Password override Z2000 VFD?

Picked up one of the 30L centrifuges @IrondogAllen was letting go at bargain basement prices, and after my standard partial teardown to make sure we knew what we were dealing with, she’s up and spinning.

I recognized the control boxes and VFD, and the HMI is identical to others that I’ve worked on over the years. so I figured getting from “spinning” to “doing my bidding” would be simple.

nope.

problem is, the OEM locked me out of the VFD!! So I have access to three preset speeds, and a timer.

the fine manual explicitly states that once the password it set, the only way to remove it, it to type it in correctly. I find that unlikely. but I’m still stuck.

with the password set, you can’t GET to any other prompt…

obviously the correct route forward is to pickup another VFD, and I’m not sure we’ve even finished checking for one in-house yet, but I’m a big fan on “run what you brung” and it would be more satisfying if I could make the bits I’ve got do the thing I want.

I’ve got access to four jumpers without removing the cover from the device, two are clearly NOT what I’m looking for.

before I just start randomly shorting terminals, has anyone managed to clear the password on a Z2000 series drive in this manner?!?



2 Likes

It seems like you run into this issue a lot - do you think there’s maybe a utility that can be built that would bruteforce these bad boys if you found a way to interface them into the circuit?

If John Connor could make an ATM spit cash out it can be done!

4 Likes

Is there a zip drive port in that one? Wonder if you could get any info that way??

I do think one could perform a brute force password attack if they understood the problem.

My skills are not there. Were I to try picking them up, I’d have to drop something else.

This is the first time I’ve hit this issue on these vfds. I’ve interacted with implementations from two vendors that use this model VFD, but didn’t lock the user out.

This particular fuge has zero makings with which to ID OEM

Do these have any lockout features where if too many incorrect attempts are detected it locks the ability to enter a password?

1 Like

Function code PP.01

Nope, not that I’ve run into

2 Likes

Right, but if you can’t GET to pp.01 without the password, how do you alter it?

1 Like

In the manual for this one it says there is a main reset using code PP.01.

1 Like

Ahh. Well sheet.

1 Like

Uh huh.

But you cannot get there.

Because you need to enter the password FIRST

2 Likes

So the whole screen and touch is locked out?

I can be an ijot just like the next guy, but if it was as simple as reading the line right after the screen capture I posted, y’all would haz have had me on ignore long ago :shushing_face:

3 Likes

I can call a tech that programmed all of our vfds and ask if you’d like? I’m curious now if ours locks out like that I want to be able to reset and get her rocking again.

Attempts to enter “parameter” mode are met with password prompt. 65k possibilities

1 Like

Oh snap…man that’s bad

My guess is there IS a reset jumper. Brick on forgotten password is stupid.

FIC and FOV are mentioned in the fine manual, so it’s neither of those.

1 Like

Found a quick howto on youtube - YOU’RE WELCOME

But on the real this is sort of an interesting topic to me. I have some in my basement (a vfd, but not the specific model) but nothing I think that uses a password. I’m gonna go grab one and see what’s up in its gutzzzzzzzz

My thinking is that if I can find where in the circuit something can be entered in data-wise maybe I can jump it over to an RPI to talk to it? I have no clue. These things just seem interesting.

7 Likes

Should be a master reset code. Have you called mfg? Maybe you already did and I failed to read that part?

2 Likes

yes their response was…
控制器很好不需要解锁

英语男孩,对你没有帮助

9 Likes