Disclaimer: Do not try ANYTHING you are about to see at home. I am not what you call an expert, but I have 9 lives. This is just a log of what I did, and you shouldn’t try it without proper training. Even if you do, it’s still at your own risk. There are very high voltages involved in the primary stage, in the 340VDC range. That can and probably will kill you if you touch wrong places.
Why do I want to do this?
I am currently working on a quadrocopter, that usually runs on a 7.4V lithium polymer battery and draws about 25A continuous at full throttle. I want to be able to do some extended testing on the ground, but it drains the battery in 10-15 minutes, which is pretty annoying. So then I had the idea of powering it from the wall.
I first looked for commercial power supplies, but all industrial high current power supplies (like this one) are very expensive, especially with shipping, because they are huge and heavy.
Then I had the idea of using computer power supplies – they can supply a lot of current (on the order of 30A), have good protection and regulation, and are dirt cheap thanks to huge volume. For example, the one I picked, the Corsair CX430, goes for about $35 on NCIX with pricematching, with no shipping because I can go pickup myself. It’s able to supply 28A on the 12V rail.
The only problem is, there is no 7.4V for me to use. My circuit will run on 12V, but I want the power supply to be closer to actual battery voltage, so tuning results are more valid, since motors run directly on battery voltage.
The available voltages are 3.3V, 5V, and 12V. And no, I can’t use 12V-5V to get 7V, because the 5V rail cannot sink current. If I want to do that, I will have to attach a 30A constant load on the 5V rail, which will get smokey hot (150W!), and contribute significantly to my electricity bill. Though if the current requirement is lower, that would be a viable and much easier option.
So my goal is to modify the 12V rail to output something like 7V to 8.5V instead (empty battery voltage to full battery voltage for 2 cell lithium polymer). My guess is, I will just have to change 1 resistor. There should be a voltage divider that divides the 12V to a lower known reference, and a feedback loop will maintain the 12V by comparing the mid-point of the divider to the reference. Of course, finding which resistor to change is the challenge. There are hundreds on the PCB.
So here is the victim –
http://ncix.com/products/?sku=60345&vpn=CMPSU-430CXV2&manufacture=Corsair ($35 after pricematching).
Like all self-respecting engineers, I promptly voided the warranty, before even plugging the unit in for the first time –
If you are interested in how computer power supply works, here is an awesome in-depth guide – http://www.hardwaresecrets.com/article/Anatomy-of-Switching-Power-Supplies/327/2
In short, the 120V/240V input AC first goes through an input filter consisting of a few inductors, capacitors, and MOV (metal-oxide varistor, used to protect the system from high voltage transients, from, eg. lightning). The filter basically “cleans up” input power, and also prevent the system from introducing noise back to the powerline.
Then, the input voltage is rectified into ~170VDC (remember Vrms? need to multiply 120V by sqrt(2)).
The 170VDC is then doubled by a power factor correction (PFC) circuit into 340VDC, and stored in the primary capacitor (the big cap on lower right of the image). After power-off and unplugging, this cap must be discharged before touching the circuit, otherwise the result may not be too pleasant, and may require emergency room or graveyard visit.
After that, a PWM circuit (in this case integrated into the PFC chip) switches the 340VDC at a higher frequency (usually about 60kHz) into a flyback transformer (a transformer optimized for square waves), which outputs the required voltages (3.3V, 5V, 12V).
All of the above may seem redundant – why go through all the trouble of rectifying AC input into DC then switch it back to AC? Why not just feed the 60Hz AC input into a transformer to generate required voltages? The reason is, at higher switching frequency (60kHz vs 60Hz), smaller transformers can be used, so the PSU won’t be the size of a car and weigh like one.
Then there is an output filter that rectifies and cleans up output voltages (inductors and capacitors).
There is also a power supervisor IC on the side that does over-voltage/under-voltage/over-current protection. When it detects any of those conditions, it shuts off the power supply.
Here is what the back side of the PCB looks like (this image is stolen from http://www.techpowerup.com/reviews/Corsair/CX430_V2/, because I forgot to take a picture of the PCB before modding).
One thing to note here is that there is total galvanic isolation (no current flow) between primary and secondary stages, separated by the flyback transformers. The only things connecting the primary and secondary stages are the transformers and optocouplers. That means, the grounds are NOT equal (as I learned the hard way – blowing up the fuse on the PSU and almost my oscilloscope).
And now we are on to business! How do we find this resistor to change?
Usually, the way to find out how a circuit works is by identifying important ICs, and map out the circuit from there. In this case, it would be the PFC/PWM combo IC, because it should be monitoring the output storage capacitors somehow, and turning on the PWM when output voltage is too low, and off when the output voltage is too high.
On this power supply, this IC sits on a daughter board in the primary stage (the black PCB above primary caps, and beside the green inductor). So I de-soldered it –
It’s hard to see here, but the chip is CM6800, with an available datasheet online!
http://www.champion-micro.com/datasheet/Analog%20Device/CM6800.pdf
It’s apparently a very common PSU chip, so if you are modding a different PSU, there is good chance it will use the same chip, too.
The chip is quite complex, because it does a million things. However, we are only interested in the part that does the regulation.
That’s pin 6, Vdc (PWM voltage feedback input). When the voltage on Vdc goes low, the PWM circuit is disabled, and when it goes high, it’s enabled. So there must be a way for the secondary side to tell it when to turn on and off.
The answer is on page 15. Sample application circuit. Turned out, after tracing the PCB, the circuit I have is very similar to the application circuit, which made my life quite a bit easier.
On the bottom half of the circuit, there is a 2.5V voltage reference, U1. It’s a very simple chip. When the voltage on the middle pin is lower than 2.5V, it shorts cathode and anode. Otherwise it opens.
R45 and R48 forms a voltage divider that will generate 2.5V at the mid-point when the top is at 12V. This way, when voltage is too low, the reference will turn on the optocoupler, and pull Vdc low, turning on the PWM circuit to increase the voltage. Vice Versa. There’s the closed loop voltage control.
So it looks like all I need to change is either R45 or R48!
I traced the PCB starting from the Vdc pin, identify all components along the way, and found the 2 resistors –
They are both 2 resistors in parallel, which is a DEAD giveaway.
The fact that they are in parallel tells us a lot.
For most resistors used in circuits, the value doesn’t really matter. Anything within an order of magnitude is fine (pull up resistors, current limiting resistors, etc).
That means, the circuit designer is trying to get a very specific value. The fact that they are high precision resistors (3 sig figs vs the usual 2) also confirms it. It’s a very cost-conscious market. If they can get away with larger tolerance parts, they won’t use better tolerance ones. If they can get away with 1 resistor, they won’t use 2.
The 12V to 2.5V voltage divider would require this kind of precision and accuracy, since it directly affects output voltage accuracy. I literally jumped out of my chair when I found these 4 little guys.
So I slightly increased R48 (slightly just in case my assumption is wrong), and bingo! 9.5V output!
Then I tried a even bigger value which should give me my 8.5V. And I got… 0V :(. Which is strange, and I thought I somehow managed to blow it up, but I decided to dig further.
The primary cap voltage is now at 170V instead of 340V, which means the PFC/PWM chip has quit or been disabled by something. Then I realized it must have been the supervisory circuit, because 8.5V would certainly trigger under-voltage protection.
That would be this guy –
I tried looking up the part number, and it looked like the chip doesn’t exist. Which means, it must be a rebranded/cloned chip.
That’s bad news. If I don’t know what the original chip is, how do I find the datasheet?
I decided to try it the dumb way, and turned out it worked out – I scoped all the pins, recorded all the voltages, went through a list of common power supervisory ICs online (can’t seem to find it anymore…) with the same footprint, and compared the expected voltages on each pin in the datasheet with what I got.
Took me about 10 minutes, and I found it just before I was ready to give up!
Turned out, the Sitronix ST9S429 (non-existent chip) is actually a rebranded Unisonic Technologies S3515! (I’m putting this line here for future Googler’s benefit. BTW, I found out that my blog gets indexed by Google 19 times a day on average. Cool)
This chip monitors all outputs rails, and disables the power supply when any of them goes out of spec. There is a fault protection output (FPO) that drives GND normally, and goes high impedance when there’s a fault condition. The signal gets sent back to the PFC/PWM chip through an optocoupler and disables it.
There is a ground pin right next to the FPO output. Convenient. I only have to short them!
That disabled fault protection. Unfortunately, that also means there is no longer output short circuit protection, so I need to add a fuse externally to protect the power supply.
(I have since replaced the through-hole resistors with surface mount ones, so that it actually fits in the enclosure)
Results –
And on capacitive coupling –
This is with ~0.5A load (power resistor + PSU original fan).
The ripple is a little worse than I had expected (284mVp-p), since it did better at 12V if my memory serves me right.
But otherwise, success!
This “little” project ended up taking me about a month, but it was my first serious reverse-engineering project, so it was pretty cool! Is it worth my ~20 hours of time to save the $50? Probably not. But I learned a lot about power circuitry and reverse engineering in general in this project, and that was more than worth it.
Now I can make arbitrary voltage 28A power supplies with $35, a few resistors, and about half an hour of time (now that I know how to do it). They normally cost $70-$80 + shipping, and are generally out of stock. Though I wouldn’t go much above 12V without verifying that the output caps are rated for it. They can very literally blow up if you go too high.
Now where is the cake?!
PS. If you seriously decide you want to try this (and you shouldn’t), there are at least few general HV precautions you should take (I didn’t write about them in the post because I didn’t want to clutter it, but I did follow them)
1. Never touch any part of the circuit when powered up (or shortly after power down, time depends on how big your bleeder resistor is), no matter what voltage you think is on that part.
2. Add an appropriately sized and rated bleeder resistor in parallel with primary caps so it won’t retain high voltage long after power-off. It will waste a little bit of power, but your life is worth more.
3. Discharge the primary cap by shorting with a piece of conductor after you think it was already discharged by the bleeder.
4. If live probing is necessary (unfortunately it usually is), fix the ground probe with a clip, so you can probe with one hand, and keep the other in your pocket (so if you get shocked, it will only burn your finger, and no current will go through your heart). Work on unpowered circuit as much as possible.
5. Make sure you are not touching any grounded metal. Computer case, metal case of most equipment, etc.
6. Only do it when you are fully awake. I usually stop around 10pm, because that’s when I start getting a little tired. Tiredness + high voltage got many people killed.
7. Make sure all equipments are rated for highest voltage of the system (400V in this case). On the oscilloscope probe, triple check it’s on X10 (attenuation). If it’s on X1 your scope will probably blow up. Both multimeter leads and device itself should be at least CAT III (600V/1000V) rated.
8. Make sure someone is around that can call 911 for you.
The list is by no means exhaustive. Just things I can think of off the top of my head.