… proper success this time, b'09.00'and it was actually set to 9V! This is excellent, cheap FTDI board, couple of optocouplers to do it nicely and we’re in business and I’ll have 2 programmable supplies! For someone that doesn’t already have a power supply, this probably isn’t worth doing as it’s only £20 difference but it saved me buying another £80 supply should I need a second programmable one so worth it for me 😀 Part 2 will be soldering something up to put into the old PSU.

Join the Conversation


  1. Absolutely loving your reverse engineering of the usb control.

    I came across your blog today while researching whether I could easily upgrade my Tenma’s output banana plugs to the older style binding posts, but got super excited about the USB module.

    As soon as I can find where I left my opto-isolators, I’m gonna whip up a prototype usb-Tenma board.

    If the whole usb-serial board is isolated from the control board, then I can’t see why a homebrew USB-only module couldn’t be powered from the USB host device (5vdc).

    The extra transformer wire, and ac-dc conversion on the module seem overkill, but they are probably needed to allow fully compliant RS-232 signal on the DE-9 connector.

    Looking forward to Part 2.
    Let me know if you want to collaborate etc.
    If I succeed in getting my prototype to work, I’ll share my results.


  2. TLDR; the newer Tenma 72-10480 seem to have the remote control disabled in firmware.

    I whipped up a isolated usb-serial interface taking inspiration from the schematic in this blog.

    No dice.
    Sending commands to the Tenma yielded no response over serial, no beeps or and no front-panel lockout.
    Swapper RX and TX in the hope they were labelled wrong on my CH340 USB-Serial module, still nothing.

    Getting an oscilloscope on the RX pins, it seems the RX pin is held low by the MCU on the control board.
    Hence my conclusion that the remote control has been disabled in firmware.

    I’m fully prepared to be wrong about this, as it would mean a custom USB control for my PSU, so if you get any further with making your own interface board for the older 72-10480, I’d be interested in the details and will likely have another crack at this.

    While reading around, searching for clues, I googled the silkscreen on the PCB “KR1025” and the etching on the main MCU “KORAD01” in my PSU.
    It looks like Tenma PSUs are re-brands of the KORAD KA3xxxP and KA3xxxD models.

    Theres a bunch of discussions on the EEVBlog forums about the KORAD units, including:
    Full schematics:

    and even somebody writing their own firmware


    1. Hmm, interesting. Have been a bit slow with part 2 as I’ve been away for a while and refused to take electronics on holiday. The silkscreen on mine does say “KR1024” so would suggest that there has been a major upgrade between mine and current generation products, probably around the time the nicer stick-out binding posts disappeared 😦

      It is reassuring that the schematic does agree with how I guessed it was working and goes to the UART pins on the MCU so I’m feeling relatively confident it is just UART and I should be able to cobble something together. Thanks for the update, will hopefully have something working early this week.


  3. Hey Dan,
    I switched my new power supply with an older 72-10480 that we had at work. When I connect to the header on the main board, via a USB-Serial module, I get the BEEP and front panel lockout, but none of the commands either return a value or have the desired effect (e.g. “OUT1” should turn on the output).
    Any serial data (e.g. “Hello World!”) causes the unit to go into “remote mode”

    Some differences between your schematic and the one from the KORAD files linked above, led me to try inverting the signals, but to no avail.

    I’m starting to suspect that the microcontroller on the interface board is doing more than just passing through the serial data unaltered, but have no evidence of this.

    From the pinout in the schematic, it looks like the MCU on the interface board could be an NUC123 or similar (ARM Cortex M0).

    Click to access DS_NUC123_Series_EN_Rev2.04.pdf

    If you’re still planning a part 2, it might be worth sniffing the link between it and the main board MCU, to confirm whether or not the command set is passed as-is to the main board.


    1. Hello,
      After some tests on a KA3005P, I can confirm that commands are passed as-is to the main board. It is 9600 8N1. I controlled main board straight from a PC without USB interface card.


Leave a comment

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: