Help with bricked APC UPS SMT1500

[mark1975]

Hey guys I have been scouring the net for some information about these shitty SMT series UPS getting bricked.

I have two SMT1000 here which i bought and put new batteries in, I also ran the ID18 version 15 "Update", one using the NMS card, then the other one using a serial cable thinking that may work. Stupid mistake.

I now have two bricked controller boards. I have removed one controller from a scrap SMT1500 and this appears to have bought one of the units back to life (although it is reporting that it is an SMT1500). It seems to work fine, and warns if the load gets close to 1000VA. Has anyone tried removing the 93LC66 and replacing it with another new programmed one? I am only guessing that this may be where the corruption is happening? I have contacted schneider, they wont sell me a spare PCB (Even though they have scrap units). I would be keen to get a copy of whatever the firmware is on this chip in an SMT1000, flash it into the 93LC66, solder it onto the pcb, and see if that works. APC should be made responsible for this failure of firmware upgrade. Judging by the tech i had on the phone, they know this is a problem.

Would anyone have a .bin file of that chip out of a 1000VA version unit? I can do some testing and get back.

Mark

[AstroAU]

It is a very Basic EEPROM that only holds 512 bytes of data in a 16 bit format, so should be easy to look into the one I posted earlier.

As for the contents of the ARM processor on the daughter board...
WE acquired an STM8 / STM32 reader programmer from AliExpress with Dupont female to female connector cable and have read the contents of a working ARM processor.

Referring to PeeJay's post back in Feb for the pinouts of the white JST connector that I'll repost below.

Ok, well for anyone who finds this post later here is the pinout:

6 - Reset
5 - Ground
4 - PB3 / JTDO
3 - PA14 - SWCLK
2 - PA13 - SWDIO
1 - VCC

It's the white connector in the photo.

The corresponding pins on the STM32 (ST-LINK V2) programmer are.

1. RST (Reset)
2. SWCLK
4. SWDIO
6. GND
8. 3.3V

JST connector - ST Link V2 connector

  6  -   -   -   -   -   -   1
  5  -   -   -   -   -   -   6
  4  -   -   -   -   -   -   NC
  3  -   -   -   -   -   -   2
  2  -   -   -   -   -   -   4
  1  -   -   -   -   -   -   8

The reader / programming tool needs to have it's address range changed from 1000H (HEX) to 40000H HEX or 4 kilobytes to 256 Kilobytes.
As the ARM processor STM32F103 RCT6 is a 256KB EEprom device and also has other internal memory.

I still need to REMOVE the AT89C51RC chip and read that from the good UPS. Unless I can read / program it from the technology connector (J606) that is on the main board as discussed above but were still researching that option

Now for the attachments, a couple of photo's showing the interconnect from the ST-Link V2 to the sub board of the UPS
Along with the subsequent 256KB file from the STM32F103 RCT6 ARM processor chip. NOTE: Rename the "HEX" file to "BIN" and you'll have the right extension for the programmer....

Foot note: you can obtain the STM32F103 RCT6 IC's through EBay for about $4 each (Lot of 5 for about $22 AU)
                 Likewise the AT89C51RC cost me $100 AU for 8 chips (Minimum order) from EBay as well.

My 2nd board that I was playing with has developed a short that I cannot see so that's set me back a bit (Getting tools to inspect board)

[DavidAlfa]

So what's this stm32 dump for? SMT1500? In working state?
Please make this clear in your message to avoid mistakes.

[AstroAU]

So what's this stm32 dump for? SMT1500? In working state?
Please make this clear in your message to avoid mistakes.

Sorry for the confusion.
Yes this is a working dump from the daughter-board's STM32F103 RCT6 which has the latest firmware version 15 contained within it.
This is from a working SMT1500i as needed.

I did say in the text of my post...

As for the contents of the ARM processor on the daughter board...
WE acquired an STM8 / STM32 reader programmer from AliExpress with Dupont female to female connector cable and have READ the contents of a WORKING ARM PROCESSOR on this board.

[DavidAlfa]

Sorry, but I re-read your entire post several times and found no reference to 1500 or whatever, and still nowhere to be found, so that's why I asked 
Uploading unidentified binaries is a very bad idea, I suggest renaming that file to "APCUPSSTM32F103RC.hex_SMT1500i".
Also, instead uploading raw binaries that could get corrupted, zip or 7z is a much better option.

[AstroAU]

DavidAlpha writes: Sorry, but I re-read your entire post several times and found no reference to 1500 or whatever.

I wonder what the THREAD TITLE reads.... oh wait.... "Help with Bricked APC UPS SMT1500" I wonder what that's about....

But yeah the file isn't really that large only 256KB and the attachment limit of the forum is 8MB per reply by the looks of the rules seen when adding attachments.
So I just renamed the extension as the forum doesn't like BIN attachments.
I'll reattach the file with a more descriptive name for you then. But you still need to change the .HEX to .BIN though.
 

[DavidAlfa]

But other models are mentioned in the thread too!
I'm not idiot, but "stm32.bin" is not a good idea!

[AstroAU]

But other models are mentioned in the thread too!
I'm not idiot, but "stm32.bin" is not a good idea!

Yeah good point, I was too focused on my bricked APC SMT1500i and presumed badly that others had the same issue with the same model.

 

[mark1975]

Thankyou AstroAU for this valuable information I will order one of these programers and have a go at getting these two failed boards going again.

A bit more of an update - I took the  93LC66 off the dead SMT1000 board and replaced the one on the SMT1500 board, whacked it back in and now the UPS is showing its correct serial number and model

It is quite possible the STM *MAY* have the same software on all models. I'm not sure.

[m k]

Since data seems to be 16 bits and so the small memory being for RBC7, maybe that is what defines the rest.
It would also be much more practical than many complete software versions.

[jeffrond]

I know I am replying to an old post, but I just bricked a SMT1000RM2U.
I have three of these and found the "daughter board" if you will.  I found that swapping the dead board with another units good board allowed the UPS to function normally.
Digging around on the internet I found this page. Seeing the posts from AstroAU, I was wondering about the chips and which one is causing the brick.

Do you think it is the 93LC66 chip, or does that just hold model number, serial number and other data?
Do you think it is the STM32F103 chip?  That is the microcontroller.  Could that be in a weird non-running state?

[jeffrond]

Another interesting item.  While running LaunchFUW and connected to the bricked UPS with the "good" daughter card installed, it says that I can update the firmware.  This is odd since the most recent firmware is 15.0 and that is what is showing on the UPS when I look at the version.  When I click on "more information", these versions show (1.jpg) UPS 15.0, MCU 11.0, UBL 08.5, MBL 11.0.
Next, I put the daughter card into the good UPS and ran LaunchFUW.  Again, it says to update the firmware. When I click on "more information", these versions show (2.jpg) UPS 15.0, MCU 19.0, UBL 08.5, MBL 19.0.  Notice the MCU and the MBL.  They are different versions.
Do you think the different MCU version has something to do with it?  Is the MCU version speaking to the code that is on the STM32F103 chip or a chip on the main board?  Do these different MCU versions handle the firmware differently?  Meaning can MCU version 19(good UPS) handle the firmware version 15, where MCU version 11(bad UPS) not handle the firmware version 15?
Does anyone have any idea how the MCU and MBL are updated?
Does anyone know what chip the MCU and MBL are located on?

[tom_e]

Hi,
I dont beleive the 93LC66 is modified during update (has constants like model number, battery model string).
MCU is probably the firmware for the 8051 which runs the inverter (it is on many other models, the PLCC chip). I know that UBL and UPS are the STM32, UBL being the bootloader, first few kb of flash, UPS being the main firmware (>100kb). It logically follows that MBL is then the bootloader for the MCU (as it always has the same version number), but im not 100% sure.

I find it very interesting that you have different firmware versions being reported for MBL and MCU across the 2 models. I am assuming it is ID 18 as it let you update to 15.0 (all the more recent of those models are ID 18 afaik).

The latest firmware image (SMT18UPS_15-0.enc) doesn't update the other 3 components anyway, for some reason, APC removed 2 of them (it only has UPS so MBL, UBL and MCU wont be updated). If you want to update them, an older version would need to be used which does include them.

I recall updating to an older version which includes MCU 19.0 & UBL 08.5 (the file is significantly larger & the update takes longer). I should still have it, so pm me if you want to try it.

What behaviour is the bad ups (MCU 11) it exhibiting when you turn it on (e.g. lights, beeper) ? I am assuming the serial port works so you can still update the firmware.

Thanks,
Tom.

[jeffrond]

The bad UPS with the bad daughter board does nothing.  The backlight of the display comes on, but nothing is shown on the display.  No other lights.  I cannot communicate with it via the serial port.

When I put in the good daughter board, I CAN communicate via serial, and that is when I see the MCU version 11.  I wonder if the MCU version 11 is incompatible with UPS version 15.

Anyhow, if you have the update that includes the MCU version 19, I would be very interested in that.