Repair Help for APC UPS BR1500G - F06 error (FIXED!!) - Page 1
Forum section: electronics / repair

author: fmashockie
author_rank: Frequent Contributor
timestamp: August 19, 2023, 05:38:36 pm
content: Hi everyone! New to this forum but I've always been a huge fan of the EEVBlog YT channel! I'm trying to repair an APC UPS BR1500G. I had it in storage for a few months (with battery installed unfortunately) and took it back out to test and it started triggering a F06 error. It would start-up fine, go through a self-test (switching to battery power) and then switch back to mains and trigger this error. According to the manual, F06 = relay welding. I've tested all the relays out of circuit and none of them have stuck contacts. But I replaced them all just in case and it did not resolve the issue (couldn't be that easy).I found that when forcing the unit into Automatic Voltage Regulation (AVR) mode, the unit will not trigger this error. But only at increased voltage (>130V). I can simulate a power failure at this voltage and it will switch to battery power without issue. I can also put a load on it and it will handle it fine. But as soon as I bring the voltage back down to normal levels, it will trigger this error again! (Quick note - If I attempt to start-up the unit at a lower than normal voltage like <110V, the unit automatically starts in the F06 error - no self test, etc.)One thing I noticed while the unit was in AVR mode is that there is a significant ripple that appears/disappears at regular intervals on the output. I observed this while hooking the output up to my oscilloscope. I have a video of it here () but it is a significant ripple/noise (~10V peaks).I would suspect that the transformer is the problem - (maybe the 130V tap has internal breakdown?), but I did a HI-POT test on the transformer up to 1000V and it passed the test. I've tested similar transformers with internal breakdown and they fail immediately.Anyway, I was hoping someone might have some troubleshooting tips/suggestions/help!! This repair is pretty much academic at this point. It's only a $200 UPS (one of APC's most common offerings). But I'd love to learn more about how to troubleshoot these things. Thanks!!

author: fmashockie
author_rank: Frequent Contributor
timestamp: August 20, 2023, 06:31:37 pm
content: Is there any additional info I can provide to help better understand the issue? Just lemme know! I would appreciate any help. Not looking for someone to fix this for me, just how they would approach this problem (at least).

author: Vovk_Z
author_rank: Super Contributor
timestamp: August 20, 2023, 09:34:47 pm
content: How old is it? Old ones tend to want to replace small electrolytes which can cause all types of problems. I'm not sure here is such a problem but who knows.Have you measured output voltage when you regulate input voltage? Is it within range? Does it change as should?

author: fmashockie
author_rank: Frequent Contributor
timestamp: August 20, 2023, 09:47:54 pm
content: Thank you for the reply! I did test the electrolytic caps in-circuit with an LCR meter. For the ones I could measure in-circuit, they measured normal. But couldn't hurt to measure again and even measure some out of circuit.The output voltage stays within range when adjusting the input voltage. For example, in the video I took in my OP, the input voltage is set to ~130VAC. But output measures ~120VAC.What I am trying to figure out is why the unit will only work when voltage is increased and the unit is in buck mode. If I start it up with mains voltage at normal 120VAC (I am in the US), it will do its self test (switch from mains to battery and back to mains). Then I hear another relay click, and I see increased noise in the AC waveform, and it triggers this F06 error and shuts down. If I start the unit with a less than normal voltage, (say 110V), it will automatically go into this F06 error. The error means relay welding according to the manual, but the relays are fine!

author: fmashockie
author_rank: Frequent Contributor
timestamp: August 20, 2023, 09:51:07 pm
content: Quote from: Vovk_Z on August 20, 2023, 09:34:47 pm

author: RLP
author_rank: Contributor
timestamp: August 20, 2023, 11:06:57 pm
content: Hi fmashockie,We know for sure that the UPSthinksthat one of the relays is faulty - but there may or may not actually be a relay problem. Based on my experience with a different APC product, the UPS may be detecting AVR relay weld faults by measuring its input and output voltages. The buck/boost operation changes the ratio of the AVR transformer to buck/boost the output voltage relative to the input voltage. The UPS can't actually detect what the relays are doing directly, but it can look at the ratio between the measured input and output voltages. If that is not as expected, it might trip the fault - essentially assuming a relay is stuck in the wrong position. So if one of its voltage measurement circuits is faulty, it may incorrectly detect a fault.However, you say that it outputs 120V with an input of 130V... that would suggest to me that its voltage measurements are OK, because it's doing the right thing under those conditions at least.If you have replaced all the relays (and the old ones tested fine anyway) and it's still doing this, then I would suspect that one of the relay driver circuits is faulty.Why would it only work at high input voltages and fail otherwise? That seems like an important clue as to which relay is failing. Based on that, I'd say the AVR trim relay is not working, so it's basically stuck in voltage trim mode. As soon as you drop the voltage to a point where it would usually switch out of trim mode, it tries to and fails, and trips the fault.I guess you'd have to figure out which relay is the trim relay, find the drive circuitry for that relay, and troubleshoot it. I'd start by looking at it, in case anything is visually blown - and then compare its input signal (from the microcontroller or other circuitry) with its output to the relay coil, to see if it's working as it's supposed to. A schematic would help a lot with that, which may be available online somewhere.

author: fmashockie
author_rank: Frequent Contributor
timestamp: August 21, 2023, 04:32:20 am
content: Thank you so much for this detailed explanation RLP! I really appreciate it. This is kinda the route I was going to go with. Interesting to think that the AVR trim relay is the problem. I could have sworn when I had it in AVR mode (buck) that when I began turning the input voltage down, I heard the trim relay click, and then the F06 error was triggered (as I show in the video), but I could be wrong. But regardless, I get your thought process and will begin with that investigation once I get back in the lab tomorrow.Do you have any thoughts on that noise/ripple I showed on the oscilloscope? I feel like that cannot be normal.Thanks again for your reply!!

author: RLP
author_rank: Contributor
timestamp: August 21, 2023, 10:01:47 am
content: In the video, I couldn't hear any relays click when the AVR icon disappeared from the LCD - only a click as it later shut down with the fault and started beeping. I would expect a click just as the AVR icon disappears.For the ripple/noise... the way it disappears and comes back reminds me of the UPS's internal battery charger, which goes off and back on briefly to test for the presence of batteries every so often. You have the bare board quite close to the oscilloscope and probe cable - I'm wondering if maybe it could actually be EMI from the board, maybe the battery charger, affecting your measurements? I imagine that level of ripple, if actually present, would be audible in the input/output filter components - can you hear that frequency audibly anywhere?These UPSs can certainly make for a bit of interesting diagnosis/repair!

author: BradC
author_rank: Super Contributor
timestamp: August 21, 2023, 01:03:28 pm
content: I had an SU2200 which started giving intermittent relay weld faults. I too replaced the relays. On the older SU series, both input and output voltages are measured by little PCB mount transformers, and the transformer on the input had developed a perverse fault in the primary that wasn't quite an open circuit, and was strongly influenced by humidity and temperature. I replaced that with another from an older scrap unit and it's been good since.In addition to the relay drive circuits I'd look at the input and output voltage sampling. I was lucky as with the older units I had a schematic available.

author: fmashockie
author_rank: Frequent Contributor
timestamp: August 21, 2023, 03:09:41 pm
content: Quote from: RLP on August 21, 2023, 10:01:47 amYes they can!! Thanks a lot for the input RLP I really appreciate it! It might be some time before I get back to you with an update. This is probably the lowest on priority of list of things to do at work (unfortunately it's the most interesting). I'll try narrowing down where that noise is coming from - try moving the board further away from the scope - make sure there's no interference.Quote from: BradC on August 21, 2023, 01:03:28 pmThank you BradC. See that is what I was afraid of hearing. This unit has little current transformers as well to sense the load (maybe voltage, too? I assumed that was done by resistor ladders). I had worked on a similar model APC UPS in the past (the BR1500MS which is pure sine-wave unlike this one) and it kept throwing errors and blowing the inverter MOSFETs. It turned out the large AVR/inverter transformer was the cause - must have had some internal breakdown. I HI-POT tested it and it failed immediately (I have a video of that on YT as well). Dr. Carlson's Lab also does a video on this APC unit and discovers the transformers might be made of aluminum (not copper) and his tap connections were crimped very poorly. My issue was not that easy to discover. But in short, I'm saying I'm not liking APC's track record with cheap transformers. Transformers can be the most difficult component to replace.And unfortunately, no schematic for this model. I've looked everywhere. I've found schematics for older models, but not for these newer models (like this one) that are currently available for purchase.Thank you both again for your input! I'll be giving an update as soon as I can take another look at this thing!

author: Vovk_Z
author_rank: Super Contributor
timestamp: August 21, 2023, 07:24:15 pm
content: I tend to double RLP thinking, I tottally agree. It seems to me that main signal processing unit is fine but some output circuit is faulty, e.g. a transistor controlling that AVR relay etc. There possibly could be a burned wire too (because of malfunctioned relay etc).There is a possibility that TS soldered wrong type of relay because they are different. They are not one type but two types I guess (NO and SPDT ?).

author: fmashockie
author_rank: Frequent Contributor
timestamp: August 22, 2023, 02:21:09 am
content: Thanks for the reply Vovk_Z. The relays I used as replacement are a different make/model than the originals because they were no longer available. But I matched them exactly to spec. All 7 of them are form C relays (both original and replacement). And it was having the same issue before I replacement the relays. Which is why I replaced them in the first place lol.

author: fmashockie
author_rank: Frequent Contributor
timestamp: August 22, 2023, 03:30:57 pm
content: Just a quick update. I had some time to work on this thing yesterday. I might have found a suspect transistor involved in the switching of one of the relays. It is a internally-biased SOT-23 package. There are several of the same type on the board and it was giving a much lower forwad voltage on diode test than all the others. Unfortunately, it broke apart as I was trying to remove it with my heat gun (maybe a sign it was in bad condition). I've ordered some replacements so it will be a bit until I can work on it again.I also removed both of the current transformers to test them. Both of them had normal resistivity/continuity readings (~0-1 ohms on primary, ~100 ohms on secondary). And I HI-POT tested them and each of them passed up to ~500-1000V (didn't want to crank it up too high as they are small little guys). There's also another large transformer on the board by the inverter which I'm not quite sure what its purpose is. The pure-sine wave APC UPS I worked on in the past didn't have one of these. But I removed/tested it anyway and it seems fine as well.Also tested all electrolytic caps in-circuit again and none of them seem suspect.A side note - it is a real pain to work on these UPSs. They use very large traces/planes due to the large amount of current/power they have to be able to handle (up to 1500VA). Desoldering/soldering anything on them can be difficult. Have to employ my heat gun and soldering gun at same time. A few years ago I grabbed a Quick 861DW after seeing Dave do a teardown on one. Works really well!Thanks again for everyone's input!

author: fmashockie
author_rank: Frequent Contributor
timestamp: August 25, 2023, 08:52:00 am
content: Just wanted to give an update regarding this repair. So my company just got in two brand new UPSs. They are BR1000MS2 models - APC's pure-sine wave offering at ~$200.00. It's a bit different than the one I'm trying to fix since the BR1500G is a simulated sine-wave model. But I decided to open this brand new one up to see if it could help me troubleshoot. I forced it into AVR mode by powering it from my Sencor PR57 transformer at ~130VAC. I then probed the secondary side of the large inverter/AVR transformer and found that voltage on outer taps was = 130VAC and the 'center' tap was = 115VAC.I realized that this was about the readings I was getting for the BR1500G even when it was not in AVR mode (i.e. >130VAC input voltage). For example, even when on battery power, the BR1500G would measure >130VAC and ~115VAC on outer and center taps, respectively. On the BR1000MS2, on battery power the outer and center taps measured ~120VAC and ~110VAC, respectively.So with that said, I'm beginning to think the issue is not with the any of the relays after all. But that there is a problem with the charge/inverter circuit. Also, there's no noise observed in the AC waveform on the output voltage for the BR1500MS2 unlike the BR1500G. This would also explain why the BR1500G does not trigger the F06 error in buck mode since it is expecting those secondary outer and center tap voltages.If it is a problem with the inverter/charge circuit, could anyone explain/speculate what could account for the increased voltage? As I said, I clearly recall measuring close to ~140VAC and ~115-120VAC on the outer and center taps of the AVR transformer without it being in AVR mode. It was in battery mode during these measurements yet still providing normal output voltage (~120VAC). I'd be curious to know anyone's thoughts on how that could happen.I'm still waiting on replacement components, but will provide an update once I receive them and install. Here's a link below to a video I did explaining my observations. Thanks!

author: RLP
author_rank: Contributor
timestamp: August 25, 2023, 11:16:35 am
content: Interesting. I think there may be some topological difference between the BR1000MS2 and BR1500G, in terms of how the inverter and transformer(s) work. The BR1000MS2 looks to me like a low frequency inverter, where the big 50Hz transformer is part of the inverter and thus has large high-current terminals on the low voltage side coming from the MOSFETs, and various taps on the high voltage side. I can't tell for sure but the BR1500G looks like a high-frequency inverter design: the transformer on the PCB looks like part of a high-frequency DC-DC boost converter used as part of the inverter (it's too big to be part of the battery charger), and so I suspect that the big transformer is probably only used for AVR. I can't see any big high-current connections to that transformer in your videos - for a 1500VA UPS, there should be some large high-current terminals on the transformer if it steps up the battery voltage to mains voltage?My thinking is, maybe there could be some legitimate topological reason for the difference in voltages while on battery?Then again if a relay is stuck (due to drive circuitry etc.), that could also cause the voltages to be different - but (maybe) it may not matter or be detected while on battery power.I'll be interested to hear what you find after replacing parts.

author: fmashockie
author_rank: Frequent Contributor
timestamp: August 25, 2023, 01:12:19 pm
content: Hi RLP. Hmm that is a very good point. I just assumed that with the BR1500G that the large transformer was being used for both the inverter and AVR just like the BR1500MS2. However, the BR1500G is the simulated sine-wave model and the BR1500MS2 is the pure sine-wave model. And I've always wondered what that large transformer on the PCB was for so I think you might be right. I suppose is it is still too early to be jumping to conclusions. It's just with the exception of that internally biased BJT (still not sure if it was bad or not), I didn't really find anything that stood out on the controller side for the relays that would indicate a fault. And even though they employed a lot of cheap electrolytic caps (OST, CapXon, Chang, etc), none of them really measured that poorly once I got them out of circuit. Still replaced them though. Can't wait to get these remaining parts in to see what happens. I just thought it was interesting to share. Really appreciate your input on this. Thanks again!!

author: fmashockie
author_rank: Frequent Contributor
timestamp: August 29, 2023, 05:03:28 am
content: The BR1500G saga continues. I received all the replacement components I ordered (all the MOSFETs and that internally biased NPN BJT by one of the relays). I soldered them all in and fired the unit up and of course... it's still having the same issueWhen the input voltage is ~120VAC, I start it up, it does its self-test (switching from battery to mains and back), and then I hear another relay click, and then it triggers the F06 error. After that, I increased the input voltage to >130VAC to force into AVR mode, and it was working without triggering the F06 error. But as soon as I brought the voltage back down, the error was triggered.But then something else happened. I was running it in backup battery mode (using my DC supply to limit the current) so I could make some measurements. The unit will beep every 30 secs or so to let the user know its on battery. All the sudden, the buzzer got much louder. I decided to check the input voltage and supply voltage on a nearby LM317T and LM358 and they had increased by ~10VDC! It stayed this way for ~1 min. Then the buzzer got lower, and all the sudden the unit powered itself off. I couldn't get it to start back up via the display controller after this happened.I took some measurements. The ~24V rail (it usually sits at 26-27VDC) was ramping up and down by ~1V every 500msec or so. The 3.3V rail was doing the same. I have attached photos of the waveform for these measurements from my oscilloscope. Any thoughts on what could be causing this? Or where I should begin to look for faults? I'm not sure if I've caused another issue or just made the original worse (i'm hoping its the latter). Thanks in advance!!

author: Vovk_Z
author_rank: Super Contributor
timestamp: August 29, 2023, 08:34:08 am
content: I'm not sure 3V3 rail is ok. Are you sure you are doing measuring right? It mustn't have such a pulsations I guess. Are you sure you have replaced all electrolytic caps?

author: fmashockie
author_rank: Frequent Contributor
timestamp: August 29, 2023, 01:48:55 pm
content: Quote from: Vovk_Z on August 29, 2023, 08:34:08 amYes I know the 3.3V rail is not okay. None of the secondary power rails are okay. They should not be ramping up and down like this. And it is definitely a problem because now the unit will not even turn on. That's why I was asking for help!! And yes I'm confident I took the measurements correctly.

author: RLP
author_rank: Contributor
timestamp: August 30, 2023, 04:45:57 am
content: From your description I'm thinking an onboard power supply failed in some way, and put out an abnormally high voltage, as you measured - and then some downstream component, maybe an IC or another power supply, failed due to that overvoltage. The failed component probably went short, hence it all shut down and won't power up. The ramping behavior you see might be power supply 'hiccuping' where a power supply is shutting down due to overcurrent, then restarting, then the cycle repeats. 500ms to a couple of seconds sounds about right for that.If that is the case, I would say you need to find the shorted component. One idea is to try powering it up again and see what gets hot. Another approach is to measure the resistance of various rails to ground (3.3V, 12V, etc.) and see if one is obviously shorted, and then inject a controlled current into that rail from an external power supply and measure voltage drops across PCB traces on that rail to locate the fault.If you remove the shorted component and power it back up and there is still a power supply issue, the overvoltage condition might come back and cause more damage! So the root cause is important too. This is kind of familiar to me because I had a similar thing happen when I was working on a UPS once. In my case it was the main 12V power supply of the unit, which went up to about 25V! It turned out to be because I'd damaged a resistor in the feedback loop of a switching regulator, while soldering a probe to it to measure the voltage, and it was a complete distraction from the main problem I was troubleshooting on the UPS. I had to replace a few ICs and fix the power supply - but it was alright in the end.Good luck!

author: fmashockie
author_rank: Frequent Contributor
timestamp: August 30, 2023, 05:34:38 am
content: Quote from: RLP on August 30, 2023, 04:45:57 amAll too similar to what I'm dealing with here!Thank you so much for your help RLP. Unfortunately, I don't see any obvious shorts yet. But definitely will be taking a closer look!Quote from: Vovk_Z on August 29, 2023, 08:34:08 amMy apologies Vovk. It turns out I was not measuring the 3.3V rail in that second oscilloscope photo. I did however find out why the controller was not turning on. The DC/DC converter (MC34063EC) was not switching. I measured no voltage on the emitter switch pin 2. Not sure why the converter is not switching tho. When it is not switching, it does not provide voltage to an LM317T and a LP2950 (KY5033). The KY5033 is the regulator for the 3.3V rail. I supplied 3.3V to the output and the display came on.I decided to desolder the MC34063 to see if the hiccup on the 24V rail would stop, but it did not (see attached photo). So still more troubleshooting left to do. Thanks for everyone's input!

author: Vovk_Z
author_rank: Super Contributor
timestamp: August 30, 2023, 12:33:44 pm
content: Quote from: fmashockie on August 30, 2023, 05:34:38 amI totally lost what are you doing and what is happening. There was only one problem at first - a problem with a relay. But now you have more problems?I don't know what to say because the more you are into it the more problems you have.

author: coromonadalix
author_rank: Super Contributor
timestamp: August 30, 2023, 04:22:29 pm
content: and without a proper schematics, at some point you only do guessing ... and create maybe more problems than neededon some 1500 models i did saw some mentions about smt alu caps creating more noise on the supply lines ... and one in a feedback loopi had one of theses who almost blown up the battery cells, had problems getting them outtrashed the unit

author: fmashockie
author_rank: Frequent Contributor
timestamp: August 31, 2023, 01:35:58 pm
content: Yep it seems that could definitely be the case here. No schematic for newer APC models like this one - I've looked everywhere.At this point, my hopes of fixing it are not high. I'm just hoping to learn from the experience and troubleshooting. I'm self-taught with this stuff and mostly learn by doing. I definitely appreciate everyone's help though!

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 02, 2023, 06:31:13 am
content: Still haven't quit on this thing yet! So as I said, for a bit there I thought I had killed this thing for good. But I found out the reason why the LCD controller was not powering up - I must have inadvertently fried the DC/DC converter. I replaced it and it powered up fine. But I was back at square one - still had the F06 error...Just like a few of you speculated, I decided to take a closer look at all the relays after I replaced them. I tested each one individually during different operation modes of the UPS - (battery power only, mains power only, and battery+mains right before F06 fault takes place). I found that only one relay was not switching at all - Relay RY14. So I started looking more closely at this relay. There's a digital NPN transistor (PDTD113ZT) and a 31V zener connected to the coil. The base of the transistor connects to the microcontroller at a GPIO pin. (I attached a schematic I drew of this portion of the circuit below). Now that I understood the circuit, I decided to see what would happen if I injected ~1VDC at the base of the transistor, hoping it would switch on the relay. I did this right before the F06 error would normally happen, and it switched the relay on... No fault occurred!! So it is indeed this RY14 not switching that is the cause of the issue!!Now I measured the output of the microcontroller GPIO this transistor base connects to. At no point in time did I measure a voltage > 0VDC. So the micro is not sending a signal to switch on the relay. Does anybody have any thoughts why? Could it be anything else besides the micro being faulty? Thoughts for further testing/troubleshooting?? I greatly appreciate everyone's help so far. Look forward to hearing your thoughts!! Here's a video I did explaining where I am at with this thing and the test I did. It's a bit long, but it might help better understand the issue. Thanks everyone!!

author: Vovk_Z
author_rank: Super Contributor
timestamp: September 02, 2023, 07:18:42 am
content: That's good you don't stop and now even can repair your own damageI'm strugling to write "we told you to look into that output circuit carefully earlier".It could be dangerous to microprocessor output pin when you apply external voltage to it without current limitting (like 100 R resistor in series). I would better cut a control wire to do it safe for microprocessor. Or I would just check a control voltage if it present or not.Are you sure that relay RY14 has to move at your tests?

author: RLP
author_rank: Contributor
timestamp: September 02, 2023, 11:25:27 am
content: OK that is fascinating indeed. Great diagnosis!My general feeling is that that particular GPIO on the microcontroller is probably dead - I have seen it happen. Usually it happens where a pin is exposed to some transient, so it's hard to guess why it would happen in this case. But definitely in the realm of plausibility. The fact that it thinks the relay is welded seems like proof that it 'should' be outputting a signal on that GPIO pin to control it. Although... I suppose there is still a tiny possibility that something else is wrong (e.g. voltage measurements) that is causing it to not switch when it actually should. But I think the voltage measurements must be correct: you said it outputs 120V (hence output measurement is probably correct) and the display shows input voltage correctly. Can the display show output voltage as well, to verify that...?Replacing the microcontroller should be feasible if you can solder it, because you can almost certainly dump the firmware from the existing microcontroller. The STs are relatively simple to do this on: it's documented by ST, but basically something along the lines of setting the boot mode with BOOT0 and BOOT1 pins so that it runs the internal factory bootloader, and then powering it up and connecting to UART0 with something like a USB to serial adapter, and using ST's flash loader program to dump the firmware. Same process for programming a new chip. And they are usually unlocked on APC products so no read protection to stop you doing this!

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 02, 2023, 12:44:21 pm
content: Quote from: Vovk_Z on September 02, 2023, 07:18:42 amI know Vovk! You and RLP were definitely right on the money from the start! Thank you for that tip about current limiting when applying external voltage to micro. I really am in new territory here. My experience troubleshooting micros is a bit slim. I did limit the current from my power supply. And I tested the micro prior to running this experiment to see if any voltage was being applied to signal RY14 - it was 0V throughout the start-up process. Having trouble understanding your last question. But I greatly appreciate your help!Quote from: RLP on September 02, 2023, 11:25:27 amYep the display can show input and output voltage. And from what I measured, both of them are very accurate.Quote from: RLP on September 02, 2023, 11:25:27 amSo I'm not worried about desoldering this micro and soldering a new one. I'm confident in my abilities to do that successfully (I like to use ChipQuik removal alloy. Works really well and don't have to worry about applying too much heat like with hotair). But reprogramming the chip and extracting the firmware is definitely new territory for me. I've always wanted to learn how. Especially because I've run into other repairs where having this experience would have allowed me to complete them successfully!! Do you have any resources/procedures you can share to get started? Do I need a USB programmer to do this (I'd need to purchase one if so). Thank you so much RLP for everything so far!!

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 02, 2023, 04:47:22 pm
content: Well guys I'm pretty excited to give 'flashing' this STM32F1xx micro a try! While I am still entertaining the possibility the micro is fine and there's something else wrong with the board, I'm leaning more towards an issue with the micro itself. So I've done some research on how to flash this chip. RLP you were pretty much spot on about how to flash the chip as far as I can tell. ST has a ton of great resources for how to do this. I started with reading ST Application Note 2606 (https://www.st.com/resource/en/application_note/an2606-stm32-microcontroller-system-memory-boot-mode-stmicroelectronics.pdf).The STM32F1 appears to be very easy to work with. It is compatible with UART connection. So I then bought one of these FTDI USB 2.0 to UART cable to interface with the micro (data sheet herehttps://ftdichip.com/wp-content/uploads/2020/08/DS_C232HD_UART_CABLE.pdfNext it seems the ST also offers free software to download that will allow me to enable the bootloader function and flash the chip. It's called the STM32CubeMx (info herehttps://www.st.com/en/development-tools/stm32cubemx.html).I will also order a replacement micro as well to perform the flash (man this repair cost for this is starting to add up)But anyway, based on all that, does it sound like I am on the right track?? Like I said, this is all really new to me so if someone could check my thought process here, I would greatly appreciate it!!! Really excited to give this a try!!

author: RLP
author_rank: Contributor
timestamp: September 02, 2023, 11:28:39 pm
content: Yeah that sounds good to me. I've only used the older software myself (https://www.st.com/en/development-tools/flasher-stm32.html) but I assume the new Cube software will have all the same functionality in there somewhere. Good luck!

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 06, 2023, 04:15:52 am
content: Well guys I have another update with this UPS... It's fixed!!!Well not exactly...So I am waiting for the delivery of the UART-USB adapter and the new micro so I can flash the chip. But today I decided to test the AVR function of the unit a bit more. A few things I found out:RY14 = Boost relay (this is the relay I discovered that was always off and was not getting a high input to the base of its controller transistor Q63)RY12 = Buck relay (more about that later)Boost mode = RY14 is on, RY12 is offNormal mode = RY14 on, RY12 onBuck mode = RY14 is off, RY12 onSo I decided to test the unit in boost mode. I started bringing the input voltage down from 120VAC while injecting ~1V at the base of transistor Q63. Once I got down to ~100VAC, the unit was in boost mode and it automatically triggered the F06 error. So this meant there's something wrong with the buck relay (RY12) as well - it was not turning off once the voltage got low enough for boost mode! The transistor that controls switching to RY12 is Q57. I traced it back to the micro and it is connected to pin 27 which is another GPIO pin (PB14). This is right next to the pin that ties to the base of Q63 for the boost relay RY14 (pin 27 PB13). I have attached a layout of the micro and descriptions of pin functions.What I also discovered is that pin 27 is shorted to the VDD pin! I checked to see if there's anywhere else that this short could be occurring but could not find it (will continue looking). Please correct me if I am wrong, but none of the GPIO pins should be shorted to a VDD pin right? I was thinking this should be another indication that the micro is bad (maybe?). But I decided to do a bit more experimentation and so I shorted the bases of Q63 and Q57 together with a 0 ohm resistor to see if the UPS would work under normal voltage (120VAC) conditions and it does! So for that reason, it is fixed somewhat right??Curious to hear if anyone has thoughts on this and/or if this new info changes anyone's ideas on the micro being bad?? Is there some other part of AVR circuitry I should check/test? Regardless, I'm really excited to try to flash the micro once I get the stuff I ordered. Here's a video below I did on these findings. And as always, really appreciate everyone's help so far!!!

author: BradC
author_rank: Super Contributor
timestamp: September 06, 2023, 04:25:46 am
content: If I didn't know any better (and I don't!) I'd say it almost looks like the micro thinks it's on a board that doesn't have AVR.I have no experience with later units than the late 4th Generation SUA units, but on all the APC units I've worked on, a firmware setting held the device type. I had once instance where the eeprom on a unit ended up corrupt and a 230V 50Hz unit believed it was a 110V 60Hz unit. All sorts of weird things happened.I find it hard to believe you have a fully functioning ups *except* for hardware failures on both boost/buck relays simultaneously. One duff output perhaps, but for both to go with the rest of the unit performing normally sounds pretty remote to me.

author: RLP
author_rank: Contributor
timestamp: September 06, 2023, 07:33:35 am
content: I don't know much about the internals of microcontrollers or their failure modes - but a GPIO being shorted with low impedance to a supply rail while the MCU is off, does sound like evidence of an internal problem. The two pins in question are next to each other and on the same port (PBx), so I guess there is some possibility of a common cause for the failures.Random thought: relay coils produce voltage spikes, which are usually clamped by diodes in the relay drive circuitry. Have you tested the diodes on those two relays? My thinking is: flyback diode fails -> back EMF from relay switching not clamped -> propagates through circuit and does damage to the MCU. It'd probably kill the relay drive transistors first though... did you mention that one may have been faulty?I did have a microcontroller once where the entire ADC section failed, so all of the ADC inputs would read high values (as if the internal voltage reference was low),unlessat least one ADC input was connected to a low-impedance voltage source such as VDD, then the remaining ADC inputs would read correctly. The rest of the microcontroller was fine, so reading firmware/replacing the chip/flashing fixed the problem. I never figured out what caused the problem, my only conclusion was that weird stuff can happen inside microcontrollers!

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 06, 2023, 01:25:45 pm
content: Quote from: RLP on September 06, 2023, 07:33:35 amYep this is exactly what I am witnessing (should have been more clear). This is with the mirco off and power disconnected from the board. Still measuring short between PB14 pin and VDD pin. That's gotta be a hardware failure of some kind right (whether on the micro or elsewhere)?Quote from: RLP on September 06, 2023, 07:33:35 amInteresting thought. So I did replace the internally biased BJT (Q57) and it's zener diode which connect to RY12. This was prior to having a better understanding of the circuit. I just thought they were measuring a bit lower forward bias voltage during diode test - turns out it was normal. But I will replace Q63 and D68 for RY14 just in case. I know it won't fix the problem, but just to prevent any damage to the new micro. Thanks for your continued help on this RLP - I greatly appreciate it!!!Quote from: BradC on September 06, 2023, 04:25:46 amI hear what you're saying BradC, but I don't see how this could possibly be a firmware issue. I didn't do ANYTHING to this unit/board. It was in service for ~3-4 years, then I took it out service briefly/put into storage, then I took it out of storage once to take a look internally to help troubleshoot another UPS, then put it back into storage for several months, and finally took it back out recently and it started with this fault! Did not make any modifications to it or anything. It always worked fine until now. So I really doubt this is a firmware issue. It has to be a hardware fault of some kind. But I appreciate your input!

author: Vovk_Z
author_rank: Super Contributor
timestamp: September 06, 2023, 06:04:27 pm
content: It looks like a hardware issue but APC UPS are known to have software problems too, e.g. loosing calibration parameters or even totally loosing all settings (230/115 V and/or 50/60 Hz etc). I've seen it on one of my UPS when smal electrolytes became a bit 'weak' (charging voltage became 24VDC instead of 27.6 VDC).

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 07, 2023, 01:37:35 pm
content: Quote from: Vovk_Z on September 06, 2023, 06:04:27 pmWow that is fascinating Vvok! Yea I'm pretty preplexed as to what could be causing this. I want to think its a problem with the micro due to that short of the PB14 pin to VDD. I did a thorough check of the board tracing all traces and couldn't find anywhere else this short could be occurring.But at the same time, it almost seems too perfect of a fault to be a hardware issue. Kind of like BradC says, everything works fine except the AVR.In your opinion Vvok, would flashing the chip and replacing the micro resolve this issue if it is a software problem? Is the programming corrupt on the original chip to prevent this from being successful?I guess I will know soon enough. Should be receiving the necessary items to do the flash today/tomorrow!!

author: Vovk_Z
author_rank: Super Contributor
timestamp: September 09, 2023, 06:16:35 pm
content: IDK, try everything.

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 09, 2023, 06:34:17 pm
content: Quote from: Vovk_Z on September 09, 2023, 06:16:35 pmWill do! I already got the replacement micro in. Just waiting on the UART to USB cable which I should have by Monday. I downloaded the STMCubeProgrammer software as well. Seems really easy to use. I'll give an update on how the flashing of the original micro goes, and the replacement with new micro.If all that doesn't fix the issue, it would probably work just fine keeping the bases of Q63 and Q57 tied together with the original micro's PB14 and VDD pins shorted. It just wouldn't have working AVR. Who needs that anyway?

author: BradC
author_rank: Super Contributor
timestamp: September 10, 2023, 03:25:20 am
content: Quote from: fmashockie on September 09, 2023, 06:34:17 pmSo if you get a mains spike or dip the first thing it'll do is dump your load with a relay weld fault. Makes the UPS more of a PS.

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 10, 2023, 03:53:27 am
content: Quote from: BradC on September 10, 2023, 03:25:20 amYes I know thats why it was a joke. Although, where I'm at, mains is fairly stable. We use these more for complete power failures. It switches from mains to battery just fine with the buck and boost relays stuck in the on position. I'd be willing to bet it would work just fine like this if I put it back into service. But, I'd rather fix it for real.

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 13, 2023, 05:20:22 am
content: Hey everyone - another update regarding this APC UPS BR1500G repair. And unsurprisingly, it continues to be a stubborn bastard!I finally got in the items I needed to perform the flash of the micro - a FTDI UART to USB cable (datasheet attached), a replacement micro (it is a STMF102C8, datasheet attached) and I installed the STMCubeProgrammer software. I installed the drivers for the FTDI cable as well from their website. I also got a LQFP48 adapter board in case I had to remove the chip from circuit to flash it.I read the ST application note 2606 to get info on the bootloader function for this chip. Here's how I set it up:-Connected the VCC 3.3V (red) wire from the FTDI cable to VDD on micro-Connected ground (black) wire from FTDI cable to VSS on micro-tied BOOT0 (pin 44) on micro high (3.3V)-tied BOOT1 (pin 20) on micro low (gnd)-Connected the TXD (orange) wire from FTDI cable to PA9/USART1_TX (pin 30) on micro-Connected the RXD (yellow) wire from FTDI calbe to PA10/USART1_RX (pin 31) on micro-I selected 'UART' in STMCube software and checked to ensure serial configs matched (see photo attached).Of course, once I was finished connecting everything, I tried to connect and an error message popped up saying 'Error activating device - check bootloader and serial configs and reset'. I double checked everything and powered cycled my setup and tried again - same result. I tried tying the NRST pin low to see if that would reset it, but that still gave me the same error. I tried connecting to the micro both in-circuit and out of circuit (note - I did verify that pin 27 is indeed shorted to VDD like I mentioned before!).So now I've reached another brick wall again! I was hoping you guys could take a look at my set-up to make sure I'm not missing anything (I've attached photos as well). Any help would be greatly appreciated! Also, if the micro is read-protected by the manufacturer, would this explain the error message I am getting?Thanks in advance as always!!

author: RLP
author_rank: Contributor
timestamp: September 13, 2023, 07:36:13 am
content: Sounds like you're close!I remember being able to connect to the device and then view status of each flash region (protected/unprotected), so I imagine you should be able to connect even if it is read protected. Unless there is some separate protection setting that disables the bootloader entirely... that would be documented somewhere if it exists.Do TX and RX need to be swapped? I might be missing something but I'd usually connect TX of the adapter to RX of the chip and vice versa.Also my quick skim of AN2606 suggests the bootloader will auto-detect the baud rate - can you try lower baud rates than 115200?

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 14, 2023, 04:23:24 am
content: Once again RLP you were spot on!So I did indeed have the TXD and RXD wires reversed. I also lowered the baud rate (115200 is the max according to application notes) and set parity to even. After I fixed all that, I was able to get the original micro connected to the STMCubeProgrammer software no problem! It appeared to read all the flash memory successfully. So I extracted the flash memory and saved it to my PC. I then desoldered the original chip from the LQFP48 adapter board and soldered in a brand new micro. I made all the connections, configured the bootloader, and connected to the chip. I downloaded the flash memory I saved from the original chip onto the new micro. I verified the files were exactly the same. Then I desoldered the new chip from the adapter board and soldered it onto the UPS PCB. I powered it up and..... nothing happened...I verified the display was getting power. It definitely appears that the new micro was not programmed properly. I then connected the new micro to the STMCubeProgrammer again (thank god it worked in-circuit because I did not feel like desoldering it again!) to verify the flash memory was there and it is.Is there something else that I am missing as far as programming the chip? Some crucial step perhaps? The only thing that seems out of the ordinary (maybe?) is that a few of the address lines in the flash memory have all zeros (see photo attached). But that is how the flash memory from the original micro read as well. Sorry, if I am not giving enough info - this is my first time attempting this. I'll post in the microcontroller forum as well. But any help you can provide would be greatly appreciated! I can't thank everyone enough so far!! Also, here's a video below summarizing where I'm at so far. Thanks again!!

author: darkspr1te
author_rank: Frequent Contributor
timestamp: September 14, 2023, 05:48:00 am
content: I replied in the other thread but will post here too, you didnt download the full firmware so you need to reattach the original chip to the dev board and dump it,then check j40 for PA13/PA14 pins (pins 34/37 of mcu) as J40 looks like a programming header and you should be able to flash in circuitwhen you dump original firmware set the read size to 0xffffff and it should read the whole chip.darkspr1te

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 14, 2023, 10:12:11 am
content: Better don't read 0xffffff, might crash or cause other issues later, I remember having issues in ST-Link utility, getting frozen/unresponsive after getting a bit over the limit.Do the correct thing instead, we all know C8/CB parts have 128KB, so 0x20000 is the size.

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 14, 2023, 02:05:43 pm
content: Thank you both for your quick responses! So I guess when you say read siz, I should change size (see photo) from 0x400 to 0x200000 (or 0xffffff as darkspr1te said)??Sorry this is all completely new to me so thank you bearing with me!

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 14, 2023, 02:37:05 pm
content: Exactly. Do that when reading it.About VDD and PB14 shorted together... double check everything connected to it, suggests some external voltage spike fried the esd diode!

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 14, 2023, 02:48:44 pm
content: Thank you so much DavidAlfa! I will give it another go as soon as I get in to the lab today. I let y'all know how I make out!And I did verify that the VDD to PB14 short is on the micro. That being said, doesn't rule out there's some issue on the board I haven't found that could cause it to happen againWill report back later!

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 15, 2023, 05:53:24 am
content: Well everyone I am pleased to say that this APC UPS BR1500G is fixed! It put up quite a fight!So changing the read size to 0x20000 allowed me to flash the micro correctly! Need to learn to read hexadecimal lol.Can't thank you guys enough for all the help. Could not have fixed it without everyone's input!Final video to the series for those interested in watching

author: RLP
author_rank: Contributor
timestamp: September 15, 2023, 07:17:46 am
content: Awesome, glad to see you fixed it in the end!! A dead GPIO pin huh - who would've thought of that when presented with an "AVR relay weld fault"!Repairs certainly are a great way to learn: IMO there is no better way to learn about electronics than to solve real problems like this, and see first-hand all the weird stuff that actually happens in circuits. Plus, who doesn't love a good mystery!

author: Vovk_Z
author_rank: Super Contributor
timestamp: September 15, 2023, 09:53:58 am
content: Quote from: fmashockie on September 15, 2023, 05:53:24 amGreat, good work! It's a pleasure to hear about one more repaired device!

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 15, 2023, 12:49:36 pm
content: Quote from: RLP on September 15, 2023, 07:17:46 amThank you again RLP - you were so helpful to me during this repair. I learned a lot from you! I really appreciate it! Same to you Vovk_Z and others!

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 15, 2023, 02:28:57 pm
content: Great! Could you attach the firmware?Other people might not get so lucky when reading the stm32 (Broken, protected...).

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 16, 2023, 05:57:32 am
content: Quote from: DavidAlfa on September 15, 2023, 02:28:57 pmAbsolutely! Once I get back in the lab Monday I'll attach in a post!

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 22, 2023, 04:07:09 am
content: So...

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 22, 2023, 02:10:42 pm
content: So sorry David! I was on PTO most of this week. Going into the lab today - I definitely won't forget. I'll have it up by tonight

author: fmashockie
author_rank: Frequent Contributor
timestamp: September 23, 2023, 04:42:58 am
content: As promised here's the firmware for APC UPS BR1500G!

author: DavidAlfa
author_rank: Super Contributor
timestamp: September 24, 2023, 02:03:25 pm
content: Thanks!

author: CoopedUp
author_rank: Regular Contributor
timestamp: November 26, 2024, 10:13:24 pm
content: This saved another APC from the scrap, Thanks you did all the hard work for me. I had another project going on so a small order of some STM chips made sense for a few bucks and boom there you have it. shot in the dark repair hahaha

author: CoopedUp
author_rank: Regular Contributor
timestamp: November 26, 2024, 10:29:39 pm
content: Here is the Firmware or whatever it is considered for a BX1500M

author: carlitos287@hotmail.com
author_rank: Newbie
timestamp: December 02, 2024, 05:53:26 am
content: I would like to know how i could change the charging voltage, so that i can raise it up to 14.4v/14.6v. I replaced the batteries on my BR1500G but batteries only gets charged up to about 50% and i only get 50% usable power out of them.....i replaced my SLAs with LiFePO4 batteries. I also want to connect an external 12v 100ah battery do that i can stay charged for a while when power outages happen here in venezuela.i am trying to find the "smart" communication on my BR1500G but to no avail.If anyone can confirm whether the smart communication protocol is available on the BR1500G, or maybe do i need to de-solder the resistor with a different value on thefeedback voltage divider as ChatGPT is telling me to do so..I got two BR1500G, and plan to use it and not waste them. Plus I think if we can use these with LiFePO4 batteries, we can have extra life ou of them.