board_home 

Visit the
UK MOT Testing
Industry Website


Autotech Training Services


 Moderated by: Stealth, MOTman, KevG, bimmer Page:  First Page Previous Page  1  2  3  Next Page Last Page  
New Topic Reply Printer Friendly
Sun DGA 1800 gas analyser  Rate Topic 
AuthorPost
 Posted: Sun Jan 17th, 2010 11:24 am
  PM Quote Reply
21st Post
MB16
Member
 

Joined: Sun Nov 15th, 2009
Location:  
Posts: 4
Status: 
Offline
Mana: 
Hi Trev16, any luck with reverse engineering the EPROM code? I'm just thinking about having a go at it myself, but wondered if you have the EPROM content you could send to me? (saves pulling my DGA apart)
Cheers!

Back To Top PM Quote Reply  

 Posted: Sun Nov 15th, 2009 12:38 pm
  PM Quote Reply
22nd Post
MB16
Member
 

Joined: Sun Nov 15th, 2009
Location:  
Posts: 4
Status: 
Offline
Mana: 
The DGA 1800 won't let you change menus when you are testing gases, until the exhaust tube is actually reading valid exhaust gases. No idea why.
Martin

Back To Top PM Quote Reply

 Posted: Sun Oct 11th, 2009 11:47 am
  PM Quote Reply
23rd Post
kev1975
Trade Member
 

Joined: Wed Sep 5th, 2007
Location:  
Posts: 912
Status: 
Offline
Mana: 
surely if it was working it wouldn't be showing a star for all of the gas levels , gases such as oxygen are present in free air & should therefore show up on the screen .

Back To Top PM Quote Reply  

 Posted: Sat Oct 10th, 2009 08:04 pm
  PM Quote Reply
24th Post
Trev16v
Member
 

Joined: Mon Sep 14th, 2009
Location:  
Posts: 5
Status: 
Offline
Mana: 
I've now got my machine set up in the house ready to start on this project. What is a little confusing is the fact that the machine seems to operate even though it is most definitely past due for calibration. For instance, it's possible to start the MOT program, and it starts going through the RPM test screens. We can also go into another screen that just shows you all of the gas levels, but for each one it just shows a star in place of the value. However, this is without the probe being anywhere near a car.

My mate actually reckons that you don't actually find out that you're locked out until you actually start trying to measure gas levels with the probe shoved up an exhaust.

I was really expecting it to be a very obvous "out of calibration!" message on the screen as soon as you try to do anything, but clearly that's not the case, so I'd be most grateful if someone could explain where it locks you out.

I'm having to ask this because, with the machine being situated where it is, it's not practical to get a car to it.

Back To Top PM Quote Reply

 Posted: Tue Sep 29th, 2009 09:47 pm
  PM Quote Reply
25th Post
Trev16v
Member
 

Joined: Mon Sep 14th, 2009
Location:  
Posts: 5
Status: 
Offline
Mana: 
Ah, interesting - I didn't realise you were talking about another fault with your DGA-1800.

I am an electronics engineer by profession so I'd like to help where I can.

Are you aware of any service manuals being available for these instruments?

Back To Top PM Quote Reply  

 Posted: Tue Sep 29th, 2009 08:49 pm
  PM Quote Reply
26th Post
Alfarusty
Member
 

Joined: Mon Jul 6th, 2009
Location: Leicester
Posts: 11
Status: 
Offline
Mana: 
Hi Trev, the gas bench i am working on is from the 1800, it is the big module in the main body of the unit just near the fan. It is manufactured by ANDROS, it has a medium sized circuit board on the top ( probably covered in dust) covered in analogue components. It has a ribbon cable connecting it to the analogue I/F board on the side of the chassis. I think the term Gas Bench is a general term . The HCR reading is usually associated with a fault although there is a slim possibility it could be because the motor has seized ( sticks out the end of our unit on a large heatsink ). I think it works by shining a light through the exhaust gas and measuring the output from some sensors that have filters infront of them that are sensitive to the different gases, the motor turns some vanes that enables the sensor outputs to be subtracted from each other to give the readings for each gas. I guess the same may be true for the other analyser you mention but i have not seen inside one. It is probably made from simple components so repairs should be possible but recalibration may be needed afterwards depending on what is changed.

The engineer did warn me about the dangers of moisture in the exhaust fumes causing problems with the gas bench and how some garages try to sniff for head gasket leaks near the radiator header... a bit damp.

Remember to take static precautions when messing with the circuit !

Lloyd

 

 

Back To Top PM Quote Reply

 Posted: Tue Sep 29th, 2009 02:56 pm
  PM Quote Reply
27th Post
Trev16v
Member
 

Joined: Mon Sep 14th, 2009
Location:  
Posts: 5
Status: 
Offline
Mana: 
Hi Alfarusty,

I now have the EPROM emulator, and as an added bonus my friend already had a 32-pin target adapter to go with it. So hopefully I have absolutely everything I need now. I am hoping to get the machine moved to where I want it and begin work at the start of next week. The emulator is a very nice and powerful machine with good real-time trace functions.

I agree that it's data within the NVRAM that would be modified when the machine is unlocked with the password. The EPROMs are indeed just plain EPROMs (not EE). The thing is, I'm not sure if I have the time or motivation to try to work out what the passwords are; instead, I think I'm just going to aim to modify the firmware within the application EPROM so that the password check is simply defeated (so that it will accept any password you give it, and allow you into the engineer menus so you can reset the calibration yourself), OR perhaps just defeat the calibration check. Really, what method I do just depends on what I can find my way to first. Then, 'unlocking' a machine would be a matter of shoving a modified EPROM in.

By the way, what is the 'Gas bench'? Is it by any chance a unit that is a little smaller and simpler than the DGA-1800, and instead just has loads of 7-segment LED displays on the front for 02, HC, and so on? Is the model number MGA-1200 or something similar to that? The reason I ask is because the father of the guy who has sourced our DGA-1800s also has a machine like I've described, and he is now unable to use it because it just displays a "HCR" calibration code on one of the displays. He says he has been able to use it for literally years but now it just displays HCR. Does this sound like the machine you're working on? I have not looked into this for him yet; I have simply no idea whether this HCR code is due to a fault condition, or because a calibration period has expired. I'm interested to know more about how you're getting on with this.

Cheers,

Trev

Back To Top PM Quote Reply  

 Posted: Tue Sep 29th, 2009 11:10 am
  PM Quote Reply
28th Post
Alfarusty
Member
 

Joined: Mon Jul 6th, 2009
Location: Leicester
Posts: 11
Status: 
Offline
Mana: 
Hi, just as a suggestion i wonder if reading and modifying the RAM is the solution. The EPROMs are not EEPROMS? so they can't be updated within the machine when the engineer unlocks it . The RAM is battery backed so would /could keep the status of the locked section of the code? I doubt if it would be conveniently labeled 'Locked=true' but comparing a locked vs unlocked unit may highlight the area.

Other things to try could be to replicate the first power on? Several possibilities here, if i were designing the machine it would default to working without being locked but it could default to locked. Either way if it didn't know the time the date related code would have to start from some point and maybe it is the other number you found?

The Engineer didn't imply that having a dead battery with the RAM was a big issue, but that is relative, if you have all the data nothing is a big issue.

Sounds like you are having fun, email me at Alfarusty@fsmail.net . I'm currently reverse engineering the Gas bench to fix the 'HCR' displayed in the calibration screen problem, usually £300 to fix.  

Back To Top PM Quote Reply

 Posted: Thu Sep 24th, 2009 10:57 pm
  PM Quote Reply
29th Post
Trev16v
Member
 

Joined: Mon Sep 14th, 2009
Location:  
Posts: 5
Status: 
Offline
Mana: 
Hi all,

Just to keep you guys posted on how I'm progressing with this, I have arranged to loan a very high-end EPROM emulator which I shall collect this weekend.

I don't think I will be able to do much for a couple of weekends because I need to order a 32-pin adapter for the emulator I'm borrowing, and next weekend is a housewarming party.

In the meantime if anyone requires pictures of any parts of the DGA-1800 then let me know, because the two machines we have seem to be very complete. Well, one of them certainly is. There's even a remote control handset that sits in a charger cradle for one of them.

I have a strong motivation to achieve this because my friend and I have between us not one, but two DGA-1800s, both of which are currently calibration 'locked'. Last weekend we borrowed a horsebox to transport one over from storage and wheel it into my place, ready for the project to begin!

The ideal end goal will be to produce a set of replacement EPROMs with modified software that replace the originals.

Alfarusty: That's right - there are two EPROMs, one of which appears to be the main application code and the other which appears to contain system diagnostics software; and there is also a RAM IC that sits upon a 'stack' of sockets just as you describe, most probably with a backup battery within the stack. Yes, I too wondered what the effect would be if the battery died completely. I am keeping my fingers crossed that the one in my shed should still have a healthy battery because I'm pretty sure the last calibration sticker on the machine was as recent as 2007. I may try to extract the data from that device just to back it up. The board also has a surprising amount of RAM, about 512K I think (would need to look and check). I'm guessing it's needed for the floppy disk access, and maybe some of it is used for video RAM?

Those of you with dead 1800s, bear with me for the next few weeks and don't chuck your machine in the skip yet.

Trev

Last edited on Thu Sep 24th, 2009 11:05 pm by Trev16v

Back To Top PM Quote Reply  

 Posted: Thu Sep 24th, 2009 08:51 pm
  PM Quote Reply
30th Post
Hut Dog
Member
 

Joined: Sun Jan 18th, 2009
Location:  
Posts: 3
Status: 
Offline
Mana: 
Hi Guys, I bought one of these machines a while back with the intension of using it as a hobist. Just tried the code unfortuatly it didn't work.:(

 

Back To Top PM Quote Reply

 Posted: Tue Sep 15th, 2009 11:08 pm
  PM Quote Reply
31st Post
Wesley
Trade Member
 

Joined: Tue Sep 25th, 2007
Location: Wanted
Posts: 1841
Status: 
Offline
Mana: 
Trev16v wrote: Hi gents,

I've just joined this forum because I was searching for information about passwords for the DGA-1800.

A friend of mine has a couple of these machines, both of which need the calibration reset. It would be extremely useful to be able to reset them so that we can both have one for home test purposes.

Is the calibration reset password still a major stumbling block, or is there now someone on here who is prepared to supply it for a few pints?

The other avenue I am exploring is this. I have read the software out of the EPROMs from within one of the machines and I've started looking at reverse engineering the software, with the hope of defeating the password and / or calibration protection. However, what is interesting is that after seeing the warmup defeat code (313159) mentioned in this thread, I actually easily found that code within the ROM file. So I wondered if it's worth me looking for any other six-digit codes and then trying them out. So far, I found one other, which is 515324. I need to keep looking through to see if I find any more.

If anyone fancies trying out 515324 then please go for it. I can't get at the complete machines yet myself anyway so I'd be glad if anyone else could try any numbers I chuck up.

Edit: Oh heck, I just read Alfarusty's comment about the passcode changing daily. So perhaps not a fixed code that I can easily find in the ROM then. Ah, fiddlesticks. I'll carry on and see what I can figure out though. I'm loaning a ROM emulator which will be helpful.

Cheers

Trev





Hi Trev,

Some time back now, My Local friendly Engineer said that the "unlock" procedure could be carried out over the phone, so I passed his mobile mumber to my previous employer hoping for a result.

Sadly my previous employer is "retired" and has not done anything to unlock it yet.:(

Alfarusty, pointed out to me that 314159 is actually in mathematical terms pi 3.14159 these machines were never connected to the internet so i cannot see how the unlock code can be changed on multiple machines daily, unless you know any different keep up the good work and good luck to all present owners.;)

"One Day":cool:

Laters,

Wes.

Back To Top PM Quote Reply  

 Posted: Tue Sep 15th, 2009 10:30 pm
  PM Quote Reply
32nd Post
Alfarusty
Member
 

Joined: Mon Jul 6th, 2009
Location: Leicester
Posts: 11
Status: 
Offline
Mana: 
Hi Trev, i can't give the new number a go myself at the moment because i'm not where the machine is till the weekends but i'll try it out when i can. It is possible that a softy wrote a back door code during development and it is still active. iIhad a look at the engineers mobile phone when he was doing my machine and they send him a table of numbers every month and at a quick glance they were all different, all 6 digit and seemed to be split into 3,2,1 numbers i think but he guarded them and i didn't want to push...bread and butter etc.  

I did try doing a spread sheet mangling the date in different formats and considering them as ascii characters but at the time i wasn't sure the password was a number so gave up, i doubt if the password is very complex and i think it must be calculatedby the software from the date as there wasn't enough memory for a look up table, maybe this other number is the offset or first code for when the battery dies?

From what he was saying there were 2 proms with the MOT program in them identified by version numbers and there is a 3rd prom on a stack of sockets ( one is a keep alive battery for the data i think ) what happens if the battery dies i don't know but it could crash out of the MOT program and default to normal? or could turn to cabbage.

good luck ! fun isn't it reverse engineering.

Lloyd

Back To Top PM Quote Reply

 Posted: Mon Sep 14th, 2009 09:54 am
  PM Quote Reply
33rd Post
Trev16v
Member
 

Joined: Mon Sep 14th, 2009
Location:  
Posts: 5
Status: 
Offline
Mana: 
Hi gents,

I've just joined this forum because I was searching for information about passwords for the DGA-1800.

A friend of mine has a couple of these machines, both of which need the calibration reset. It would be extremely useful to be able to reset them so that we can both have one for home test purposes.

Is the calibration reset password still a major stumbling block, or is there now someone on here who is prepared to supply it for a few pints?

The other avenue I am exploring is this. I have read the software out of the EPROMs from within one of the machines and I've started looking at reverse engineering the software, with the hope of defeating the password and / or calibration protection. However, what is interesting is that after seeing the warmup defeat code (313159) mentioned in this thread, I actually easily found that code within the ROM file. So I wondered if it's worth me looking for any other six-digit codes and then trying them out. So far, I found one other, which is 515324. I need to keep looking through to see if I find any more.

If anyone fancies trying out 515324 then please go for it. I can't get at the complete machines yet myself anyway so I'd be glad if anyone else could try any numbers I chuck up.

Edit: Oh heck, I just read Alfarusty's comment about the passcode changing daily. So perhaps not a fixed code that I can easily find in the ROM then. Ah, fiddlesticks. I'll carry on and see what I can figure out though. I'm loaning a ROM emulator which will be helpful.

Cheers

Trev


Last edited on Mon Sep 14th, 2009 10:05 am by Trev16v

Back To Top PM Quote Reply  

 Posted: Sun Sep 13th, 2009 10:33 pm
  PM Quote Reply
34th Post
Alfarusty
Member
 

Joined: Mon Jul 6th, 2009
Location: Leicester
Posts: 11
Status: 
Offline
Mana: 
Hi, i have sent you some photos of the back but haven't done the inside as i didn't want to disturb the calibration. i had a look in when the man was setting mine up and got him to explain a bit so if you send me photos of what you have i might be able to help a bit more.

Lloyd

 

Back To Top PM Quote Reply

 Posted: Fri Sep 11th, 2009 10:19 pm
  PM Quote Reply
35th Post
Alfarusty
Member
 

Joined: Mon Jul 6th, 2009
Location: Leicester
Posts: 11
Status: 
Offline
Mana: 
Hi, its going to have to be after the weekend as my machine isn't local at the moment. i'll see what i can get.

lloyd

 

Back To Top PM Quote Reply  

 Posted: Fri Sep 11th, 2009 11:18 am
  PM Quote Reply
36th Post
golden-net
Member
 

Joined: Wed Sep 9th, 2009
Location:  
Posts: 3
Status: 
Offline
Mana: 
Hi Mate,

Any chance of those pictures?

Regards,

Chris

Back To Top PM Quote Reply

 Posted: Thu Sep 10th, 2009 12:00 am
  PM Quote Reply
37th Post
golden-net
Member
 

Joined: Wed Sep 9th, 2009
Location:  
Posts: 3
Status: 
Offline
Mana: 
Hi Mate,

Yep that was the one on ebay. He wanted the cabinets to put parts in, I did know that when I bid. Didn't realise half the casing would be missing though! Yep someone cut thru or pulled off the plastic piping..... the :( gits. Thanks for the info, I'll have a look tomorrow see whats what. I got all the bits, filters, printer, leads etc... so far as I can see.

If you could sent some pics that would be brilliant. Its chris@nvqs.net

Thanks

Chris

 

Back To Top PM Quote Reply  

 Posted: Wed Sep 9th, 2009 11:21 pm
  PM Quote Reply
38th Post
Alfarusty
Member
 

Joined: Mon Jul 6th, 2009
Location: Leicester
Posts: 11
Status: 
Offline
Mana: 
I can send you a picture or 2 if you send an email address, the chassis should slide out like a filing cabinet draw so there should be no need to have cut any pipe inside ( please say he hasn't ) . There should be a pair of filters out side the chassis did you get them? As a quick guide there should only be 2 pipes and 1 small filter sticking out the middle of the rear panel. when you start the machine and it is doing the count down with the pump running air is sucked in through the small filter not through the 2 filter bowls. nothing more to do to that one. Air should be puffing out of one pipe.. this one goes to the T peice at the bottom of the filter bowls and blows away vapour/ moisture. The final pipe goes to the filter bowl ( far right hand side with right angle union) the exhaust probe goes to the input to the filter bowls on the left. When you do a leak check air should be sucked in through the filter bowls/ exhaust probe not the small filter sticking out the back.

I think i was watching that ebay sale, did he state is was sold without trolley? collect from london?.... why?

You should try to ensure cooling air is directed over electronics, put newspaper over top worked for me.

enjoy.

Lloyd

 

Back To Top PM Quote Reply

 Posted: Wed Sep 9th, 2009 10:11 pm
  PM Quote Reply
39th Post
golden-net
Member
 

Joined: Wed Sep 9th, 2009
Location:  
Posts: 3
Status: 
Offline
Mana: 
Hi All,

So I got me a cheap DGA - 1800 - 96 Sun gas analyser of ebay. Budgeted for an engineer to switch off the MOT lock. Guess what?..... When I picked it up the guy had decided to 'take the cabinet' so I got all the leads (good) + two caseless bits and a screen.

The thing starts OK (at least the menus etc come up on the screen) but he has cut so many air pipes getting it out of the case that I can't see wot goes where, so of course it is reporting a 'leak'. Got a user manual OK, but it does not go in to detail regarding a parts diagram - that is copyright apparently!

So can anyone let me have a picture of the back of their machine, especially with the lid of so I can see wot goes where!

Thanks for any help.

Chris

p.s. I have a copy of the operators manual if any one wants a copy........

Last edited on Wed Sep 9th, 2009 10:15 pm by golden-net

Back To Top PM Quote Reply  

 Posted: Thu Sep 3rd, 2009 06:00 pm
  PM Quote Reply
40th Post
Alfarusty
Member
 

Joined: Mon Jul 6th, 2009
Location: Leicester
Posts: 11
Status: 
Offline
Mana: 
:( Ok i gave up and got a SUN man to come and turn it off the MOT program. Apparently the password changes daily so chances are if some one finds out what it is it would be out of date by the time you use it. He said he was told by someone that there was a site on the internet that could predict the password ( number ) but i couldn't find it.

He also said that because it had gone passed the cal due date and locked out it had to have cal gas passed through it before the password would unlock it so i needed him to come and unlock it. ***So if you are thinking of buying one off EBAY like i did and they say it is out off cal extpect to part with money ***.

He did tweek it while he was here to get it back in spec. The extra leads i have are for triggering of the injectors and connecting to a BMW.

This model is still a MOT grade machine so it is still serviced by SUN and hence they still control the  password.

Good luck sorting yours !

Back To Top PM Quote Reply

Current time is 07:27 pm Page:  First Page Previous Page  1  2  3  Next Page Last Page    
MOT Forum - The MOT Testing Forum for the UK MOT Testing Industry > Trade Category (MOT Trade Discussions) > Equipment Forum - Advice on Parts, Service, Performance etc | MOT Forum > Sun DGA 1800 gas analyser Top




UltraBB 1.172 Copyright © 2007-2011 Data 1 Systems