Hacking the newer APC ups's - mini worklog/howto

Beware - mains voltages and high current from batteries can present a shock/fire hazard. Do not copy what I am doing here unless you are confident with electronics and handling big batteries. Also don't assume the PCB is safe to handle once the mains and batteries are removed. Capacitors in the unit can give you a hefty belt long after all power sources have been removed.

edit: well this turned out to be even simpler than I thought - batteries not needed to calibrate!! just use the cap!

Tools needed:
A multimeter that can measure DC voltage, and AC voltage
A suitable breaker for the battery end of the cable (if connecting to external batteries)
Suitable cable long enough to reach your battery bank, with decent current capacity
A pair of crocodile clips for the meter (to monitor the capacitor below). A friend will do as well, so long as he/she is happy to hold the probes on the relatively safe capacitor terminals (its a low enough voltage and multimeter probes are insulated).
A large electrolytic capacitor (5000uf or better, 75 volts or more)
A large flat blade screwdriver (to lever the tight front panel off
A hanky (to put over the flat blade so you don't mar the front panel)
A medium sized phillips head screwdriver
A usb to TTL converter (ebay)
A set of batteries suitable for the ups (mine needed 2 in series - it got 8 in series parallel!)
A Towel (to lay the smaller models belly up on to prevent scratches)
A dremel

I recently came into posession of an APC Smart-UPS1500I. This is one of the newer models that doesn't use smart protocol for reprogramming.... or does it



Rear (of an american unit) showing the triangular battery isolation plug. I pinched this photo off a website while doing research on the thing LOL. Mine is the same, but instead of yankee sockets, it has iec sockets. And it puts out 230V, not 110V.



Note the lack of a DB9 serial port? and that silly RJ50 does not do smart protocol. Bad APC!

After doing some research I found a video on you tube by ffcossag that shows how to access the smart protocol on these things to enable access to the programming mode. As smart ups's tend to have the charger set to a slightly high float voltage, they tend to kill batteries quicker than they should. Even that geek group fella Chris Boden had trouble getting the packs out of a big rackmount one when he did a teardown. It was quite funny - I was waiting for him to swear

If your willing to sacrifice 5-10% runtime and reduce the float voltage by reprogramming the ups, you can increase your SLA battery pack lifetime from 2-4 years to pretty much their documented lifespan, provided you don't deep discharge them too many times. You'll want to aim for 13.5-13.55 volts per battery. So in this ones case, I'll be reprogramming it to 27 volts exactly.

If your batteries are brand new, let the ups charge them to full without making any adjustments to the float voltage. This is a conditioning or "boost charge". It helps the batteries reach full potential with this one off charge at the usually too high a float voltage. You can skip this step if they are used and have been properly commissioned, as mine were.

So I got to work on this thing. I started by removing the front panel. Mine was on quite tight, and I had to lever it off gently with the big flat blade screwdriver. To do this, I placed a clean hanky over the blade of the screwdriver, put it in one of the finger release points and gave it a gentle twist. Then I repeated the process on the other side. Then gently tilted it down, and lifted it up and onto the top of the ups, screen facing up. Don't be rough here - theres a ribbon cable behind the front panel that if you yank it off, you'll cry as you'll need a new cable from somewhere. On opening the battery door I discovered that my friend who sent me up the unit had been smart and kept all the doings for the battery compartment, and dumped the dead batteries to save on shipping costs and our backs. Since it was destined for the tip, he asked me if I wanted it. I said sure I love playing with these things. So he boxed it up and sent it up with startrak express. Didn't ask for any money except the $27 it cost to ship. Bonus!



I then took two of my 55Ah batteries and placed them in series (this ups has a 24V bus), and checked each battery on my multimeter. I used the fuse from the UPS to join them. I used these for testing purposes.



Using the Andersons connector from the ups that was connected to the original battery pack, I connected this to a 6800uf 160V DC capacitor. The capacitor serves as a battery surrogate, and although the ups may complain the batteries are dead, its still possible to reprogram the ups using the capacitor. The capacitor reacts far more quickly to adjustments than a battery pack when reprogramming the ups, so you don't have to wait minutes for the voltage to adjust down as you change the setting.



Before reprogramming, remove anything from the SmartSlot on the ups. You can put it back once your finished.

Connect the rear battery isolation plug, and plug the anderson connector with the capacitor on it, into the ups's battery connector. Then plug the UPS into a wall outlet. At this point I shoudn't need to remind you that high voltages are now present inside the ups.

Next I turned the ups on. I waited until it did its self test and failed and was sitting idle with the power LED on and battery failure led blinking, I then measured the voltage across the big cap. 28.7 volts - way too high - just as I suspected. Note in this picture I've done it a second time, so the multimeter reads a much more healthy 27.57 volts but still a touch high.



Turn off the ups, disconnect the capacitor and unplug it from the mains.

Next pop the top off the ups (theres several screws around the ups which hold the black top cover on). You only need to do this for the larger units like the SMT2200. If you have a smaller model, flip it upside down and rest it on a towel. I didn't and now mine has some very slight battle scars (they are quite heavy, even without batteries; even the little ones thanks to the big transformer).

Locate J606. In the larger models with the side mounted board, its toward the back near the front panel and smart slot connectors. In the smaller models with the top mounted board, its located near the "Stickered" CPU inside the battery compartment.

In this picture you can see j606 in the bottom right hand corner. I have added a red tag next to it to make it easy to spot.



First lets identify the ground pin. Connect a multimeter to case ground (with the ups OFF and unplugged from all sources of power!) and then set it to continuity beep. Try each of the middle pins. One should beep. Thats pin 5! Try to imagine the ups rotated with pin 5 closest to you. Then the one above it in the middle is pin 2, and to the left of pin 2 is pin 1 which we also need to connect to.

1 2 3
. . .
. . .
4 5 6

In mine, pin 5 was the rear middle pin, and the right two were TX and RX.

While still imagining the pin 5 (ground) closest to you, connect pin one (top left pin to the TX line of your usb to TTL, the RX line to pin 2 (the one next to it) and the ground line to the bottom middle pin (lets call it pin 5). Its below pin 2.

Now connect the capacitor, with its anderson. Attach a multimeter set to the DC volts range across the cap.

Note here now that we are interrupting the signals between the main cpu and the communications cpu, which drives the front panel, so anything shown on the front panel is rubbish and to be ignored. This is temporary and once we disconnect the ttl converter the front panel operation will return to normal.

Your setup should now look like this:



Now download the PDF for your batteries and look for the "Standby Use" float voltage. Write it down.

plug the ups back into the wall, and turn the ups back on. At this point I shouldn't need to remind you, especially in the case of the bigger units, that some of the exposed parts of the unit are at mains potential, so don't go poking around at things while its plugged in. If you have a helper holding the multimeter leads on the capacitor for you, they will be safe so long as the leads are in good condition, and they don't touch the tips. The voltage here can be as high as 55 volts for a 48 volt model, so best not to let them tempt fate.

Open up putty on a windows laptop (its important that this laptop is isolated e.g. running from battery - we don't want a hazardous ground loop!) and tell it you want to communicate with the usb to TTL converters com port at 2400 baud, 8N1, xon xoff or none (try both).

At this point you may see a crapload of data scrolling up the terminal window. If you see long lines of jibberish you have your TX and RX lines reversed and you're seeing the communications processor talking to the main cpu. If you get the shorter snippets of data that look like line voltage, frequency etc, you're hooked up properly. If you get nothing, try the Y command and see if you get the "SM" prompt. If you don't, double check your connections by disconnecting the usb to ttl thingy, turning off the ups and starting with the continuity check of the middle pins again. Also ensure you are connected to J606

To reprogram the unit, enter the commands that follow.

Press Y (capital is important) and the ups will respond "SM"

Press 1, wait 2-3 seconds and press 1 again. UPS will respond "PROG"

Well well well, we have smart protocol in these things afterall!



Now to bring that high battery float voltage down. Press B (capital is important). It should show the battery voltage, but ignore that reading. Give the + key a few taps until the multimeter across the big capacitor reads a satisfactory value. (mine is just north of 27 volts). If you overshoot, press - to come back up in voltage. The voltage across the cap should correspond to ever so slightly higher than the standby float voltage for your given batteries (multiplied by the number of batteries the ups model uses in series). So mine was 13.5-13.6 multiplied by 2. I erred on the lower side for longest life.



For those using a much bigger than stock battery/pack now press >

Mine had 2 17Ah batteries as stock. I took 220 (the size of my battery pack in Ah) and divided it by 17 (size of original pack in Ah). This gives 12 - so I need to add 12 additional battery packs by pressing + 12 times. (> tells the ups you'd like to add battery packs or EBM's as most ups manufacturers call them.). Some non extended runtime models will accept this, others wont, by responding "NO"

Now press R and the ups should respond "BYE". Press Y again. It should again respond SM. You can now disconnect your TTL converter and the multimeter.

Pull the mains and let the ups discharge the big capacitor and then remove it. We're finished with it now.

Reassemble the ups / flip it the right way up and connect the battery bank. You should now have a SMTXXXX ups with a recalibrated charger that doesn't cost a hundred or so every few years in batteries.

I noticed the source of all the noise - on the left side of my unit is a 80-92mm 24volt fan. When I'm up to taking it apart again (and can afford to take my server offline), I'll replace it with an equally powerful, but quieter model. Its a two wire fan, so the ups is controlling it via pwm or voltage, and doesn't do any sensing. Handy for us. A temperature controlled one with the thermoprobe attached to the H-Bridge heatsinks should do nicely.

It may also be possible to run a more common 12V temperature controlled fan via an LM7812 regulator off the 24V line, or by using a more efficient buck converter. Either can be easily retrofitted into the ups, especially if you're planning to remove the stock batteries and run the unit of a bigger bank.

 

Nice! Although I didn't quite follow the connect capacitor / connect battery part.

I wouls like to run one of these things off a few bigger batteries though. like a few deep cycle car units

Regards,
g@z.

 

I'll be taking more photos of how to wire it later - my DSLR died after I took the photo of the capacitor and uploaded it to my mac, but basically you wire the batteries in parallel with the capacitor, through a suitable breaker, so you can disconnect the pack, while keeping the capacitor connected. Once adjusted, you remove the capacitor completely and wire the ups directly to the battery pack.

I'd use SLA batteries if you plan to have this indoors - the deep cycle batteries wont last as long, and arent really suited to indoor use. They can vent hydrogen when charging which is a fire/explosion hazard.

For shits and giggles, I rewired my bank for 24 volt operation at 160aH. Heres the silliness photo:



Its been running for half an hour on a fully charged set and the battery meter is still saying 72%. 18% load. LOL

Load-o-Meter:



Multimeter:



This is my standard load (both server and main pc, along with my mixer; plus the xbox, 55" LCD, apple TV and amplifier on standby, plus a few plug packs (ADSL modem and switch).

At 3:40 am I aborted the test and went to bed and allowed the batteries to charge - it was at 68% SOC having run my gear for ~4 hours so looks like the full bank should easily power my gear for an overnight run. Looks like this ups will work well once the cooling is upgraded. At the very least I MUST replace the fan in this thing, it is quite loud, but easily dealt with by closing the bedroom door.

The fan runs at full speed when on battery, and when fast charging the battery. By the time I woke up this morning (pillboxie nagging me to take my antibiotics), the machine had fully charged the battery and quietened right down. It also goes into high gear in warmer weather for a few minutes every few hours. Not horribly annoying as when its in turbo when charging the batteries and you're trying to sleep.

During the run I checked in on the patient every so often, placing my hands under and around it checking for heat. The air coming out of the left vent was ever so slightly above ambient room temperature. Still, a suitable non noisy fan is a must

My next step is mounting an andersons at the back of the ups so I can put the front panel back on. I will probably mount this to the left most side of the ups (when looking at its rear) below the smart slot. Dremel time!

 

g@z, I have revised the tutorial and its a LOT easier provided you have an SMT model. Theres no faffing about precharging capacitors etc, just connect the cap, the ttl to usb, reprogram and you're done

 

Programming cost? What was the address to send it to again?

 

LOL it would be cheaper to do it yourself - freighting the ups would cost more than a usb to TTL conveter and locating a suitable capacitor to do the job. 4700uf 75V capacitors are commonplace and should be sufficient to reprogram the ups (and they're a lot smaller than the bean can sized one I used!)

However if you're willing to cover freight both ways I can reprogram yours as I have all the crap to do it. Not sure if we're allowed to discuss a trade in the non for sale/trade forums, so take it to PM so neither of us get into trouble.

 

Will do, I have a smart-UPS 1000 which I changed the batteries over to the 1500 size, but its been sitting unused for a year, as the heat here was really killing the battery life.

 

Is it an LCD model or a lights model (i.e. SUA or SMT)

 

Thanks, love it.

I would not put deep cycles inside either. Was thinking my shed. I chucked an ibm ups (rebadged apc 1500 unit) a few months ago. Bummer!

Regards,
g@z

 

I have an older APC 1500VA Rackmount unit. got 8x 19Ah batteries connected in 4 banks. Seems like it's set to 27.67V currently, is that low enough to not boil the batteries?

Also its an older unit with the DB9 port and USB port as well. Should I adjust the calibration value on it? Currently, says I will get around 4 hours with 20% load.

 

divide the float volt by number of cells, 27.67/12=2.30Vpc.

Should be sitting closer to 2.26Vpc to help prolong life. Unfortunately the pulse charger of these units punch out some AC ripple.

Can measure the AC volts on across the string to get an idea, generally 1-3VAC.

 

I picked up a lovely 2kva server UPS a few years ago with a similar plan in mind, unfortunately, it turned out to have 180v battery packs
dammit, nothing I can do with it.

that's a lot of batteries! $$$$$$

plan to eventually buy a half decent 12v inverter and charge it from solar during the day.
finding a half decent inverter I can afford on the other hand..
and one that doesn't have a stupidly low 10v low voltage disconnect (or at least a user selectable low voltage cut off) is seemingly impossible.

 

You can reprogram those units with a serial cable. Its not an ordinary serial cable though, its a APC wired one - easy enough to make if you have a soldering iron and know how to use it.

The procedure is exactly the same as for the new models, but instead of puttying into a usb to ttl converter, you putty into a normal serial port or usb to serial lead (I would recommend a FTDI one if you go usb to serial as I find they work better than the PL2303 based ones). Same data rate too - 2400 8 N 1 none/xon xoff. You will also need to precharge the capacitor in these models otherwise they won't turn on. Use a 500 ohm resistor in series with the positive of your battery bank to bring the cap up to voltage.

You will not see the data stream like the SMT models though, as there is no communications processor constantly spamming the main CPU for data to drive the front panel.

So once your connected, press Y and that should put the unit into smart signalling mode and it will respond "SM". From there follow the tutorial.

 

Unless the FTDI one is a fake and has been crippled by the dodgy FTDI driver.
I avoid FTDI on principal after they pulled that shit.

How about a CP2102?

 

I forgot about the crippling of the fake FTDI ones - yes that would work.

Sometimes the prolific ones can be difficult to obtain drivers for newer OS's thats why I suggested an FTDI.

Or just use a computer with a real serial port. My old hp laptop comes in handy for this and its why I havent given it away. I also have an FTDI usb to serial which hasn't been crippled so i guess its genuine.

I'm pretty sure you can avoid the crippling by installing an older version of the driver. Dave (eevblog) I think mentioned how to do it and reverse the crippling too.

 

That can be fixed on linux with a few console commands. Done with OBD2 cables for use with diagnostic/code reading software for alfa romeo's that have compatible chips for a fraction of the price.

http://minipwner.com/index.php/unbrickftdi000

 

I have found with windows 8 and 8.1 that the older prolific ones are the most stable you just need to load old drivers and stop windows from updating them I use driver version 3.3.2.102 this works fine.