We are talking about the gas compressor pump. You would need to fabricate a mount for the pump. You would need to fabricate/bend pipe from the expansion column on the back of the IES machine to the CO2 pump inlets, and then from the CO2 pump outlet ports back to the IES machine. If using a hydraulic-powered pump, run hoses from the new gas booster pump to the IES hydraulic pump. That is not too complicated.
Getting the IES PLC to control a different pump is more difficult (beyond me since I am not a programmer or elec. engineer), since the way the IES pump is controlled would be different than any other pump (see my original post, point #3).
Iâve reassembled and commissioned a smaller IES system without their assistance, but after running it for a couple of weeks it was clear that it was not a great fit for the folks who tasked me with that evaluation.
Flights look to be in the $2-3k range at the moment.
Iâd be willing to do it on an expenses only basis, possibly less if you manage to convince @greenbuggy itâs worth his time as wellâŚ
@cyclopath Havenât been in that part of the world yet but Iâd love to go. Have a cousin currently living in the Gold Coast area.
My biggest concern with any programming changes would be if IES or whoever they contracted to do the PLC/HMI work locked anything down with passwords as without them anyone else would have a hard time seeing or changing the original program. @Eazy_710 would you know the answer or who might?
On the programmingâŚnot sure. Look in the panel of the machine. When the PLC runs the pump, there are two solid-state relays with a green led that blinks in unison to the pump switching directions. They output to the electrical shifting valve that is mounted on the gas compressor pump. The blinking led indicates the relay being turned on and off by the PLC.
A Haskel pump would need an uninterrupted signal from one of those relays, since that pump has built-in position sensors on the pistons which tell it when to change directions. Seems possible if you can find a programmer that can crack into the PLC and read the program off it, and change it to hold the relay open instead of pulse it.
Unfortunately, the vast majority of the time, brute forcing passwords on PLCs is not generally as viable as poorly designed and protected VFDs that let you query them endlessly over modbus.
It MIGHT be possible to crack the hardware, dump the binary, reverse engineer it, etc. But thatâs something that would be a fuckton of work with no guarantee of success.
Or itâs possible that there is some vulnerability/workaround for the password, but thatâs going to be hardware and firmware dependent.
Most of the time, with PLCs, lost password == âyouâre fucked if you want to change anythingâ
(Except, notably, with versions of the Siemens Logo you linked, so long as they were programmed with Logosoft version 8.2 and below⌠which is how I cracked the controls on the hilariously expensive Millipore RO system we have/had.)
Considering that the PLC in question is likely jut a basic state machine, for an option that beats that in fast, cheap, AND good, Iâd go with:
Reverse engineer the PLC program
A logic analyzer is your friend here
Replace existing PLC with something more friendly/less dumb
Replace problematic pump with something more friendly/less dumb
Regardless of path, if you want something workable at the end of the day it would be quite a bit of work for someone with the relevant skills.
Worth a shot, but I wouldnât count on it. They may not have the ability to recover it. A full reset is almost certainly possible and probably easy. Recovery of program however ranges from trivial to functionally impossible.
Depending on how the system is set up, the password might be used to generate an encryption key that encrypts the whole system. Or it could be a simple flag that says âno touchyâ to the programming software.
If someone were to post a picture of the guts of control panel, I could take a poke around and make some more educated guesses as to what may or may not be viable.
A P&ID would be great. Even without it, from pictures I can probably take a guess at how much work it would be to reverse it.
If the password is lost or forgotten, you will have to return the PLC to AutomationDirect, to get the password cleared . The CPU contents will be erased when we clear the password, there is not a way to retrieve the project. Contact Tech Support to get an Equipment Evaluation form to fill out and return with your PLC.
@Eazy_710 manages to make contact with programmerâŚ
