Power Supply Hacking – Part 1

I’ve really liked my Tenma 72-10480 power supply which I’ve been using for the last couple of years. Main plus points for me have been:

• Fairly cheap – currently £60 on CPC
• Amazing voltage accuracy (especially for the price)- setting the output to 20V still reads 20.00V on my Fluke 87V. Numerous checks over using it have me pretty convinced that the voltage it says is actually what it is putting out. This reassurance is worth a lot when connecting to expensive stuff and is something I don’t get with eBay specials.
• Current limiting – saved me on more than one occasion!
• Nice user interface – it’s really simple and “just works™”

The main downside is the obnoxiously loud fan which I’ve been meaning to replace since I bought it.

Recently, I decided that I needed another supply in the shack, I have been running with just 1 for a long time and it’s been slightly limiting on several occasions. Given how much I’ve liked the Tenma, I basically decided to buy the same thing again. This time, I splashed a little bit more cash (£84) and get the programmable version (Tenma 72-2535). Same power supply inside (I suspect) but now has a USB / Serial port on the back to allow the power supply to be configured by a computer. This will be a requirement in a future project to convert a lot of my testing to be handled by a Python script rather than me manually pressing buttons and taking readings. Given everything else in my shack supports remote control, it felt lacking to not be able to adjust power conditions and turn things on/off as required. The fan is still loud (though does pump a lot of air through the unit) and they’ve changed the binding posts from the “sticky-out” (apologies for technical language!) kind that could have a wire directly inserted to insert sockets that are still fine for banana plugs but useless to shove a wire in. Solution long-term is probably just to buy a load of banana leads off eBay and cannibalise as needed.

Given how similar they look, I was hopeful that they had the same hardware inside and making my original PSU programmable was just a case of finding the right header / bit of firmware prodding. I was made more confident by having a working programmable unit as a reference. IF not (assuming nothing gets broken in the process!) I haven’t lost anything.

Hello World

Step 1 was to ensure I was able to communicate with the new PSU before I started breaking anything. I was a bit surprised that Tenma haven’t jumped onto the bandwagon of GPIB, instead offering a normal COM port with a command set that looks supiciously like GPIB but just not quite: *IDN? is still a thing but other than that, they’ve gone a bit rogue. Datasheet on Farnell is here. Anyway, once I’d got over being deafened by the fan preparing for take-off, a few minutes of Python and everything looked to be working:

import serial
PORT = "COM3"
BAUDRATE = 9600
TIMEOUT = 1

with serial.Serial(PORT, BAUDRATE, timeout=TIMEOUT) as ser:
ser.write(b'*IDN?')
print(ser.readline())
resulted in:
b'TENMA 72-2535 V2.1'
The unit beeps when it transitions from local (buttons) to remote (USB) control and takes roughly 5s to return to local control once the serial port has been closed. The buttons are disabled while the unit is under remote control, however the main power button is a physical switch that does allow the unit to be shutdown instantly when the unit is under remote control. This is a definite plus if something goes wrong and your device under test starts smoking.

Don’t turn it on, take it apart!

Usual disclaimer about working on stuff that has mains electricity in it: Don’t work on any electrical device, especially ones containing high voltage, unless you are suitably trained and competent. You do any activity entirely at your own risk and high voltage can be fatal. This is not a guide, I will not document every step I take and I do (surprisingly) know what I’m doing!

Boring stuff aside, I wanted to open up both of these units and see how different they looked inside. I did have the slight extra complication of one unit being 5 years older than the other as well as being different models so wasn’t really sure what to expect.

• 

• 

• 

• 

• 

• 

• 

• 

Overall, both look incredibly similar. What is very interesting is that the old unit has a unpopulated 4 pin header just above (what I’m guessing) is the microcontroller. In the programmable unit, this header has a cable going to the rear USB port with a small adapter board. Ooh, this just got exciting! I’m also going to stick my neck out and guess its running UART. If this is the case, a cheap USB-UART adapter should allow us to test if the old unit can be programmable or if the firmware doesn’t support it. Firstly, let’s remove the USB adapter board and have a look.

• 

• 

• 

The two pin header is clearly power, it comes straight from the transformer. I’m not quite sure what the coil on the board does but a bridge rectifier and voltage regulator are obvious. Sorry but some of this “just spotting what they are” is experience and I don’t know how to explain how I guessed certain things. The two 4 leg SMD parts under the 4 pin communications header are most likely optocouplers based on how they look. It’s not normal for a 4 pin device to be so physically large. The text FPT2 can also be seen on these parts, small amount of Googling returns that these are Isocom IS181 optocouplers – datasheet here. This makes some sense, USB board is floating compared to everything else and prevents conducted USB noise getting in.

Bit of tracing later and I appear to be correct. Combing what is traced out above with the pinout for a IS181GB:

This gives Pin 1 on the header goes through the LED on the left optocoupler (pale blue line), through a 510R resistor and back to pin 2 (orange line). The output emitter is connected to 0V (black circle) and the collector goes off somewhere (purple line) but has that resistor marked 30B (I think but it measures 2k exactly) going up to the supply voltage on the USB board. The opposite happens in the TX path, a trace comes out from the IC, through a 510R resistor (dark blue trace), into pin 2 of the right hand optocoupler with the LED anode connected to V+ on the USB board (brown circle). Pin 4 of the optocoupler goes to pin 4 of the header (green trace), pin 3 goes to the collector (red trace) with a 2k pullup to pin 1. This would suggest pin 1 is the logic supply voltage on the other board. That nicely means that circuit is symmetrical which is a nice design touch. This is quite hard to convey in words so schematically:

Fairly nice, quite elegant and means that both RX and TX paths always have normal polarity. Standard feeding of the data signal into the anode means the UART gets inverted as a high into the LED causes the output to be pulled low but this problem doesn’t exist here. It does mean that we should find normal polarity UART signals at the point marked TX and RX above. Now I’m fairly happy that this USB board should not damage the old power supply, the acid test is plugging the USB board into the old supply’s control board and seeing if we can talk to it. There is the slight issue of there being no extra winding on the transformer but that’s nothing a bit of Frankensteining can’t fix. Note, what is shown in the next picture is seriously dangerous. PLEASE DON’T DO THIS YOURSELF.

Oh it’s a good job I spent loads on my education, right? Incidentially, I did replace the fan in the old PSU with a random one I found but it didn’t solve fan noise. Most power supplies don’t come looking as trashy as this.
However, this was vaguely successful. Running the same script as above, the old PSU did not return an identity string but did beep to indicate it was being controlled remotely and locked all the front panel buttons while the script was running. Control was then nicely set back to manual once the script finished. Think we need to write a bit more code to see if we can actually do something as it’s not surprising that a PSU without remote control doesn’t have an identity string. So let’s query the voltage on channel 1. Same code as before but send “VSET?” instead of “*IDN?” and… proper success this time, b'09.00'and it was actually set to 9V! This is excellent, cheap FTDI board, couple of optocouplers to do it nicely and we’re in business and I’ll have 2 programmable supplies! For someone that doesn’t already have a power supply, this probably isn’t worth doing as it’s only £20 difference but it saved me buying another £80 supply should I need a second programmable one so worth it for me 😀 Part 2 will be soldering something up to put into the old PSU.