Help with bricked APC UPS SMT1500

[mark1975]

Hey guys I have been scouring the net for some information about these shitty SMT series UPS getting bricked.

I have two SMT1000 here which i bought and put new batteries in, I also ran the ID18 version 15 "Update", one using the NMS card, then the other one using a serial cable thinking that may work. Stupid mistake.

I now have two bricked controller boards. I have removed one controller from a scrap SMT1500 and this appears to have bought one of the units back to life (although it is reporting that it is an SMT1500). It seems to work fine, and warns if the load gets close to 1000VA. Has anyone tried removing the 93LC66 and replacing it with another new programmed one? I am only guessing that this may be where the corruption is happening? I have contacted schneider, they wont sell me a spare PCB (Even though they have scrap units). I would be keen to get a copy of whatever the firmware is on this chip in an SMT1000, flash it into the 93LC66, solder it onto the pcb, and see if that works. APC should be made responsible for this failure of firmware upgrade. Judging by the tech i had on the phone, they know this is a problem.

Would anyone have a .bin file of that chip out of a 1000VA version unit? I can do some testing and get back.

Mark

[AstroAU]

It is a very Basic EEPROM that only holds 512 bytes of data in a 16 bit format, so should be easy to look into the one I posted earlier.

As for the contents of the ARM processor on the daughter board...
WE acquired an STM8 / STM32 reader programmer from AliExpress with Dupont female to female connector cable and have read the contents of a working ARM processor.

Referring to PeeJay's post back in Feb for the pinouts of the white JST connector that I'll repost below.

Ok, well for anyone who finds this post later here is the pinout:

6 - Reset
5 - Ground
4 - PB3 / JTDO
3 - PA14 - SWCLK
2 - PA13 - SWDIO
1 - VCC

It's the white connector in the photo.

The corresponding pins on the STM32 (ST-LINK V2) programmer are.

1. RST (Reset)
2. SWCLK
4. SWDIO
6. GND
8. 3.3V

JST connector - ST Link V2 connector

  6  -   -   -   -   -   -   1
  5  -   -   -   -   -   -   6
  4  -   -   -   -   -   -   NC
  3  -   -   -   -   -   -   2
  2  -   -   -   -   -   -   4
  1  -   -   -   -   -   -   8

The reader / programming tool needs to have it's address range changed from 1000H (HEX) to 40000H HEX or 4 kilobytes to 256 Kilobytes.
As the ARM processor STM32F103 RCT6 is a 256KB EEprom device and also has other internal memory.

I still need to REMOVE the AT89C51RC chip and read that from the good UPS. Unless I can read / program it from the technology connector (J606) that is on the main board as discussed above but were still researching that option

Now for the attachments, a couple of photo's showing the interconnect from the ST-Link V2 to the sub board of the UPS
Along with the subsequent 256KB file from the STM32F103 RCT6 ARM processor chip. NOTE: Rename the "HEX" file to "BIN" and you'll have the right extension for the programmer....

Foot note: you can obtain the STM32F103 RCT6 IC's through EBay for about $4 each (Lot of 5 for about $22 AU)
                 Likewise the AT89C51RC cost me $100 AU for 8 chips (Minimum order) from EBay as well.

My 2nd board that I was playing with has developed a short that I cannot see so that's set me back a bit (Getting tools to inspect board)

[DavidAlfa]

So what's this stm32 dump for? SMT1500? In working state?
Please make this clear in your message to avoid mistakes.

[AstroAU]

So what's this stm32 dump for? SMT1500? In working state?
Please make this clear in your message to avoid mistakes.

Sorry for the confusion.
Yes this is a working dump from the daughter-board's STM32F103 RCT6 which has the latest firmware version 15 contained within it.
This is from a working SMT1500i as needed.

I did say in the text of my post...

As for the contents of the ARM processor on the daughter board...
WE acquired an STM8 / STM32 reader programmer from AliExpress with Dupont female to female connector cable and have READ the contents of a WORKING ARM PROCESSOR on this board.

[DavidAlfa]

Sorry, but I re-read your entire post several times and found no reference to 1500 or whatever, and still nowhere to be found, so that's why I asked 
Uploading unidentified binaries is a very bad idea, I suggest renaming that file to "APCUPSSTM32F103RC.hex_SMT1500i".
Also, instead uploading raw binaries that could get corrupted, zip or 7z is a much better option.

[AstroAU]

DavidAlpha writes: Sorry, but I re-read your entire post several times and found no reference to 1500 or whatever.

I wonder what the THREAD TITLE reads.... oh wait.... "Help with Bricked APC UPS SMT1500" I wonder what that's about....

But yeah the file isn't really that large only 256KB and the attachment limit of the forum is 8MB per reply by the looks of the rules seen when adding attachments.
So I just renamed the extension as the forum doesn't like BIN attachments.
I'll reattach the file with a more descriptive name for you then. But you still need to change the .HEX to .BIN though.
 

[DavidAlfa]

But other models are mentioned in the thread too!
I'm not idiot, but "stm32.bin" is not a good idea!

[AstroAU]

But other models are mentioned in the thread too!
I'm not idiot, but "stm32.bin" is not a good idea!

Yeah good point, I was too focused on my bricked APC SMT1500i and presumed badly that others had the same issue with the same model.

 

[mark1975]

Thankyou AstroAU for this valuable information I will order one of these programers and have a go at getting these two failed boards going again.

A bit more of an update - I took the  93LC66 off the dead SMT1000 board and replaced the one on the SMT1500 board, whacked it back in and now the UPS is showing its correct serial number and model

It is quite possible the STM *MAY* have the same software on all models. I'm not sure.

[m k]

Since data seems to be 16 bits and so the small memory being for RBC7, maybe that is what defines the rest.
It would also be much more practical than many complete software versions.