Password override Z2000 VFD?

Help Support and Requests
#1

Picked up one of the 30L centrifuges @IrondogAllen was letting go at bargain basement prices, and after my standard partial teardown to make sure we knew what we were dealing with, she’s up and spinning.

I recognized the control boxes and VFD, and the HMI is identical to others that I’ve worked on over the years. so I figured getting from “spinning” to “doing my bidding” would be simple.

nope.

problem is, the OEM locked me out of the VFD!! So I have access to three preset speeds, and a timer.

the fine manual explicitly states that once the password it set, the only way to remove it, it to type it in correctly. I find that unlikely. but I’m still stuck.

Screen Shot 2023-01-11 at 8.59.26 AM
Screen Shot 2023-01-11 at 8.59.26 AM1618×342 75.7 KB

with the password set, you can’t GET to any other prompt…

obviously the correct route forward is to pickup another VFD, and I’m not sure we’ve even finished checking for one in-house yet, but I’m a big fan on “run what you brung” and it would be more satisfying if I could make the bits I’ve got do the thing I want.

I’ve got access to four jumpers without removing the cover from the device, two are clearly NOT what I’m looking for.

before I just start randomly shorting terminals, has anyone managed to clear the password on a Z2000 series drive in this manner?!?

image
image1920×2560 200 KB

image
image1920×2560 369 KB

image
image1920×2560 235 KB

2 Likes
Got BOCK?
#2

It seems like you run into this issue a lot - do you think there’s maybe a utility that can be built that would bruteforce these bad boys if you found a way to interface them into the circuit?

If John Connor could make an ATM spit cash out it can be done!

4 Likes
#3

Is there a zip drive port in that one? Wonder if you could get any info that way??

#4

I do think one could perform a brute force password attack if they understood the problem.

My skills are not there. Were I to try picking them up, I’d have to drop something else.

This is the first time I’ve hit this issue on these vfds. I’ve interacted with implementations from two vendors that use this model VFD, but didn’t lock the user out.

This particular fuge has zero makings with which to ID OEM

#5

Do these have any lockout features where if too many incorrect attempts are detected it locks the ability to enter a password?

1 Like
#6

Function code PP.01

#7

Nope, not that I’ve run into

2 Likes
#8

Right, but if you can’t GET to pp.01 without the password, how do you alter it?

1 Like
#9

In the manual for this one it says there is a main reset using code PP.01.

Screenshot_20230111_121901_Drive
Screenshot_20230111_121901_Drive1045×479 139 KB

1 Like
#10

Ahh. Well sheet.

1 Like
#11

Uh huh.

But you cannot get there.

Because you need to enter the password FIRST

2 Likes
#12

So the whole screen and touch is locked out?

#13

I can be an ijot just like the next guy, but if it was as simple as reading the line right after the screen capture I posted, y’all would haz have had me on ignore long ago :shushing_face:

3 Likes
#14

I can call a tech that programmed all of our vfds and ask if you’d like? I’m curious now if ours locks out like that I want to be able to reset and get her rocking again.

#15

Attempts to enter “parameter” mode are met with password prompt. 65k possibilities

1 Like
#16

Oh snap…man that’s bad

#17

My guess is there IS a reset jumper. Brick on forgotten password is stupid.

FIC and FOV are mentioned in the fine manual, so it’s neither of those.

1 Like
#18

Found a quick howto on youtube - YOU’RE WELCOME

But on the real this is sort of an interesting topic to me. I have some in my basement (a vfd, but not the specific model) but nothing I think that uses a password. I’m gonna go grab one and see what’s up in its gutzzzzzzzz

My thinking is that if I can find where in the circuit something can be entered in data-wise maybe I can jump it over to an RPI to talk to it? I have no clue. These things just seem interesting.

7 Likes
#19

Should be a master reset code. Have you called mfg? Maybe you already did and I failed to read that part?

2 Likes
#20

yes their response was…
控制器很好不需要解锁

英语男孩，对你没有帮助

9 Likes