-
Hi all!
APC Uninterruptible Power Supplies (UPSs) are quite common devices, which are often posted about on this forum. I thought I would share the results of my most recent endeavor into hacking them, which may be useful for others doing repairs and modifications (hence, I've started this thread in the repair forum). This information pertains to APC Smart-UPSs of the 'SMT' series, e.g. SMT1500I, SMT1000, SMT750RMI2U, etc., especially the somewhat older ones, which I have tested it on, but most likely any except the 'CloudConnect' models, which use different internals.
What is green mode?
One of the big selling points of these models over the older SUA series was the addition of 'Green mode'. I will briefly explain what this is. The UPS usually charges its batteries using the inverter circuitry in reverse. This is effective, but somewhat inefficient once the batteries are fully charged. 'Green mode' entails turning off the inverter entirely once the batteries are fully charged, and switching on a much smaller Switch Mode Power Supply (SMPS) circuit to take over maintenance charging of the batteries, and powering the unit's electronics. This reduces the idle power consumption of the units. From my testing, a SMT1500I uses about 12W with green mode, compared to about 20W without green mode (those numbers are with a network card installed).
Why disable it?
Saving power is great, but there are a few key reasons why you might want to disable this mode:- The SMPS has failed and you want to run the UPS without it. This has happened to several of my units, and often isn't easily repairable as the flyback transformer seems to fail and it's a custom part.
- You want to add external batteries to the unit. The higher charge current of the larger batteries can cause the SMPS to fail as above. Otherwise these units work fairly well with external batteries, like the SUA series, so this is a common idea.
- You want it to be quieter. The SMPSs make a lot of audible noise compared to the rest of the unit (aside from the fan, but that is easily modded). They are designed for commercial environments where nobody cares, but many people use these UPSs for other purposes.
There's no user-accessible setting (that works)
Now you're supposed to be able to disable this mode by using the following setting in the Network Management Card interface:
But anyone who's tried it will know it doesn't actually work! At least not on units of the vintage I have. There is also no front panel setting for green mode on any of my units. Green mode isn't even mentioned in the most recent SMT series (non-SmartConnect) manual as a front panel setting, so I doubt that's changed on the newer units (anyone who has one could comment).
So this weekend I had a go at hacking this and I believe I have figured out how to do it.
Internal serial port and APC Smart Protocol
These UPSs have an internal serial port, which is a 6-pin header on the PCB that you can connect to at 2400 baud 8N1 and use the standard UPSLink communications protocol that the older SUA series used. The location of the header varies depending on the UPS model and revision, but the fundamentals are the same for the whole series. Credit for discovering this goes to YouTuber FFcossag, and his video below which describes using this in better detail.
But basically, there are two microcontrollers inside the unit, a main processor (based on 8051 architecture) and a communications processor (newer STM32 part). Connecting to the internal serial port allows you to talk directly to the 8051 and use the standard APC Smart protocol, to hack things like setting the battery charge voltage of the UPS. That's great, but the standard APC Smart protocol has no green mode setting - it pre-dates the existence of this feature. So none of the existing documentation online covers this. And of course, APC (Schneider) are never going to document what is now only an internal protocol that is not supposed to be accessible to the user at all!
Firmware reverse engineering
Now the interesting bit. I had a dump of the main (8051) processor's firmware, from doing repairs on these UPSs ages ago. What I did was disassemble the firmware dump into assembly code using an 8051 disassembler program, and then I spent most of this weekend deciphering it. After a great deal of head scratching and learning how assembly code actually works, I believe I struck gold. I knew that entering programming mode (part of the APC Smart Protocol, achieved by sending two 1s, about one second apart) causes the UPS to exit green mode and not re-enter it until leaving programming mode. I therefore reverse engineered that small part of the firmware, and found that a specific memory location was being checked in parallel with that check of programming mode which I believed to be disabling green mode. That specific memory location is only ever written to if the device reads ASCII code 0x13, i.e. CTRL-S, on the serial port, which toggles it between zero and one. It was a long shot, but the value of that parameter appeared to be causing a change in program execution that looked about right, so of course I tried it.
Testing
Upon sending 0x13 to the main processor via the internal serial port, once in Smart mode (Y->SM), I got responses of '01' and then '00' and then '01' again - i.e. toggling the value. It turns out that the value is in fact saved to EEPROM, and persists even if the UPS is power cycled!
And wouldn't you know - if set to one, the UPS never switches to green mode!! Usually it does so after one hour of normal operation without power interruptions - it's gone 6 hours now (edit: now multiple days) with no interruptions and no green mode. Nothing else seems to be affected, the UPS otherwise works normally.
So the conclusion is you can send 0x13 (CTRL-S) to the internal serial port, to toggle the green mode setting, and the change is saved in EEPROM so you only have to do it once. You want the '01' setting to disable green mode.
To me, it makes sense that there would be a setting for it in there somewhere, even if it was never implemented in the communications processor to make it user-accessible.
Physical removal of the SMPS
After doing this, you can physically unplug the mains input of that SMPS board inside the UPS, which will save about 1-2W of power (the irony is not lost on me). You can also remove the SMPS entirely, as it's on a separate board.
On some units, like mine, the SMPS board also has a relay that switches the neutral of the main transformer, to energize/de-energize it on the mains side. In this case, without the board installed, the transformer will be disconnected from the mains permanently, and the UPS won't work. I therefore desoldered the connector from the SMPS board and shorted it out with a piece of wire, to make a jumper I can plug into the transformer connector so that the transformer is permanently connected.
Without the firmware setting changed, if you actually remove the board like this then it will trip a fault after one hour when it tries to enter green mode. With the firmware setting changed as above, the UPS works fine like this in my testing so far.
Conclusion
I thought this was a remarkable - if obscure - find, if you happen to have one of the issues I listed above, where disabling green mode might solve a problem for you. As such, I thought it might be worth sharing, so that this information exists somewhere on the internet, in case it's useful for others repairing/modding these UPSs!
-
Hi,
The topic is interesting, I would like to summarize everything in it.
I want to make some clarifications so as not to mislead myself and others.
So,
-
SMPS (Charger), among other things, charges the battery in case of replacement and partial discharge.
This is easy to see from the replicas in the LAN NMC AP9630-AP9631, if the battery was discharged as a result of the UPS operating from the battery and after switching to a power outlet, the battery charge did not reach more than 30%.
For this reason, if the battery is discharged and there is not enough voltage for full operation of the internal SMPS (IC12 TL3843), which supplies power to all components and parts of the circuit (+5V; +5V; +12V; -9V; &+24 for SMT3k), startup not possible.
That is, SMPS (Carger) is simply necessary.
And, naturally, Charger for different UPS has its own characteristics (24V; 48V, 192V).
-
The charge of the battery during reverse operation in the transformer and the components involved is shown here:
https://www.eevblog.com/forum/repair/apc-smartups-overload/
And it seems to me that the transformer has nothing to do with it.
-
If you are talking about fan noise, then its operating mode is here:
https://www.eevblog.com/forum/repair/apc-smt3000rmi2u-battery-not-charging/
-
Connector J606 (pin3-TX; pin5-RX) does have access to MPU IC11 ATMEL89C51RC-UM (pin11-RX; pin13_TX) and can be used for calibration in the traditional sense, but it is also connected to IC603 ARM STM32F103 C4 (pin43-RX ; pin42_TX).
IC603 can be accessed in two ways:
IC603 (pin29-RX; pin30_TX) -> IC601 MAX232 (pin12-RX; pin11_TX // pin13-RX; pin14_TX) -> RJ45_10 (pin8-RX; pin2-TX)
IC603 (pin17-RX; pin16_TX) -> J2 (pin7-RX; pin9_TX) -> NMC (pin9-RX; pin7-TX)
This is probably MODBUS.
The presence of LAN NMC AP9630-AP9631, as far as I understand, provided for UPS control via the cloud.
It is difficult to judge to what extent this has been implemented.
-
The display and keys are also controlled by IC603, and the operation of the keys is implemented at the ADC level (a set of resistors), the display is IC200 74HC595.
-
Please note that on some relay chargers R901 or R902 this controls group sockets, the power to which can be reset to reboot connected devices via LAN or via the cloud.
Let's continue... -
Very interesting RLP! I've never worked with these models from APC. Only the cheap versions (like the one I had fixed recently
). But this is fascinating to me! Thanks for sharing!
-
The world is still running on those good old serial ports
Thanks for the write-up, lots of interesting info in here. -
For this reason, if the battery is discharged and there is not enough voltage for full operation of the internal SMPS (IC12 TL3843), which supplies power to all components and parts of the circuit (+5V; +5V; +12V; -9V; &+24 for SMT3k), startup not possible.
That is, SMPS (Carger) is simply necessary.
So one thing to clarify in case others are confused, is that the TL3843 SMPS you speak of (which provides the lower voltage rails) is entirely separate from the SMPS that I removed, which is based on a TNY280GN chip, labelled IC900 on my unit, which only supplies 24V (for the 24V units, 48V for the larger ones). This TNY280GN-based flyback SMPS board runs directly from the mains input of the UPS.
The older SUA series don't have this extra SMPS/charger at all. Hence, what you describe is exactly how they behave: they will not start up if the batteries are disconnected or totally dead, or more specifically if the voltage isn't sufficient to run the internal SMPS (the one based on IC12, UC/TL3843, that provides the lower voltage rails). Even if there is a mains input, because battery voltage is required to 'bootstrap' the control circuitry to begin charging. My understanding is that this isn't usually a problem because the unit will cut off the inverter to prevent over-discharge of the batteries, so they won't reach such a low voltage. But, if they self-discharge below that point, or are faulty, then people do report experiencing what you describe: it won't power up without sufficient battery voltage. This wouldn't be an issue with the SMT series because the extra SMPS powered directly from the mains input could 'bootstrap' the system even if the batteries are dead.
Having modified my SMT series UPS to work like an older SUA series UPS in this regard, yes I agree that same limitation will now apply to my unit. -
Only the cheap versions
Yeah the Smart-UPSs are only affordable for the individual if you can find them used and install new batteries, which I did for all of mine. One advantage, since they are commercial units, is that many commercial outfits are quite wasteful with their old IT equipment, so large numbers of these units, still working, make their way to the second hand market through IT recyclers (and dumpsters in corporate buildings, like Dave's).
-
The world is still running on those good old serial ports
Indeed, and I can see that there are other un-documented secrets in the assembly code just waiting to be discovered... I will look into it further if I get the time! -
Hi,
The above links were mainly about UPS's SMT1500-3000, which, as far as I remember, is G5.
I'm more familiar with the SMT1500RMI2U PCB 640-3081J-Z-001 (BAT-24V).
You have a J906 4pin connector installed on your charger (640-3076A REV09) and one optocoupler on the PCB.
Probably - Pin2 control DOWN (increment U), Pin3 control UP (decrease U) - control is performed by MPU IC11 89C51RC-UM (P2.0-pin24, P1.4-pin6).
Please tell me what is your P/N PCB 640-xxxx and number G4.5?
Thank's. -
You have a J906 4pin connector installed on your charger (640-3076A REV09) and one optocoupler on the PCB.
Probably - Pin2 control DOWN (increment U), Pin3 control UP (decrease U) - control is performed by MPU IC11 89C51RC-UM (P2.0-pin24, P1.4-pin6).
Please tell me what is your P/N PCB 640-xxxx and number G4.5?
It is labeled 4.5G, part number is 640-3076A REV09 for the main board also.
J906 pinout on this board:
- 1: 24V
- 2: PSU control (goes to pin 24/P2.0 on IC11), looks like some sort of PWM signal
- 3: Relay on/off (goes to pin 31/P2.7 on IC11)
- 4: GND -
Hi,
I would like to ask you to take a photo of the charger at the top and bottom.
I'll reverse the diagram and clarify some components.
Thank you. -
Indeed, and I can see that there are other un-documented secrets in the assembly code just waiting to be discovered... I will look into it further if I get the time!
Are you aware of the procedures for setting the battery charge voltage lower to extend battery life? I don't have the page handy, but the same procedure that works via the external serial port on the SUA- models also works on the SMT- models via the internal port. -
I would like to ask you to take a photo of the charger at the top and bottom.
Images attached here. Note I desoldered J903. Also, you might notice that there is some discolouration of the PCB visible in the image of the bottom side, at the top edge of the board just to the right of the centre. That is from the power resistors on the other side of the board getting unusually hot at some stage. It appears to have no ability to sense current, hence an overload just intermittently triggers the over-temperature protection in the TNY280GN IC, but also seems to heat up those snubber resistors a lot and damage the windings in the transformer. The flyback transformer on this board is actually one I re-wound, because the original windings failed. The turns ratio is 185:31 from memory. Now my re-wound unit seems to have failed again after I used it with external batteries. Hence part of the reason I gave up on it altogether and disabled green mode!Are you aware of the procedures for setting the battery charge voltage lower to extend battery life? I don't have the page handy, but the same procedure that works via the external serial port on the SUA- models also works on the SMT- models via the internal port.
Indeed, I've used that to reduce the charge voltage a little bit. You can also still set the number of 'external battery packs', as if it were one of the SUA-XL models, which allows extending the runtime estimates if you add external batteries.
-
Hi,
Unfortunately, I can’t see everything in the photo, so errors and inaccuracies are possible.
If you help, I will correct it.
-
Nice work. Here are a few things I can see from my board:
- Q903 is STU6NF10
- R900 = 01B, 1k
- C939 measures 10nF in circuit
- C904 is 22uF 50V
- D914 and D900 are marked WT6 -> BZX84-C33
- D901, D933, D938 are A4W -> BAV70
- C938 is 10uF 50V
- C916A is 0.1uF 250/275V AC X2-class
- R911, R993 are 01C, 10k
- R902 is 2613, 261k
- Q900 and Q906 are marked W7V thus PDTD113ZT
- C907 is 20pF according to my notes from a previous out-of-circuit measurement
- C915/915A measures 1uF
- R915 is 30B, 2k
- C900 is indeed 10nF
- C909 is 470pF
- There is also a C913 in parallel with C906 - 0.1uF
- Q904 is marked 2F -> MMBT2907A
- There might be another couple of capacitors left that need measuring out of circuit...
Not sure about the position of Q903... I think it is actually involved in switching the relay, and the GND is continuous between C906 and J906? Also not too sure what is going on around Q906 and D938. Hopefully the attached photos of that side of the board help.
-
Hi,
Unfortunately, I can’t see everything in the photo, so errors and inaccuracies are possible.
If you help, I will correct it.
Hello,
Very interesting work, I'm sad I did not find it before!
I'm reworking on a few units of SMT 3000 I boards and I have some difficulties on investigating the internal circuitry.
@asis, how did you made the diagram for the maintenance charger board? I really would like to prepare such a schematics for my boards... -
Hi,
A basic “reverse” can be done with a pencil and a sheet of paper.
The essence is to restore the connections of all existing components using their characteristic generally accepted mapping.
In order for the reconstructed circuit to be readable, you need to develop your own style, which will allow not only you, but also other already trained people, based on the perception of the existing connections and components, to generalize the electrical circuit diagram and understand how it functions.
This is a kind of puzzle that presents a complete picture for perception.
These skills take years to develop and are essentially the work of the brain.
You can use any SW CAD as a basis, which has the necessary set of tools and a library of elements, or you can create your own library.
https://www.eevblog.com/forum/other-blog-specific/pcb-reverse-engineering-317953/