Hacking Verizon Power Reserve battery unit


  #1  
Old 10-22-17, 09:33 AM
2
Member
Thread Starter
Join Date: Jan 2014
Location: USA near Boston, MA
Posts: 2,262
Received 388 Upvotes on 337 Posts
Hacking Verizon Power Reserve battery unit

My Verizon FiOS developed a problem with noise on HD digital channels that required a visit by a technician. To solve the problem he replaced the entire ONT (fiber interface unit) with a new one. The old one had a battery backup for landline phone during a power failure. The new one does not. I use the phone line for alarm monitoring and need it to work during a power failure.

The solution was to have Verizon send me a Power Reserve https://www.verizon.com/supportresou...werreserve.png unit that uses 12 D cell batteries that plugs into the ONT power supply. However the instructions say to leave it turned off until the power fails and then to switch it on. That won't work for me if there is a power failure and I am not home--the alarm company connection by phone will not work. I tried leaving the switch in the on position and only the phone works--internet and TV feeds are interrupted.

People in other forums have documented the same problem with using Power Reserve and there is much discussion about using a UPS for backup for the entire ONT, but there seems to be voltage matching and capacity issues.

I thought I might solve my problem by inserting a 120 vac fan relay like this https://www.mccombssupply.com/90-382...120v-1no-1-nc/ between the output of the Power Reserve box and the power supply. It would be plugged into the same outlet as the ONT power supply and the contacts would close on power failure to provide DC power.

But I was concerned about how the switch on the Power Reserve is connected so I opened up the box the check it. The switch does not control the output line directly. It is a NO/NC switch connected to a printed circuit board. The board has six canisters mounted on it (as well as other electronics--the documentation says that there is a latching system that drops out if the battery voltage goes too low.) The canisters are labelled Taicon 1649M. I could not find them in a Google search so I do not know if they are capacitors, batteries, or something else.

I also checked the output at the plug. With the switch OFF there is 0.15 vDC between the + and - on the plug. With the switch ON there is 19.1 vDC. Because of this it appears that my plan to use the fan relay to hold open one of the conductors to the plug during normal power and let it close on power failure will not work as the minimal voltage with the switch OFF will not get through. I'm not sure why that voltage is there as there is no monitoring or switching of the battery supply by the ONT or its power supply.

I am now thinking that I will have to remove the switch from the circuit board and connect the NO/NC contacts from the fan relay there to mimic the operation of the switch.

Any other thoughts or suggestions?
 
  #2  
Old 10-22-17, 11:02 AM
F
Member
Join Date: Mar 2006
Location: Wet side of Washington state.
Posts: 16,321
Received 38 Upvotes on 30 Posts
I am not familiar with either your ONT or that back-up power supply. Could you post some more information, especially on the ONT?

With my ONT it takes 12 volts at about 2.5 amperes to operate for Internet only. (I don't have telephone service or TV via the FiOS.) For a while I ran a UPS of my own design on just the ONT, disconnecting the Verizon power supply and battery back-up unit.

I might add that I am currently on the THIRD ONT, it seems these things are not made all that well and have a high failure rate after a few years.

For some background, at least with my system, the AC power supply outputs 48 volts DC to the battery back-up unit (BBU) and that unit has all the "brains" in it to switch the ONT to battery upon failure of the AC supply. However, to do that switching it MUST have the multi-conductor cable between the ONT and the BBU. When it switches it ONLY powers the telephone function. To disable this shutting off of the Internet (and television, I suspect) you need to disconnect the signal return wire (or remove the entire cable as I did) and then the ONT will only "see" the 12 volt power from the BBU. Now, IF your local central office (CO) has enabled the alarm reporting function (it sends alarms to the CO for power failure, low battery, battery failure and maybe a couple I forget) then Verizon will be upset with you for playing with their equipment. In my case I never heard a peep from Verizon, or Frontier, which bought out Verizon in my area.

I used a 12 volt regulated power supply connected to a 12 volt 7-AH gel cell (power supply set to the "float" voltage of the battery) and powered the ONT directly from the battery. I never had to see just how long it would run as I would start my generator within a few minutes of power failure. I ran this system for a couple of years, only reverting back to the Verizon power supply when the original ONT failed. The tech never mentioned the missing control cable and he said that they were replacing a lot of the original ONTs. This replacement lasted about two, maybe three years and failed. Again, the tech told me they were having a lot of failures on this particular model and he said nothing about the missing control cable.

Now a slight aside. For critical alarm functioning I prefer a cellular telephone link. If someone with some alarm smarts wanted to disable your alarm they would simply cut the fiber optic line going to the ONT. I don't know about where you live but here the preferred ONT placement is on the outside of the house and the fiber is readily accessible to anyone wanting to cut it. This is true whether the fiber is an underground installation (as is mine) or an overhead drop.
 
  #3  
Old 10-22-17, 01:52 PM
2
Member
Thread Starter
Join Date: Jan 2014
Location: USA near Boston, MA
Posts: 2,262
Received 388 Upvotes on 337 Posts
Thanks for your reply Furd. Here are some pictures:

1. Overall view. It is located in the basement.
2. ONT
3. Backup battery pack
3. Power supply label
5. Input from battery pack to power supply
6. Battery pack label
7. Battery pack circuit board (I see now that the canisters are capacitors.)
8. Power switch on circuit board
9.ONT leds. From left MOCA, POTS, MGMT, NTWK, DATA, VD, FAIL, BAT, PWR. (POTS, VD & FAIL are NOT lit even though it looks like they are in the photo. BTW the BAT led is lit even when the battery pack is not plugged in. There may be a small battery internally for memory keeping or something.)

Since this external battery pack is unsupervised and manually switched, I want to install a relay that will monitor the 120 VAC for the power supply and if power fails will switch the DC output of the battery pack. The existing manual switch (NO/NC) provides 0.15 VDC output in the OFF position and 19.1 VDC in the ON position.

For my needs a UPS for the ONT that would provide full function in a power failure is not required.

Since the battery plugs into the power pack and is unsupervised, I doubt that Verizon would get a signal (or care) if the battery is on or not.

Your point about the location of the fiber feed into the house is acknowledged. I am in a densely populated neighborhood (with neighbors who watch), the drop is near the front of the house visible from the street in an area covered by lights on motion detectors so I'm not too concerned about that. Also the house alarm turns on all outside lights around the house when activated.

Name:  v1.jpg
Views: 14952
Size:  47.3 KB

Name:  v2.jpg
Views: 5969
Size:  33.1 KB

Name:  v3.jpg
Views: 6419
Size:  46.2 KB

Name:  v4.jpg
Views: 5832
Size:  33.5 KB

Name:  v5.jpg
Views: 6106
Size:  20.7 KB

Name:  v6.jpg
Views: 5833
Size:  38.1 KB

Name:  v7.jpg
Views: 5980
Size:  26.6 KB

Name:  v8.jpg
Views: 5824
Size:  20.7 KB

Name:  v9.jpg
Views: 6811
Size:  28.6 KB
 

Last edited by PJmax; 05-06-19 at 10:44 AM. Reason: resized pictures
  #4  
Old 10-22-17, 02:21 PM
PJmax's Avatar
Group Moderator
Join Date: Oct 2012
Location: Jersey
Posts: 64,939
Received 3,953 Upvotes on 3,546 Posts
The AC power supply plugs in to the ONT .
Does the battery pack plug in to the power supply ?
Am I correct and the ONT says 12vdc input on it ?

Is the connector from the power supply to the ONT just a two pin coaxial power plug and jack ?

I have Fios here but I kept the old PSU's and fixed them.
The older ONT's were reliable.... it was the power supplies that crapped out.
 
  #5  
Old 10-22-17, 02:21 PM
F
Member
Join Date: Mar 2006
Location: Wet side of Washington state.
Posts: 16,321
Received 38 Upvotes on 30 Posts
I can't really make out much but it seems the power supply in the lower left corner is the key. You will need to determine the output from that supply (input to the ONT) and then have a battery pack with sufficient ampere-hour rating to carry you through any expected power outage. Could be fairly simple IF it is a standard voltage.

Like I did you would have the ONT connect directly to the battery and then a power supply set to the battery's "float charge" voltage. At that point you could do away with the silly dry cell battery back-up.


The older ONT's were reliable.... it was the power supplies that crapped out.

Not in my case.
 
  #6  
Old 10-22-17, 03:00 PM
PJmax's Avatar
Group Moderator
Join Date: Oct 2012
Location: Jersey
Posts: 64,939
Received 3,953 Upvotes on 3,546 Posts
I'd been thru three power supplies. They'd crap out, switch to battery and kill the battery. I basically did what you did Furd and clipped a float charger onto the battery.

Once we find out exactly the cable/connection arrangement..... using a lead acid battery and float charger in place of the existing AC supply and that silly battery pack is the perfect choice. You aren't actually hacking anything so Verizon would have no reason to squawk unless your supplied power supply damaged the ONT.
 
  #7  
Old 10-22-17, 03:12 PM
2
Member
Thread Starter
Join Date: Jan 2014
Location: USA near Boston, MA
Posts: 2,262
Received 388 Upvotes on 337 Posts
Originally Posted by PJmax
The AC power supply plugs in to the ONT . .
Yes

Originally Posted by PJmax
Does the battery pack plug in to the power supply ?
Yes

Originally Posted by PJmax
Am I correct and the ONT says 12vdc input on it ?
Where do you see that?

Originally Posted by PJmax
Is the connector from the power supply to the ONT just a two pin coaxial power plug and jack ?
I don't know. I did not unplug it to check. It is the thick black cord in the middle in the first photo. It looks more like a phono plug than a coax. I can't pull it now to check--my wife is playing her computer game and I will be killed it if goes down.

I hear what you and Furd are saying about going to a self-sufficient power supply and avoiding the Verizon options altogether. I will look into it further when I can pull the plug without jeopardy.

Thanks.
 
  #8  
Old 10-22-17, 03:58 PM
PJmax's Avatar
Group Moderator
Join Date: Oct 2012
Location: Jersey
Posts: 64,939
Received 3,953 Upvotes on 3,546 Posts
It was on another one I worked on. Similar to this one. It's on the back.

Name:  fios.jpg
Views: 8731
Size:  31.1 KB

This is a coaxial power plug.
Name:  cpp.jpg
Views: 8495
Size:  15.0 KB
 
gahamby voted this post useful.
  #9  
Old 10-22-17, 04:10 PM
2
Member
Thread Starter
Join Date: Jan 2014
Location: USA near Boston, MA
Posts: 2,262
Received 388 Upvotes on 337 Posts
Thanks PJ. I'll check mine out to confirm.
 
  #10  
Old 10-29-17, 07:52 AM
2
Member
Thread Starter
Join Date: Jan 2014
Location: USA near Boston, MA
Posts: 2,262
Received 388 Upvotes on 337 Posts
For now...

Since VZ provided the Power Reserve box and batteries for free (as replacement for previous BBU) and since I had already ordered a NO/NC 120VAC relay ($5.95 + $3 shipping) I have gone ahead with the modification to provide an automatic switchover to battery power on failure of 120 volt power for telephone service only until I decide whether to go ahead with backup for the ONT.

First, I clipped the connector leads on the switch (shown in photo #8 in Post #1) at the right angle to leave three "posts" sticking up from the circuit board. Since I did not want to mess with trying to solder onto those posts, I got the smallest terminal connector I could find (first photo in this post). After attaching each to a wire in a 3 conductor cord I had to open the connector slightly to get it onto the post and then crimped it tight. I drilled a hole in the end of the enclosure for the cord to enter and I closed the switch hole with moldable plastic.

Next, I made connections to the relay. (Second photo.) The coil to a cordset to plug into the 120 VAC outlet. Terminals 2 & 5 to the common (center) post of the switch. Terminal 4 to the OFF (right) post of the switch and terminal 5 to the ON (left) post of the switch. When the coil is energized the 2-4 connection provides fractional DC voltage to the Power Reserve output plug similar to when the switch was in place and turned OFF. When the coil is de-energized the 5-6 connection provides 19.6 DC volts to the output plug (again like the switch turned ON).

The third photo shows the devices mounted and connected, but I have not yet run an actual test (other than measuring the voltages.)

While I was moving the devices around I was able to take photos of the power supply and ONT labels. (Fourth and fifth photos.) The power supply is rated Output: 16VDC, 1.6A and the ONT is rated 12VDC, 2.5A.

If I decide to go ahead with a battery and float charger to power the ONT directly can I use a BLACK+DECKER BM3B 6V and 12V Battery Charger / Maintainer with a 12V SLA battery?
 
Attached Images      
  #11  
Old 10-30-17, 11:35 AM
2
Member
Thread Starter
Join Date: Jan 2014
Location: USA near Boston, MA
Posts: 2,262
Received 388 Upvotes on 337 Posts
It works...

I did a full operational test today by killing power to the 120 volt circuit that feeds the ONT and backup relay. The battery backup switched on and kept the ONT working fully for almost a minute. Then it switched to POTS only mode and maintained telephone service. When I switched the 120 volt power back on the ONT rebooted and restored all services automatically. Telephone service was interrupted only during the reboot.
 
 

Thread Tools
Search this Thread
 
Ask a Question
Question Title:
Description: