resolvido APC Smart-UPS 3000XL, 640-0800G - bouncing between online and on battery

[Ivo Andonov]

A friend asked me to have a look at the device. No commercial interest.

 

Working fine on batteries. When on standby (output off) it is charging the batteries. The problem? When online (plugged in) it is constantly switching between online and on batteries. Really constantly - half a second online, half a second offline etc... I changed the sensitivity - was High, set it to Medium - problem disappeared. The last transfer reason indicates "T" - due to a notch/spike. The grid in the region is nearly perfect. Scope showed it as well while the UPS was bouncing back and forth between online/offline. Another Smart-UPS 2200 is working fine in the same socket at high sensitivity.

 

Well, while it works on Medium and Low sensitivity the engineering mind could not let me leave it like this without finding the reason and confirming it is not repairable.

 

Long story short - the R127 resistor was way off its indended value. Some 140k+ instead of the 7.15k nominal. Thus the SINE-REF signal was barely seen by the summer. Replaced it with a 7.5k one and the device is back in business. (as a side note: seems that APC chose some quite funny values for many of the resistors. I can only speculate why not some standard ones) 

 

So why am I posting when I have no actual problem? Well, it is all about sharing my findings. During the process of debugging I learned quite a lot and what I have learned is not currently available online (and I searched a lot... correct me if I am wrong). And it might have been probably a bit more helfpul if I had a schematic, but I do not have the points to download it from here. And it seems like "here" is the only place where it is present.

 

So what I have learned:
- turning off High sensitivity effectively eliminates the AC-OUT1 + SINE-REF => TURBO signal by turning off the EX0 interrupt generation in the CPU. And the EX0 interrupt handler seems like the only place in the firmware that sets the "T" reason for transfer;
While there are is lot of information about the hardware internals of these series of UPS-es, there does not seem to be information (any?) about the software workings. So here are some of my findings.
- the program execution is fully synchronized with the line frequency. When offline, a fixed 50Hz or 60Hz (EEPROM configurable) line frequency is generated. When online, a software PLL synchronizes the synthetic and actual line frequencies;
- the program is actually split into 16 steps that get executed during the full line period. Hence at 60Hz each step is executed more frequently than at 50Hz;
- four of the steps handle the input line voltage (same procedure). They are called equally spaced in time so as to sample the same points in the sine wave. Sensitivity also plays here by checking the difference between two successive odd or even samples. Threshold dependant on H, M, L setting. Thresholds are hard coded in the 8051 firmware, not configurable in the EEPROM;
- one of the steps handles EEPROM requests (reading and writing);
- one of the steps handles serial communication - one byte processed per line period;
- SINE-REF is generated using the PWM. It is approximated using eight 8-bit points per half-period;
- Most (all?) EEPROM values can be programmed;
- Battery multiply (BTMUL) constant is at EEPROM address 0x00);
- Battery reading for the terminal is caluclated as the battery ADC value (BADC, 0..255) is multiplied by the BTMUL (16 bit result), high byte taken and multiplied by 27 (for the 48V battery version) - printed as a fixed decimal point number with two decimal. So with a battery constant of 0xE9 (233), an ADC reading of 193 the reading of the battery voltage will be int(233 * 193 / 256) * 27 = 4725, 47.25 displayed;
- EEPROM address 0x01 is the input voltage multiply constant;
- EEPROM address 0x02 is the device configuration value. Bit 5 is the battery version - 1 for 48V, 0 for 24V; Bits 1:0 are the voltage/frequency setting. 0 - 240V/60Hz, 1 - do not know, as the device in question goes into output overload, 2 - 230V/50Hz, 3 - 210V/60Hz.
When in PROG mode:
- Ctrl+B allows for changing EEPROM address 0x02;
- Ctrl+W will print in hex EEPROM 0x02, 0x01 and 0x00 (in this order). After that it accepts "=" and an input for most (all) of the usable EEPROM values. The first three values are input as HH DDDD DDDD. No spaces; HH for 0x02 configuration value (hexadecimal digits, lowercase a-f), DDDD - current input voltage, DDDD - current battery voltage. Then are input HH values for addresses 0x0A, 0x0C, 0x0B, 0x03. Next follow the values for addresses 0x1B till 0x40 inclusive in RAW ASCII CODES;
- The clear (z) command will only clear (set to 0x00) EEPROM values from 0x11 to 0x1A.

 

That is it for now. Let me know if anyone needs more information that might happen to be helpful.