Help with bricked APC UPS SMT1500 - Page 1
Forum section: electronics / repair

author: PeeJay
author_rank: Newbie
timestamp: February 20, 2024, 04:09:00 am
content: Hi, somehow I've managed to brick my UPS.Not the NMC but the actual ups. I've tried the serial cable firmware update tool but to no avail.I took the controller board out and discovered it's an STM32F103RC and they have very helpfully populated a SWD interface, so I dumped the ROM but the provided firmware file is not in a format I can figure out. (Both attached).Any ideas what to do next?

author: DavidAlfa
author_rank: Super Contributor
timestamp: February 20, 2024, 05:00:24 am
content: No idea if this is ok for that model:https://www.eevblog.com/forum/repair/repair-help-for-apc-ups-br1500g-f06-error/msg5074456/#msg5074456

author: darkspr1te
author_rank: Frequent Contributor
timestamp: February 20, 2024, 06:01:54 am
content: i dont see anything attacheddarkspr1te

author: DavidAlfa
author_rank: Super Contributor
timestamp: February 20, 2024, 07:56:29 am
content: Yes, almost at the end there's an hex file!

author: PeeJay
author_rank: Newbie
timestamp: February 20, 2024, 09:05:42 am
content: Sorry, the attachment didn't attach! It's on the first post now.

author: darkspr1te
author_rank: Frequent Contributor
timestamp: February 20, 2024, 09:29:00 am
content: file wont unpack, says un-supported 7z method,

author: PeeJay
author_rank: Newbie
timestamp: February 20, 2024, 09:45:40 am
content: hmm I've noticed winrar doesn't like those files. Here is a zip. (I hope!)

author: DavidAlfa
author_rank: Super Contributor
timestamp: February 20, 2024, 12:53:49 pm
content: Better don't attach it here unless proved working, it's for a different model and might induce confusion.

author: PeeJay
author_rank: Newbie
timestamp: February 22, 2024, 03:06:49 am
content: Ok, well for anyone who finds this post later here is the pinout:6 - Reset5 - Ground4 - PB3 / JTDO3 - PA14 - SWCLK2 - PA13 - SWDIO1 - VCCIt's the white connector in the photo.I'm toying with the idea of buying another unit of ebay and then selling it once I fix mine. Will post the firmware if I manage to get it.

author: asis
author_rank: Frequent Contributor
timestamp: February 22, 2024, 01:42:09 pm
content: Hi,ARM STM32F103_C4 (IC603) data exchange with the main MPU 89C51RC -UM (IC11) occurs through connectors J710B-J710B (pin3-TX, pin4 -RX).These buses (RS232) are also connected to the J606 pin3-TX technology connector; pin5 -RX.This is the only connector through which you can access SW or perform calibration (in the traditional sense).In this case, the module itself (PCB: 640-3081J-Z-001 _IMG_) must be removed.As far as I understand, APC (Schneider Electric) planned to use technology for managing and servicing UPS of this generation via the cloud and, probably, by for this reason it was created.ARM STM32F103_C4 (IC603) communicates with the control/display panel, NMC and RJ50-10 RTU.Moreover, the navigation buttons are controlled based on ADC (PB1 pin27) and resistors corresponding to the values of:-R200-604E “DOWN”;-R201-1.2k "UP";-R202-2.43k "ENTER";-R203-3.01k "Escape"All of them are connected to the midpoint of the divider made of resistors(R205-2k +5V) * (R203-3.01k GND).Pins PB10-pin29 (TX), PB11-pin30(RX) via IC601 (MAX3232) are connected to the RTU connector RJ50-10 pin2 (TX) and pin 8 (RX).Pins PA2-pin16 (TX), PA3-pin17(RX) - directly via connectors J702B/J702A (pin5-RX, pin6-TX) connected to connector J2 and via a cable to NMC (AP9630, AP9635 pin8/9 [SUMX v6. 4.6]).J602 JTAG - connector for programming the module and binding to a specific type of UPS.IC904 93LC66 can be read. Most likely it's MAC/WWN.SW update is carried out via NMC.Most likely you downloaded the wrong version.-You can find answers to many questions and the firmware you need on the forum:https://community.se.com/t5/forums/searchpage/tab/message?advanced=false&allow_punctuation=false&q=STM1500-I apologize for the boring description, there is no other way.

author: PeeJay
author_rank: Newbie
timestamp: February 22, 2024, 11:51:18 pm
content: Oh, so it's likely the 89C51RC/93LC66 with bad firmware then?It's strange that I get no response trying to communicate via the RTU port. I made a cable according tohttps://pinoutguide.com/UPS/apc_0625_cable_pinout.shtmlwhich matches what you wrote, I checked for continuity to the pcb pins as I was using a RJ45 connector. Perhaps I should have tried swapping tx/rx?I've since seen a few other posts from people who had timeout errors like me when trying to flash via the web interface on the NMC, but I'm not sure if any of them managed to resolve it.

author: NickPlays
author_rank: Newbie
timestamp: March 10, 2024, 12:13:22 am
content: Hi,Just bricked my smt1000i also during a firmware update.Luckily i got it for cheap so it isnt a huge loss but ill see what controlboard mine has.edit: Tried the exact same firmware version you did....Edit2: Mine has a 640-3081A_REV06 board. dont know if thats the main one.

author: asis
author_rank: Frequent Contributor
timestamp: March 10, 2024, 01:58:42 am
content: Hi,You can see everything written above at this link:

author: blueman2
author_rank: Newbie
timestamp: March 15, 2024, 05:42:02 pm
content: I also bricked my SMT1500 trying to update the UPS firmware.Some of the info in this thread is way over my head but still curios to know if you were successful in recovering the UPS?My control board appears to be 640-3081_REV03.My unit is a 2011 manufacture date so about time to retire it anyway but it would be nice to recover it.Bruce

author: asis
author_rank: Frequent Contributor
timestamp: March 15, 2024, 11:57:14 pm
content: Hi,Start with this:

author: AstroAU
author_rank: Contributor
timestamp: March 30, 2024, 08:17:08 am
content: Hi PeeJay,I'm also in the same boat with a Bricked SMT1500. BUT I have TWO working ones, one with ID17 and the other with ID18 chip for the main device. This latter one I picked up brand new back in the day and acquired my 3rd one from Ebay for $250.The Ebay one is also ID18 and unfortunately the one I bricked, as the original firmware for the sub board which was 9.2 and attempting to upgrade it to 15.0 is where it went awry.So down the path of scouring the internet I come across this forum and your posts.So it got me to thinking and sure enough my working UPS with ID18 has the same part number (640-3081A-REV006). But I needed to READ the EEPROM chip on the working one on the sub board you have displayed. The chip is an 8 pin SOP and marked 93LC66B1.This is a 4kbit EEPROM arranged in 256x16 configuration. After googling it and I found a programmer that supports 34,000 different chips on Ali-express (T48 programmer to be precise) with the right connectors etc.I subsequently took my working UPS off line and removed the sub board and read the EEPROM after some fiddling to get the clip to connect properly. So I have a BIN file with the contents (I'll attach later). BUT upon trying to program the chip on the board from the bricked UPS, I get the error message that the EEPROM failed to be written too. the reason for this is because it's "In Circuit" and I need other connections to my programmer for me to attempt to do it that way. (Currently on order).Also I noted while I had the bricked UPS disassembled. Their is another EEPROM on the main board near ID18 (AT89C51RC) Which is IC 303 and is an 93C56 chip which is a 2KBit chip (256x8) Which I have yet to read on my working UPS.So yeah a fun project to say the least and hopefully one that will have a good outcome.I have also ordered some 93LC66B1's and have the equipment to replace the onboard one if all else fails.Just change the extension from "HEX" to "BIN" and you'll be fine, Forum doesn't like BIN files

author: AstroAU
author_rank: Contributor
timestamp: April 09, 2024, 07:22:25 pm
content: Well after getting a programmer and then the correct accessories to do the job at hand.We discover that the chip (93LC66B1) holds only the serial number of the device and other configuration information.Having acquired 10 of these devices and reprogramming said device OFF the sub board as they won't program ON board.We powered up the UPS expecting LIFE to come back. But alas this wasn't the case.Delving further into the main board and observing those 6 pins. We are of the assumption that they are an ISP connector for programing said device and so forth. BUT we will need to investigate this further.Having bought an ISP programmer (Dirt cheap) we will see where this goes.I also have some AT89C51RC chips in the post which is a micro controller with 32KB of memory on board. Yes we have the DATA sheets on these too...This is an interesting project.Anyone else with updates to this issue. Anyone resolved it yet ??Also will do some more research. Gotta be information on the devices somewhere.

author: Fish_bonz
author_rank: Newbie
timestamp: April 12, 2024, 01:28:24 am
content: I've also recently bricked my SMT1500. It's also a 2011 model year with the same board 640-3081A_REV06 noted above. That said, I'm following this thread carefully to see if anyone can figure out how to get this working again. I'm of little help when it comes to circuit knowledge but not afraid to get my hands dirty either.In the interim, I had to break down and purchase another SMT1500 (2010 model) on the cheap. It's being shipped so not sure what rev board is on the 2010yr model. Don't know if they can be swapped if they are different either.What is disappointing is that APC should be reaching out and owning up to this bricking problem. They just shrug it off and state that you should not update or should call first. I'm obviously not the only one that has bricked the unit going from 9.04 ID18 to 15.0 ID18. They should probably pull that firmware to figure what's going on unless it's by design....I have other SMT750's that I had no issue with updating firmware. One dated from 2011 and another 2022.Peter

author: asis
author_rank: Frequent Contributor
timestamp: April 12, 2024, 12:06:54 pm
content: Hi,??? ҐS361030X7272 mSra-tPUS5100 MS1T05I0 FFFFFFFFFFFFFFBR7C FFFFFFFFFFFFFFOltteG orpu1 FFFFFFFFFFFFFFPU SuOltte s ?? FF??ґ?FF????FF???FFFFFFFFFeSvrreU SPFF====??? ҐXS6301032727 Smart-UPSS1500 SMT1500I FFFFFFFFFFFFFFRBC7 FFFFFFFFFFFFFFOutlet Group1 FFFFFFFFFFFFFFFPSU Outlet s ?? FF??ґ?FF????FF????FFFFFFFFServer UPS--IC904 93LC66 Most likely, this is a profile for the server for managing group outlets and time delays(Outlet Group 1) via the NMC card.Older models provide control of two groups of controlled sockets (Outlet Group 1 & Outlet Group 2).They can be activated via the control panel or via an NMC card.The SMT1500RMI2U is equipped with a PCB: 640-3081J-Z-001 1335BSAA15655138 and a relay RY901;(RY902), with the help of which a remote power reset is performed connected equipment.At the beginning of the dump there is the SN/production date (S361030X7272), device type, model, battery type, outlet group number and timing parameters.By rearranging the letters, you can match it with the S/N (XS6301032727) that you have on the UPS case.Remote control of group sockets via LAN/Internet can be similar to the Wake On LAN protocol.IC8 (LC93LC56) contains the UPS SN and calibration constants of the control controller IC11 (AT89C51RC).-IC303 is the reset circuit of the MC34064.

author: AstroAU
author_rank: Contributor
timestamp: April 12, 2024, 03:44:00 pm
content: Howdy all,I've done what Fish_bonz has done and that is Purchase another SMT1500i UPS from Ebay from the UK, which was 95 pounds and 88 pounds shipping, add sundry items to the purchase, convert to Australian Dollars and OUCH.Comes with NO batteries but is guaranteed working and by the looks original box too.Looking at the serial number of the unit, it'll be an ID18 setup. SO once I have that in hand (About 3 weeks away) I'll be able to disassemble this working unit (After testing) and remove the main Micro controller off of it (AT89C51RC)Then put a socket on the board for this device. Read the chip, program a new one. test that out in the unit. then if that repairs it then replace the chip on the other UPS and bring it back to life.Lots of if's and but's and possibilities.Ahh the joys of electronics, internet searching and lack of information...

author: AstroAU
author_rank: Contributor
timestamp: May 05, 2024, 06:57:57 pm
content: Just an update of sorts.UPS from the UK arrived, but it wasn't in an original box but some other thing which was a thin box, the unit had a thin layer of bubble wrap around it and the box was filled with packing peanuts UGH...The box was not in a good shape and upon inspection the UPS had been dropped and suffered damage to the left rear of the unit.Using my metal working skills we straightened the bend in the case.Inserting a new set of batteries that I'd ordered while waiting for the unit to arrive, building the battery pack with connector and fuse (100A) and subsequently powering it up all looked good.UPS firmware on the sub board was 8.8 and via USB we upgraded that to 15.0 and didn't brick this oneIt works fine BUT the display goes blank after several days of use. Inserting network card and checking it's configuration. The display is set to permanently ON. So it does have a fault.Going through Ebay to resolve this but that's another story.Anyway, The sub board with it's STM32F103RCT6 ARM processor, needs the right piece of hardware to read that. I've got the software for the reader / programmer from this site...https://stm32-st-link-utility.software.informer.com/and subsequently ordered also a STM32 reader/programmer that only costs a small amount from Aliexpress.the UPS IS ID18 so that's a plus. So once I've got that NEW reader on hand then we will read the contents of the sub boards ARM processor.This sub board is for some basic interfacing to the main UPS board as when I put the working board into the dead UPS, the alarm didn't go off, the display came to life BUT it couldn't control the UPS as it didn't see it.So once we get this sub board back to life it looks like we WILL need to pull off the AT89C51RC micro controller from the main board of working UPS. Put a socket on the board and read the data from the controller.Drop in the other controller from the dead UPS and reprogram that and put a socket on that board too and hopefully we will get them both working again.I do have 44 pin PLCC sockets on hand as well as 8 AT89C51RC micro controllers that came in the post.Will update in a while when I've got the DATA from the ARM Processor and micro controller for all to useLooked into the SMT18UPS_15-0.enc file and discovered the extension means it's encrypted and in all things it's a base 64 encryption, so good luck with thatSo yeah we did look into that as well with no joy.Photo's of the damage...

author: DavidAlfa
author_rank: Super Contributor
timestamp: May 05, 2024, 07:34:00 pm
content: .enc might be anything.

author: flaotte
author_rank: Contributor
timestamp: May 06, 2024, 01:39:58 pm
content: Quote from: AstroAU on May 05, 2024, 06:57:57 pmbase64 is just way to transfer binary data over text symbols.https://en.wikipedia.org/wiki/Base64there is no key for encryption, you can encode/decode it with any free tool.

author: AstroAU
author_rank: Contributor
timestamp: May 06, 2024, 03:20:48 pm
content: Ahh ok, will look into that further. Thanks flaotte

author: DavidAlfa
author_rank: Super Contributor
timestamp: May 06, 2024, 08:55:37 pm
content: Definitely not base 64!The tool is java-based, so much easier to reverse engineer.You can unpack LaunchFUW.exe with 7zip.Navigate to com\apc\microlink\fwtool.Open each class files with inRecaf.There's some interesting stuff:DESEncrypter.classCode:public class DESEncrypterimplements IEncrypter {private static final String kENCPREFIX = "SOELM";private static final String kENCSUFFIX = "EOELM";private static final String kKEY = "H25s@ase";public String doEncrypt(String plainText) throws InvalidKeyException, NoSuchAlgorithmException, InvalidKeySpecException, NoSuchPaddingException, IllegalBlockSizeException, BadPaddingException {byte[] keyBytes = kKEY.getBytes();DESKeySpec desKeySpec = new DESKeySpec(keyBytes);SecretKeyFactory secKeyFactory = SecretKeyFactory.getInstance("DES");SecretKey key = secKeyFactory.generateSecret(desKeySpec);Cipher cipher = Cipher.getInstance("DES/ECB/PKCS5Padding");cipher.init(1, key);byte[] textBytes = plainText.getBytes();String encryptedText = kENCPREFIX + this.byteToHexString(cipher.doFinal(textBytes)) + kENCSUFFIX;return encryptedText;}private String byteToHexString(byte[] byteBlock) {StringBuilder hexString = new StringBuilder();int i = 0;while (i < byteBlock.length) {byte b = byteBlock;String str = Integer.toHexString(b);if (str.length() > 2) {str = str.substring(str.length() - 2);}if (str.length() < 2) {str = "0" + str;}hexString.append(str);++i;}return hexString.toString().toUpperCase();}}FWToolConstants.classCode:public static final String kHashPassword = "o9aZNAPyYcxs86ysOpGUdg==";public static final String kSecretKey = "apcschneider@2021";UtilType.classCode:private static int deviceID = 0;String originalString = "apc@123";private static SecretKeySpec secretKey;private static byte[] key;VerifyFileCompatibility.classSome stuff going on here, too.VerifyFileCompatibility$FileHeader.classHere you can see the firmware file has a 128 byte header, might include a key, keep searching in other class files and you migh find out.Also there're some details about how to parse the file:Code:public void parseData(byte[] data) {this.version = data;this.command = data;byte[] size = new byte;System.arraycopy(data, 6, size, 0, 4);this.fileSize = this.unsignedBytesToInt(size);byte[] id = new byte;System.arraycopy(data, 12, id, 0, 2);this.deviceID = this.unsignedTwoByteArrayToInt(id);UtilType.setDevideId((int)this.deviceID);FWToolApp.theLogger.debugMsg("deviceID:" + this.deviceID);byte[] filecheck = new byte;System.arraycopy(data, 16, filecheck, 0, 2);this.fileChecksum = this.unsignedTwoByteArrayToInt(filecheck);this.index = data;this.fwversionStringSize = data;this.fwversionString = this.setValueFromByteArray(data, this.fwversionStringSize, 20);FWToolApp.theLogger.debugMsg("fw version String:" + this.fwversionString);this.byte64 = data;byte[] check = new byte;System.arraycopy(data, 126, check, 0, 2);this.headerChecksum = this.unsignedTwoByteArrayToInt(check);byte[] xmodemstring = new byte;System.arraycopy(data, 68, xmodemstring, 0, 33);this.stringToWaitfor = this.setValueFromByteArray(xmodemstring, 33, 0);if (this.stringToWaitfor.equals(Messages.getString((String)"VerifyFileCompatibility.45"))) {this.stringToWaitfor = null;}}Also:calculatefilechecksum,calculateheaderchecksum.

author: mark1975
author_rank: Newbie
timestamp: May 26, 2024, 10:45:08 am
content: Hey guys I have been scouring the net for some information about these shitty SMT series UPS getting bricked.I have two SMT1000 here which i bought and put new batteries in, I also ran the ID18 version 15 "Update", one using the NMS card, then the other one using a serial cable thinking that may work. Stupid mistake.I now have two bricked controller boards. I have removed one controller from a scrap SMT1500 and this appears to have bought one of the units back to life (although it is reporting that it is an SMT1500). It seems to work fine, and warns if the load gets close to 1000VA. Has anyone tried removing the 93LC66 and replacing it with another new programmed one? I am only guessing that this may be where the corruption is happening? I have contacted schneider, they wont sell me a spare PCB (Even though they have scrap units). I would be keen to get a copy of whatever the firmware is on this chip in an SMT1000, flash it into the 93LC66, solder it onto the pcb, and see if that works. APC should be made responsible for this failure of firmware upgrade. Judging by the tech i had on the phone, they know this is a problem.Would anyone have a .bin file of that chip out of a 1000VA version unit? I can do some testing and get back.Mark

author: AstroAU
author_rank: Contributor
timestamp: May 26, 2024, 01:22:39 pm
content: It is a very Basic EEPROM that only holds 512 bytes of data in a 16 bit format, so should be easy to look into the one I posted earlier.As for the contents of the ARM processor on the daughter board...WE acquired an STM8 / STM32 reader programmer from AliExpress with Dupont female to female connector cable and have read the contents of a working ARM processor.Referring to PeeJay's post back in Feb for the pinouts of the white JST connector that I'll repost below.Ok, well for anyone who finds this post later here is the pinout:6 - Reset5 - Ground4 - PB3 / JTDO3 - PA14 - SWCLK2 - PA13 - SWDIO1 - VCCIt's the white connector in the photo.The corresponding pins on the STM32 (ST-LINK V2) programmer are.1. RST (Reset)2. SWCLK4. SWDIO6. GND8. 3.3VJST connector - ST Link V2 connector6 - - - - - - 15 - - - - - - 64 - - - - - - NC3 - - - - - - 22 - - - - - - 41 - - - - - - 8The reader / programming tool needs to have it's address range changed from 1000H (HEX) to 40000H HEX or 4 kilobytes to 256 Kilobytes.As the ARM processor STM32F103 RCT6 is a 256KB EEprom device and also has other internal memory.I still need to REMOVE the AT89C51RC chip and read that from the good UPS. Unless I can read / program it from the technology connector (J606) that is on the main board as discussed above but were still researching that optionNow for the attachments, a couple of photo's showing the interconnect from the ST-Link V2 to the sub board of the UPSAlong with the subsequent 256KB file from the STM32F103 RCT6 ARM processor chip. NOTE: Rename the "HEX" file to "BIN" and you'll have the right extension for the programmer....Foot note: you can obtain the STM32F103 RCT6 IC's through EBay for about $4 each (Lot of 5 for about $22 AU)Likewise the AT89C51RC cost me $100 AU for 8 chips (Minimum order) from EBay as well.My 2nd board that I was playing with has developed a short that I cannot see so that's set me back a bit (Getting tools to inspect board)

author: DavidAlfa
author_rank: Super Contributor
timestamp: May 26, 2024, 02:47:22 pm
content: So what's this stm32 dump for? SMT1500? In working state?Please make this clear in your message to avoid mistakes.

author: AstroAU
author_rank: Contributor
timestamp: May 26, 2024, 05:54:30 pm
content: So what's this stm32 dump for? SMT1500? In working state?Please make this clear in your message to avoid mistakes.Sorry for the confusion.Yes this is a working dump from the daughter-board's STM32F103 RCT6 which has the latest firmware version 15 contained within it.This is from a working SMT1500i as needed.I did say in the text of my post...As for the contents of the ARM processor on the daughter board...WE acquired an STM8 / STM32 reader programmer from AliExpress with Dupont female to female connector cable and have READ the contents of a WORKING ARM PROCESSOR on this board.

author: DavidAlfa
author_rank: Super Contributor
timestamp: May 26, 2024, 07:06:59 pm
content: Sorry, but I re-read your entire post several times and found no reference to 1500 or whatever, and still nowhere to be found, so that's why I askedUploading unidentified binaries is a very bad idea, I suggest renaming that file to "APCUPSSTM32F103RC.hex_SMT1500i".Also, instead uploading raw binaries that could get corrupted, zip or 7z is a much better option.

author: AstroAU
author_rank: Contributor
timestamp: May 27, 2024, 04:44:11 am
content: DavidAlpha writes: Sorry, but I re-read your entire post several times and found no reference to 1500 or whatever.I wonder what the THREAD TITLE reads.... oh wait.... "Help with Bricked APC UPS SMT1500" I wonder what that's about....But yeah the file isn't really that large only 256KB and the attachment limit of the forum is 8MB per reply by the looks of the rules seen when adding attachments.So I just renamed the extension as the forum doesn't like BIN attachments.I'll reattach the file with a more descriptive name for you then. But you still need to change the .HEX to .BIN though.

author: DavidAlfa
author_rank: Super Contributor
timestamp: May 27, 2024, 05:55:58 am
content: But other models are mentioned in the thread too!I'm not idiot, but "stm32.bin" is not a good idea!

author: AstroAU
author_rank: Contributor
timestamp: May 27, 2024, 03:12:37 pm
content: Quote from: DavidAlfa on May 27, 2024, 05:55:58 amYeah good point, I was too focused on my bricked APC SMT1500i and presumed badly that others had the same issue with the same model.

author: mark1975
author_rank: Newbie
timestamp: May 28, 2024, 05:58:38 am
content: Thankyou AstroAU for this valuable information I will order one of these programers and have a go at getting these two failed boards going again.A bit more of an update - I took the 93LC66 off the dead SMT1000 board and replaced the one on the SMT1500 board, whacked it back in and now the UPS is showing its correct serial number and modelIt is quite possible the STM *MAY* have the same software on all models. I'm not sure.

author: m k
author_rank: Super Contributor
timestamp: May 28, 2024, 10:13:19 am
content: Since data seems to be 16 bits and so the small memory being for RBC7, maybe that is what defines the rest.It would also be much more practical than many complete software versions.

author: jeffrond
author_rank: Contributor
timestamp: September 21, 2024, 04:00:15 am
content: I know I am replying to an old post, but I just bricked a SMT1000RM2U.I have three of these and found the "daughter board" if you will. I found that swapping the dead board with another units good board allowed the UPS to function normally.Digging around on the internet I found this page. Seeing the posts from AstroAU, I was wondering about the chips and which one is causing the brick.Do you think it is the 93LC66 chip, or does that just hold model number, serial number and other data?Do you think it is the STM32F103 chip? That is the microcontroller. Could that be in a weird non-running state?

author: jeffrond
author_rank: Contributor
timestamp: September 21, 2024, 07:31:51 pm
content: Another interesting item. While running LaunchFUW and connected to the bricked UPS with the "good" daughter card installed, it says that I can update the firmware. This is odd since the most recent firmware is 15.0 and that is what is showing on the UPS when I look at the version. When I click on "more information", these versions show (1.jpg) UPS 15.0, MCU 11.0, UBL 08.5, MBL 11.0.Next, I put the daughter card into the good UPS and ran LaunchFUW. Again, it says to update the firmware. When I click on "more information", these versions show (2.jpg) UPS 15.0, MCU 19.0, UBL 08.5, MBL 19.0. Notice the MCU and the MBL. They are different versions.Do you think the different MCU version has something to do with it? Is the MCU version speaking to the code that is on the STM32F103 chip or a chip on the main board? Do these different MCU versions handle the firmware differently? Meaning can MCU version 19(good UPS) handle the firmware version 15, where MCU version 11(bad UPS) not handle the firmware version 15?Does anyone have any idea how the MCU and MBL are updated?Does anyone know what chip the MCU and MBL are located on?

author: tom_e
author_rank: Newbie
timestamp: September 26, 2024, 12:39:54 am
content: Hi,I dont beleive the 93LC66 is modified during update (has constants like model number, battery model string).MCU is probably the firmware for the 8051 which runs the inverter (it is on many other models, the PLCC chip). I know that UBL and UPS are the STM32, UBL being the bootloader, first few kb of flash, UPS being the main firmware (>100kb). It logically follows that MBL is then the bootloader for the MCU (as it always has the same version number), but im not 100% sure.I find it very interesting that you have different firmware versions being reported for MBL and MCU across the 2 models. I am assuming it is ID 18 as it let you update to 15.0 (all the more recent of those models are ID 18 afaik).The latest firmware image (SMT18UPS_15-0.enc) doesn't update the other 3 components anyway, for some reason, APC removed 2 of them (it only has UPS so MBL, UBL and MCU wont be updated). If you want to update them, an older version would need to be used which does include them.I recall updating to an older version which includes MCU 19.0 & UBL 08.5 (the file is significantly larger & the update takes longer). I should still have it, so pm me if you want to try it.What behaviour is the bad ups (MCU 11) it exhibiting when you turn it on (e.g. lights, beeper) ? I am assuming the serial port works so you can still update the firmware.Thanks,Tom.

author: jeffrond
author_rank: Contributor
timestamp: September 26, 2024, 09:58:17 pm
content: The bad UPS with the bad daughter board does nothing. The backlight of the display comes on, but nothing is shown on the display. No other lights. I cannot communicate with it via the serial port.When I put in the good daughter board, I CAN communicate via serial, and that is when I see the MCU version 11. I wonder if the MCU version 11 is incompatible with UPS version 15.Anyhow, if you have the update that includes the MCU version 19, I would be very interested in that.

author: AstroAU
author_rank: Contributor
timestamp: September 27, 2024, 06:46:05 pm
content: Quote from: jeffrond on September 26, 2024, 09:58:17 pmI had this issue with a daughter board as well and upon further investigation and using a multimeter, I checked the resistance across the supply rails and found it to be a dead short on the board.I put the meter across the 47UF capacitor (C606) and this read ZERO Ohms and beeped on the continuity tester.What I found was that the regulator chip (5500) the 8 pin SOP chip next to C612 had died. so we sourced some from the net, replaced it and then the board worked again. This chip takes the 5V supply and generates the 3.3v needed by the STM32.

author: JeffWDH
author_rank: Newbie
timestamp: October 01, 2024, 07:19:09 pm
content: I too attempted to update a APC SMT UPS to v15 and bricked it. In my case it was a Smart-UPS 3000.SKU: SMT3000RM2UManufacture Date: 11/28/2010Revision: ID18I can confirm that with a ST-LINK V2 and the STM32 ST-LINK Utility, along with the firmware dump of v15.0/pinout provided by AstroAU, I was able to restore use of the device. Great stuff! I had just replaced the batteries in this thing and thought I'd update the firmware as I thought APC may have tweaked the charge cutoffs to maybe help with longevity... Not sure about that but it almost snuffed the life out of it.Current firmware versions:UPS 15.0MCU 11.0UBL 08.5MBL 11.0Does anybody know if there are any benefits to trying to update the MCU or should I just be thankful I got this working again? I went down this path because I barely got 3 years out of my last set of batteries. Does the code contained on MCU have anything to do with charging?

author: jeffrond
author_rank: Contributor
timestamp: October 08, 2024, 02:36:55 am
content: SMT1000RM2U ID18Ugraded fromUPS 06.5MCU 11.0UBL 08.5MBL 11.0Upgraded toUPS 15.0MCU 11.0UBL 08.5MBL 11.0This bricked the UPS.I have another UPS that is already at UPS 15.0. This good UPS has MCU and MBL at 19.0.Testing the theory that if the MCU and MBL are upgraded to 19.0 that the UPS would work.Swapped bad daughter board with good daughter board from another UPS. I attempted to use a 940-0127E cable from APC which did not work. It shut the unit down when connected to the laptop. I have heard that the 940-0127E cable is not meant for the units that already have a USB port. I connected the USB port to the laptop and ran firmware upgrade wizard. I attempted to use firmware SMT18UPS_09-4.enc to downgrade the good daughter board from UPS 15.0 to UPS 09.4. It started ok, but I was just getting a lot of usb connect/disconnects sounds and the firmware update wizard is at 0%. I let it run for 2 days straight until it died. I assumed driver issues, so I installed ApcUpsUsbDriver.zip and pcss.zip(PowerChute Serial Shutdown). Again, I attempted firmware SMT18UPS_09-4.enc to downgrade the good daughter board from UPS 15.0 to UPS 09.4. It worked! In this process it upgraded the MCU and MBL to 19.0!UPS 09.4MCU 19.0UBL 08.5MBL 19.0I used the firmware SMT18UPS_15-0.enc to upgrade the good daughter board back to UPS 15.0 and I put the good daughter board back in the good UPS.I put the bad daughterboard back in the bricked UPS. It is still bricked and the USB connector will not speak to the UPS.I ordered a ST-Link clone and connected as below:JST connector - ST Link V2 connector6 - - - - - - 15 - - - - - - 64 - - - - - - NC3 - - - - - - 22 - - - - - - 41 - - - - - - 8Started the ST-Link Utility program and changed the size to 40000 and read the bad daughter board and the good daughter board.Editing the files with notepad++ showed obvoius differences.Flashed the good bin file to the bad daughter board. It works! The unit powers up and works! Serial number and all other information are still correct.I had another UPS that was at UPS 06.5. So to test, I upgraded to UPS 09.4. This worked great. I then upgraded to UPS 15.0. This also worked with no issues!Moral of the story? For SMT1000RM2U ID18, if you are upgrading to UPS 15.0, always upgrade to UPS 09.4 first.Major thank you to tom_e.We spoke over emails over many days and he was always ready to help. He helped walking me through serveral sticky wickets. He pushed me to try the ST-Link which revived my bricked unit. He helped with UPS 09.4 firmware. And he was totally correct in thinking that MCU and MBL had to be at version 19.0 before upgrading the UPS to version 15. Brilliant!Also thanks to AstroAU for the methodology and pictures and pinouts of the JST connector to ST-Link.I will post my file dumps here in case anyone is interested. The file "SMT1000RM2U-v15.0-STM32F103 good.bin" is the flash I used to revive my bricked UPS. The file "SMT1000RM2U-vxx.x-STM32F103 bad.bin" is from the bricked UPS. I put vxx.x since I am not totally sure if it is 06.5 or if it is really 15.0. I am unsure of the legality of posting firmware here, so I will not. But if anyone wants SMT18UPS_09-4.enc or SMT18UPS_15-0.enc or ApcUpsUsbDriver.zip or pcss.zip(PowerChute Serial Shutdown), let me know.

author: JeffWDH
author_rank: Newbie
timestamp: October 08, 2024, 01:28:42 pm
content: Thanks for posting your experience, jeffrond. I decided to risk it and try to downgrade to update the MCU/MBL:Firmware: SMT18UPS_09-6.encResulting MCU/MBL: 20.0Then updated to SMT18UPS_15-0.enc again and was successful.

author: tom_e
author_rank: Newbie
timestamp: October 09, 2024, 12:13:54 am
content: Great news that it is working successfully! Thank you very much for the updates!I think that what bricked the update was going from a too old version (if UBL is anything less than UBL 08.5) to UPS 15.0. It seems to load UPS 15.0 at the wrong memory offset (0x3000 instead of 0x7000) because of the smaller bootloader.Loading an older version first, as jeffrond and JeffWDH said, should fix this as it writes a newer bootloader to the device

author: JeffWDH
author_rank: Newbie
timestamp: October 23, 2024, 01:15:21 pm
content: For future reference I have compiled the steps I used to recover my device and some of the advice posted here.https://www.tarball.ca/posts/unbricking-an-apc-smt3000-ups-after-a-failed-firmware-update/

author: KrabKley
author_rank: Newbie
timestamp: November 12, 2024, 02:39:59 pm
content: I have SMT3000I and the same problem. I want to solve the problem with your advice, but the structure of vertical UPS is different. everything is on 1 board and there are no such connectors.There is a similar connector J602 and can someone tell me the pinout?

author: asis
author_rank: Frequent Contributor
timestamp: November 12, 2024, 07:12:07 pm
content: Hi,You can reflash via this connector (J602).Just check the pins match - indexing given by @AstroAU.6 - Reset - IC603 STM pin 75 - Ground - IC603 STM pin 12,18,31,47,634 - PB3 / JTDO - IC603 STM pin 553 - PA14 - SWCLK - IC603 STM pin 492 - PA13 - SWDIO - IC603 STM pin 461 - VCC - 3.3V

author: KrabKley
author_rank: Newbie
timestamp: November 12, 2024, 09:01:16 pm
content: I had to ring everything up and everything worked out. Thank you all very much. The SMT3000i is working again.I also want to say that it was very difficult to connect ST LINK St link ST-Link V2 because.1. Did not work with the USB extension cable.2. Connected directly to USB 2.0, it worked but with errors.3. Only after I plugged it into USB 3.0 did everything work perfectly!

author: mangup
author_rank: Newbie
timestamp: December 09, 2024, 02:35:32 pm
content: Hello everybody.I upgraded my ups SMT1000I, and after upgrade UPS is bridged. I use Jeffwdh reference and flashed via STlink bin from smt1500 - same board id18. Now display is live, but don't recognize that is powered on main plug and don't recognize that have battery. That is enough to not let me to start upgrade.I notice that MCU and MBL version is 0. Serial, usb, NMC work but can't do anything with UPS settings.I try to update via xmode , but I'm not sure I'm doing it right.Is there something that I can try ?

author: tom_e
author_rank: Newbie
timestamp: December 10, 2024, 02:43:05 pm
content: Hi mangup,It may have been bricked during 8051 (plcc chip) MCU upgrade (stage where the lights blink slowly). You need to reflash MCU but it is not possible as upgrade wizard will not let you, and I doubt it will work if the 8051 is corrupted because the bootloader is probably gone.Can you confirm MCU is dead by probing UART pin, if there is no activity it's probably bricked. The 8051 should be spamming characters back to main chip, and there should be a single character being spammed on rx (pin 11) so check tx (pin 13) to see if its dead. If the beeper is constantly buzzing or the transformer is humming loudly this also hints dead 8051.Also please confirm model of 8051 chip, e.g. 89C51RC2. If it is this chip you would need to flash it directly (it has some lock which you need to reset and original firmware cannot be recovered after this). You will need an existing copy of the firmware image as it's usually read protected.Hope this is helpful

author: AreYouLoco?
author_rank: Newbie
timestamp: December 20, 2024, 09:23:09 pm
content: Hi mangup,I am in the exact same brick situation as you. Mine is SMT750I. I am actually trying to dump the MCU from working unit that I also happen to own. But there is simple catch. MCU chip at least the one that I got is made in two versions low voltage (5V) and which unfortunately happened in my case (12V needed for programming it externally).I am waiting for PLCC44 adapter to put on top. The pins will be reversed like that but still should be able to communicate with that chip. I will wait for quess 2 weeks before all necessary parts arive. And will post a result and dump and instructions so You might recover yours. If it works at the end for me.

author: mangup
author_rank: Newbie
timestamp: December 23, 2024, 02:10:50 pm
content: I found what is problem.The problem with my UPS was that I had very bad contacts. I wouldn't even call it a cold solder. some of the chips fell off when touched. So my mcu fell off the main inverter board. as well as some transistors. Luckily everything was there and we managed to get it back. and we re soldered almost everything.UPS work for 5 day, and then just power off itself. No reaction on battery, just on AC power, but can not power. NMC work when UPS in on AC and don't see UPS.So I need, if some have, diagram/schematics of this ups SMT1000i/SMT1500i .Thank You.

author: tom_e
author_rank: Newbie
timestamp: December 24, 2024, 05:51:29 pm
content: Hi mangup,I had a similar issue with an older (~2009) smt750i.I spent ages trying to find the issue and it turned out a surface mount diode had just fallen off! Maybe APC had some qc issues on these early units?Double check to make sure no small components are missing. The schematics should be similar to the SUA 1000/1500 (I think its titled "red wolf apc") which are on the internet but I doubt you will find the exact schematic for your current model. Other than that I can't really help sorry.Also, AreYouLoco, I might have a backup of the 32k 8051 firmware but im not sure its from the right ID unit.

author: mangup
author_rank: Newbie
timestamp: December 26, 2024, 10:15:45 am
content: @tom_e thank you for information.

author: TheDeadGuy
author_rank: Newbie
timestamp: July 16, 2025, 11:50:12 pm
content: Sorry for kicking up an old thread.I have a bricked SMT1500i. It's got the ID17. This UPS seems to have an STM32F10* Medium density chip. Consisting of only 128KB of space. Have you by anychance got the firmware for this UPS? as you mentioned you had an ID17?Thanks

author: jeffrond
author_rank: Contributor
timestamp: July 17, 2025, 12:05:44 am
content: Do you think the 1500 firmware is the same as the 1000? I think I have the 1000 firmware somewhere.

author: TheDeadGuy
author_rank: Newbie
timestamp: July 19, 2025, 02:43:25 pm
content: It's not unfortunately. I have a smt1000i which i managed to update without issue but it has different firmware unfortunately. and in this forum thread, i found the smt1000i bin files and they didn't work.

author: TheDeadGuy
author_rank: Newbie
timestamp: July 20, 2025, 05:30:55 pm
content: Hi,Looked into this a bit further. if it's an ID17 smt1000 firmware. that would work/do the trick too. main thing i need it to be is the "ID17" as that seems to identify whether it's going to be the 128kb medium density or the 256kb high density st32.

author: TheDeadGuy
author_rank: Newbie
timestamp: August 31, 2025, 07:30:49 pm
content: Working (SMT1000 Super 4.5G) ID17 5.0 firmware for whoever this may help.Real extension of file is .bin. .hex is just a placeholder as per previous messages