Summary

  • RFC 1628's deep battery calibration put the UPS on battery to a manufacturer-selected discharge level so replacement need and run time could be estimated with high confidence.
  • The specification warned that this test left the battery at low charge and required recharge before normal protected-load duration returned.
  • A spin lock, SetResponse, test result, battery estimate, alarm, powered output and useful service were separate receipts; none could silently stand for all the others.

The minutes were conditional

Published in May 1994, RFC 1628 brought an uninterruptible power supply into the Internet management vocabulary. Its MIB did not stop at a manufacturer name or one battery icon. It separated battery, input, output, bypass, alarm, test, control and configuration groups.

That separation mattered because “reserve” was not one number. upsEstimatedMinutesRemaining estimated time to depletion under the present load if utility power was absent and stayed absent. Estimated charge was another value. Battery voltage, current and temperature were others. Output source could be normal, bypass, battery, booster, reducer or none.

The word estimated and the condition present load carried the boundary. A reading did not promise how long an application would remain useful after a later failure. Load could change. Transfer could fail. A protected device could stop before the UPS did. The MIB exposed evidence needed for a decision without promoting it into an outcome.

Even battery status was relative to policy. “Low” meant estimated remaining minutes were less than or equal to the configured low-battery time. Changing that threshold could change the classification while the physical battery stayed the same. A displayed state therefore joined a measurement to local configuration.

The deeper test drew the reserve down

RFC 1628 named two battery tests with different claims. The quick test was sufficient to determine whether replacement was needed. The deep calibration placed the system on battery until it reached a discharge level chosen by the manufacturer, sufficient to judge replacement and run time with a high degree of confidence.

Then came the warning. Deep calibration would leave the battery at low charge. Time would be required to recharge it enough to provide normal duration for the protected load.

The test did not merely observe a standing fact. It created a temporary operating condition in order to learn. Before the test, the reserve might be uncertain but available. During it, the battery carried a deliberate diagnostic load. After it, the estimate could be better while the immediate safety margin was worse.

That exchange requires an owner and a window. “Test passed” says something about the diagnostic as defined by the implementation. It does not say the battery has already recharged, utility power will remain present, the protected load is unchanged, or service would survive a failure beginning now.

One manager had to own the test epoch

The MIB expected more than one management station might act. Writing upsTestId initiated a named test, but the same SNMP message also had to carry upsTestSpinLock. A manager first read the lock and current result, waited while another test was in progress, then tried to write the remembered lock value with its requested test. If another manager slipped in first, the lock check failed and the procedure began again.

After a successful start, the manager polled summary and detail. If the later lock equalled the remembered value plus one, the returned result belonged to its test rather than a successor's.

This was concurrency control, not authorization. The lock answered which writer won a race and which test epoch the result described. It did not decide who was allowed to discharge the battery, whether the maintenance window was safe or whether the protected service owner had accepted the temporary loss of reserve.

The possible results were also deliberately plural: pass, warning, error, aborted, in progress or no tests initiated. Additional detail could be empty. A result could disappear after reinitialization of the management subsystem if the system lacked non-volatile storage. “No test recorded” was therefore not a historical proof that no test had occurred.

The alarm table was a present-tense view

The alarm table contained rows for conditions currently in effect. The agent created a row when it detected a condition and removed the row when that condition ceased. IDs could wrap, the table could become sparse, and its rows could not be assumed chronological.

An alarm already present when the agent started received time zero. That value meant the condition predated or coincided with the observation epoch; it did not date the physical beginning of the fault. Test in progress, diagnostic failure, on battery, low battery, depleted battery, shutdown pending, output off and whole-system off were distinct alarms because they described different facts.

The persistent on-battery notification carried remaining minutes, seconds on battery and the low-battery threshold, repeating every minute until the UPS turned off or left battery operation. Repetition improved the chance of attention. It did not prove that a receiver got the notification, that a human acknowledged it or that corrective action succeeded.

Writable seconds became physical control

RFC 1157 had explained SNMP's unusual discipline: model management as inspecting or altering variables, and represent an imperative action such as reboot as a writable countdown. RFC 1628 made that pattern physical. A manager could select whether shutdown affected only output or the entire UPS, schedule it, abort it with -1, start output later, request a timed reboot, or choose automatic restart.

Those variables included their own uncertainty. A later write could override a countdown. On some systems, restarting the agent could abort it. Battery depletion could cause shutdown sooner. Startup due during utility failure had to wait for utility restoration. A requested reboot might complete later than its nominal off interval.

The MIB therefore provided separate alarms for a pending command and output actually off as requested. A successful SetResponse was evidence that the agent accepted a protocol operation. It was not a current probe of the breaker, attached equipment or application.

RFC 1448 supplies the contemporary SNMPv2 operations context, while RFC 3416 later made validation, commit, undo and response phases explicit. Those stages still end at the managed entity's protocol boundary. Power and service require later witnesses.

The control vocabulary did not contain its guard

RFC 1628 ends its Security Considerations with a single statement: security issues are not discussed. That absence must be read precisely. It does not prove that deployed UPS agents were open, insecure or attacked. SNMP administration and access policy lived in companion specifications and local configuration.

It does show that a common vocabulary for discharging batteries, silencing alarms and turning off output was not itself a complete authorization design. The verified errata later corrected a missing macro import, impossible signed-integer bounds and mismatched enumeration numbers. Even the portable syntax remained a maintained record rather than immutable truth.

The RFC Editor record establishes the document and its present series metadata. It does not establish implementation, adoption, product conformance or a real power event.

Heng Lu's Running-Code Primacy provides the discipline for reading the MIB: an object name, accepted write and diagnostic result are inputs to reality, not substitutes for the battery and protected service. Minimum Initial Specification explains why a narrow shared vocabulary can leave test scheduling, authority and recovery local. Reality, Not Advocacy keeps the historical claim bounded to what the record can show.

RFC 1628's deepest lesson was not that remote management made backup power safe. It was that trustworthy evidence has a cost and a custody chain. The test spent reserve to learn about reserve. Responsible operation had to preserve who authorized that exchange, which test ran, what changed afterward and whether the protected service remained protected.

Sources