UPS Hack

The UPS in object is a TRUST 750 VA (360W) model PW-4075T.

This hack started just for adding a fan blower. The article I wrote said:

My economical UPS dies every two years. Yep, the battery has to be changed but I noticed signs of overheating.
Adding a fan blower may help just a little bit. I removed two plugs and the telephone-surge-protection, opened a hole, and mounted a 60×60 fan blower.
Wiring is shown in photo, only one transistor and one 4k7 resistor to turn on the fan blower with the ups.

But then I saw a predisposition for serial port… some checks and it worked!

This is a hack onto shock hazardous circuits. 230VAC (300VDC) are present everywhere also when everything shut down.

Also, keep in mind that low voltage control circuits are actually connected to Mains circuits.

Do not connect Oscilloscopes to main-powered circuits. Isolate them, and connect a safety ground wire.

This hack is not 100% safe

Note. Fan wires ARE actually connected to MAINS.

Note. Opto-isolators separate RS-232 circuits (SAFE) from ups ttl circuits (NOT SAFE, connected to MAINS).

Initially it did'nt work. This is what I got.

Yellow is the rs232 (from pc to ups). Green is ttl (from pc to ups).

The cause is a capacitor. Two ways: (1) use a TTL/CMOS circuit instead of “pull-up” one. (2) remove that “worthless” cap. I preferred the latter.

It works with “network ups tools” (http://www.networkupstools.org/). The driver is called “blazer_ser”. Protocol used is “Megatec/Q1”. This is the info that NUT and the blazer_ser driver provide:

battery.charge: 77
battery.voltage: 12.40
battery.voltage.high: 13.00
battery.voltage.low: 10.40
battery.voltage.nominal: 12.0
device.type: ups
driver.name: blazer_ser
driver.parameter.pollinterval: 2
driver.parameter.port: /dev/ttyS0
driver.version: 2.6.4
driver.version.internal: 1.55
input.current.nominal: 2.0
input.frequency: 49.9
input.frequency.nominal: 50
input.voltage: 223.6
input.voltage.fault: 223.6
input.voltage.nominal: 230
output.voltage: 223.6
ups.beeper.status: enabled
ups.delay.shutdown: 30
ups.delay.start: 180
ups.load: 2
ups.status: OL
ups.temperature: 25.0
ups.type: offline / line interactive

Link is 2400 baud, 8n1

Standard status inquiry is achieved sending 3 ascii characters: “Q1” followed by CR (13). (others are tried by blazer_ser, but only this works)

UPS answers with this string:

(005.2 005.2 237.9 002 50.1 12.0 25.0 10001001

Comparing the string with the driver data, you can recognize the voltage 237.9, frequency 50.1, battery voltage 12.0 and temperature 25.0, then a series of boolean flags. Actually I don't know which of these data are reliable. Something could be not implemented, or badly implemented.

I don't know if other inquiry could be made to the UPS, in addition to “Q1”.

Blazer_ser is also capable of remotely shutdown the UPS (upsdrvctl shutdown). But if you do, you cannot turn it on again remotely. I did'nt see which characters are sent to do this.

I don't know if other commands could be sent to the UPS, in addition to the shutdown.

This is more likely a CISCO router related topic. However, I have connected the ups serial port to the router's AUX port and configured as modem inout.

Now I can inquiry UPS status remotely connecting to the Cisco. In the next step I'll try to forward the remoted session to a virtual serial port. This can be usually achieved with unix socat command but in my case the Cisco asks for login before relaying to the serial port.