APC Back-UPS 1500 erratic behavior

[budm]

Re: APC Back-UPS 1500 erratic behavior

http://batteryuniversity.com/learn/a...internal_short
So much info!

[budm]

Re: APC Back-UPS 1500 erratic behavior

Battery University would be incomplete without this CAR AND DEEP CYCLE BATTERY FAQ 2018.

But sadly no cigar - meaning no Smart UPS for $5 deal.

Just search 'deep cycle'
http://batteryuniversity.com/learn/a...ased_batteries

[sambul83]

Re: APC Back-UPS 1500 erratic behavior

Battery University would be incomplete without this CAR AND DEEP CYCLE BATTERY FAQ 2018.

But sadly no cigar - meaning no Smart UPS for $5 deal.

[Curious.George]

Re: APC Back-UPS 1500 erratic behavior

Would measuring a battery Cell internal resistance give a hint whether it has short internal cells? If yes, how to measure it in a meaningful way?

If you could measure a cell's internal resistance, the short (separator failure) would be apparent. But, if you could access a cell, individually, you would also see this short as 0V potential across the cell (just like if you ran a wire from the + to - terminals and then tried to note the voltage between those SHORTED terminals).

The problem with most batteries is that you can't access the "ends" of each cell but, rather, just the ends of the STRING of cells (which is what makes it a battery).

If you are curious and already have a defective battery (for whatever reason -- including NON shorted cells), you can CAREFULLY remove some of the plastic material on the top of the battery to expose the connections between cells. (you can similarly "open" the cell's vent and access the electrolyte directly)

But, this is just a learning experience and not an effective way to service SLA's (if you fail to seal properly it when done, you risk it venting hydrogen gas into the environment -- think: fire/explosion)

BMSs for large batteries (battery being multiple cells) actively watch each cell (or, sometimes pairs of cells) to track the health of the battery, ensure even charging, etc. But, those batteries are designed with access to individual cells in mind and the value of the battery is typically considerable (think: electric car).

[budm]

Re: APC Back-UPS 1500 erratic behavior

Would measuring a battery Cell internal resistance give a hint whether it has short internal cells? If yes, how to measure it in a meaningful way?

http://batteryuniversity.com/learn/a...nal_resistance

There are so much info on this website that I gave in the earlier thread, just a matter of spending time reading and studying them.

[sambul83]

Re: APC Back-UPS 1500 erratic behavior

https://blog.schneider-electric.com/...ups-batteries/

Would measuring a battery Cell internal resistance give a hint whether it has short internal cells? If yes, how to measure it in a meaningful way?

[Curious.George]

Re: APC Back-UPS 1500 erratic behavior

Was able to install libusb-k driver for the Back-UPS, but NUT says "device is not responding to messages". Other driver types don't install in Win 10. Were you more successful in running NUT in Windows with APC Back-UPS devices?

Sorry, I guess I wasn't clear enough in my earlier comment re: FOSS.

I don't run FOSS software "products" under Windows -- because they have been disappointing, there.

And, as I have *BSD boxes, here, its so much easier for me to run them under *BSD -- more in line with where/how they were initially developed. It also lets me poke at the code if I find something that isn't working properly (instead of waiting for someone else to do that and make their results "available")

But, by moving to network access for my UPSs (one of the reasons for "upgrading"), the likes of nut and apcupsd become largely irrelevant. Many of the superficial things that those programs can do are made available in the user (web) interface that the network card makes possible.

The UPS that you seem to have is a problem as there is no NMC (network management card) option available for it. So, you're stuck with PowerChute (or whatever third-party software you can find).

[budm]

Re: APC Back-UPS 1500 erratic behavior

https://blog.schneider-electric.com/...ups-batteries/

[sambul83]

Re: APC Back-UPS 1500 erratic behavior

Was able to install libusb-k driver for the Back-UPS, but NUT says "device is not responding to messages". Other driver types don't install in Win 10. Were you more successful in running NUT in Windows with APC Back-UPS devices?

[Curious.George]

Re: APC Back-UPS 1500 erratic behavior

Not likely. Different APC design teams or divisions do different UPS models, hence varying design choice, but cutting production costs requires standardized solutions.

Actually, that is really only the case for low volume production. When your quantities get high enough, there's very little recurring cost penalty for many "trivial" design decisions. We often joke that you're paying for the plastic, not what it encapsulates (the "chips", etc.) Notice how many different products APC has in its offerings -- each plastic part needs to be injection molded (hard tooling for large molds costs tens of thousands of dollars, per mold); each metal chassis needs to be fabricated; each different battery size/shape needs to be warehoused; etc. Yet, this is all (apparently) an acceptable cost of their doing business!

There is always a reason for each design decision especially like this with a non-standard cable, since its all discussed as the project progresses and approved by management.

Of course! But the criteria that they consider important to driving the decision may appear to be completely arbitrary to an outsider or "rational thought". I've been "directed" to use certain components in a design simply because they overbought them for a previous (unsuccessful) design and wanted a way to "use them up" (so upper management wouldn't inquire as to the reason for all this "stale stock" that is being carried on the books).

I'd say, they needed more contact points namely for Serial control, hence used Ethernet connector, as in this model there're no other exposed service connectors, and diag & update with case open is very time consuming and may damage case parts.

Note the three pin RxD/TxD serial interface on the NMC that I mentioned. It's a smaller connector so easier to accommodate on a wider range of applications/products. It's easier to "plug correctly" -- no polarized key to accommodate or large rectangular shell to align with its mating receptacle (esp when reaching BEHIND a UPS that already is tethered to multiple devices).

Initial firmware install can take place before the case is even "applied". You don't need to open the case to do an update (see post upthread). And, diagnostics can't be very detailed when limited to an "external viewpoint" -- esp on a "power device" such as this (where, chances are, you have current carrying devices that may have failed). If there's only one "module" in the case, then there is limited value to those sorts of diagnostics (contrast this with a TV that you could pinpoint a failure to a particular board/FRU).

Increasingly, designs are moving to "no maintenance" implementations: make the high dollar items that are unlikely to have failed (or, have some significant recycle value) easy to extract from the product; then "discard" the rest. The only folks I know who regularly repair kit are high-end medical equipment, process control systems (which are increasingly moving to smaller "modules" mounted on DIN rails for ease of design/assembly/replacement-at-module-level) and very low quantity "unique" products.

Or, allow the "often replaced components" (software!) to be handled automatically (dial home) or handled using the consumer's labor!

Figure a $100 item costs less than $25 to make (DM+DL). How much effort do you put into "recovering" that $25? Notice the disposable inkjet printers where all of the electronics ($$value) can be removed just by unsnapping a panel at the rear (and discard the mechanism!)

I can't think of anything I've designed in the past decade that had "serviceability" as a design goal -- though all had manufacturability very high on the list (so, any hooks for testing were really only intended for use on the assembly line -- hence the reason you see unpopulated serial ports that mysteriously "work" even in production units).

There's more recycle value in the batteries (even depleted) than any other part of the UPS -- and they are easy to access! A UPS can be purchased for ~$5, here, regardless of size/features/capacity (I "upgrade" my UPSs by swapping them for newer/better units of equivalent weight; there's a SmartUPS 1500 going out the door tomorrow with this in mind -- I'm trying to standardize on 48V units even if similar capacity)

They may also wanted to sell unique overpriced cables, like Apple did in the past. There might be LCD Service GUI mode too, as you mentioned.

Note that they might not even be viewing it as "overpriced" but, rather, reflective of the design of their profit centers. How much does it cost to process an order? How much do you "burden" the price of an item with the warehouse space required to store it prior to sale?

Likewise, marketing plays a role: how many people really want to talk to their UPS? Should you penalize those who don't want to with the cost of facilitating that for those who do? Of those who want to talk to it, are they likely to have more than one UPS? And, if so, aren't they likely to already have such a cable?

Why have a separate interface for the "serial console" vs. the "data port"?
(see above list for some examples)

Why not put an ethernet connection on each UPS? MCUs with onboard NICs are relatively common. And, not much more expensive than those without. TCP/IP stacks are commodity items so its not like you have to invest to develop yet another one for "this product". Connector is the same 8P8C we've been discussing, already (probably cheaper than a DB9!). All the serial port user interface software can sit behind a virtual serial port and be accessed via TELNET/SSH...

Yet, they keep pushing the network connectivity to an optional NMC (as a $150 add-on). Wouldn't this be a big value-adder for all units instead of just the ones that folks wanting network connectivity want??

APC just doesn't leak their tools to the community.

Sadly, very few firms do. There's little incentive to do so and a significant downside: you're disclosing IP to competitors. And, needlessly formalizing an interface that you may later want to change (without risking hearing "users" bitch that the interface HAS changed and they now have to adapt "for no good reason"). Plus, its one more thing you have to "support" with your users ("I tried to do <this> and it didn't work...")

I tried installing NUT port in Windows, and figure out how it works with various UPS brands.

I use these types of "products" as reference books, not as "implementations" to actually use. I.e., I grep(1) through the sources to see what they say about the object that I'm really interested in (e.g., the UPS interface). I see what they have discovered and use that information in my own solution -- or, in a diagnosis of a particular problem I am encountering.

For example, that's how I "discovered" the "capability list" command in the APCs (I'd previously known that the command "did something" but never invested the time to figure out what)!

Its pain-in-the-ss to install, and it varies with NUT releases and hooked UPS models, while install and runtime errors are frequent. Will see if I've time to sort them out, and what controls it may expose beyond trivial info collection.

Welcome to the FOSS world! "Free" is often very expensive, in practice!

In the defense of FOSS "programmers", its really hard to interface to something where you don't know the consequences of every action that your software might initiate. "How long should I wait for an acknowledgement of this command? If I don't get one, should I try it, again? Or, will that actually be seen as second command? (maybe the response to the first got lost or arrived coincident with my issuing the second!)"

And, most "programmers" aren't well equipped to anticipate the sorts of things that can go wrong in other systems -- esp if those systems have to deal with real world things (including human beings! -- ever been to a web site where you have to fill in your name before you can fill in your address? or, tried to fill in your "deductions" before specifying your "income"?)

Windows "ports" of most FOSS tools seem to be the worst. I don't know if that is a consequence of the Windows environment or just that the ports weren't created with that sort of portability in mind. (I don't code for Windows). You might have more luck installing a *BSD or Linux port and tinkering with that. At the very least, it makes it a lot easier to alter the software (vs. setting up a Windows development environment).

Ahhhh... box of goodies just dropped off! I'll have to see what new toys I've inherited

[sambul83]

Re: APC Back-UPS 1500 erratic behavior

it could just be they use whatever the hell they want and aren't bothered by "standards".

Not likely. Different APC design teams or divisions do different UPS models, hence varying design choice, but cutting production costs requires standardized solutions. There is always a reason for each design decision especially like this with a non-standard cable, since its all discussed as the project progresses and approved by management. I'd say, they needed more contact points namely for Serial control, hence used Ethernet connector, as in this model there're no other exposed service connectors, and diag & update with case open is very time consuming and may damage case parts. They may also wanted to sell unique overpriced cables, like Apple did in the past. There might be LCD Service GUI mode too, as you mentioned.

APC just doesn't leak their tools to the community. I tried installing NUT port in Windows, and figure out how it works with various UPS brands. Its pain-in-the-ss to install, and it varies with NUT releases and hooked UPS models, while install and runtime errors are frequent. Will see if I've time to sort them out, and what controls it may expose beyond trivial info collection.

[Curious.George]

Re: APC Back-UPS 1500 erratic behavior

The question is, why would APC go to such length to make special cables for this hybrid instead of putting an ordinary USB port on their units? The answer may be, while the board doesn't carry a network chip, same "Ethernet" port given a larger number of contacts can be used for both USB and Serial signals. Unless someone offers a different plausible explanation, it sounds like APC flashes UPS firmware through that port and does in-depth device diagnostics with in-house software.

Their UPS products are all over the map in terms of what types of connectors they use and how they are pinned-out. From what I have on hand (and easily accessible):

BackUPS XS 1500 LCD  RJ45 USB
BackUPS RS 1500 LCD  RJ45 USB
SmartUPS RT 2200   RJ45 USB, DB9 serial
SmartUPS 1500     USB B, DB9 serial
SmartUPS 750     USB B, RJ45 USB?
SmartUPS X 1000    RJ45 serial, USB B

The same holds true of EPO and environmental sensor connectors. E.g., the AP9619 uses a miniDIN connector (like PS2 keyboard) for the temperature and humidity sensor connections -- but, a removable barrier strip for the contact closure sensors. OTOH, the AP9631 uses RJ45s for all of these (and allows each connector to be used for either purpose).

The AP9631 also implements its own serial console (in addition to the serial port on the UPS!) -- but, using a 2.5mm phone plug (RxD/TxD/GND).

So, it could just be they use whatever the hell they want and aren't bothered by "standards".

[Note that they also have their own oddball ways of initializing their network cards, resetting default passwords, etc.]

[Curious.George]

Re: APC Back-UPS 1500 erratic behavior

Most likely there's a serial port on the board.

I've never looked closely enough to be able to comment. APCC offers lots of different products (models) but, I suspect, they are all very closely derived designs (beef up the FETs for higher load currents, etc.). This suggests that the control software may be very similar, hence my pointing out the "god mode" details, up thread -- present on SmartUPS and possibly hiding inside BackUPS as well.

No 3rd party software can control the Back-UPS through its USB port the way it does through a serial port.

Have you looked at NUT?

The Back-UPS still has microprocessor and EEPROM - correct? So its likely target charging voltages or currents are set in firmware, and can be changed to some degree. Firmware itself is loaded via Serial port, unless APC has a tool to load it via the hybrid port, whatever they call USB or Ethernet connector wired to USB standard.

Firmware updates are accomplished in a variety of ways: via the serial port (XMODEM), via the network interface, etc. As to how the original firmware is installed at the factory, that can be done in a variety of ways -- including buying the MCUs from their supplier preprogrammed (to eliminate that labor and testing/verification -- of the programmed MCU!).

Note, also, that not all (APC) firmware is field-updateable.

[sambul83]

Re: APC Back-UPS 1500 erratic behavior

It's not really an "ethernet" cable but, rather, an 8P8C/RJ45 connector.

The question is, why would APC go to such length to make special cables for this hybrid instead of putting an ordinary USB port on their units? The answer may be, while the board doesn't carry a network chip, same "Ethernet" port given a larger number of contacts can be used for both USB and Serial signals. Unless someone offers a different plausible explanation, it sounds like APC flashes UPS firmware through that port and does in-depth device diagnostics with in-house software.

[sambul83]

Re: APC Back-UPS 1500 erratic behavior

see if there are any "internal" serial port connections hidden just for manufacturing use...

Most likely there's a serial port on the board. Will leave Float Voltage Calibration for another try. I couldn't find hints about it on the web. No 3rd party software can control the Back-UPS through its USB port the way it does through a serial port. The Back-UPS still has microprocessor and EEPROM - correct? So its likely target charging voltages or currents are set in firmware, and can be changed to some degree. Firmware itself is loaded via Serial port, unless APC has a tool to load it via the hybrid port, whatever they call USB or Ethernet connector wired to USB standard.

If one battery has 14V and connected to another battery (6V) in series, so when you measure the total Voltages (not connected to the UPS) it should then show around 20V with no load.
When I indicate loading the battery during test it meas you connect the 12V battery to the load resistor while having the DC Volt meter connected.

The UPS couldn't charge the pack with 2 batteries at 6V each. Then I read, to prevent high current UPS charging circuit in contrast with car battery charger can't start unless the pack shows 70%+ of nominal voltage. So I hooked each 6V battery to 14V battery, and UPS started to charge. While not recommended, the alternative was to seek specific 2A standalone charger, as charging current was said not to exceed 10-20% of battery capacity.

I measured voltage on both detached from UPS charged batteries at 100W load, and it shows 14.1 and 14.3, while without load 14.6 and 14.9. One battery hooked inside UPS to the red wire gets warmer than the other. If I change their sequence, the other battery hooked to the red wire gets warmer. Not sure what it means, since they're connected in series?

Charging with a Power Supply article mentions "high self-discharge (soft electrical short) can prevent the battery from reaching the low saturation level". I wonder whether something similar happen causing to discharge batteries to 6V, when a brand new pack got overcharged to 30.9V in the UPS? May be the UPS triggered such discharge, or the batteries are now made smarter? Hopefully, they seems to have recovered now.

[Curious.George]

Re: APC Back-UPS 1500 erratic behavior

Thanks for sharing. The charger voltage is obviously even higher, and can be measured with device disassembly, which is a bit odd given large sturdy but easily damaged clips on the front and top plastic panels, or by using a charger adapter I don't have at the moment.

You can "see" the charging voltage by monitoring the terminals that would normally connect to the battery and increasing the battery pack's apparent impedance (so the battery doesn't "load down" the charger). Or, by impressing a voltage from a lab supply, behind a resistance, and gradually increasing the output until the charging current drops to 0. By doing this, you're effectively simulating a battery at various levels of charge.

[Some UPSs disconnect the charging current if they don't sense a battery's presence. So, you may have to impress a nominal ~24VDC potential (behind maybe 100 ohms?) to get the UPS to supply charging voltage.]

The battery leads on all UPSs are really short -- to limit voltage drops in the wiring (some UPSs add a third "sense" wire so they can see the voltage AT the battery terminals despite the current load on the pack). But, if you flip the UPS onto its side, you can usually access the leads (note that you aren't powering a load at this time so you don't need the battery in the way!)

Can someone share practical experience in charger voltage calibration in APC Back-UPS BX1500 LCD? It comes with APC USB-to-Ethernet cable ( AP9827 ) control cable.

It's not really an "ethernet" cable but, rather, an 8P8C/RJ45 connector. While this has the same physical characteristics of an "ethernet connector", thinking of it as such leads folks to try stupi^H^H^H silly things -- like plugging it into a network jack!

I don't think the Back-UPS line of products offers any hooks for "programming" beyond the general options presented in the powerchute interface (e.g., selecting self-test frequency).

My notes for my SmartUPS units effectively say:

• Use the "UPC" widget; a 9pin serial cable will shut down the UPS!
• Configure tip session for 2400 8N1
• Send 'Y'
• Expect "SM" ("Smart Mode"?)
• Send '1'
• Pause >1 second
• Send '1'
• Expect "PROG" ("PROGramming mode"?)
• Send 'L' ("Line voltage scale factor"?)
• Expect <current value>
• Send 'o' ("Output voltage scale factor"?
• Expect <current value>
• Send 'B' ("Battery voltage scale factor"?)
• Expect <current value>
• Send 'P' ("Power scale factor"?)
• Expect <current value>
• ...
• Send 'R' ("Return"? "Ready"??)
• Expect "BYE"

Once a parameter has been selected:

• Send '+'
• Expect next higher value
• Send '-'
• Expect next lower value

until the next parameter selection or the session is concluded

But, I'm not sure any of this will work on the BackUPS devices. (And, if the USB port on those appears as a serial port or something else)

Note, also, that I've not tried any of these in a TELNET session (which could, in theory, support them on NMC-equipped units!)

I've also not tried poking around on the PCBs to see if there are any "internal" serial port connections hidden just for manufacturing use...

[sambul83]

Re: APC Back-UPS 1500 erratic behavior

Thanks for sharing. The charger voltage is obviously even higher, and can be measured with device disassembly, which is a bit odd given large sturdy but easily damaged clips on the front and top plastic panels, or by using a charger adapter I don't have at the moment. Can someone share practical experience in charger voltage calibration in APC Back-UPS BX1500 LCD? It comes with APC USB-to-Ethernet cable ( AP9827 ) control cable. Found some remotely relevant hints here, with APCUPSD being the control package.

[Curious.George]

Re: APC Back-UPS 1500 erratic behavior

My DMM voltage readings are reasonably accurate based on long time observations and compare.

OK. It was a possible explanation for the discrepancy, hence my reason for mentioning it (having no idea as to the equipment to which you have access)

I had to entirely remove the old pack, since that UPS model requires a different battery arrangement, and its charging contacts are not accessible until the pack is removed.

OK. So, you're not seeing the voltage impressed by the charger but, rather, the open circuit voltage of the battery pack.

In the future, you might want to apply a temporary load to the battery pack (after removal) just to drain off any surface charge to get a better indication of the actual voltage on the pack.

[I usually remove one of the leads from the DMM and momentarily shorting it to the opposite battery post -- drawing a brief arc (don't do this with vented cells!) Then, plug the test lead back into the DMM to see the "new" voltage; if it has changed, I need to understand the magnitude of the change (this shouldn't have significantly affected the state of charge in the pack so I don't expect to see big changes! If I do, I immediately question the quality of the pack]

APC PowerChute package doesn't allow to keep detail log, I may need to use a 3rd party soft for that, since I do need to maintain also power interruptions history. What Windows package would you suggest?

Sorry, I can't help you, there -- I don't use that software. My UPSs have network management cards installed so I talk to them via WWW/TELNET/FTP interfaces. They, in turn, talk to my servers via email, syslog and FTP) As a result, only the server that receives their data needs to be powered up (24/7/365) -- though the UPSs will queue up messages for later delivery, if that server is down when the need arises.

+I suspect such overcharging to 30V+ may be the actual reason for the brand new pack to drop the charge to 6V. I wonder if it might do it without actual cells damage due to bad insulation btw cells.

Batteries (in general) don't like to be overcharged. When encountered by "wet cells" (like in your car) the overcharging causes the cells to out-gas (hydrogen) which can be compensated by "adding water".

Sealed/geled batteries are more sensitive, in this regard.

[Note that one way to prolong the life of wet cells (like in legacy "emergency lighting" units) is to reduce the specific gravity of the electrolyte in the cells.]

You can't really do much to the battery to alleviate this problem. So, your only remedy is to make the charging circuit "friendlier". Ideally, the charger wants to have smarts -- to know what it has done (recently) to better decide what it should be doing, now! And, (ideally) to track the state of charge in the battery pack (by monitoring demand -- "coloumb counting") so it has a general idea as to how much charge needs to be dumped back into it. This also gives an indication as to the health of the battery (if you took out X but had to cram 5X back into it to get to the same state of charge, something is obviously wrong!)

[QUOTE]Programmed overcharging likely aims to accelerate battery wear and sales.[/QUOTE}

Really? Now why would a company THAT MAKES A LOT OF MONEY SELLING OVERPRICED/rebranded BATTERIES do something like that??

OTOH, there are cost issues. And, reliability issues as well: you'd probably be pissed if the power flickered AGAIN before the battery was GENTLY recharged to normal capacity and the UPS quit on you "quickly" (cuz the battery wasn't topped off soon enough)

Can I do anything to block overcharging, may be by adjusting some board components? Surprisingly both new batteries seems recovered for now. I still need to check again under direct load.

You can search for remedies for your particular model UPS. Some have settings that can be tweeked (via a hidden "god mode" interface). Others may have component values that folks have discovered you can tweek. YMMV.

The other thing you should ask yourself is what you are expecting from the UPS. E.g., the UPS on this PC and the internet router will keep me running for a few HOURS in the absence of power. Likewise for the UPS on my primary TV. Because I may be in the middle of something that I can't just "save" (e.g., a broadcast TV presentation; a lengthy download; etc.). By contrast, I may be willing to live with 30 minutes of uptime on a workstation: if I'm using it, at the time, I can calmly bring my work session to a close (without feeling panicked); if I'm away from my desk... <shrug>

On other devices, I may be willing to live with "1 second protection" (often, the public utility switches the distribution lines at odd hours of the day and this manifests as all of the UPSs flipping into bypass mode for just a second or two -- before the switching transient subsides)

Note, also, that you can often add external battery packs to a UPS (within reason). Even in an ad hoc fashion (I have several 300WHr expansion packs for my UPSs, here)

Dealing with batteries is more art than science. There are lots of factors that influence how a battery performs (e.g., charging it at 25C is different than charging it at 35C -- and, its the battery's notion of temperature, not the human sitting next to the UPS!!). You have to decide where your comfort level ($ vs peace-of-mind) lies.

[sambul83]

Re: APC Back-UPS 1500 erratic behavior

Did you measure this with the batteries still connected to the UPS?

It is not uncommon for UPS's to overcharge their battery packs.

My DMM voltage readings are reasonably accurate based on long time observations and compare. I had to entirely remove the old pack, since that UPS model requires a different battery arrangement, and its charging contacts are not accessible until the pack is removed. APC PowerChute package doesn't allow to keep detail log, I may need to use a 3rd party soft for that, since I do need to maintain also power interruptions history. What Windows package would you suggest?

I suspect such overcharging to 30V+ may be the actual reason for the brand new pack to drop the charge to 6V. I wonder if it might do it without actual cells damage due to bad insulation btw cells. Programmed overcharging likely aims to accelerate battery wear and sales. Can I do anything to block overcharging, may be by adjusting some board components? Surprisingly both new batteries seems recovered for now. I still need to check again under direct load.

[Curious.George]

Re: APC Back-UPS 1500 erratic behavior

They were at 6V each yesterday. By today they slowly recharged by the UPS to 14V+ each, and the pack seems to hold the charge for now. I realize, both may have some short cells despite charging OK.

No. A shorted cell will definitely lower the open-circuit potential of the battery.

The battery (by definition, a group of cells) consists of a string of ~2.4V cells wired in series (different battery chemistries have different cell voltages). Put 6 of these together and you have a nominal "12V battery" - which may measure as high as 14.4VDC. Short a cell and you now have only five 2.4V cells -- 12.0V (you won't see anything higher unless the measurement circuit effectively has a "higher" impedance in it)

Of course, when a cell starts to lose charge, its voltage falls (though not as much as you'd expect -- for a good battery!)