Power fails.
Your shutdown shouldn't.

1 · Mental model

A UPS is not a battery. It is a small computer with a battery attached, and managing it is a software problem: something on your Mac has to hear what the UPS is saying and act on it before the battery runs out. Everything in this guide is about building and trusting that listener.

Why UPS management exists

The AVR900U on your desk solves the easy problem by itself: when wall power dies, it switches to battery in milliseconds and your Mac never notices. But at 480 W of load its battery lasts 2.7 minutes. The hard problem is what happens in minute two of a long outage. Without management software, the battery empties, the UPS drops its outlets, and your machine loses power mid-write — exactly the event you bought the UPS to prevent. The UPS only buys time; software has to spend that time well, by saving state and shutting the machine down cleanly while power remains.

That is the entire job description: detect the power event → decide how bad it is → shut down cleanly before the battery is gone. Every tool in this guide is one link in that chain.

The two stacks on your Mac

The AVR900U speaks USB HID "Power Device Class" — the same protocol family a laptop battery uses. Because of that, two independent software stacks on your Mac can manage it, and understanding their relationship is the single most load-bearing idea in this guide:

• The Apple stack (built in). When you plug in the UPS, macOS claims the HID device with its own drivers. ioupsd and powerd track it, a battery-style indicator appears, pmset can read it, and Energy Saver grows UPS shutdown options. Zero installation, minimal data, minimal control.
• The NUT stack (installed). Network UPS Tools is the open-source lingua franca of UPS management: a hardware driver, a network server (upsd), and a monitor (upsmon) that executes the shutdown decision. Rich data, scriptable, network-capable — but on macOS it must coexist with the Apple stack, which got to the USB device first.

NUT's three-layer architecture

NUT splits UPS management into three processes with one job each. The separation looks like overkill for one Mac and one UPS — it exists because NUT also scales to server rooms where one UPS protects many machines — but you benefit from it even standalone, because each layer can be tested alone.

The vocabulary you need immediately

Three status tokens dominate every conversation about UPS state. They appear in ups.status, in upsmon's log lines, and throughout this guide:

• OL — online. Wall power is good; the battery is idle or charging. The normal state.
• OB — on battery. Wall power failed; you are now spending stored minutes. A countdown has started.
• LB — low battery. The battery is nearly empty. When upsmon sees OB + LB together, it triggers the shutdown. This pair is the tripwire the whole system is built around.

Watch the transitions, not the states: OL → OB is an event you want to know about; OB → LB is an event your Mac must act on without you. The simulator in §13 lets you run this sequence as many times as you like without touching a plug.

Sources: NUT user manual · macosx-ups(8)

2 · Prerequisite floor

This guide assumes a working macOS terminal habit and nothing about UPS software. Check yourself against the floor before continuing — everything above it is taught in place.

Hard prerequisites

• Shell basics. You can run commands, edit a file with vim/nano/VS Code, and read a man page.
• Homebrew. Installed and working; you know brew install, brew list, brew services.
• sudo. You have admin rights and understand why a daemon that shuts your Mac down needs root.

Soft prerequisites (taught just-in-time)

• launchd. macOS's init system. §8 introduces exactly the plist vocabulary you need — no prior experience assumed.
• The macOS unified log. log show / log stream appear in §10 with worked commands you can copy.
• Electrical units. VA vs W is explained in §3 where it matters (load sizing).

Self-assessment

You are ready if you can answer all four without looking anything up:

1. What does brew services list show, conceptually?
2. What is the difference between a process run in your terminal and a daemon?
3. Why would sudo pkill -f upsd need sudo?
4. Where do Homebrew's config files live on an Intel Mac? (/usr/local/etc/…)

If item 4 surprised you: this guide's paths are for Intel Macs (Homebrew prefix /usr/local), matching the machine it was verified on. On Apple Silicon substitute /opt/homebrew throughout — nothing else changes.

3 · Know your hardware

You cannot size, test, or trust a UPS whose numbers you do not know. This section pins down what the AVR900U actually is — and what its marketing numbers mean for your shutdown deadline.

What the AVR900U is

VA vs W — the sizing trap

Watts measure real power your equipment draws; volt-amperes measure apparent power, which is always ≥ watts for the same load. Marketing leads with the bigger VA number. Size against watts: the AVR900U can carry 480 W, full stop. A Mac, a display, and network gear typically sit well under that — but measure rather than guess. system_profiler SPPowerDataType tells you your Mac's adapter rating; a $15 plug-through power meter tells you the truth for the whole desk.

What "line-interactive with AVR" buys you

Cheap standby UPSes do nothing until power fails. Online double-conversion units rebuild the sine wave continuously and cost 5× as much. The AVR900U sits between: its automatic voltage regulation boosts brownouts and trims overvoltage using a transformer tap, switching to battery only when voltage leaves the correctable range. For you this means two things: minor grid sag does not cycle (and age) the battery, and frequent audible relay clicks are a diagnostic signal — your wall voltage is wandering (§12).

Sources: Eaton/Tripp Lite AVR900U product page

4 · Install & verify

One formula installs the entire NUT toolbox — drivers for hundreds of UPS models, the server, the monitor, and the client tools. Your job in this section is smaller: confirm what you have and learn where everything lives.

brew install nut

Verify the install and pin the version. Both transcripts below are real output from the machine this guide was written on:

brew list --versions nut
nut 2.8.5

/usr/local/sbin/upsd -V
Network UPS Tools upsd 2.8.5 release

NUT 2.8.5 is the current stable release (April 2026). Homebrew tracks it closely, so brew upgrade keeps you current.

Where everything lives (Intel prefix)

Set the mode

In /usr/local/etc/nut/nut.conf, one line matters:

MODE=standalone

Standalone means all three layers run on this Mac and protect this Mac. The other modes (netserver, netclient) exist for sharing one UPS across machines — out of scope for this guide, but the config you build here is the server half of that setup if you ever want it.

Sources: Homebrew nut formula · nut.conf(5)

5 · Choosing the driver

Three NUT drivers plausibly match a Tripp Lite USB unit, and picking by name leads you astray — the obvious choice, tripplite_usb, is wrong for this hardware on this OS. The right question is not "which driver mentions my brand?" but "who owns the USB device?"

The wrong question, then the right one

The wrong question: "Which driver is for Tripp Lite?" — NUT has four with the brand in the name, segmented by protocol generation, not by brand loyalty.

The right question: "What does my unit speak, and can the driver even reach it?" The AVR900U speaks USB HID Power Device Class — the modern, standardized protocol. And on macOS, the kernel claims HID power devices at plug-in, which changes the answer entirely.

Decision matrix

Your working configuration

This is the live /usr/local/etc/nut/ups.conf from the verified machine — two global lines, then the device section:

user = you
group = admin

[myups]
    driver = macosx-ups
    port = auto
    model = AVR900U
    desc = "Tripp Lite AVR900U via macOS"

• user = you, group = admin — the account the driver drops to once started, and the group it stamps on its socket so upsd can reach it. Both are overrides of NUT's compiled-in defaults, and both are needed on this machine — the callout below explains why.
• [myups] — the UPS's NUT name; every later command addresses myups@localhost.
• driver = macosx-ups — the decision this section justified.
• port = auto — required by NUT's config grammar; ignored by this driver (there is no port to open — Apple's layer is the port).
• model = AVR900U — a regex matched against the power-source name; only needed to disambiguate if several UPSes are attached, harmless otherwise.

sudo /usr/local/sbin/upsdrvctl -D start myups
Listening on socket /usr/local/var/state/ups/macosx-ups-myups
WARNING: Needed to fix group access to filesystem socket of this driver, but failed; run the driver with more debugging to see how exactly.
Consumers of the socket, such as upsd data server, can fail to interact with the driver and represent the device: /usr/local/var/state/ups/macosx-ups-myups

Sources: macosx-ups(8) · tripplite_usb(8) · usbhid-ups(8) · ups.conf(5)

6 · Manual bring-up

Before any launchd automation, bring the stack up by hand, one layer at a time, in foreground debug mode. When each layer runs where you can see it, failures point at themselves — and you learn the healthy transcript you will later compare sick systems against.

The bring-up order is the architecture

Driver first, then server, then queries. Each layer refuses to work without the one before it, so the order doubles as a diagnostic ladder: whichever step fails names the broken layer.

The failure signature worth memorizing

With upsd not running, every client fails identically. This is real output from this machine, captured with the stack down:

upsc myups@localhost
Error: Connection failure: Connection refused

Read it precisely: connection refused means nothing is listening on port 3493 — a upsd problem (or upsd never started). A different error, Driver not connected, means upsd is fine but the driver layer is down. Two errors, two layers, no ambiguity. This distinction does half your future debugging for you.

Sources: upsdrvctl(8) · upsd(8) · upsc(8)

7 · upsd & access control

upsd is a network server, which means it has opinions about who connects. For one Mac protecting itself the policy is short — listen on loopback only, one privileged account for the monitor — but you should understand each line you are trusting.

Listening: upsd.conf

The entire non-comment content of the working /usr/local/etc/nut/upsd.conf:

LISTEN 127.0.0.1 3493

Loopback only. No other machine can query this upsd, which is exactly right for standalone mode — the best network security is not being on the network. Port 3493 is NUT's IANA-registered port. If you one day serve LAN clients, you add a second LISTEN line with a LAN address; until then, leave it.

Accounts: upsd.users

upsmon must log in to upsd to be trusted with power-state decisions. One account, defined in /usr/local/etc/nut/upsd.users (password redacted here — the file on disk holds it in plain text):

[monmaster]
    password = <your-password>
    upsmon master

The upsmon master line grants the role, not just access: a master (called primary in NUT 2.8's newer terminology — both spellings work) is a machine drawing power from this UPS that coordinates the shutdown. The matching half lives in upsmon.conf:

MONITOR myups@localhost 1 monmaster <your-password> master

Read it as a sentence: monitor the UPS named myups on this machine, which feeds 1 power supply of mine, logging in as monmaster with this password, in the master role. The 1 matters on servers with redundant PSUs; on a desktop it is always 1.

sudo chmod 600 /usr/local/etc/nut/upsd.users /usr/local/etc/nut/upsmon.conf

Sources: upsd.conf(5) · upsd.users(5) · upsmon.conf(5)

8 · Auto-start with launchd

A UPS monitor you start by hand protects you only on days you remembered to start it. launchd — macOS's init system — is how the stack becomes furniture: running after every reboot, restarted after every crash, no terminal involved. This is also where Homebrew's convenience story quietly falls short, so look before you lean on it.

What brew services actually starts

The plist Homebrew ships for nut, verbatim from /usr/local/opt/nut/homebrew.mxcl.nut.plist on this machine (boilerplate keys trimmed):

<key>ProgramArguments</key>
<array>
    <string>/usr/local/opt/nut/sbin/upsmon</string>
    <string>-D</string>
</array>
<key>RunAtLoad</key>
<true/>

launchd in ninety seconds

launchd supervises jobs, each described by a plist file. Files in /Library/LaunchDaemons/ run as root at boot, before login — the right domain for power management. The keys you need: Label (unique job name), ProgramArguments (argv as an array), RunAtLoad (start when loaded), KeepAlive (restart if it exits). One rule shapes the design: launchd runs foreground processes. Daemons that background themselves confuse it — which is why every command below carries -F, NUT's "stay in the foreground" flag.

The three jobs

launchd offers no startup ordering between jobs, and none is needed: each NUT layer retries until the layer below appears. Write these three files (owner root:wheel, mode 644 — launchd refuses anything looser):

1 · The driver — /Library/LaunchDaemons/org.nut.driver.plist. Note it runs the driver binary directly with -a myups (pulling settings from ups.conf), not via upsdrvctl, which would exit after spawning and make launchd restart it forever:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>              <string>org.nut.driver</string>
  <key>ProgramArguments</key>
  <array>
    <string>/usr/local/bin/macosx-ups</string>
    <string>-a</string><string>myups</string>
    <string>-F</string>
  </array>
  <key>RunAtLoad</key>          <true/>
  <key>KeepAlive</key>          <true/>
  <key>ThrottleInterval</key>   <integer>30</integer>
</dict>
</plist>

2 · The server — /Library/LaunchDaemons/org.nut.upsd.plist. Same skeleton, different program — plus -u you, which is not optional (explained under job 3):

<key>Label</key>              <string>org.nut.upsd</string>
<key>ProgramArguments</key>
<array>
  <string>/usr/local/sbin/upsd</string>
  <string>-u</string><string>you</string>
  <string>-F</string>
</array>
<key>RunAtLoad</key>          <true/>
<key>KeepAlive</key>          <true/>
<key>ThrottleInterval</key>   <integer>30</integer>

3 · The monitor — /Library/LaunchDaemons/org.nut.upsmon.plist, replacing brew services so all three jobs live in one place, managed one way:

<key>Label</key>              <string>org.nut.upsmon</string>
<key>ProgramArguments</key>
<array>
  <string>/usr/local/sbin/upsmon</string>
  <string>-F</string>
</array>
<key>RunAtLoad</key>          <true/>
<key>KeepAlive</key>          <true/>
<key>ThrottleInterval</key>   <integer>30</integer>

upsmon must start as root: it keeps a tiny privileged stub alive to run the shutdown command, drops the rest of itself to an unprivileged user, and cannot arrange that from a user session. Running it from /Library/LaunchDaemons satisfies this naturally. If you previously ran brew services start nut, stop it first: sudo brew services stop nut && brew services stop nut (clears both the root and user domains).

upsd is the mirror image. LaunchDaemons run as root, and upsd started as root drops to NUT's compiled-in nobody — an account that cannot enter Homebrew's state directory (§5), so the job exits immediately and KeepAlive respawns it every 30 s to exit again. -u you tells it to become you instead, which matches the driver (it takes the same instruction from user = in ups.conf) and the socket the driver leaves behind (owner you, group admin). Nothing upsd does needs root: port 3493 is unprivileged and every file it reads is yours. The driver job needs no such flag — it starts as root and reads its user from ups.conf. (launchd's own spelling is a UserName key set to you; either works. The flag keeps the reason visible next to the command.)

Sources: nutupsdrv(8) · upsmon(8) · man launchd.plist, man launchctl (local)

9 · Automated shutdown

Everything so far was plumbing. This is the payoff: the sequence that runs at 3 a.m. while you sleep, taking your Mac from "power just failed" to "halted cleanly with minutes to spare." Build it, then test it on purpose, because an untested shutdown path is a hope, not a system.

The event chain, end to end

upsmon.conf — the decision lines

Beyond the MONITOR line from §7, these are the settings that shape behavior (values shown are NUT's defaults, sane for a desktop):

Who decides "low battery"? With macosx-ups, the LB flag arrives from Apple's power layer, which takes it from the UPS's own firmware threshold. You are trusting the AVR900U's definition of "low" — typically conservative, but on an aged battery "low" can be seconds from "empty." This is why §11's runtime calibration matters and why the belt-and-suspenders timer below exists.

Desktop notifications when events fire

upsmon can run a command on every event via NOTIFYCMD. Point it at a script that posts a macOS notification, and flag which events should call it (EXEC) versus only syslog:

# upsmon.conf
NOTIFYCMD /usr/local/etc/nut/notify.sh
NOTIFYFLAG ONBATT   SYSLOG+EXEC
NOTIFYFLAG ONLINE   SYSLOG+EXEC
NOTIFYFLAG LOWBATT  SYSLOG+EXEC
NOTIFYFLAG COMMBAD  SYSLOG+EXEC
NOTIFYFLAG COMMOK   SYSLOG
NOTIFYFLAG REPLBATT SYSLOG+EXEC

#!/bin/sh
# /usr/local/etc/nut/notify.sh — upsmon passes the message as $1
# chmod +x; runs in upsmon's unprivileged context
/usr/bin/osascript -e "display notification \"$1\" with title \"UPS\" sound name \"Sosumi\""

Shutting down early: upssched

Waiting for LB spends the whole battery before acting. On a 2.7-minutes-at-full-load unit, a better policy is often "if the outage lasts longer than N minutes, it is not a blip — shut down now, with margin." That is upssched: upsmon forwards events to it, it runs timers, and cancels them if power returns:

# upsmon.conf — route events through upssched
NOTIFYCMD /usr/local/sbin/upssched
NOTIFYFLAG ONBATT  SYSLOG+EXEC
NOTIFYFLAG ONLINE  SYSLOG+EXEC

# upssched.conf
CMDSCRIPT /usr/local/etc/nut/upssched-cmd.sh
PIPEFN /usr/local/var/state/ups/upssched.pipe
LOCKFN /usr/local/var/state/ups/upssched.lock
AT ONBATT myups@localhost START-TIMER onbatt-too-long 120
AT ONLINE myups@localhost CANCEL-TIMER onbatt-too-long

#!/bin/sh — upssched-cmd.sh receives the timer name as $1
case "$1" in
  onbatt-too-long)
    logger -t upssched "On battery 120s; forcing early shutdown"
    /usr/local/sbin/upsmon -c fsd
    ;;
esac

Two minutes on battery → forced shutdown, with the battery still half full instead of empty. Pick the timer from §3's runtime math: at your measured load, leave at least 2× the time a clean halt takes.

The second brain: macOS's own shutdown rules

With the UPS attached, the Apple stack keeps its own thresholds, visible and settable via pmset's UPS flags (per pmset(1): haltlevel %, haltafter minutes on UPS, haltremain minutes-left) and mirrored in Energy Saver's UPS options. Two brains can both order a shutdown; that is safe — the second order finds the system already halting — but make NUT the authority so behavior is in one config you version and test. Either disable Apple's thresholds or set them strictly later than NUT's, and check the current state with pmset -g ups.

Closing the loop: restart after power returns

Because macosx-ups is monitoring-only, it cannot tell the UPS to cut and restore outlet power the way Linux + usbhid-ups setups do. Sequence that follows a real outage: your Mac halts → UPS discharges to empty → outlets drop → wall power returns → outlets energize. For the Mac to come back on its own at that last step:

sudo pmset -a autorestart 1
pmset -g | grep autorestart

This is macOS's "start up automatically after a power failure." Without it, the 3 a.m. outage ends with a Mac that stays dark until you press the button.

Sources: upsmon(8) · upsmon.conf(5) · upssched(8) · man pmset (local)

10 · Monitoring — reading both stacks

When something is off — runtime seems short, the status looks stale, a shutdown fired that shouldn't have — you want testimony from two independent witnesses. Your Mac has them: NUT's view and Apple's view of the same hardware. When they agree, trust the reading. When they disagree, the disagreement itself is the diagnostic.

The NUT witness

# full variable dump — the baseline you captured in Lab 1
upsc myups@localhost

# one variable, script-friendly
upsc myups@localhost battery.charge

# continuous CSV logging: one line per minute to a file; -F keeps it in the foreground so Ctrl+C stops it
upslog -s myups@localhost -l ~/ups-log.csv -i 60 -F

# same, but self-terminating: exit after 60 samples
upslog -s myups@localhost -l ~/ups-log.csv -i 60 -d 60

# quick live watch in a spare terminal
while sleep 5; do printf '%s  %s  %s%%  %ss\n' "$(date +%T)" \
  "$(upsc myups@localhost ups.status 2>/dev/null)" \
  "$(upsc myups@localhost battery.charge 2>/dev/null)" \
  "$(upsc myups@localhost battery.runtime 2>/dev/null)"; done

Three quirks of what macosx-ups hands you. battery.charge arrives in 5-point steps — the AVR900U's gauge reports 65, 70, 75, never 68 — and when the true value sits near a boundary it flaps between neighbours every few seconds (65↔70 for an hour on this machine); read a flapping pair as the midpoint, not as a trend. battery.runtime is Apple's Time to Empty in seconds: load-dependent and, on this unit, wildly nonlinear (about 61 minutes reported at 100 %, 9 minutes at 75 %), so it is a warning light, not a health metric. battery.voltage: 0.001 is a placeholder — the driver has no real voltage.

pkill -x upslog
ps aux | grep '[u]pslog'
# expect no output; then tidy: rm /usr/local/var/run/upslog.pid

The Apple witness

# current power sources — the fastest health check
pmset -g ps
Now drawing from 'AC Power'
 -InternalBattery-0 (id=9175139)	100%; charged; 0:00 remaining present: true
 -AVR900U          (id=19136514)	65%; charging present: true

# Apple's UPS shutdown thresholds (empty when no UPS is attached)
pmset -g ups

# hardware detail: is the UPS even enumerated on USB?
system_profiler SPUSBDataType | grep -i -A10 "tripp\|ups"
system_profiler SPPowerDataType

The transcript above is this machine with the UPS attached: the internal battery and the UPS each get a line. The UPS's percentage is Apple's reading of the same HID gauge that NUT's battery.charge mirrors, so the two witnesses should agree to within one gauge step (see the traps below). With the UPS detached the line simply vanishes — that presence/absence check settles the most fundamental question in seconds and needs no NUT at all.

Deep history: the unified log and ioupsd

Apple's ioupsd narrates every UPS state change into the unified log. This is your black-box recorder: after any incident, the answer to "what did the Mac believe, and when?" is already on disk.

# live tail while you run a fire drill
log stream --predicate 'process == "ioupsd"'

# reconstruct an incident: dump the last 3 hours to a file
log show --debug --last 3h --predicate 'process == "ioupsd"' > ~/macos-ups-log.txt

The dump is verbose — each dispatchEvent block repeats every HID property. The extractor below (a cleaned-up version of a script battle-tested on this machine's own logs) collapses it to one line per state change: charge, alarm, failure flag, charging flag, source, and runtime.

UPS_DUMP="$HOME/macos-ups-log.txt"
perl -0777 -ne '
  while (
    /(\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d{3})
     [^\n]*dispatchEvent:\s*\{([^}]*)\}/sgx
  ) {
    $time  = $1;
    $block = $2;

    ($charge)   = $block =~ /"Current Capacity"\s*=\s*(\d+)/;
    ($alarm)    = $block =~ /"Enable Audible Alarm"\s*=\s*(\d+)/;
    ($failure)  = $block =~ /"Internal Failure"\s*=\s*(\d+)/;
    ($charging) = $block =~ /"Is Charging"\s*=\s*(\d+)/;
    ($source)   = $block =~ /"Power Source State"\s*=\s*"([^"]+)"/;
    ($runtime)  = $block =~ /"Time to Empty"\s*=\s*(\d+)/;

    next unless defined $charge && defined $source && defined $runtime;

    $alarm    = "unavailable" unless defined $alarm;
    $failure  = "unavailable" unless defined $failure;
    $charging = "unavailable" unless defined $charging;
    $runtime  = "unavailable" unless defined $runtime;

    $state = "charge=$charge alarm=$alarm failure=$failure " .
             "charging=$charging source=$source runtime=$runtime";

    if ($state ne $previous) {
      print "$time  $state\n";
      $previous = $state;
    }
  }
' "$UPS_DUMP"

Output reads like a flight recorder: a timestamped line each time anything changed. Power Source State flips between "AC Power" and "Battery Power" at the exact millisecond of each transfer — lay it beside upsmon's log and the two witnesses cross-examine each other.

log show --debug --last 12h --style compact --predicate 'process == "ioupsd" AND eventMessage CONTAINS "with key Current Capacity"' \
  | sed -E 's/^([0-9-]+ [0-9:]+)\.[0-9]+ .*IV: ([0-9]+)\).*/\1 \2/' | awk '$3 != p { print; p = $3 }'

Translation table — pmset instinct → NUT move

Sources: upslog(8) · man pmset, man log (local)

11 · Battery health & maintenance

Every number in this guide silently assumes a healthy battery. Lead-acid chemistry guarantees that assumption expires: capacity fades slowly, then suddenly, and the UPS keeps reporting green right up until an outage proves otherwise. Maintenance is the practice of finding that out on your schedule instead of the grid's.

What you are maintaining

The AVR900U holds a 12 V valve-regulated lead-acid (VRLA) battery — the sealed, maintenance-free descendant of a car battery. "Maintenance-free" means no fluid to top up; it does not mean immortal. Typical service life for this class is 3–5 years, shortened by heat (chemistry roughly doubles its aging rate per 8–10 °C), deep discharges, and time spent sitting empty. Recharge after a full discharge takes about 8 hours to reach 90 %.

Runtime calibration — twice a year

The point: measure how long the battery actually lasts at your real load, so LB thresholds and the §9 timer rest on today's battery, not the 2.7/10-minute numbers from the datasheet.

Replacement

• When: measured runtime clearly declining, the unit's alarm/fault behavior signaling battery trouble, a REPLBATT event from upsmon, or age past ~4 years — whichever arrives first.
• What: the official replacement is Tripp Lite RBC51; the cell inside is a standard 12 V sealed lead-acid block, and matching-spec third-party cells (12 V, matching Ah, F2 terminals) are widely sold for this model.
• How: power down and unplug the unit, open the battery door per the unit's label, swap the connector, and give the new battery a full 24 h charge before trusting it with a runtime test. Recycle the old cell — any auto-parts store takes sealed lead-acid.
• After: run Lab 4 again. A new battery that can't beat the old one's numbers is a warranty conversation.

Load discipline

Runtime maintenance has a second lever: what you plug in. Keep the battery side of the UPS for things that must survive the outage — the Mac, the display you need to see the shutdown, the router/modem if remote access matters. Move speakers, chargers, lamps, and anything with a motor or heater to the surge-only outlets or the wall. Recheck after every desk reshuffle; load creep is silent and §3's math says every watt removed pays back runtime with interest.

Sources: Eaton/Tripp Lite AVR900U product page · upsmon.conf(5) (REPLBATT)

12 · Troubleshooting

Almost every failure in this stack announces which layer it lives in, if you read the error precisely. Work the ladder from §6 — hardware visible → driver up → upsd answering → upsmon deciding — and each symptom below names its own rung.

13 · Power-event simulator

You cannot rehearse outages on demand — but the state machine that manages them is simple enough to carry in your head, and this simulator exists to put it there. It models a 480 W-class UPS with your stack attached: fail the wall power, watch status tokens flip, see upsmon's events fire, and learn the rhythm before the real thing tests you.

Things worth trying deliberately: fail power at 240 W and watch how long the OB phase lasts with the early-shutdown timer on versus off; raise the load to 480 W and see the timer become the only thing standing between you and an LB race; restore power mid-countdown and watch the timer cancel — the exact behavior §9's CANCEL-TIMER line buys you. Time compression: one simulated minute ≈ two real seconds.

14 · Capstone — the trusted-stack audit

The capstone is not a new build; it is proving the one you have. Run it after finishing the guide, and then again once a quarter — it exercises every layer, both witnesses, the automation, and the battery in one sitting, and ends with a written record you will thank yourself for.

1. Cold-start proof. Reboot the Mac. Before opening anything else: upsc myups@localhost ups.status → OL. All three launchd jobs report state = running under sudo launchctl print. (§8)
2. Witness agreement. pmset -g ps shows the UPS; its charge agrees with upsc's battery.charge within one 5-point gauge step (§10). Disagreement is your first finding. On a laptop, also read the InternalBattery line: charged or charging while the UPS is on wall power. A Mac whose own battery drains while it claims Using AC is telling you its charger is not on a battery-backed outlet, or the hub between them is not passing power. (§10)
3. Config review. Read all four config files end to end. Every line should be one you can explain; any you can't, this guide's §4–§9 name. Confirm modes/permissions on upsd.users and upsmon.conf are 600. (§7)
4. Event round-trip. Recorders on (Lab 4 step 1), pull the wall plug for 60 seconds, restore. Verify ONBATT and ONLINE appear in upsmon's log, the notification fired, and ioupsd's log shows the same transitions at the same timestamps. (§9, §10)
5. Fire drill. Work saved; run the full shutdown path — upssched timer or sudo upsmon -c fsd — and let the machine halt. Boot; confirm autorestart is still 1. (§9, Lab 3)
6. Runtime measurement. Lab 4 in full. Record date, load, minutes measured. Compare against last quarter; adjust the upssched timer if the battery has faded. (§11)
7. Write it down. Three lines in a log file next to your configs: date, measured runtime, anything that surprised you. The quarter-over-quarter trend of that file is your battery-replacement early-warning system.

15 · Cheat sheet

The working set, one glance. The universal starting pattern comes first — it answers "is everything okay?" in two lines and is the opening move of every §12 diagnosis.

# the universal starting pattern
pmset -g ps                              # does macOS see the UPS?
upsc myups@localhost ups.status          # does NUT? want: OL

16 · Glossary

AVR — automatic voltage regulation

A line-interactive UPS's transformer trick: correcting brownouts/overvoltage without switching to battery. (§3)

Driver (NUT)

The process that speaks to one UPS and translates its state into NUT's standard variables. Here: macosx-ups. (§5)

FSD — forced shutdown

upsmon's point of no return: the flag that commits every attached machine to shutting down. Latched by design until upsd restarts. (§9)

HID Power Device Class

The USB standard for batteries and UPSes. Why macOS auto-recognizes the AVR900U — and why the kernel claims it before NUT can. (§1, §5)

ioupsd

Apple's UPS daemon; narrates UPS state changes into the unified log. The "Apple witness." (§10)

launchd / LaunchDaemon

macOS's init system and its root-context boot jobs, defined by plists in /Library/LaunchDaemons. (§8)

LB — low battery

Status token meaning the battery is nearly spent; OB+LB together triggers the automated shutdown. (§1, §9)

Line-interactive

UPS topology between cheap standby and expensive double-conversion: AVR for small deviations, battery for real failures. (§3)

Master / primary

The upsmon role for a machine powered by the UPS that coordinates shutdown. "Primary" is NUT 2.8's newer spelling. (§7)

MODE=standalone

NUT's arrangement for one machine protecting itself with a local UPS — this guide's entire scope. (§4)

OB — on battery

Status token: wall power failed, stored energy is being spent. (§1)

OL — online

Status token: wall power good. The state you want to be bored by. (§1)

Peukert effect

Lead-acid batteries yield less energy at higher discharge rates — why half load gives ~4× runtime, not 2×. (§3)

pmset

macOS's power-management CLI: reads power sources, sets UPS thresholds and autorestart. (§10, §9)

RBC51

Tripp Lite's replacement battery model for the AVR900U: 12 V sealed lead-acid. (§11)

SHUTDOWNCMD

The command upsmon's root stub runs when shutdown is required — /sbin/shutdown -h now on macOS. (§9)

upsc

NUT's query client: dumps a UPS's variables, or one variable, script-cleanly. (§6)

upsd

NUT's data server: publishes driver state on TCP 3493 to authenticated clients. (§7)

upsdrvctl

Start/stop wrapper for NUT drivers listed in ups.conf. Not used under launchd, which runs the driver binary directly. (§6, §8)

upslog

NUT's CSV logger — one status line per interval, ideal for calibration records. Detaches when given a log file unless run with -F; stop with pkill -x upslog. (§10)

upsmon

NUT's monitor: watches ups.status, fires notifications, and executes the shutdown decision via a privileged stub. (§9)

upssched

Timer layer between upsmon events and actions — "on battery 120 s → shut down early," cancelled if power returns. (§9)

VA vs W

Apparent vs real power. Size the UPS by watts (480 W here); VA is the marketing number. (§3)

VRLA — valve-regulated lead-acid

Sealed "maintenance-free" battery chemistry: no topping up, 3–5 year life, heat-sensitive. (§11)

17 · Index

18 · Quiz

Self-scored flashcards — answer out loud before revealing, then mark yourself honestly. Aim for 14/16; every answer links back to the section that taught it, and the two you miss are tonight's re-reading list.

19 · Sources

Checked with NUT 2.8.5 (Homebrew) on macOS 15.6 with a Tripp Lite AVR900U · 2026-09-03 · external links require network; the guide itself works offline. Command transcripts marked as real were captured on the verified machine; labs requiring a live UPS are marked in place.

• NUT user manual — best for the big picture: modes, architecture, configuration walk-throughs.
• macosx-ups(8) — best for this driver's exact capabilities and limits; short and worth reading whole.
• usbhid-ups(8) — best for understanding what the standard HID driver would give you on Linux, and the variables the protocol defines.
• tripplite_usb(8) — best for the protocol-generation split that makes it the wrong driver here.
• upsmon(8) and upsmon.conf(5) — best for the shutdown decision machinery: privileges, FSD, NOTIFY events.
• upssched(8) — best for timer-based policies beyond "wait for LB."
• nutupsdrv(8) — best for the flags shared by every driver (-F, -a, -D), which the launchd jobs depend on.
• Homebrew nut formula — best for what the package installs and its service definition.
• Eaton/Tripp Lite AVR900U product page — best for the hardware numbers: runtime curve, battery, outlets, topology.
• man pmset, man launchd.plist, man launchctl, man log — local, always current for your macOS build; best for the Apple half of every workflow here.