Hi all!
APC Uninterruptible Power Supplies (UPSs) are quite common devices, which are often posted about on this forum. I thought I would share the results of my most recent endeavor into hacking them, which may be useful for others doing repairs and modifications (hence, I've started this thread in the repair forum). This information pertains to APC Smart-UPSs of the 'SMT' series, e.g. SMT1500I, SMT1000, SMT750RMI2U, etc., especially the somewhat older ones, which I have tested it on, but most likely any except the 'CloudConnect' models, which use different internals.
What is green mode?One of the big selling points of these models over the older SUA series was the addition of 'Green mode'. I will briefly explain what this is. The UPS usually charges its batteries using the inverter circuitry in reverse. This is effective, but somewhat inefficient once the batteries are fully charged. 'Green mode' entails turning off the inverter entirely once the batteries are fully charged, and switching on a much smaller Switch Mode Power Supply (SMPS) circuit to take over maintenance charging of the batteries, and powering the unit's electronics. This reduces the idle power consumption of the units. From my testing, a SMT1500I uses about 12W with green mode, compared to about 20W without green mode (those numbers are with a network card installed).
Why disable it?Saving power is great, but there are a few key reasons why you might want to disable this mode:
- The SMPS has failed and you want to run the UPS without it. This has happened to several of my units, and often isn't easily repairable as the flyback transformer seems to fail and it's a custom part.
- You want to add external batteries to the unit. The higher charge current of the larger batteries can cause the SMPS to fail as above. Otherwise these units work fairly well with external batteries, like the SUA series, so this is a common idea.
- You want it to be quieter. The SMPSs make a lot of audible noise compared to the rest of the unit (aside from the fan, but that is easily modded). They are designed for commercial environments where nobody cares, but many people use these UPSs for other purposes.
There's no user-accessible setting (that works)Now you're supposed to be able to disable this mode by using the following setting in the Network Management Card interface:
But anyone who's tried it will know it doesn't actually work! At least not on units of the vintage I have. There is also no front panel setting for green mode on any of my units. Green mode isn't even mentioned in the most recent SMT series (non-SmartConnect) manual as a front panel setting, so I doubt that's changed on the newer units (anyone who has one could comment).
So this weekend I had a go at hacking this and I believe I have figured out how to do it.
Internal serial port and APC Smart ProtocolThese UPSs have an internal serial port, which is a 6-pin header on the PCB that you can connect to at 2400 baud 8N1 and use the standard UPSLink communications protocol that the older SUA series used. The location of the header varies depending on the UPS model and revision, but the fundamentals are the same for the whole series. Credit for discovering this goes to YouTuber FFcossag, and his video below which describes using this in better detail.
But basically, there are two microcontrollers inside the unit, a main processor (based on 8051 architecture) and a communications processor (newer STM32 part). Connecting to the internal serial port allows you to talk directly to the 8051 and use the standard APC Smart protocol, to hack things like setting the battery charge voltage of the UPS. That's great, but the standard APC Smart protocol has no green mode setting - it pre-dates the existence of this feature. So none of the existing documentation online covers this. And of course, APC (Schneider) are never going to document what is now only an internal protocol that is not supposed to be accessible to the user at all!
Firmware reverse engineeringNow the interesting bit. I had a dump of the main (8051) processor's firmware, from doing repairs on these UPSs ages ago. What I did was disassemble the firmware dump into assembly code using an 8051 disassembler program, and then I spent most of this weekend deciphering it. After a great deal of head scratching and learning how assembly code actually works, I believe I struck gold. I knew that entering programming mode (part of the APC Smart Protocol, achieved by sending two 1s, about one second apart) causes the UPS to exit green mode and not re-enter it until leaving programming mode. I therefore reverse engineered that small part of the firmware, and found that a specific memory location was being checked in parallel with that check of programming mode which I believed to be disabling green mode. That specific memory location is only ever written to if the device reads ASCII code 0x13, i.e. CTRL-S, on the serial port, which toggles it between zero and one. It was a long shot, but the value of that parameter appeared to be causing a change in program execution that looked about right, so of course I tried it.
TestingUpon sending 0x13 to the main processor via the internal serial port, once in Smart mode (Y->SM), I got responses of '01' and then '00' and then '01' again - i.e. toggling the value. It turns out that the value is in fact saved to EEPROM, and persists even if the UPS is power cycled!
And wouldn't you know - if set to one, the UPS never switches to green mode!! Usually it does so after one hour of normal operation without power interruptions - it's gone 6 hours now (edit: now multiple days) with no interruptions and no green mode. Nothing else seems to be affected, the UPS otherwise works normally.
So the conclusion is you can send 0x13 (CTRL-S) to the internal serial port, to toggle the green mode setting, and the change is saved in EEPROM so you only have to do it once. You want the '01' setting to disable green mode.
To me, it makes sense that there would be a setting for it in there somewhere, even if it was never implemented in the communications processor to make it user-accessible.
Physical removal of the SMPSAfter doing this, you can physically unplug the mains input of that SMPS board inside the UPS, which will save about 1-2W of power (the irony is not lost on me). You can also remove the SMPS entirely, as it's on a separate board.
On some units, like mine, the SMPS board also has a relay that switches the neutral of the main transformer, to energize/de-energize it on the mains side. In this case, without the board installed, the transformer will be disconnected from the mains permanently, and the UPS won't work. I therefore desoldered the connector from the SMPS board and shorted it out with a piece of wire, to make a jumper I can plug into the transformer connector so that the transformer is permanently connected.
Without the firmware setting changed, if you actually remove the board like this then it will trip a fault after one hour when it tries to enter green mode. With the firmware setting changed as above, the UPS works fine like this in my testing so far.
ConclusionI thought this was a remarkable - if obscure - find, if you happen to have one of the issues I listed above, where disabling green mode might solve a problem for you. As such, I thought it might be worth sharing, so that this information exists somewhere on the internet, in case it's useful for others repairing/modding these UPSs!
Home
Help
Search
Login
Register
