====== UPS Hack ====== The UPS in object is a TRUST 750 VA (360W) model PW-4075T. This hack started just for adding a fan blower. The article I wrote said: > My economical UPS dies every two years. Yep, the battery has to be changed but I noticed signs of overheating. > Adding a fan blower may help just a little bit. I removed two plugs and the telephone-surge-protection, opened a hole, and mounted a 60x60 fan blower. > Wiring is shown in photo, only one transistor and one 4k7 resistor to turn on the fan blower with the ups. But then I saw a predisposition for serial port... some checks and it worked! ===== Warnings ===== This is a hack onto shock hazardous circuits. 230VAC (300VDC) are present everywhere also when everything shut down. Also, keep in mind that low voltage control circuits are actually connected to Mains circuits. Do not connect Oscilloscopes to main-powered circuits. Isolate them, and connect a safety ground wire. **This hack is not 100% safe** ===== Adding the Fan ===== {{:projects:smallhacks:img_0081.jpg?200|}} {{:projects:smallhacks:img_0082.jpg?200|}} {{:projects:smallhacks:img_0084.jpg?200|}} {{:projects:smallhacks:img_0085.jpg?200|}} {{:projects:smallhacks:detail.jpg?300|}} Note. Fan wires ARE actually connected to MAINS. ===== Adding the RS-232 interface ===== {{:projects:smallhacks:detail2.jpg?300|}} {{:projects:smallhacks:schema.png?500|}} {{:projects:smallhacks:img_0086.jpg?200|}} {{:projects:smallhacks:img_0088.jpg?200|}} {{:projects:smallhacks:img_0090.jpg?200|}} {{:projects:smallhacks:img_0091.jpg?200|}} Note. Opto-isolators separate RS-232 circuits (SAFE) from ups ttl circuits (NOT SAFE, connected to MAINS). ==== Solving a "problem" ==== Initially it did'nt work. This is what I got. {{:projects:smallhacks:merda.png?300|}} Yellow is the rs232 (from pc to ups). Green is ttl (from pc to ups). The cause is a capacitor. Two ways: (1) use a TTL/CMOS circuit instead of "pull-up" one. (2) remove that "worthless" cap. I preferred the latter. {{:projects:smallhacks:conddtl.jpg?300|}} ==== Communication Protocol ==== === NUT rulez === It works with "network ups tools" ([[http://www.networkupstools.org/]]). The driver is called "**blazer_ser**". Protocol used is "Megatec/Q1". This is the info that NUT and the blazer_ser driver provide: battery.charge: 77 battery.voltage: 12.40 battery.voltage.high: 13.00 battery.voltage.low: 10.40 battery.voltage.nominal: 12.0 device.type: ups driver.name: blazer_ser driver.parameter.pollinterval: 2 driver.parameter.port: /dev/ttyS0 driver.version: 2.6.4 driver.version.internal: 1.55 input.current.nominal: 2.0 input.frequency: 49.9 input.frequency.nominal: 50 input.voltage: 223.6 input.voltage.fault: 223.6 input.voltage.nominal: 230 output.voltage: 223.6 ups.beeper.status: enabled ups.delay.shutdown: 30 ups.delay.start: 180 ups.load: 2 ups.status: OL ups.temperature: 25.0 ups.type: offline / line interactive === Watching how the driver works (reversing protocol) === Link is 2400 baud, 8n1 Standard status inquiry is achieved sending 3 ascii characters: "Q1" followed by CR (13). (others are tried by blazer_ser, but only this works) UPS answers with this string: (005.2 005.2 237.9 002 50.1 12.0 25.0 10001001 Comparing the string with the driver data, you can recognize the voltage 237.9, frequency 50.1, battery voltage 12.0 and temperature 25.0, then a series of boolean flags. Actually I don't know which of these data are reliable. Something could be not implemented, or badly implemented. I don't know if other //inquiry// could be made to the UPS, in addition to "Q1". Blazer_ser is also capable of remotely shutdown the UPS (''upsdrvctl shutdown''). **But if you do, you cannot turn it on again remotely**. I did'nt see which characters are sent to do this. I don't know if other //commands// could be sent to the UPS, in addition to the shutdown. === I'm a stupid === **//Some day after//** Source code of NUT and its drivers, including blazer, is available at [[http://www.networkupstools.org/download.html|NUT download page]]. If you look in "blazer.c" and "blazer_ser.c" (in the drivers directory) you can understand how the protocol works. **Answer data fields** InputVoltage ; InputVoltageFault ; OutputVoltage ; UpsLoad ; InputFrequency ; BatteryVoltage ; UpsTemperature ; StatusBits **StatusBits field** bit if=1 if=0 0 utility fail (OB) online (OL) 1 battery low (LB) battery good 2 bypass/boost active normal 4 offline/interactive online 5 test in progress normal 7 beeper on beeper off ===== Final hack ===== This is more likely a CISCO router related topic. However, I have connected the ups serial port to the router's AUX port and configured as ''modem inout''. Now I can inquiry UPS status remotely connecting to the Cisco through a telnet session. A small script in python has been written to keep the telnet connection alive and inquiry UPS status every 10 seconds. If there are problems a mail is sent.