Electronics: UPS Repair

What do you do when you accidentally cook the microcontroller of a commercial grade uninterruptible power supply, containing $100s worth of power conversion hardware?

Well, you buy another one of course, and tear it apart too, hoping not to make the same mistake twice!

The device I'm talking about is the APC Smart UPS 1500, model SMT1500I. It's a 230V uninterruptible power supply running on two 12V 17Ah lead acid batteries, with a 50/60Hz transformer based inverter and monitoring/network capabilities. These devices have been around in some form or other since the 1970s, but the SMT1500I is the latest model in the series with an LCD display, improved power efficiency and better monitoring capabilities, first released in the early 2010s and still in production today.

Image credit: APC by Schneider Electric

What happened?

Suffice it to say, I was curious, and mistakes were made involving multimeter probes. The main battery voltage rail inside the unit, which sits at about 27.5V under normal conditions, was shorted directly to one of the I/O pins of the microcontroller. They don't like that, and the poor chip was cooked instantly.

What can you do?

As far as options for actually fixing such a device when this happens, the average consumer or technician doesn't have many. That's because the microntroller in question - one of two in the unit - is a PLCC44 chip soldered to the board, with proprietry firmware on it. Once you cook that, there's no going back - and it didn't help that the chip used in the particular unit I had looked to be some custom APC part with a part number I couldn't find reference to anywhere.

Long part numbers and a long history

I decided to try pulling the sticker off of the microcontroller. What on earth did I have to lose? Not an awful lot, the thing was already dead. Guess what I found underneath?

Image credit: eBay - liaoxiyuan

The part in question was actually a NXP P89CV51RC2FA - not a custom APC ASIC of some sort. Haha, can't fool me with stickers. Anyone who knows anything about 8051 microncontroller part numbers will recognise that as an 8051 series 8 bit microcontroller. In this case, the "P" indicates the manufacturer, Philips (who renamed their semiconductor division as NXP) and the second "C" indicates 32kb of flash memory. I found, to my disappointment, that it was discontinued at the end of 2011.

An 8051 microcontroller, in a post-2010 UPS? That's a bit old, isn't it? Well. As it turns out, APC have been building these UPSs on 8051 microcontrollers pretty much since the beginning - decades ago - and have continued to use that platform to this day. If it ain't broke, don't fix it, I guess. In this most recent SMT series of UPSs, they have actually added a second microcontroller, a much more modern STM32 ARM Cortex M3 based chip, which interfaces with the main microcontroller via UART and handles external communications and the LCD front panel of the unit.

But wait, there's more

I managed to get hold of a document from Atmel (now owned by Microchip) that cross referenced the discontinued NXP part number to an Atmel drop-in replacement - the AT89C51RC2 - which was still in production!

Getting the firmware

This is where most people would give up. APC offers firmware upgrade files for this unit, but they're not the sort of thing you can just chuck straight onto the flash of the microcontroller and expect it to work! Through a process of research and experimentation, I was able to figure out that the firmware files APC provides are encrypted, and contain firmware both for the STM32 communications processor, and the firmware I needed, for the 8051 main processor. The communications processor runs a bootloader that accepts the file from a host computer over a USB or serial interface, and decrypts both its own firmware and the main processor's firmware, before flashing the main processor's firmware. Long story short, it was a dead end: I'm no hacker and didn't want to spend countless hours trying to figure out how APC encrypted their firmware files.

But that's not the only way to get hold of the firmware. Mhuwahahahaha. Well, I probably shouldn't actually tell you how to get the firmware, because it's proprietry, and APC clearly don't want people getting access to it judging by their encryption of the firmware files - but suffice it to say, there is a way.

The repair

So I bought a replacement microcontroller, flashed the firmware, and went through the laborious process of soldering it in - not easy when it has 44 pins and I have only one soldering iron and two hands. I can't say the soldering looked neat, but you can't argue with the 2 years of trouble free 24/7 operation it's had since I fixed it.

Images coming soon.