Author Topic: Help with bricked APC UPS SMT1500  (Read 33876 times)

0 Members and 1 Guest are viewing this topic.

Offline mark1975

  • Newbie
  • Posts: 2
  • Country: au
Re: Help with bricked APC UPS SMT1500
« Reply #25 on: May 26, 2024, 10:45:08 am »
Hey guys I have been scouring the net for some information about these shitty SMT series UPS getting bricked.

I have two SMT1000 here which i bought and put new batteries in, I also ran the ID18 version 15 "Update", one using the NMS card, then the other one using a serial cable thinking that may work. Stupid mistake.

I now have two bricked controller boards. I have removed one controller from a scrap SMT1500 and this appears to have bought one of the units back to life (although it is reporting that it is an SMT1500). It seems to work fine, and warns if the load gets close to 1000VA. Has anyone tried removing the 93LC66 and replacing it with another new programmed one? I am only guessing that this may be where the corruption is happening? I have contacted schneider, they wont sell me a spare PCB (Even though they have scrap units). I would be keen to get a copy of whatever the firmware is on this chip in an SMT1000, flash it into the 93LC66, solder it onto the pcb, and see if that works. APC should be made responsible for this failure of firmware upgrade. Judging by the tech i had on the phone, they know this is a problem.

Would anyone have a .bin file of that chip out of a 1000VA version unit? I can do some testing and get back.

Mark
 

Offline AstroAU

  • Contributor
  • Posts: 10
  • Country: au
Re: Help with bricked APC UPS SMT1500
« Reply #26 on: May 26, 2024, 01:22:39 pm »
It is a very Basic EEPROM that only holds 512 bytes of data in a 16 bit format, so should be easy to look into the one I posted earlier.

As for the contents of the ARM processor on the daughter board...
WE acquired an STM8 / STM32 reader programmer from AliExpress with Dupont female to female connector cable and have read the contents of a working ARM processor.

Referring to PeeJay's post back in Feb for the pinouts of the white JST connector that I'll repost below.

Ok, well for anyone who finds this post later here is the pinout:

6 - Reset
5 - Ground
4 - PB3 / JTDO
3 - PA14 - SWCLK
2 - PA13 - SWDIO
1 - VCC

It's the white connector in the photo.

The corresponding pins on the STM32 (ST-LINK V2) programmer are.

1. RST (Reset)
2. SWCLK
4. SWDIO
6. GND
8. 3.3V

JST connector - ST Link V2 connector

  6  -   -   -   -   -   -   1
  5  -   -   -   -   -   -   6
  4  -   -   -   -   -   -   NC
  3  -   -   -   -   -   -   2
  2  -   -   -   -   -   -   4
  1  -   -   -   -   -   -   8

The reader / programming tool needs to have it's address range changed from 1000H (HEX) to 40000H HEX or 4 kilobytes to 256 Kilobytes.
As the ARM processor STM32F103 RCT6 is a 256KB EEprom device and also has other internal memory.

I still need to REMOVE the AT89C51RC chip and read that from the good UPS. Unless I can read / program it from the technology connector (J606) that is on the main board as discussed above but were still researching that option

Now for the attachments, a couple of photo's showing the interconnect from the ST-Link V2 to the sub board of the UPS
Along with the subsequent 256KB file from the STM32F103 RCT6 ARM processor chip. NOTE: Rename the "HEX" file to "BIN" and you'll have the right extension for the programmer....

Foot note: you can obtain the STM32F103 RCT6 IC's through EBay for about $4 each (Lot of 5 for about $22 AU)
                 Likewise the AT89C51RC cost me $100 AU for 8 chips (Minimum order) from EBay as well.

My 2nd board that I was playing with has developed a short that I cannot see so that's set me back a bit (Getting tools to inspect board)



« Last Edit: May 26, 2024, 02:00:14 pm by AstroAU »
 
The following users thanked this post: mark1975, jeffrond, JeffWDH

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 6402
  • Country: es
Re: Help with bricked APC UPS SMT1500
« Reply #27 on: May 26, 2024, 02:47:22 pm »
So what's this stm32 dump for? SMT1500? In working state?
Please make this clear in your message to avoid mistakes.
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 
The following users thanked this post: mark1975

Offline AstroAU

  • Contributor
  • Posts: 10
  • Country: au
Re: Help with bricked APC UPS SMT1500
« Reply #28 on: May 26, 2024, 05:54:30 pm »
So what's this stm32 dump for? SMT1500? In working state?
Please make this clear in your message to avoid mistakes.

Sorry for the confusion.
Yes this is a working dump from the daughter-board's STM32F103 RCT6 which has the latest firmware version 15 contained within it.
This is from a working SMT1500i as needed.

I did say in the text of my post...

As for the contents of the ARM processor on the daughter board...
WE acquired an STM8 / STM32 reader programmer from AliExpress with Dupont female to female connector cable and have READ the contents of a WORKING ARM PROCESSOR on this board.

 

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 6402
  • Country: es
Re: Help with bricked APC UPS SMT1500
« Reply #29 on: May 26, 2024, 07:06:59 pm »
Sorry, but I re-read your entire post several times and found no reference to 1500 or whatever, and still nowhere to be found, so that's why I asked  :)
Uploading unidentified binaries is a very bad idea, I suggest renaming that file to "APCUPSSTM32F103RC.hex_SMT1500i".
Also, instead uploading raw binaries that could get corrupted, zip or 7z is a much better option.
« Last Edit: May 26, 2024, 07:11:13 pm by DavidAlfa »
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 

Offline AstroAU

  • Contributor
  • Posts: 10
  • Country: au
Re: Help with bricked APC UPS SMT1500
« Reply #30 on: May 27, 2024, 04:44:11 am »
DavidAlpha writes: Sorry, but I re-read your entire post several times and found no reference to 1500 or whatever.

I wonder what the THREAD TITLE reads.... oh wait.... "Help with Bricked APC UPS SMT1500" I wonder what that's about....

But yeah the file isn't really that large only 256KB and the attachment limit of the forum is 8MB per reply by the looks of the rules seen when adding attachments.
So I just renamed the extension as the forum doesn't like BIN attachments.
I'll reattach the file with a more descriptive name for you then. But you still need to change the .HEX to .BIN though.
 :-+ :-+ :-+
« Last Edit: May 27, 2024, 04:49:34 am by AstroAU »
 

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 6402
  • Country: es
Re: Help with bricked APC UPS SMT1500
« Reply #31 on: May 27, 2024, 05:55:58 am »
But other models are mentioned in the thread too!
I'm not idiot, but "stm32.bin" is not a good idea! :-+
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 

Offline AstroAU

  • Contributor
  • Posts: 10
  • Country: au
Re: Help with bricked APC UPS SMT1500
« Reply #32 on: May 27, 2024, 03:12:37 pm »
But other models are mentioned in the thread too!
I'm not idiot, but "stm32.bin" is not a good idea! :-+

Yeah good point, I was too focused on my bricked APC SMT1500i and presumed badly that others had the same issue with the same model.

 |O |O |O
 

Offline mark1975

  • Newbie
  • Posts: 2
  • Country: au
Re: Help with bricked APC UPS SMT1500
« Reply #33 on: May 28, 2024, 05:58:38 am »
Thankyou AstroAU for this valuable information I will order one of these programers and have a go at getting these two failed boards going again.

A bit more of an update - I took the  93LC66 off the dead SMT1000 board and replaced the one on the SMT1500 board, whacked it back in and now the UPS is showing its correct serial number and model :)

It is quite possible the STM *MAY* have the same software on all models. I'm not sure.



« Last Edit: May 28, 2024, 09:18:43 am by mark1975 »
 
The following users thanked this post: Sorama

Offline m k

  • Super Contributor
  • ***
  • Posts: 2648
  • Country: fi
Re: Help with bricked APC UPS SMT1500
« Reply #34 on: May 28, 2024, 10:13:19 am »
Since data seems to be 16 bits and so the small memory being for RBC7, maybe that is what defines the rest.
It would also be much more practical than many complete software versions.
Advance-Aneng-Appa-AVO-Beckman-Danbridge-Data Tech-Fluke-General Radio-H. W. Sullivan-Heathkit-HP-Kaise-Kyoritsu-Leeds & Northrup-Mastech-OR-X-REO-Simpson-Sinclair-Tektronix-Tokyo Rikosha-Topward-Triplett-Tritron-YFE
(plus lesser brands from the work shop of the world)
 

Offline jeffrond

  • Newbie
  • Posts: 5
  • Country: us
Re: Help with bricked APC UPS SMT1500
« Reply #35 on: September 21, 2024, 04:00:15 am »
I know I am replying to an old post, but I just bricked a SMT1000RM2U.
I have three of these and found the "daughter board" if you will.  I found that swapping the dead board with another units good board allowed the UPS to function normally.
Digging around on the internet I found this page. Seeing the posts from AstroAU, I was wondering about the chips and which one is causing the brick.

Do you think it is the 93LC66 chip, or does that just hold model number, serial number and other data?
Do you think it is the STM32F103 chip?  That is the microcontroller.  Could that be in a weird non-running state?

 

Offline jeffrond

  • Newbie
  • Posts: 5
  • Country: us
Re: Help with bricked APC UPS SMT1500
« Reply #36 on: September 21, 2024, 07:31:51 pm »
Another interesting item.  While running LaunchFUW and connected to the bricked UPS with the "good" daughter card installed, it says that I can update the firmware.  This is odd since the most recent firmware is 15.0 and that is what is showing on the UPS when I look at the version.  When I click on "more information", these versions show (1.jpg) UPS 15.0, MCU 11.0, UBL 08.5, MBL 11.0.
Next, I put the daughter card into the good UPS and ran LaunchFUW.  Again, it says to update the firmware. When I click on "more information", these versions show (2.jpg) UPS 15.0, MCU 19.0, UBL 08.5, MBL 19.0.  Notice the MCU and the MBL.  They are different versions.
Do you think the different MCU version has something to do with it?  Is the MCU version speaking to the code that is on the STM32F103 chip or a chip on the main board?  Do these different MCU versions handle the firmware differently?  Meaning can MCU version 19(good UPS) handle the firmware version 15, where MCU version 11(bad UPS) not handle the firmware version 15?
Does anyone have any idea how the MCU and MBL are updated?
Does anyone know what chip the MCU and MBL are located on?
 

Offline tom_e

  • Newbie
  • Posts: 4
  • Country: gb
Re: Help with bricked APC UPS SMT1500
« Reply #37 on: September 26, 2024, 12:39:54 am »
Hi,
I dont beleive the 93LC66 is modified during update (has constants like model number, battery model string).
MCU is probably the firmware for the 8051 which runs the inverter (it is on many other models, the PLCC chip). I know that UBL and UPS are the STM32, UBL being the bootloader, first few kb of flash, UPS being the main firmware (>100kb). It logically follows that MBL is then the bootloader for the MCU (as it always has the same version number), but im not 100% sure.

I find it very interesting that you have different firmware versions being reported for MBL and MCU across the 2 models. I am assuming it is ID 18 as it let you update to 15.0 (all the more recent of those models are ID 18 afaik).

The latest firmware image (SMT18UPS_15-0.enc) doesn't update the other 3 components anyway, for some reason, APC removed 2 of them (it only has UPS so MBL, UBL and MCU wont be updated). If you want to update them, an older version would need to be used which does include them.

I recall updating to an older version which includes MCU 19.0 & UBL 08.5 (the file is significantly larger & the update takes longer). I should still have it, so pm me if you want to try it.

What behaviour is the bad ups (MCU 11) it exhibiting when you turn it on (e.g. lights, beeper) ? I am assuming the serial port works so you can still update the firmware.

Thanks,
Tom.
 
The following users thanked this post: jeffrond

Offline jeffrond

  • Newbie
  • Posts: 5
  • Country: us
Re: Help with bricked APC UPS SMT1500
« Reply #38 on: September 26, 2024, 09:58:17 pm »
The bad UPS with the bad daughter board does nothing.  The backlight of the display comes on, but nothing is shown on the display.  No other lights.  I cannot communicate with it via the serial port.

When I put in the good daughter board, I CAN communicate via serial, and that is when I see the MCU version 11.  I wonder if the MCU version 11 is incompatible with UPS version 15.

Anyhow, if you have the update that includes the MCU version 19, I would be very interested in that.
 

Offline AstroAU

  • Contributor
  • Posts: 10
  • Country: au
Re: Help with bricked APC UPS SMT1500
« Reply #39 on: September 27, 2024, 06:46:05 pm »
The bad UPS with the bad daughter board does nothing.  The backlight of the display comes on, but nothing is shown on the display.


I had this issue with a daughter board as well and upon further investigation and using a multimeter, I checked the resistance across the supply rails and found it to be a dead short on the board.
I put the meter across the 47UF capacitor (C606) and this read ZERO Ohms and beeped on the continuity tester.
What I found was that the regulator chip (5500) the 8 pin SOP chip next to C612 had died. so we sourced some from the net, replaced it and then the board worked again. This chip takes the 5V supply and generates the 3.3v needed by the STM32.
 

Offline JeffWDH

  • Newbie
  • Posts: 3
  • Country: ca
Re: Help with bricked APC UPS SMT1500
« Reply #40 on: October 01, 2024, 07:19:09 pm »
I too attempted to update a APC SMT UPS to v15 and bricked it. In my case it was a Smart-UPS 3000.
SKU: SMT3000RM2U
Manufacture Date: 11/28/2010
Revision: ID18

I can confirm that with a ST-LINK V2 and the STM32 ST-LINK Utility, along with the firmware dump of v15.0/pinout provided by AstroAU, I was able to restore use of the device. Great stuff! I had just replaced the batteries in this thing and thought I'd update the firmware as I thought APC may have tweaked the charge cutoffs to maybe help with longevity... Not sure about that but it almost snuffed the life out of it.

Current firmware versions:
UPS 15.0
MCU 11.0
UBL 08.5
MBL 11.0

Does anybody know if there are any benefits to trying to update the MCU or should I just be thankful I got this working again? I went down this path because I barely got 3 years out of my last set of batteries. Does the code contained on MCU have anything to do with charging?
« Last Edit: October 01, 2024, 08:13:31 pm by JeffWDH »
 

Offline jeffrond

  • Newbie
  • Posts: 5
  • Country: us
Re: Help with bricked APC UPS SMT1500
« Reply #41 on: October 08, 2024, 02:36:55 am »
SMT1000RM2U ID18

Ugraded from
UPS 06.5
MCU 11.0
UBL 08.5
MBL 11.0

Upgraded to
UPS 15.0
MCU 11.0
UBL 08.5
MBL 11.0

This bricked the UPS.

I have another UPS that is already at UPS 15.0.  This good UPS has MCU and MBL at 19.0.
Testing the theory that if the MCU and MBL are upgraded to 19.0 that the UPS would work.
Swapped bad daughter board with good daughter board from another UPS. I attempted to use a 940-0127E cable from APC which did not work. It shut the unit down when connected to the laptop.  I have heard that the 940-0127E cable is not meant for the units that already have a USB port.  I connected the USB port to the laptop and ran firmware upgrade wizard.  I attempted to use firmware SMT18UPS_09-4.enc to downgrade the good daughter board from UPS 15.0 to UPS 09.4.  It started ok, but I was just getting a lot of usb connect/disconnects sounds and the firmware update wizard is at 0%.  I let it run for 2 days straight until it died.  I assumed driver issues, so I installed ApcUpsUsbDriver.zip and pcss.zip(PowerChute Serial Shutdown).  Again, I attempted firmware SMT18UPS_09-4.enc to downgrade the good daughter board from UPS 15.0 to UPS 09.4.  It worked!  In this process it upgraded the MCU and MBL to 19.0!

UPS 09.4
MCU 19.0
UBL 08.5
MBL 19.0

I used the firmware SMT18UPS_15-0.enc to upgrade the good daughter board back to UPS 15.0 and I put the good daughter board back in the good UPS.

I put the bad daughterboard back in the bricked UPS.  It is still bricked and the USB connector will not speak to the UPS.

I ordered a ST-Link clone and connected as below:

JST connector - ST Link V2 connector
  6  -   -   -   -   -   -   1
  5  -   -   -   -   -   -   6
  4  -   -   -   -   -   -   NC
  3  -   -   -   -   -   -   2
  2  -   -   -   -   -   -   4
  1  -   -   -   -   -   -   8

Started the ST-Link Utility program and changed the size to 40000 and read the bad daughter board and the good daughter board.
Editing the files with notepad++ showed obvoius differences.
Flashed the good bin file to the bad daughter board.  It works!  The unit powers up and works!  Serial number and all other information are still correct.


I had another UPS that was at UPS 06.5.  So to test, I upgraded to UPS 09.4.  This worked great.  I then upgraded to UPS 15.0.  This also worked with no issues!


Moral of the story?  For SMT1000RM2U ID18, if you are upgrading to UPS 15.0, always upgrade to UPS 09.4 first.

Major thank you to tom_e.  We spoke over emails over many days and he was always ready to help.  He helped walking me through serveral sticky wickets.  He pushed me to try the ST-Link which revived my bricked unit.  He helped with UPS 09.4 firmware.  And he was totally correct in thinking that MCU and MBL had to be at version 19.0 before upgrading the UPS to version 15.  Brilliant!
Also thanks to AstroAU for the methodology and pictures and pinouts of the JST connector to ST-Link.


I will post my file dumps here in case anyone is interested.  The file "SMT1000RM2U-v15.0-STM32F103 good.bin" is the flash I used to revive my bricked UPS.  The file "SMT1000RM2U-vxx.x-STM32F103 bad.bin" is from the bricked UPS. I put vxx.x since I am not totally sure if it is 06.5 or if it is really 15.0.  I am unsure of the legality of posting firmware here, so I will not.  But if anyone wants SMT18UPS_09-4.enc or SMT18UPS_15-0.enc or ApcUpsUsbDriver.zip or pcss.zip(PowerChute Serial Shutdown), let me know.
 

Offline JeffWDH

  • Newbie
  • Posts: 3
  • Country: ca
Re: Help with bricked APC UPS SMT1500
« Reply #42 on: October 08, 2024, 01:28:42 pm »
Thanks for posting your experience, jeffrond. I decided to risk it and try to downgrade to update the MCU/MBL:

Firmware: SMT18UPS_09-6.enc
Resulting MCU/MBL: 20.0

Then updated to SMT18UPS_15-0.enc again and was successful.
 
The following users thanked this post: jeffrond

Offline tom_e

  • Newbie
  • Posts: 4
  • Country: gb
Re: Help with bricked APC UPS SMT1500
« Reply #43 on: October 09, 2024, 12:13:54 am »
Great news that it is working successfully! Thank you very much for the updates!

I think that what bricked the update was going from a too old version (if UBL is anything less than UBL 08.5) to UPS 15.0. It seems to load UPS 15.0 at the wrong memory offset (0x3000 instead of 0x7000) because of the smaller bootloader.

Loading an older version first, as jeffrond and JeffWDH said, should fix this as it writes a newer bootloader to the device

 

Offline JeffWDH

  • Newbie
  • Posts: 3
  • Country: ca
Re: Help with bricked APC UPS SMT1500
« Reply #44 on: October 23, 2024, 01:15:21 pm »
For future reference I have compiled the steps I used to recover my device and some of the advice posted here.

https://www.tarball.ca/posts/unbricking-an-apc-smt3000-ups-after-a-failed-firmware-update/
 
The following users thanked this post: tom_e

Offline KrabKley

  • Newbie
  • Posts: 2
  • Country: ru
Re: Help with bricked APC UPS SMT1500
« Reply #45 on: November 12, 2024, 02:39:59 pm »
I have SMT3000I and the same problem. I want to solve the problem with your advice, but the structure of vertical UPS is different. everything is on 1 board and there are no such connectors.
There is a similar connector J602 and can someone tell me the pinout?
 

Offline asis

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: ru
Re: Help with bricked APC UPS SMT1500
« Reply #46 on: November 12, 2024, 07:12:07 pm »
Hi,

You can reflash via this connector (J602).
Just check the pins match - indexing given by @AstroAU.

6 - Reset                 -  IC603 STM pin 7
5 - Ground               -  IC603 STM pin 12,18,31,47,63
4 - PB3 / JTDO         -   IC603 STM pin 55
3 - PA14 - SWCLK    -   IC603 STM pin 49
2 - PA13 - SWDIO    -   IC603 STM pin 46
1 - VCC                   -   3.3V
 
The following users thanked this post: KrabKley

Offline KrabKley

  • Newbie
  • Posts: 2
  • Country: ru
Re: Help with bricked APC UPS SMT1500
« Reply #47 on: November 12, 2024, 09:01:16 pm »
I had to ring everything up and everything worked out. Thank you all very much. The SMT3000i is working again.

I also want to say that it was very difficult to connect ST LINK St link ST-Link V2 because.
1. Did not work with the USB extension cable.
2. Connected directly to USB 2.0, it worked but with errors.
3. Only after I plugged it into USB 3.0 did everything work perfectly!
 

Offline mangup

  • Newbie
  • Posts: 4
  • Country: cs
Re: Help with bricked APC UPS SMT1500
« Reply #48 on: December 09, 2024, 02:35:32 pm »
Hello everybody.
I upgraded my ups SMT1000I, and after upgrade UPS is bridged. I use Jeffwdh reference and flashed via STlink bin from smt1500 - same board id18. Now display is live, but don't recognize that is powered on main plug and don't recognize that have battery. That is enough to not let me to start upgrade.

I notice that MCU and MBL version is 0. Serial, usb, NMC work but can't do anything with UPS settings.

I try to update via xmode , but I'm not sure I'm doing it right.

Is there something that I can try ?
« Last Edit: December 09, 2024, 02:37:28 pm by mangup »
 

Offline tom_e

  • Newbie
  • Posts: 4
  • Country: gb
Re: Help with bricked APC UPS SMT1500
« Reply #49 on: December 10, 2024, 02:43:05 pm »
Hi mangup,

It may have been bricked during 8051 (plcc chip) MCU upgrade (stage where the lights blink slowly). You need to reflash MCU but it is not possible as upgrade wizard will not let you, and I doubt it will work if the 8051 is corrupted because the bootloader is probably gone.

Can you confirm MCU is dead by probing UART pin, if there is no activity it's probably bricked. The 8051 should be spamming characters back to main chip, and there should be a single character being spammed on rx (pin 11) so check tx (pin 13) to see if its dead. If the beeper is constantly buzzing or the transformer is humming loudly this also hints dead 8051.

Also please confirm model of 8051 chip, e.g. 89C51RC2. If it is this chip you would need to flash it directly (it has some lock which you need to reset and original firmware cannot be recovered after this). You will need an existing copy of the firmware image as it's usually read protected.

Hope this is helpful
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf