darwinbeing/HPServerPSUHack

alt text

HP HSTNS-PL11/PL30/PL42

HP HSTNS-PL11/PL30/PL42 1200Watt Hot Plug Power Supply Hack for Vehicle Flashing and Programming. The HPE PSU is a powerful and versatile power supply unit that can be modified or hacked to suit a wide range of needs,With some basic electronics knowledge and proper safety precautions, it's possible to make this PSU even more useful and versatile for your specific applications. Modified HPE PSUs are suitable for RC battery charging, radio power supply, and vehicle flashing/powering applications.

Activate PSU

To activate the PSU, add a small resistance resistor between Pin 33 and 36 or simply short them together.
33: ENABLE#
36: PRESENT
alt text

In-Circuit Serial Programming and Debugging Pinout

alt text

Pin1 - PGEC
Pin2 - PGED
Pin3 - $\overline{\textrm{MCLR}}$
Pin4 - GND
Pin5 - Vcc(3.3V)

alt text

Modify PL30/PL42 Output & OVP Voltage

Type III Compensator Using Op-Amp

Type III compensators are a type of compensation network used in control systems to improve stability and performance.
Locate the Type III compensator in the HP PL30 power supply by examining the PCB for the Op-Amp TSV994 alt text

To increase the output voltage, one can either increase the reference voltage or decrease the resistance value of R4. alt text

alt text

Assuming the default Output is 12.32V.
There are two approaches to prevent the OVP (Over Voltage Protection) from being triggered, one is to add a resistor in parallel with the 01B resistor, the other is to modify the firmware of the MCU(dsPIC33FJ64GS606).

\begin{gather*}
\frac{R_{p1}}{R_{p1}+39.2+10+4420}{\ast}V_{out}=0.58,\ R_{p1}=\frac{R_1{\ast}220}{R_1+220} \\
\frac{1}{1+3.92}{\ast}12.32=\frac{R_{p2}}{R_{p2}+3.92}{\ast}V_{out},\ R_{p2}=\frac{R_2{\ast}1}{R_2+1} \\
If \ V_{out}=14.4V,\ R_1{\approx}1.27Kohms,\ R_2{\approx}4.7Kohms \\
If \ V_{out}=15.2V,\ R_1{\approx}910(Ohms),\ R_2{\approx}3.4Kohms \\
If \ V_{out}=16V,\ R_1{\approx}715(Ohms),\ R_2{\approx}2.67Kohms
\end{gather*}

WolframAlpha Solver Output 15.2V

R1 is used to adjust the output voltage of the power supply, while R2 is used to adjust the threshold of the Over Voltage Protection (OVP).
The modification mentioned above is not meant to increase the OVP threshold, but rather to trick the dsPIC33FJ64GS606 MCU into thinking that the output voltage has not been adjusted.

PL30 Current Sense Amplifier

alt text Figure above shows a current sense amplifier circuit for high side current measurements based on a Texas Instruments OPA2277 op amp and discrete gain setting resistors.
C1,C2,C4 Filter capacitors, GAIN=400.

Rev10 Firmware

Original DSPIC33FJ64GS606

Patch Firmware

--- PL30/10/DSPIC33FJ64GS606.hex    2023-03-12 14:10:17.000000000 -0700
+++ PL30/10/Patch/DSPIC33FJ64GS606.hex  2023-04-11 10:05:24.000000000 -0700
@@ -1802,7 +1802,7 @@
 :10708000D06E88000603A90091C0A9004400F90051
 :107090004F047800CF0278004F027800CF017800CB
 :1070A0004F017800CF0078004F00780000400600C4
-:1070B000811F7800851F7800211A80000150880008
+:1070B000811F7800851F7800E134070001508800A7
 :1070C000155280008582400011508000818252005C
 :1070D00015528800C2AADE0015508800311A8000BF
 :1070E00051528800D5E9AE00060037004501200066
@@ -4747,7 +4747,7 @@
 :10288000D06E88000603A90091C0A9004400F90099
 :102890004F047800CF0278004F027800CF01780013
 :1028A0004F017800CF0078004F007800004006000C
-:1028B000811F7800851F7800211A80000150880050
+:1028B000811F7800851F7800E1060700015088001D
 :1028C00015528000858240001150800081825200A4
 :1028D00015528800C2AADE0015508800311A800007
 :1028E00051528800D5E9AE000600370045012000AE
@@ -5188,8 +5188,8 @@
 :104410008080A900FFFF37000000FE00FFFFFF00C3
 :10442000FFFFFF00FFFFFF00FFFFFF00FFFFFF0098
 :10443000FFFFFF00FFFFFF00FFFFFF00FFFFFF0088
-:10444000FFFFFF00FFFFFF00FFFFFF00FFFFFF0078
-:10445000FFFFFF00FFFFFF00FFFFFF00FFFFFF0068
+:104440000000F800211A8000C0072000808F500073
+:1044500001003600808050000000F90000000600D6
 :10446000FFFFFF00FFFFFF00FFFFFF00FFFFFF0058
 :10447000FFFFFF00FFFFFF00FFFFFF00FFFFFF0048
 :10448000FFFFFF00FFFFFF00FFFFFF00FFFFFF0038

The code snippet above is PL30 Output set to 14.28V

PL30 Rev10 Firmware With Output 15.2V

PL30 DSPIC33FJ64GS606 Output 15.2V

PL42 Rev01 Firmware With Output 14.28V

PL42 DSPIC33FJ64GS606 Output 14.28V

Modify PL11 Output & OVP Voltage

alt text

There are two approaches to prevent the OVP (Over Voltage Protection) from being triggered, one is to connect a resistor in parallel, the other is to modify the firmware of the MCU(PIC16F883).

\begin{gather*}
\frac{{VR}+R_{p3}}{{VR}+R_{p3}+39.2+10+4420}{\ast}V_{out}=2.5,\ R_{p3}=\frac{R_3{\ast}1100}{R_3+1100},\ 0<{VR}<90 \\
If \ R_3=4.7Kohms,\ V_{out} \in (13.9,15) \\
If \ R_3=6.8Kohms,\ V_{out} \in (13.3,14.3) \\
\frac{R_{p3}+VR}{R_{p3}+VR+39.2+10+4420}{\ast}V_{out}=2.5,\ R_{p3}=\frac{R_3{\ast}1100}{R_3+1100},\ VR=40 \\
\frac{1.74}{1.74+5.11}{\ast}12.29=\frac{R_{p4}}{R_{p4}+5.11}{\ast}V_{out},\ R_{p4}=\frac{R_4{\ast}1.74}{R_4+1.74} \\
If \ V_{out}=14.4V,\ R_3{\approx}5K1ohms,\ R_4{\approx}7K68ohms \\
If \ V_{out}=15.2V,\ R_3{\approx}3K57ohms,\ R_4{\approx}5K49ohms \\
If \ V_{out}=16V,\ R_3{\approx}2K7ohms,\ R_4{\approx}4K3ohms
\end{gather*}

WolframAlpha Solver Output 15.2V

R3 is used to adjust the output voltage of the power supply, while R4 is used to adjust the threshold of the Over Voltage Protection (OVP).
The modification above is not to increase the OVP threshold, but to make the MCU believe that the output voltage has not been adjusted.

$$ \begin{gather} \frac{1.74}{1.74+5.11}{\ast}V{ovp}=(\frac{1}{4}+\frac{15}{32}){\ast}V{dd} \ If \ V{dd}=4.9V,\ V{ovp}{\approx}13.86V \ If \ V{dd}=5V,\ V{ovp}{\approx}14.12V \end{gather} $$

Vdd is the supply voltage of the PIC16F883. By default configuration, The OVP voltage is dependent on the MCU supply voltage, which is approximately 13.86 volts in this case.

PL11 Rev12 Firmware With OVP Disabled

PL11 PIC16F883 OVP Disabled
PL11 OCP

The output voltage of the CT amplified is divided down to 5V and fed into the MCU(PIC16F883). Adding a resistor in parallel across the 8.2k（labeled '8201') resistor can reduce the maximum output current. A more effective approach would be to measure the voltage at OC_DET along with the actual output voltage of amplifier, and calculate the appropriate divider ratio.
Shorting the 8.2k resistor would cap the maximum output current at around 30A.
The current flowing through the CT(Current Transformer) is transformed into a voltage signal and subsequently amplified using an amplifier. The amplified voltage is directly proportional to the output current $V=\frac{I}{10}$.

PL30 PICO Watt Meter

alt text The image above shows the Raspberry Pi Pico reading data from the HP HSTNS-PL30 power supply via I2C, measuring electrical parameters such as Amps, Volts, Watts, and Watt-hours, and displaying the results on the PIMORONI Pico Display Pack.

PICO	PL30
VSYS(39)	3.3V
GND(38)	GND
GP4/SDA(6)	31
GP5/SCL(7)	32

BOMs

Raspberry Pi Pico
Pico Display Pack

PICO Firmware 14.48V

Modify HP HSTNS-PD44 800W TITANIUM LLC PSU

Reverse Engineer a Schematic

alt text

Activate PSU

alt text

Modify Output & OVP

alt text

\begin{gather*}
\frac{5.23}{5.23+20}{\ast}12.3=\frac{5.23}{5.23+R_1}{\ast}V_{out} \\
\frac{5.23}{5.23+20}{\ast}12.3=\frac{5.23}{5.23+R_2}{\ast}V_{out} \\
If \ V_{out}=13.8V,\ R_1{\approx}23.2Kohms,\ R_2{\approx}23.2Kohms \\
If \ V_{out}=14.25V,\ R_1{\approx}24Kohms,\ R_2{\approx}24Kohms \\
If \ V_{out}=14.4V,\ R_1{\approx}24.3Kohms,\ R_2{\approx}24.3Kohms
\end{gather*}

PD44 14.4V

alt text

Load Test

When conducting load testing with ignition ON and AC running, the fan operates at its maximum speed. The output voltage reads 14.28V with no load. However, when under load, there is a voltage drop caused by the impedance in the wires, which is expected. Technically speaking, I would recommend employing Nichrome 80 12 gauge AWG resistance wire for the construction of a dummy load.

PL11/PL30/PL42 Load With Fan on MAX,Audio,High Beam activated alt text