open‑UPS

Modular user-populated 18650 UPS
with mains inverter output
Output range 37 W → 1,500 W
Runtime at max 6.5 h @ 1.5 kW
Rev / status A · Phase 0 done

Two PCB designs, each built once for the maximum configuration. Users scale power and runtime by populating fewer cells — no jumpers, no BOM variants, no firmware rebuild. The shippable product contains no lithium at all.

Corrected since the approved plan

The moderate derating stack was stated as 0.6117. That was the product of only four factors — it dropped the 0.96 parallel-group-mismatch term. The correct value is 0.5871, which moves the maximum build from 16 modules to 17 (1,768 cells, 19.09 kWh — still under the NFPA 855 line). Every dependent figure on this page has been recomputed. The conservative and salvaged stacks were unaffected.

The silkscreen population map also changed: the bottom face is 6 · 2 · 4 · 8, not 8 / 4 / 2 / 6. See §02.

01

System block diagram

Colour carries meaning throughout this document: SELV — touch safe for everything a user can reach, hazardous — mains referenced for everything behind the isolation barrier. The barrier exists in exactly one place, and only two things cross it: the DAB transformer and the digital isolator.

SELV — TOUCH SAFE, ≤60 V HAZARDOUS — MAINS REFERENCED REINFORCED ISOLATION · 8 mm CREEPAGE CELL MODULES 1 to 17 · one PCB design M1 · 13S1P–8P · BQ76952 M2 · 13S1P–8P · BQ76952 M17 · 13S1P–8P · BQ76952 104 holders, 4×13, both faces 48 V BUS 33–60 V 43.5 A max DUAL ACTIVE BRIDGE bidirectional, 1.7 kW 2-phase interleaved 33–60 V ↔ 400 V · 100 kHz charge + discharge HF XFMR triple-insulated 400 V DC LINK 2 × 220 µF 500 V, 105 °C sized by 100 Hz ripple 400 V dc H-BRIDGE + LC rated 2.2 kW, run 1.5 kW 4 × 650 V superjunction unipolar SPWM 20 kHz K2 N–PE bond in inverter mode AC IN 90–265 V K1 BYPASS break-before-make AC OUT 230 V / 50 Hz pass-through when mains healthy pure sine, <3 % THD PFC BOOST UCC28180 — analog, no MCU charges link & pack STM32G474 HRTIM ×12 = DAB 8 + bridge 4 CORDIC sine reference P_max = min(1.5 kW, N × 2.86 W) foldback, not trip phase shift DIGITAL ISOLATOR isolated gate drive CAN — auto-discover cell count, IR, SoC, temps HARDWARE PROTECTION comparators → driver /EN latches with MCU in reset
One bidirectional converter serves both directions — the DAB charges the pack from the DC link and discharges it back. That is what lets v1 ship line-interactive (K1 passes mains through) and become true online double-conversion later in firmware alone, with no board respin. The PFC is analog so all twelve HRTIM channels stay free for the DAB and bridge, avoiding a second MCU.
02

How one PCB spans 37 W to 1.5 kW

Your scaling requirement turned out to already be latent in the derating work. The 0.3 C per-cell current limit — 0.9 A for a 3.0 Ah cell — collapses into a single constant, and everything else follows from it automatically.

1 populated cell = 2.86 W of deliverable AC power

0.9 A × 3.6 V × 0.884 chain efficiency. Firmware computes P_max = min(1500 W, N_cells × 2.86 W) and applies it as foldback. Populate more cells, get more power and more runtime. Populate fewer, get less of both — safely, with no hardware change.

Reading “13S1P–8P”

Standard battery-pack notation: S = cells in series, P = cells in parallel. 13S means 13 cells wired in series, which sets the voltage — 13 × 3.6 V = 46.8 V nominal. 1P–8P means between 1 and 8 cells wired in parallel at each of those 13 series positions, which sets capacity and current. So the notation describes a range: from 13 cells (13S1P) to 104 (13S8P).

ONE MODULE AT 13S4P — 52 CELLS 4P G1 G7 G13 13 groups in series — sets voltage, 39–54.6 V parallel count sets capacity and current
Thinning every column from 4P to 2P halves the capacity and leaves the voltage untouched. Emptying one whole column breaks the series string and the module is dead — which is why the constraint below is on P, never on S.
ConfigCellsVoltageCapacity / groupUsablePmax
13S1P1339–54.6 V3 Ah82 Wh37 W
13S4P52unchanged12 Ah330 Wh149 W
13S8P104unchanged24 Ah659 Wh298 W

Voltage never moves; energy and power scale 8×. S is locked at 13 deliberately — the DAB is built for 33–60 V, and going above 60 V would make an array that users reach into to swap cells no longer touch-safe. All the scaling therefore happens in P.

Two knobs

Coarse: number of modules, 1 to 16. They parallel on the 48 V bus and the master auto-discovers them over CAN. Fine: cells per module, 13S1P to 13S8P.

Hard constraint

All 13 series groups must stay populated — you cannot remove a group without breaking the string. You reduce the parallel count uniformly. Mixed P within one module is a hard fault: the smaller groups get current-hogged and over-discharged. Firmware detects it by group internal resistance and refuses to enable the module.

The silkscreen population map

Every holder carries a silkscreen digit 1–8. The instruction to the user is one sentence: “fill every holder numbered ≤ N.” Row ordering is chosen so every fill level stays symmetric front-to-back and centred on the board — which matters for balance on a 4.9 kg PCB and for even thermal distribution.

MODULE TOP FACE — 52 HOLDER POSITIONS — SHOWN AT FILL LEVEL N = 4 row 7 row 3 row 1 row 5 7777777777777 5555555555555 3333333333333 1111111111111 G1 G7 G13 13 series groups — every group must be populated
Rows are numbered 7 / 3 / 1 / 5 top to bottom rather than 1–4, and the bottom face carries 6 / 2 / 4 / 8. With four rows you cannot centre a three-row fill — it is always offset by half a row — so the two faces are ordered to offset in opposite directions and cancel. “Fill all ≤ 4” gives two rows per face: exactly 4P, uniform across all 13 groups, balanced on both axes.

Guided population — the sorting bay

Every module carries one extra holder, isolated from the 13 series groups, with 4-wire Kelvin contacts, a load FET for a ~1 A / 100 ms internal-resistance pulse, an NTC for temperature compensation, and a single-cell charger. Drop a candidate cell in, and the module measures it and lights the LED of the group it belongs in.

It trims in both directions. The load FET bleeds a cell down to the group's level; the charger brings one up. Either is about 4 minutes for 0.10 V at 2 A. That is what makes the maintenance case work — adding or replacing a cell in a module already installed and partly discharged, where the group will sit well below 4.2 V.

Measurements are only comparable between cells at the same state of charge, and on NMC the open-circuit voltage curve is nearly flat from 20–80 % SoC. So the sequence is ordered, and the order matters:

charge / bleed → DISCONNECT charger → rest ≥45 min → measure OCV + IR → place

The charger must be electrically removed before the Kelvin measurement — its output capacitance corrupts the IR pulse. The rest is not optional either: surface charge decays over ~45 minutes and a cell measured early reads high. It is also why the bay is for single-cell work rather than bulk — 2.6 h per cell including rest is 193 days for a full build. Building a module starts with bulk parallel pre-charge instead, where cells on one bus self-equalise and the whole batch reaches a common reference in ~5.5 days unattended.

Why this is a safety feature, not a convenience

Inserting a mismatched cell into a partially-filled group is a real event. A 4.2 V cell dropped into a group sitting at 3.0 V equalises through roughly 63 mΩ of loop resistance:

I = 1.2 V / 0.063 Ω  ≈  19 A, sustained for minutes as ~0.6 Ah moves across

— through contacts the design otherwise runs at 0.9 A continuous. The per-holder fuse is the backstop, not the plan.

The clever part is that almost none of this is new hardware. The BQ76952 already measures all 13 group voltages continuously, so the module already knows every group's state. The bay only has to characterise the candidate — after that, “which group does this belong in” is a subtraction. It also flips the firmware from rejecting a bad configuration to preventing one.

MeasurementTimeMethod
Open-circuit voltage~10 msKelvin-sensed ADC read — the safety-critical one
Internal resistance~2 sLoad FET pulse, temperature-compensated (IR drifts ~2 %/°C)
CapacityhoursNot possible in a bay — needs a full charge/discharge cycle. Bench testing stays necessary for salvaged cells.

Indication is 13 LEDs on the module plus a single readout display on the power board. An LCD per module was rejected as the primary indicator: “place this in G7” makes you count columns on a 300 × 420 mm board, and miscounting is the exact error the feature exists to prevent. LEDs cost ~$1 against ~$8 and are unambiguous. Cost: ~$4.10 per module, ~$12 once for the display.

Configuration table

ModulesCellsNameplateUsable at EOL PmaxRuntime @ 1.5 kWRuntime @ 500 W
1 × 8P1041.12 kWh659 Wh298 W
22082.25 kWh1,319 Wh596 W2.3 h
33123.37 kWh1,978 Wh894 W3.4 h
44164.49 kWh2,638 Wh1,191 W4.5 h
55205.62 kWh3,297 Wh1,489 W5.7 h
66246.74 kWh3,956 Wh1,500 W2.3 h6.8 h
88328.99 kWh5,275 Wh1,500 W3.1 h9.0 h
121,24813.48 kWh7,913 Wh1,500 W4.6 h13.3 h
161,66417.97 kWh10,550 Wh1,500 W6.1 h17.6 h
171,76819.09 kWh11,210 Wh1,500 W6.5 h18.6 h

Your 500 W / 6 h case

A 6-module build — 624 cells, 6.8 h at 500 W. About a third of the hardware and a third of the cells, same two PCBs, same firmware image. It also happens to be exactly where full 1.5 kW power becomes available.

Two invariants worth documenting

Below 6 modules, power and capacity scale together, so runtime at rated power is always ~1.9 h. At 6 modules the system reaches full 1.5 kW — modules 7–17 buy runtime only. The invariant softens at 1P, where fixed auxiliary draw is a quarter of the load.

Within-module fill levels, and what the design must do to support scaling
Fill levelCells / moduleUsablePmax
1P1382 Wh37 W
2P26165 Wh74 W
4P52330 Wh149 W
6P78495 Wh223 W
8P104659 Wh298 W

Minimum viable system: one module at 1P — 13 cells, 37 W, ~1.5 h. A working desktop UPS. Maximum: 17 modules at 8P — 1,768 cells, 1,500 W, 6.5 h. Same two PCBs across a 40× power range and a 137× energy range.

  1. Module current is bounded at 7.2 A (8P × 0.9 A) regardless of module count, because per-cell current always binds first. Size module FETs and traces for 7.2 A continuous / 15 A transient — easier than a fixed-power design, where a lone module would have to carry everything.
  2. The 48 V bus, busbars and connectors are built for the full 43.5 A regardless of population.
  3. DAB input range widened to 33–60 V. At 1P a module’s pack impedance is 8× higher, so loaded voltage sags further. The current limit bounds the sag, but the converter must not drop out.
  4. The power board takes a dynamic limit over CAN and current-limits by foldback, not tripping, with a user-visible reason: “limited to 595 W: 208 cells populated”.
  5. Aux rails must come up from a single module. Pre-charge must work from 1 module up to 16.
  6. Reported capacity and runtime over USB HID track the actual population, never the maximum. A UPS that lies about its runtime is worse than one with less runtime.
  7. Surge scales too: 3 × Pmax, capped at 3 kW — within the 1.0 C surge rule.
  8. Configuration is verified two independent ways: measured per-group internal resistance (1P ≈ 40 mΩ, 8P ≈ 5 mΩ) cross-checked against a user-declared config. Never infer silently from a noisy measurement when the consequence is over-current on a small pack.
03

Derating basis

An auditable chain rather than a safety factor sprinkled on at the end — and the source of the 2.86 W constant above.

Energy chain, backwards from the load

Required AC energy 1,500 W × 6 h = 9,000 Wh ÷ inverter η 0.95 ÷ DAB η 0.95 ÷ BMS/wiring η 0.98 chain η = 0.884 → 10,181 Wh dc from pack + aux (16 × BMS, MCUs, drivers, fans) 25 W × 6 h = 150 Wh → 10,331 Wh dc required

Capacity derating stack

FactorModerate (chosen)ConservativeRationale
Usable depth of discharge0.850.803.0–4.1 V/cell, not 2.5–4.2 — buys cycle life
End-of-life SoH0.850.80Spec holds at EOL, not only when new
Low-temperature capacity0.920.900–10 °C garage / outdoor worst case
Cell grade (locally sourced, unknown brand)0.920.90Nameplate optimism
Parallel-group mismatch0.960.95Weakest group limits the string
Product0.58710.49251 cell = 6.34 Wh usable at EOL
Nameplate required17,598 Wh20,977 Wh

Chosen maximum is 17 modules = 1,768 cells = 19.09 kWh nameplate, giving 11,210 Wh usable against 10,331 Wh required — 8.5 % margin.

Two constraints meet exactly at 17, which is why the number looks arbitrary and is not. From below: 16 modules leaves only 2.1 % margin — too thin, given that the 0.884 chain efficiency it depends on is still an unvalidated target. From above: 18 modules is 20.22 kWh, over the NFPA 855 threshold. 17 is the only count that satisfies both.

Component derating rules applied throughout
DomainRuleResult
Cell continuous current≤ 0.3 CGoverns Pmax at every population level
Cell surge (≤ 2 s)≤ 1.0 CSurge = 3 × Pmax, capped at 3 kW
Holder contact current≤ 40 % of measured rating0.9 A worst case vs ~5 A — 5.5× margin
MOSFET VDS≤ 80 % of rating650 V on 400 V = 62 % · 100 V on 60 V = 60 %
MOSFET ID≤ 50 % at TcaseSize for 2× continuous
Junction temperature≤ 110 °C at 40 °C ambientvs 150 °C rating
Electrolytics≤ 80 % Vrated, 105 °C, ≤ 70 % ripple400 V bus needs 500 V caps, not 450 V (450 V = 89 %)
MagneticsΔB ≤ 0.15 T, ΔT ≤ 40 KETD44 / planar
PCB tracesIPC-2152 at 20 °C rise, × 1.52 oz outer and inner
Inverter stageRate for 2.2 kW, run at 1.5 kW68 % loading

Because the 0.3 C rule binds at every population level, per-cell current never exceeds 0.9 A. The stainless-steel holder-contact resistance concern — which would dominate a small, hard-worked pack — stays bounded across the entire 40× power range. The derating rule and the scaling requirement protect each other.

04

Three things to decide before I draw anything

A literal single PCB is physically impossible

1,768 cells × 1,784 mm² per holder = 1.58 m² per face, a board roughly 1.26 × 1.26 m carrying ~110 kg. JLCPCB’s 4-layer maximum is 1016 × 596 mm — about 2.6× too small, and the largest option available anywhere at sane cost.

Resolution: one module PCB design replicated up to 17×, plus one power board. Both built once for the maximum. I did evaluate a 3-board system on near-maximum panels, but each board would carry 32 kg of cells, oversize panelisation costs several times more per m², and — decisively — the minimum configuration would be 678 cells. Your scaling requirement actively favours smaller modules.

At maximum configuration this is legally a stationary ESS

Regulatory

NFPA 855 applies above 20 kWh aggregate; residential limits are 20 kWh per unit, 40 kWh in a closet, 80 kWh in a garage or outdoors. The 2026 edition removed the thresholds that let you skip a Hazard Mitigation Analysis. UL 9540 / 9540A large-scale fire testing is normally expected — and a user-populated system can never obtain it.

This is why section 03 uses the moderate stack rather than the conservative one: the full build lands at 19.09 kWh, deliberately under the line. The conservative stack needs 19 modules (21.34 kWh) and crosses it, and an 18th module would take even the moderate build to 20.22 kWh.

Depopulation is also a code feature. A 6-module build is 6.7 kWh — nowhere near any threshold. Most users will never approach the regulatory line; only the maximum build does. The docs should carry a configuration-versus-code table so people can choose a build that stays out of scope entirely.

The economics invert against LiFePO₄ at the top configuration

Holders and PCB area are per-cell costs. The same ~18 kWh in LFP prismatic cells at $60–80/kWh is ~20 cells and ~$1,260, with no holders and one small BMS board — roughly $2,180 all-in, about 4.6× cheaper, with ~6× the cycle life and lower runaway risk.

The 18650 route wins in three cases, and the README should say so plainly: where cells are near-free (scrapyard laptop packs run ~$0.30/cell after testing); where LFP genuinely isn’t available locally; and — newly relevant given your scaling requirement — at small configurations, where LFP’s 280 Ah minimum cell size is absurdly coarse. A 149 W / 344 Wh build is natural with 18650s and impossible with prismatics.

Because the BQ76952 covers both chemistries and the bus spec is 33–60 V, an LFP module variant remains a cheap future addition on the same power board.

05

Phases

Each phase ends with a gate. No PCB starts until the previous gate passes. Roughly 14 months for a competent power-electronics engineer.

#DeliverableTimeGate
0Spec, safety case, HMA outline, architecture, legal opinion, fab quotes, DAB simulation across 33–60 V4–5 wkSafety case reviewed; legal position understood; turns ratio proven across the full range
1Holder test coupon — 100 × 100 mm, 4 holders (2/side), 3 variants, fuses, 4-wire Kelvin points2 wk
~$50
Contact resistance and ΔT measured cold and after 50 insertion cycles; bottom-side holder survives reflow #2
2Module board rev A — 13S8P, BMS, per-holder fusing, CAN, combining FETs, pre-charge, population silkscreen, sorting bay~10 wkCorrect at 1P, 4P and 8P; qualification catches bad cells and non-uniform P; bay resolves IR to ±5 % and steers population correctly; controlled single-cell propagation test
3Multi-module bring-up — 4 modules, deliberately mixed fill levels~4 wkHot-plug without arcing; no circulating current; clean fault isolation; Pmax recomputes on topology change
4Power board rev A — PFC + DAB + 2.2 kW H-bridge, bench supply into a load bank~16 wk1.5 kW continuous, THD < 3 %, η ≥ 88 %, transfer < 8 ms, stable at 33 V and 60 V input
5Full system integration — cabinet, 16 modules + power board~10 wkLogged 6.5 h @ 1.5 kW on 17 modules and logged 6.8 h @ 500 W on 6 modules — both cases you named
6Enclosure, fire mitigation, firmware hardening, docs, sourcing and population guides, pre-compliance, release~14 wkSomeone who isn’t you can build one from the repo, at any configuration

Phase 1 is front-loaded and deliberately cheap because it retires the two risks unique to this construction: real holder contact resistance, and whether a heavy bottom-side holder survives the second reflow. Both are measurable for $50 before anything expensive is committed.

06

Cost

The scaling requirement changes the cost story fundamentally: entry cost is now ~$1,100, not ~$10,000.

Per module, fully populated (8P)

PCB 300 × 420 mm, 4L 2 oz$32
104 × SMD 18650 holder$114
104 × cell fuse$16
BQ76952 + FETs + balance + protector$26
Sorting bay + 13 group LEDs$4
Bay charger + disconnect FET + uprated 5 V rail$2.50
STM32G0 + isolated CAN + NTCs$16
Combining FETs + pre-charge$10
Assembly + test$32
Module, no cells$252.50

Shared, built once

Power board — PFC + DAB + inverter, relays, heatsinks, IEC, display$532
Cabinet / shelf — scales with modules$60–600

The power board is identical at every configuration. It simply receives a lower power limit over CAN.

ConfigurationBoardsCells Cells @ $3 newCells @ $0.50 salvaged Total, newTotal, salvaged
1 module, 4P — 149 W, 2 h$84552$156$26~$1,001~$871
1 module, 8P — 298 W, 2 h$845104$312$52~$1,157~$897
6 modules — 1.5 kW, 500 W for 6.8 h$2,347624$1,872$312~$4,219~$2,659
17 modules — 1.5 kW, 6.5 h$5,4251,768$5,304$884~$10,729~$6,309

Worked in INR — the India case

Board cost is fixed and known; cell cost is local and variable. Figures below use ₹95.75/USD (spot, 19 Aug 2026) and Indian market cell prices, both verified rather than assumed.

Verification reversed this section’s conclusion

A first pass assumed ₹88/USD and ₹100 per cell, and concluded that cells are only 27 % of the cost so sourcing barely matters. Both inputs were wrong. The rate is ₹95.75, and ₹100 buys a salvaged cell — new 3000 mAh 18650s retail in India at ₹300–700. At those prices cells become 50–67 % of the build, and the conclusion inverts.

BuildBoards + cabinet @ ₹100 salvaged@ ₹300 new budget@ ₹600 new quality
1 module @ 8P — 298 W₹80,861₹91,261₹112,061₹143,261
6 modules — full 1.5 kW₹224,725₹287,125₹411,925₹599,125
12 modules₹384,149₹508,949₹758,549₹1,132,949
17 modules — 1.5 kW, 6.5 h₹519,396₹696,196₹1,049,796₹1,580,196

The economics only work on salvaged cells

A 17-module build on new quality cells costs ₹1.58 million against ₹223,000 for the tubular lead-acid setup it replaces — a factor of seven, which is not a trade-off, it is a non-starter. On reclaimed cells it is ₹696,000: still 3.1×, but at least in the same conversation. E-waste reclamation is not a nice-to-have for this project in India — it is the only sourcing route where the design makes economic sense at all.

The cost that isn’t money

Qualifying salvaged cells means a full charge plus a measured discharge — roughly 10 hours per cell, parallelised only by how many analyser bays you own. This is the longest single task in the project and it is almost never stated in build logs.

BuildCells4-bay analyser8-bay16-bay
1 module10411 days5 days3 days
6 modules — full 1.5 kW62465 days32 days16 days
12 modules1,248130 days65 days33 days
17 modules — 6.5 h1,768184 days92 days46 days

Start at 6 modules

It reaches the full 1.5 kW and costs about a month of bench time. The 17-module build is three months of testing before you switch anything on.

New cells buy two months back

They arrive factory-matched, so the capacity test is unnecessary entirely. That is a real offset to their 3–6× price, and it was under-weighted in the first pass of this analysis.

The sorting bay does not shorten this. It makes placement instant and safe; it does not make qualification faster. Nothing does, short of more analyser bays.

Holders are 45.2 % of a module

₹10,916 of every ₹24,177 module is plastic holders — more than the PCB, BMS, MCU and assembly combined. A $0.40 holder that passes Phase 1 is worth ₹118,500 on a full build. This finding survived verification.

The power board sets a floor

₹50,939 lands on every system regardless of size. A 1-module build pays ₹80,861 in boards to hold ₹10,400 of cells. Below ~4 modules this architecture is not economic — the right answer at that scale is a different, smaller design.

Budget for salvage yield

Reclaimed packs return 60–80 % usable cells. A 1,768-cell build means testing ~2,400. If you are buying salvage by the cell rather than reclaiming your own, add ~35 % to the cell figures above.

Phase 1 is now the cost gate too

It was scheduled to answer a technical question — contact resistance over insertion cycles. It is also the highest-leverage cost experiment in the project. Same $50 board.

The structural problem with India specifically

Against a 1.5 kVA inverter and 13 × 150 Ah tubular lead-acid — ~11.7 kWh usable for about ₹223,000, verified against current Luminous and Exide retail — open-UPS at its best is 3.1× the upfront cost. It wins on weight (110 kg against 780 kg), zero maintenance, per-cell repairability, and an open design nobody can discontinue. It does not win on price.

The founding argument is that shipping lithium across borders is expensive. An Indian buyer sourcing cells locally never pays that cost — so the advantage this entire design is built around does not apply. India is the project's least favourable market. open-UPS is most compelling where cells are hard or expensive to import and cheap lead-acid is not already ubiquitous. Where it wins here is turning scrap into storage, which lead-acid cannot do at any price.

Full working, sources, and the levers that would move the number: docs/cost-model.md. The ₹95.75/USD rate is a single point of adjustment — change it there and every figure rescales.

07

Top risks

RiskSeverityRetired by
Thermal runaway propagating across up to 1,768 cells of unknown provenanceCriticalPhase 2 controlled heater test in a facility; per-holder fusing; module separation; siting restrictions; NFPA 855 HMA
Legal / code exposure at top configurations — no possible UL 9540 listingCriticalPhase 0 legal opinion; max build stays at 19.09 kWh, under 20 kWh; config-vs-code table; kit-not-appliance model
DAB stability across 33–60 V at full loadHighPhase 0 simulation gate, Phase 4 bench validation at both extremes. The scaling requirement widened this range — it is now the hardest converter spec in the design.
User draws more than the populated cells supportHighPmax foldback; declared-vs-measured cross-check; hardware OC sized for the smallest legal config
Non-uniform P within a moduleMediumGroup-IR detection, refuse to enable; silkscreen map makes the correct fill obvious
Economics ~4.6× worse than LFP at top configMediumPhase 0 decision gate; small configs are where 18650s genuinely win
Bus inrush / circulating current across mixed-fill modulesMediumPhase 3 bring-up with deliberately mismatched fill levels
Balancing 24 Ah groups at 8PMedium500 mA external balancers + mandatory top-balance at install
Bottom-side holders detach in reflow #2MediumPhase 1 coupon — locating pegs vs adhesive staking vs selective solder
Holder contact reliability over repeated insertionMediumPhase 1: 50-cycle insertion test. Matters more here because scaling means users reopen modules
Holder contact resistance (stainless steel)LowEliminated by scale — 0.3 C operation caps current at 0.9 A. Still measured in Phase 1
Single G474 with zero spare HRTIM channelsLowAnalog PFC keeps all 12 free; escape hatch is a second G431
08

Safety and legal position

This is close to the highest-risk category of open hardware that exists: mains output, up to 19 kWh of lithium, unknown user-supplied cells, user assembly, user-variable configuration. Safety work is a Phase 0 deliverable that constrains the design, not a checklist at the end.

The scaling-specific hazards

Inserting a mismatched cell into a partially-filled group — ~19 A for minutes through 0.9 A contacts. Closed by the sorting bay: measure before insert, guided by LEDs.

And a user populating few cells and drawing full power. Mitigated by the Pmax foldback, the declared-versus-measured config cross-check, and a hardware over-current limit sized for the smallest legal configuration — not the largest.

The dominant hazard at full build

Runaway propagation across 1,768 cells. Per-holder 10 A fusing, steel dividers with air gaps between modules, module-level over-temp isolation, a defined cabinet vent path, and explicit siting guidance — detached structure, garage or outdoors, not a cupboard on an egress path.

State plainly in the README, do not bury it

A system whose battery is assembled by the end user from unknown cells cannot be pack-certified or UL 9540 listed. There is no legitimate path to a CE or UL mark on the finished system. It is distributed as a development kit, not a consumer appliance — no warranty, explicit hazards, explicit siting.

Get written legal advice in Phase 0 for at least the EU and US on “component sold to an assembler” versus “product placed on the market”. That is a lawyer question, not an engineering one.

The counterweight, and the project’s central economic argument: a bare PCB contains no cells. No UN38.3, no dangerous-goods handling, no lithium air-freight restrictions, no per-country import friction. That is the entire reason this design is worth building, and it survives every finding above.

09

Verification

Phase 1 — coupon

4-wire contact resistance per holder variant, cold and after 50 insertion cycles. Thermal ΔT at 0.9 A / 4 A / 6 A held 30 min. Reflow-2 retention across 20 samples.

Phase 2 — module

Full cycles at 1P, 4P and 8P, confirming Pmax at each. Fuse clearing verified by shorting one holder. Fault injection: pull a cell, leave one group at 3P while others are 4P, empty a group entirely, short a sense line, heat an NTC. Controlled runaway propagation test in a facility.

Phase 3 — multi-module

Hot-plug onto a live bus at 1→2 and 16→17 modules, scoping inrush. Circulating current between modules at different fill and different SoC. Verify Pmax recomputes and the inverter folds back within one line cycle when a module is removed under load.

Phase 4 — power board

Efficiency curve 10–120 %. THD by scope FFT at resistive and PF 0.7. Transfer time scoped across mains dropout at multiple phase angles. 3 kW / 2 s surge. DAB stability sweep at 33 V, 46 V and 60 V. Protection chain verified with the MCU held in reset. Conducted-emissions pre-scan with a LISN.

Phase 5 — system

A logged 6.5 h discharge at 1.5 kW on 17 modules, and a logged 6.8 h discharge at 500 W on 6 modules — both configurations you named, verified end to end. Recharge timing at 1 kW and 2 kW. 72 h soak. Hi-pot the isolation barrier. Cold start on battery alone.

Host integration

NUT’s usbhid-ups enumerates the board as a USB HID Power Device and reports the correct runtime for the actual population, then triggers a graceful shutdown. No custom driver, no vendor daemon, works on Linux, macOS and Windows.

10

What Phase 0 delivered

Committed to main as f881288 — 26 files, ~17,700 words, all internal links verified. No schematic capture, because three gates come first.

open-UPS/ README.md spec, config table, hazards, legal position, siting LICENSE-HARDWARE CERN-OHL-S v2 ← canonical upstream text, not a stub LICENSE-FIRMWARE GPL-3.0 ← canonical upstream text LICENSE-DOCS CC BY-SA 4.0 ← canonical upstream text docs/ architecture.md system design and rationale per block derating-basis.md the auditable basis — every number derives here scaling-guide.md silkscreen population map, configuration tables safety-case.md 13-entry hazard register — gates the project hazard-mitigation.md NFPA 855 config-vs-code table, 4-layer fire strategy cell-sourcing-guide.md acceptance criteria, test procedure, what to reject module-interface.md bus pinout, CAN message map, 12 fault codes adr/0001 … 0006 decisions taken and alternatives rejected test-reports/ 15 named reports, one per gate criterion — empty until Phase 1 hardware/ coupon-holder-test/ Phase 1 — 5 tests, 6 gate criteria, ~$50 module-18650/ Phase 2 — blocked on the Phase 1 gate power-board/ Phase 4 — blocked on the DAB simulation gate firmware/ mechanical/ manufacturing/ scoped, not started .gitignore KiCad, build output, generated manufacturing

Three gates block Phase 1

☐ Written legal opinion (EU + US). “Component sold to an assembler” versus “product placed on the market” is unresolved and needs an actual lawyer.

☐ Safety case reviewed by someone other than its author.

☐ DAB simulation across 33–60 V at full load. A 1.8:1 input swing at 1.7 kW — the hardest spec in the design, now a Phase 0 gate rather than a Phase 4 surprise.

Two things genuinely unresolved

The legal opinion is not something engineering can close. It blocks Phase 1 outright.

The Phase 2 propagation test needs a facility — a controlled single-cell heater-induced runaway test, not a bench experiment. If that cannot be arranged, hazard-mitigation.md says plainly the project should not proceed past Phase 2 at multi-module scale. Small builds carry a fire load comparable to a laptop battery; the 17-module build does not.

Licensing note: CERN-OHL-S keeps derivative hardware open, but also discourages some manufacturers from producing cheap clones — a real tension with the goal of cheap worldwide availability. A deliberate trade, recorded in ADR-0006 and worth revisiting once the design is proven.

This page is a snapshot for review. The Markdown files under docs/ are canonical — if a number here disagrees with docs/derating-basis.md, the Markdown wins. Regenerate this page rather than editing figures into it.

Sources — mini-box/ups (note: OpenUPS is not open hardware; the repo holds only NUT integration) · Hackaday #25116 · libreUPS/bms · TI BQ76952 · Keystone 1042 SMT holder · ST UM3198 — DAB with STM32G474 HRTIM · Network UPS Tools · NFPA 855 2026 updates · JLCPCB PCB dimensions · LiFePO₄ price trend 2026 · Salvaging 18650 cells · Double-sided reflow fallout