2011
03.02

A common question among commenters to this blog when I write about my Stratasys FDM 1600 is “how did you hack the cartridge?”  Newer Stratasys machines such as the Dimension series (P-Class machines – I assume named after the Prodigy, which I think was the first Stratasys machine to use cartridges) don’t have plain old wire welding type spools like the old FDM series – instead, they have the filament stored in a large cassette.  This is nice as it keeps the filament dry without having to keep it in a dry box and it makes loading in new material (or swapping colors) a breeze.  On the down side (as many Stratasys owners have apparently discovered), Stratasys went the route of inkjet printer manufacturers and have ‘chipped’ their cartridges so that you can’t simply refill the cartridge with material and continue on.  While this isn’t a hindrance to me and my old machine, I’ve still been curious to know if there’s a way around this (if I ever come across a Dimension for cheap, I’ll need a way to feed it as well).  Note: I understand the big T-class machines (named after the Titan model, I assume) still use large spools, though I believe the spools also have a chip module (but hey, if you can afford to buy a T-class, the consumables cost probably isn’t a big concern).

Inside each Stratasys cartridge is a Maxim DS2433 one-wire EEPROM (in a SO-8 package) that the machine communicates with. This is a simple 4kb (that’s kilobits – only 512 bytes of storage) device, and reading/writing them is reasonably straightforward – a library most likely exists for 1-wire communication no matter what your microcontroller of choice is (Arduino enthusiasts, look here). Dumping the contents of one yields hexadecimal gibberish, unfortunately. What’s more, you can’t simply clone one of them, as each has a unique 48-bit serial number lasered onto the die at the time of production, and this serial (presumably) is used as the seed to encrypt/obfuscate the EEPROM data. This has been enough to dissuade most tinkerers from playing further with the system, though Bolson Materials may very well have cracked the code, as they are able to provide new EEPROMs with their cartridge refill spools.

Thanks to some hacking by the shadowy figure known as ‘Dervish’, it’s been found that only a small portion (12 bytes) of the EEPROM is dedicated to storing how much material is left on the spool.  As a cartridge was used, the EEPROM was read out at various points and only bytes 0×58-0×63 changed over the life of a cartridge.  Specifically, here’s the layout of data on the EEPROM as known thus far as a result of reading EEPROMs from several brand new cartridges:

0×00-0×41: scrambled data (commenter lgg2 noted that 0×28-0×2F is identical to 0×30-0×37, highlighted in purple)
0×42-0×45: 0×00000000
0×46-0×47: scrambled data
0×48-0×4A: 0×55AA55 (highlighted in green)
0×4B-0×4D: scrambled data
0×4E-0×4F: 0×71BE, 0×72BE, 0×73BE, 0×74BE, or 0×75BE
0×50-0×51: scrambled data
0×52-0×57: 0×000000000000
0×58-0×63: filament remaining (scrambled data, highlighted in yellow) – on an unused spool, 0×62-0×63 is always 0×4BB9, but this gets modified (along with 0×58-0×61) as the cartridge is used.  Perhaps 0×62-0×63 is an unencrypted checksum?
0×64-0×67: 0×00000000
0×68-0×70: 0×535452415441535953 (‘STRATASYS’ in ASCII, highlighted in dark blue)
0×71-0×1FF: scrambled data

Simple enough, right?  Just read in the EEPROM at 100% full, respool it with generic material when empty and write the 100% full data back to the EEPROM…  Well, not quite.  You can certainly use this respooled cartridge in a different machine, but not in the same one, as they remember what cartridges they’ve already used (that serial number on the EEPROM).  This is where Dervish tore into the guts of the machine and began the really clever hacking.  When you open up the side panel of a Dimension, here’s what you see (image taken from Brad Rigdon’s Print To 3D gallery):

Brad also has a nice video on youtube that shows the full workings of the machine. The electronics appear to be composed of 3 boards – the large PDB (Power Distribution Board) on the left, the SBC (Single Board Computer, just a PC) in the center right above the hard drive, and what appears to be a motion controller board (in the upper right, connected to the SBC via a 16-bit PC/104 header). As per the troubleshooting section of the Dimension/SST Service Guide, the motion controller board in the upper right is known as the ‘186 board’.  The SBC pictured appears to be an Ampro P5v, though some Dimensions use a Nova-600.  After connecting a keyboard and monitor to the SBC, Dervish found that the computer is running Linux (Red Hat 8, specifically – not Fedora 8, but the circa 2002 version with a 2.4.x kernel).

By rebooting the system he was able to enter single user mode (at the LILO prompt, enter ‘linux single’) and could change the root password to whatever was desired (type ‘passwd’ at the prompt, enter a new password, then enter again to confirm). After rebooting once more into standard mode as root with his newly minted password, he modified /etc/sysconfig/iptables to open up port 22 so that he could ssh into the system and hack remotely without having to be at the console itself (the sshd daemon does not run by default, so adding the line ‘/etc/init.d/sshd start’ to /etc/rc.local is also required).   While he had been able to modify temperatures on the machine by using Stratasys’s ‘Maraca’ software (the CatalystEX software offers no ability to tweak the system), direct access to the SBC allows much greater control over process parameters such as adjusting rollback.  All the configurations are stored within the /mariner/config tree (the hard drive image covers multiple models), and it can be tricky to determine which ‘gender’ (kona, lanai, spinnaker, oahu etc.) corresponds to a given machine, but noting which directory has the most recent modification date is a dead giveaway.

The holy grail turned out to be the discovery of an innocuous sounding file named ’system.dat’ located in the root directory.  This is where the Dimension apparently stores a list (in binary) of all the cartridge EEPROM serial numbers that it has seen before.  Delete this file and the machine gets amnesia, allowing respooled cartridges (with the EEPROM rewritten to show 100% full) to be used again.  I assume creating a cron job to delete this file periodically (or using rc.local to delete it on startup) would also work.

As far as I know, this constitutes the cutting edge of Stratasys hacking – I’ve heard rumors before of people having bypassed the cartridge EEPROMs, but this is the first concrete information I’ve seen on how to accomplish it.  If anyone has further information, please leave a comment!

192 comments so far

Add Your Comment
  1. Hi,

    Has anyone tried to replace the DS chip with a micro-controller, like atmega8?
    It’s no problem making a atmega board with a button to reset back to original data.
    has anyone been able to connect anything else than the original DS chip to cummunicat with the machine?

  2. Jarno you were asking how to “upgrade” a SST 768 to a Elite.
    I have a 768BST, and to me it looks like it’s probably different head since the BST only has one temperature in the head. and the elite probably has two.

    Your SST also has two i suspect.
    can build with two different temperatures on material and support or can only have one headtemp like on my BST?

    I talked to a technician some time back and he said the new one’s are based on ball screws while mine are using wire.
    But while ball screws are better at positioning it has nothing to do with what materials it can handle. That is what I’m interested in widening, since i can only use the P400 and breakaway support.
    first off i want to be able to use water soluble support, secondly it would be great to be able to use more modern materials.

    In my machine it’s ready for connecting another temperature sensor, and probably different two-temp head also. Other than that i suspect it’s only a matter of software?

    I will “Root” my BST today and investigate a bit. but don’t be betting on me finding the answer, with two kids and toooooo much work to do, other than hacking.

    Anyone done an upgrade from BST to Elite?
    Anyone out there with a spare head for an sst or elite mashine?

  3. Hello Peter,

    We are buying a SST version, but will be delivered at February. If of interest, I have the 768/Elite Service and Maintenance Manual (713 pages), so you can give a look at it.

    About materials, go to take a look on isquared. It is a german company delivering ABSplus and ABS M30 materials for the 768 printers, and it costs 1/3 less compared to original ones.

    Would be nice if we could cooperate in this upgrade challange :-)

    • Hi Jarno,

      I have the Elite version of the printer at my work. is it possible for you to send me the service and maintenance manual ?

      I will try to hack it.

    • hello peter i am based in Argentina, and I have a 768 now that I have to calibrate, it is used machine. Could you share the Maintence Manual with me. We have no manual down here. Also you advice buying the material from inquired or hacking the machine? Thanks.¡ José

    • Hi Jarno,
      i am a teacher and my school have buy a Elite 3d printer, could you send me “the 768/Elite Service and Maintenance Manual (713 pages)”
      thanks

      vincent

    • Peter,

      I have a SST machine that I’m working on can you send the repair manual. It too old for dealer support.

      Thanks,
      Mike

  4. It seems to me that we should just be able to source the DS2433 – it’s a commonly available part, and flash the microcontroller with the same (or similar) micro code as on the factory ones. A careful hack might disable the part of the code that decrements/increments the valued stored in the counter.

    This means that it won’t be neccessary to bypass the ID code in the chip, provided the user data in the chip is correctly implemented. The trick is figuring out how to decipher the user ID data, compared to the chip code. I see multiple avenues for attack here, since the cartridge chip is easily probed, but it will basically boil down to whether the cryptographic polynomial used for the user hash can be bypassed. It might come down to looking at a de-capped device under a microscope.

    • May have posted too soon. Closer reading of the data sheet indicates that the ID code is not a user setting like some RFID systems (as I’d expected), but entirely fixed. Soooooo, if that’s the case, then it might be possible to simply overwrite a new chip and do a brain-swap. Anybody want to try?

      • The DS2433 is not a microcontroller – it’s just a serial EEPROM. The unique serial number of the EEPROM is used as part of the encryption key, so simply copying the contents from one EEPROM to another will not work, as the key is different.

  5. Hi all,

    first of all, thanks for the nice docs … I got a BST 768 into my access lately and due to the same motivation to use cheaper or other materials I did open up our machine as well. My colleagues, who were working with the machines did not have the courage to do it :-) …
    I also did “backups” of all our cartridge chips using a simple 1wire-usb adapter with the basic 1wire demo software, what allows direct reads and writes. I even played around with a simple battery powered microcontroller circuit what would record the chip content (of an unused cartridge) and write back that data when the spool came close to 0% …
    Next time when I have spare time, I will move the breadboard circuit to a more professional looking built :-) … Probably a TI Launchpad micro kit with USB for approx. $5 could be a good platform as well.

    What would be great if those who made experiences with different materials could set up a table with sources, quality evaluation and usage hints, so that others (including me) could more easy gain from those experiences.
    So far we have used original Stratasys materials, Bolson and noname chinese ABS, all with good results without changing parameters. To be more productive here, I probably could play around with the MARACA tool, if I could get hold of it, too.
    In the moment we are looking for good and cheaper breakaway support material. Any good source in Europe known ?

  6. I’ve a stratasys 400mc.
    Based in Central UK.
    I’d like to try this modification. I’m looking for a linux consultant to help..Has anyone any recommendations?

  7. Hi all,

    I have a SST1200 which does not boot. The Display on the panel remains empty.
    I tried Power cycling many times. On the Diag port I got the following:

    Running POST
    Internal Flash CRC Test [PASS]
    SDRAM Addr Test [PASS]
    ISA DPM Addr Test [PASS]
    Pmd DPM Data Test [PASS]
    External Flash CRC Test [PASS]
    NVRAM check [PASS]
    Supply Voltages
    5V supply: 5.07V Range: 4.85 to 5.15 [PASS]
    12V supply: 12.00V Range: 11.28 to 12.72 [PASS]
    15V supply: 16.00V Range: 13.50 to 16.50 [PASS]
    -15V supply: -15.77V Range: -13.50 to -16.50 [PASS]
    10V supply: 10.00V Range: 9.84 to 10.16 [PASS]
    3.3V supply: 3.30V Range: 3.23 to 3.37 [PASS]
    Navigator checksum: 0×12345678
    Navigator version: 0×28400F23
    Pilot checksum: 0×12345678
    Pilot version: 0×34100F20
    Pmd DAC Tests
    XSin@0.00V: 0.01V Range: -0.06 to 0.06 [PASS]
    XSin@2.15V: 2.24V Range: 1.96 to 2.34 [PASS]
    XSin@4.30V: 4.35V Range: 3.98 to 4.62 [PASS]
    YSin@0.00V: 0.01V Range: -0.06 to 0.06 [PASS]
    YSin@2.15V: 2.25V Range: 1.96 to 2.34 [PASS]
    YSin@4.30V: 4.33V Range: 3.98 to 4.62 [PASS]
    ZSin@0.00V: 0.01V Range: -0.06 to 0.06 [PASS]
    ZSin@2.15V: 2.25V Range: 1.96 to 2.34 [PASS]
    ZSin@4.30V: 4.34V Range: 3.98 to 4.62 [PASS]
    Controller board EEPROM CRC Test [PASS]
    Controller Configuration ID: 0
    Controller part number: 202414-0001
    Controller serial number: 0641-002175
    Power Dist board EEPROM CRC Test [PASS]
    PDB Configuration ID: 0
    PDB part number: 202143-0003
    PDB serial number: 0647-001636
    CPLD version: 29
    ColdFire version: 0 rev: 0
    Mariner build: 1710.0
    Cause of last reset: Power Cycle
    POST successful
    last act:289216 / req:244297 / malloc:651/0 / stk:1180/11196
    act:279648/268768 / req:234729/231646 / malloc:538/0 / stk:2436/11196
    Running POST
    Internal Flash CRC Test [PASS]
    SDRAM Addr Test [PASS]
    ISA DPM Addr Test [PASS]
    Pmd DPM Data Test [PASS]
    External Flash CRC Test [PASS]
    NVRAM check [PASS]
    Supply Voltages
    5V supply: 5.06V Range: 4.85 to 5.15 [PASS]
    12V supply: 12.00V Range: 11.28 to 12.72 [PASS]
    15V supply: 15.98V Range: 13.50 to 16.50 [PASS]
    -15V supply: -15.74V Range: -13.50 to -16.50 [PASS]
    10V supply: 10.00V Range: 9.84 to 10.16 [PASS]
    3.3V supply: 3.30V Range: 3.23 to 3.37 [PASS]
    Navigator checksum: 0×12345678
    Navigator version: 0×28400F23
    Pilot checksum: 0×12345678
    Pilot version: 0×34100F20
    Pmd DAC Tests
    XSin@0.00V: 0.01V Range: -0.06 to 0.06 [PASS]
    XSin@2.15V: 2.25V Range: 1.96 to 2.34 [PASS]
    XSin@4.30V: 4.35V Range: 3.98 to 4.62 [PASS]
    YSin@0.00V: 0.01V Range: -0.06 to 0.06 [PASS]
    YSin@2.15V: 2.25V Range: 1.96 to 2.34 [PASS]
    YSin@4.30V: 4.33V Range: 3.98 to 4.62 [PASS]
    ZSin@0.00V: 0.01V Range: -0.06 to 0.06 [PASS]
    ZSin@2.15V: 2.25V Range: 1.96 to 2.34 [PASS]
    ZSin@4.30V: 4.34V Range: 3.98 to 4.62 [PASS]
    Controller board EEPROM CRC Test [PASS]
    Controller Configuration ID: 0
    Controller part number: 202414-0001
    Controller serial number: 0641-002175
    Power Dist board EEPROM CRC Test [PASS]
    PDB Configuration ID: 0
    PDB part number: 202143-0003
    PDB serial number: 0647-001636
    CPLD version: 29
    ColdFire version: 0 rev: 0
    Mariner build: 1710.0
    Cause of last reset: Power Cycle
    POST successful
    last act:289136 / req:244217 / malloc:651/0 / stk:1188/11196
    act:279648/268768 / req:234729/231646 / malloc:538/0 / stk:2212/11196

    Any help would be fine.

    Thanks,
    Robert

  8. Hi folks,

    hope you could help out as our BST 768 stopped to work. I assume there is something wrong with the alignment before starting to build the part.
    Whenever were are starting a printout the BST 768 starts to work, the build platform is moving around for some seconds and then the system shows CODE 14,100 on the LCD display and the BST 768 is rebooting.

    Unfortunately, the CDROM with the error codes is archived somewhere where we can’t find it. Probably somebody could help us out with the meaning of that error code or
    behavior ?

    Thanks,
    Yogi

    • HI Folks,

      after some search and analysis it turned out that the sensor Z home became defective, but only, when the printer was heating up …
      We ordered the switch (a part worth 6€ ) and replaced it and now our BST 768 is running as well as before …

      • hi I have the same problem with bst 768 and same error CODE 14,100. where is placed that switch and where did you ordered it for €6?

        thanks, Filippo

  9. Hi guys!

    I have an older BST1200 with recently updated firmware that I’ve been trying to figure out. I’ve written lines into the rc.local to delete any system.dat files I could find among the various partitions but the reloaded/reflashed cartridges don’t seem to be resetting. If I wipe the printers HDD and reload it with my backup.img the reset cartridges can be used so I figure the firmware update must have started storing the EEPROM data in some other files (aside from just in the system.dat files). Any recommendation on how I could go about finding those files?

    Best,
    Kain
    kain3713@gmail.com

  10. other think
    I have a problem with a full cartridge. It’s blocked because the tip is inside.
    I cut it off and I don’t even see them.
    Is there a chance for this cartridge?

    • Open the cartridge with a 7/64 hex wrench—turn the cartridge upside down, unscrew the four bolts, BUT DON’T OPEN THE CARTRIDGE UNTIL IT’S RIGHTSIDE UP.
      Turn the cartridge rightside up, keeping track of the four bolts, cut, loosen, or remove the side id sticker so the top half of the cartridge can be lifted off.
      Then you can extend or retract the filament, as needed.
      To close it up, make sure the 2 pinch rollers, dessicant bags, and the gasket are in place, then put the lid back on, hold the halves together while you turn the cartridge upside down. Insert and tighten the 4 bolts, and you’re done!

  11. Hi

    My friend have a SST 768 and the hard-drive seem to malfunction. Is there any way that he can get the software (OS etc.) to setup another drive ?

    Regards

  12. Hello all.
    We have a Dimension Elite that we are working over. We successfully installed the rc.local trick to remove the internal cartridge logs, but have been having problems dumping the cartridge chips. We have tried both the arduion approach (1 wire interface etc), and the DIAG port trick. The DIAG report does not echo anything back, and the chips respond with all zeros (including the ROM portion), so it feels like we are doing something wrong on both fronts.

    Can someone look over my code snippet and tell me what I am doing wrong? Should I post a link?

    • Well,

      I always used a cheap USB-1WIRE dongle to connect and read/write the chips. BUT, we always are using the DIAG terminal interface as well.
      Is the DIAG not answering anymore or just not giving back any EEPROM data ?

    • I have the exact same problem. I have no idea what im doing wrong.

    • Hi Meawoppl, may I know how you installed the rc.local trick?

  13. Guys, may be someone of you has Insight software? it should be relatively new, cause i want to experiment with fortus 250mc files.
    I’ve done some research and now i am able to print files with 0.07″ layer height with my sst1200es.

    I wiдl appreciate any help from you. Thanks. you can find me by mail ashanin @ gmail.com (removes spaces)

  14. Eureka! Nice site. Now, my problem. I have an FDM-3000 which was running fine until I took head out to clean nozzels. Now on startup, the CTM150 user keypad shows that it booted and passed by displaying “Version 2.00 Test OK”, but the FDM controller no longer displays it’s v9.07 check or the controls for the feed motors to LOAD/UNLOAD or any other FDM controller interface. It did a pin-to-pin continuity check of the head-to-controller cable, all good. I tried pressing the RESET button which connects to the DS1232 guard chip, but no “reset” of the FDM controller. I ordered a new HPC46003V20 microprocessor and DS1232 chip, but I read in the data sheets that the microprocessor has built in user programmable ROM in addtion to the two EEPROM’s called “HI” and “LO” mounted on the FDM controller board. I would really like to connect with someone who can troubleshoot an FDM-3000 for cash or sell me the FDM controller service manuals and any BIOS that I need to flash to the microcontroller. It’s a great machine, just some little fiddly component is FUBAR and needs repalcement. Please advise. Thanks.

  15. Also, I wondered if any clever fellow has worked up an Arduino-based controller that can replace the Stratasys controller. That would be a major benefit.

  16. im using a BST120es but somehow i fail to get a serial connection to the diag port.
    i tried three different USB2Serial converter, different cables, swapping TX/RX a.s.o.
    and all the possible settings for the com-port (38400 8N1) but i never get anything back
    from the printer. i used putty (win7), minicom and gtkterm (ubuntu) nothing worked …

    does anyone have an idea hint what the problem might be ?!

    thnx
    Marc

    • Any chance you can try using a computer with a built-in serial port? I have had mixed results with USB converters in the past, and I run my FDM printers off of computers with built-in ports.

  17. I’m adding this line:

    rm system.dat

    to etc/rc.local, but it doesn’t seem to be doing the trick. Any pointers would be appreciated.

    Jeff

  18. Also, I notice that etc/grub.conf is now blinking with a red background in the directory listing. How can this be fixed?

    Jeff

  19. Thanks all for all the wonderful information but I am having problems with hacking a dimension 1200. I have followed all the procedures and no go. Has anyone out there simplified the procedure any more? When I try and re-flash the chip it just sits there and does nothing. Any help would be greatly appriciated.

    • Rick, what are you using to re-flash the EEPROM? Can you do an EEPROM read to see if the contents are what you expect?

  20. hello,
    like KELL as saying, someone trying to load code from a full cartridge in a new epprom?
    cordially

  21. The newest firmware update I downloaded from the server updates the kernel to 2.6.23.15-137.FC8 from the old 2.4.18-24. Instead of the LILO boot it uses GRUB and loads a disk image at boot.

    I guess it’s a nice upgrade but if you opened port 22 before. Updating to this firmware. Closed that hole.

    • It can certainly be reopened – also, I believe the filesystem is mounted read-only now, so remount r/w before you try making any changes to the firewall settings.

  22. I mounted the drive in another machine with Ubuntu. chroot’d to the drive from the printer. erased the shadow file from /root/etc/ and then ran passwd root to change the root password. I changed all of the grub.conf files and removed the RO from them.

    Best part of this whole thing. Good by Vi. Nano is part of the update.

    • Yep, mounting the drive in another machine is the easiest way – if you are doing the modifications right on the live system, though, it’s a little trickier with having to remount the filesystem and such.

      • Just for the fun of it. chkconfig –add sshd will add the sshd to the boot init. chkconfig sshd on turns it on. Then while I was adding port 22 to the iptables I removed the outbound reject rules. Added some DNS name servers to the hosts file. Renamed the hostname to 3D-Printer from Master. Since the printer can now speak to the outside world, I updated yum. And am now in the middle of upgrading the packages from a yum check-update. I think I will either pick up a pata SSD for it. Or possibly a pata/sata adapter and put a more readily available sata ssd in it just because I don’t like old Seagate drives.

  23. Oops. Don’t upgrade the kernel to 2.6.26.8-57.fc8. The mariner modules were not compatible. Grub back to the old one.

  24. Pulled the PC104 board out of my machine to see what it was. Advantech PCM-9371 with 128MB memory. Here is the user manual.

    http://advantech.vo.llnwd.net/o35/ProductFile/1-K3BUH/PCM-9371_Manual_ed.1.pdf

    Just in case anyone wants to play with the board. It does have a compact flash slot on the back to use a solid state card. IDK why they would put a hard drive in this thing if they could have used that instead.

    • I’m guessing they skipped using the CF card to make sure that their main drive image was backwards compatible with older hardware (the system software has been very picky about being run from /dev/hdc, for example).

      • Just for fun. I think I might up the memory in this thing from the 128 to 512 and DD the drive to a CF card. I wonder if I could order something from Advantech with a newer pc on card that would work with this thing. Probably a waste of time. But I just want to mess with it.

  25. I have a Dimension 768 BST and the hard rive is corrupt, completely lost partition 1, if anyone can get me an ISO, discs or clone a drive for me I would be willing to pay for it. I need my machine!!
    thanks!

  26. i have a dimension 768 bst, the hard drive has failed. could anyone give me an image of the drive? thanks
    noonevav1@gmail.com

    • sorry email is noonevac1@gmail.com

    • Matt, I think the drive image may be tied to whatever firmware your mainboard is using, so it may not be a simple re-image job. Also, I’ll mention it in a future blog post, but there’s apparently a new forum for Stratasys users that you might want to ask on: stratasysusers.org

      • thank you
        i have the service manual and went through the trouble shooting. i have squares across all the lcds.

        • What generation controller bay does your machine have?

          • how do i tell what generation controller bay i have? if you email me i can send you a picture. my direct email is mattk@flexibleconcepts.com
            thanks, any help would be greatly appreciated

            • Gen 1 electronics have a 186 based controller board, while Gen 2 and 3 have a Coldfire based controller. Gen 3 controller has a column of LEDs on the top right of the board, but Gen 2 does not.

          • its a gen 1 with the 186. i got a new hd from strat. still have dark squares across all lcd’s. think it might be the SBC which is a Ampro p5v. what goes bad in these the embedded cmos?

            • turned out to be a bad front display that was keeping the machine from booting and displaying squares across all screens.

  27. I have “Dimension sst1200es” 3D printer. After the voltage source reset suddenly the printer givinig me message “Starting up. Finding home” to lcd display. What should I do? Can anybody help me?

    Running POST
    Internal Flash CRC Test [PASS]
    SDRAM Addr Test [PASS]
    ISA DPM Addr Test [PASS]
    Pmd DPM Data Test [PASS]
    External Flash CRC Test [PASS]
    NVRAM check [PASS]
    Supply Voltages
    5V supply: 5.04V Range: 4.85 to 5.15 [PASS]
    12V supply: 11.98V Range: 11.28 to 12.72 [PASS]
    15V supply: 15.88V Range: 13.50 to 16.50 [PASS]
    -15V supply: -15.82V Range: -13.50 to -16.50 [PASS]
    10V supply: 10.00V Range: 9.84 to 10.16 [PASS]
    3.3V supply: 3.28V Range: 3.23 to 3.37 [PASS]
    Navigator checksum: 0×12345678
    Navigator version: 0×28400F23
    Pilot checksum: 0×12345678
    Pilot version: 0×34100F22
    Pmd DAC Tests
    XSin@0.00V: 0.01V Range: -0.06 to 0.06 [PASS]
    XSin@2.15V: 2.25V Range: 1.96 to 2.34 [PASS]
    XSin@4.30V: 4.49V Range: 3.98 to 4.62 [PASS]
    YSin@0.00V: 0.01V Range: -0.06 to 0.06 [PASS]
    YSin@2.15V: 2.25V Range: 1.96 to 2.34 [PASS]
    YSin@4.30V: 4.48V Range: 3.98 to 4.62 [PASS]
    ZSin@0.00V: 0.01V Range: -0.06 to 0.06 [PASS]
    ZSin@2.15V: 2.25V Range: 1.96 to 2.34 [PASS]
    ZSin@4.30V: 4.49V Range: 3.98 to 4.62 [PASS]
    Controller board EEPROM CRC Test [PASS]
    Controller Configuration ID: 0
    Controller part number: 205627-0002
    Controller serial number: 0945-000285
    Power Dist board EEPROM CRC Test [PASS]
    PDB Configuration ID: 0
    PDB part number: 202569-0006
    PDB serial number: 0948-002057
    CPLD version: 33
    ColdFire version: 0 rev: 0
    Mariner build: 1924.0
    Cause of last reset: Software Reset
    POST successful
    last act:718768 / req:660187 / malloc:849/0 / stk:3240/8792
    act:699104/690720 / req:640523/638280 / malloc:760/0 / stk:2724/8792

    ————————————————————–SS——————————————————————————————–

    NMIStatus: 0×0
    Flags: 0xc8 : Initialized : MhmReady : ShmReady
    PwrControl: 0xd : DC : HeadHeater
    Cartridge: 0×3fc3 : ModPresent : SupPresent : ModLoaded : SupLoaded
    : ModLatched : SupLatched : ModMatInHead : SupMatInHead
    : ReplaceFailed : LoadFailed
    XYAxis: 0×0
    ZAxis: 0×0
    Status: 0×2000
    command flag = 0
    curve count = -1
    modHead = 184 / 0
    supHead = 186 / 0
    Temps = 89.40/0.00 / 89.40/0.00 / 28.60/0.00
    Current Position = 0.00,0.00,0.00
    Gantry: GR5K Stage: SR64K
    current material: model model fc: 0 support fc: 0
    Version: 1924 PLDVersion: 33 Gender: sst1200es

    ———————————————————————FZ———————————————————————————————-
    01/14/14 05:17:24:989: FindZHome.cpp:262:INFO:XY axis not ready:Find Z before Fi
    nd Home.

    maxts1990@gmail.com

    • It looks like the ‘XY axis not ready’ error is the issue – can you connect up a cable to the diagnostic port?

      • yes i can

  28. How to Fix ‘XY axis not ready’ please help me

    • Okay, I think you’re supposed to use the ‘SS’ command when connected via HyperTerminal, and you should get “X Axis Ready”. If not, use the FH and FZ commands followed by SS. If you still don’t get “X Axis Ready” then your controller board is shot – that’s according to an old photocopy I have. I don’t have any experience with the P-class machines, so I don’t know that I can provide any real guidance. You may want to also ask in one of the threads at gnurds.com or the stratasysusers.org forum.

      • when entering command “SS” gave the result
        NMIStatus: 0×0
        Flags: 0×40c8 : Initialized : MhmReady : ShmReady : GlobalsLoaded
        PwrControl: 0xd : DC : HeadHeater
        Cartridge: 0×3fc3 : ModPresent : SupPresent : ModLoaded : SupLoaded
        : ModLatched : SupLatched : ModMatInHead : SupMatInHead
        : ReplaceFailed : LoadFailed
        XYAxis: 0×0
        ZAxis: 0×0
        Status: 0×2000
        command flag = 0
        curve count = -1
        modHead = 184 / 0
        supHead = 186 / 0
        Temps = 100.20/100.00 / 99.90/100.00 / 75.30/75.00
        Current Position = 12.50,12.37,-0.00
        Gantry: GR5K Stage: SR64K
        current material: model model fc: 0 support fc: 0
        Version: 1924 PLDVersion: 33 Gender: sst1200es

        • What does entering “FH” and “FZ” provide?

          • when entering FH not give a result. but it will start finding home
            when entering FZ, XY axis not ready:Find Z before Fi
            nd Home.

          • when entering command “FH” gave the result
            INFO:Foam sensor down when it should
            be up:Surface sensor down after motion complete

            when entering FZ, XY axis not ready:Find Z before Fi
            nd Home.

            • I’m guessing the ‘foam sensor down when it should be up’ may be the issue – is there a sensor that you can check? I have no idea how the sensors might work (I didn’t even know there was a foam sensor), but if it’s a microswitch or an optical flag, check the outputs with a multimeter.

  29. HI,
    i have just purchased a BST 768 printer and was wondering if anyone could help
    with a a problem I have. when you try to build It shows error 14-21
    and shuts down, I have contacted Sys in the UK but have had no reply.
    is it possible to obtain a copy of the manual for this machine.
    I have a copy of the service manual for the uprint range. but the machines are to
    dissimilar for it to be of any use.

  30. 14, 21: Abort : Z axis not ready. (PMD chip not ready)
    sing the HyperTerminal, type SS. “X Axis Ready” should be displayed.
    (Housekeeper needs to be preformed every second but did not)

    (Chip that controls the PMD chip not ready)
    14, 21: Abort : Z axis not ready. (PMD chip not ready)
    If it is not displayed, then type the “FH” & “FZ” commands. Finally type “SS” again. If “X Axis Ready” still is not displayed, then replace the 186/contoller Board.

  31. Could anyone lead me to software for a Stratasys 1650 FDm machine I have.
    It did not come with software and can not find anything that would work.

  32. I Get no data on my Dimension SST 768…
    it stops at “Sending Eeprom Data”

    Could anyone please help me!

    • i just got that advise that my Printer is to old aged ;) Any one here who could help? I just dont get any data. Is there a way to get the Data direct from the Chip? I hope anybody could help! Thank you!

  33. reload chip UPRINT?

  34. Hi
    I have a SST 1200es. Can some please share any maintenance manual.
    Many thanks

    Ignacio

  35. I know the thread reference is old, but I’m looking for the service manual for the dimension 768. Any help would be greatly appreciated.
    Thanks in advance

  36. Hi all,
    i have hacked the encryption ! ;-)
    the ds-chip-key is not the one the Machine remembers, it is as Serial-Number inside the encrypted block and the chip-key is Part of a bigger Encryption-Key ;-)
    It is possible to reuse the chip again and again !!!
    it would also be very difficult for SSys to keep track of the refilled Chips.
    What Do You mean?
    Should I Start a Chip-Refill-Service?
    Refilling is resistant against Firmware-upgrades ;-)
    You can test me :-)
    Send me a Chip-Dump with the Chip-Key and wait for a response ;-)

    • You lost me a touch DS_Filler… What is the Chip key, is it not in the Chip Dump in line 3 of your post?

    • Obviously your not planning on sharing that info… but you are somewhat confusing… what is the DS chip key? the DS serial number?.. what is the encrypted Block?

      Ok I’ll send you a Dump.. but what’s the chip key?

      Thanks,

      Ted

      • Yes i meant the DS 64-bit serial. Sorry for that confusion
        I need the Dump and the DS-Serial to create a new Record you can write back on the DS-chip.

        Right now i dont plan to share that info, maybe i will change my opinion in the future?
        I dont want to pull down SSys pants ;-) They have to much money and lawyers on their side …
        They did a good job in constructing the machine and its internal protection to bind their customers to them.

        The De/Encryption uses a key split into
        a) a machine-key
        b) the chip-serial
        c) fixed parts of the Dump
        These 3 are brew together and the resulting Block
        contains a 64-bit (Material)-Serial-Number you can find in the logs of the Machine when changing the Material ;-)
        this Mat-Serial and Materialammount is rememberd encrypted in the system.dat ( this behaviour seems to be different in newer firmware as SSys has obviously reacted on the Hack described here )

        What i can do with your Dump in connection with the DS-Serial is
        a) create a new Mat-Serial
        b) Fill to the same or a bigger ammount of Material
        c) set any other Material-Type

        Greez
        ;-)

      • Send the Dump to ds_filler(_at_)freenet.de ;-)

  37. hi i am unfortunately a new dumb ass that bought a demssions sst 768 off ebay and in up to my ears . i was told “it only needed a print head” but it doesn’t have any words in the lighted display and like i see many of you are requesting help
    i have the 4.o catalyst soft ware and a user guide but my computer dont comunicate to or from it(sob/sob more sobs.could ya help a poor helpless dumb ass PLEASE!
    im a us vet paying a lot of child support mercy sob sob

    • Unfortunately, if you bought one that ‘only needed a print head’, it is probably a trade-in unit that had the head, main control board, and hard drive yanked out and sent back to Stratasys. What boards are still installed in the rear? Getting a new head will not be cheap.

  38. Could you send me Service and Maintenance Manual. Please.

  39. Could someone please send me the service manual. The link in the post is no longer working.

  40. I’d Like to add that on my EEPROM dump (P430 cartridge Stratasys Dimension SST1200) 0×4E-0×4F Reads 0×66BE.

    Bit late i know, but any byte might help.

  41. So did you actually figure out how to reset the material chip so it can be used again for a Dimension 1200?

  42. We bought a dimension 768 and it works perfect.. but the cartridge issue… we are willing to pay anyone that can walk us through this (may even pay a trip for you to come to denver).. email me at jason dolbin (at) yahoo dot com

  43. I used the diagnostics port to copy the eprom from one fresh cartridge onto an old cartridge. I then rebooted, which deleted /system.dat.
    However, the printer now thinks that the cartridge is empty, and the eprom contents have been changed!

    • Now the display says that it can’t read the cartridge, although I can dump the eprom from the diagnostics port.

      • I had the same problem and figured out how to solve it. The first time I tried to write the data back to the EEPROM I accidentally copied the entire message, which includes a header with information that you shouldn’t write back to the cartridge. Also try using this tool to format it: http://gnurds.com/index.php/2013/11/14/updated-eeprom-tool/

    • chelmite, you can’t copy the cartridge contents from one EEPROM to another. The contents of the EEPROM are encrypted in part with the EEPROM’s uniquely lasered serial number. You’ll want to have a look at bvanheu’s program for generating your own EEPROM from scratch: https://github.com/bvanheu/stratasys/tree/stratasys-ng

  44. It may be possible to determine the gender of your machine through the diagnostics port using the rg command. According to the output from my BST1200 the command “displays the current gender as found in the status structure. The gender may be neutral, mariner, dimension, prodigyplus, jib, msi, or schooner. Each of these corresponds to a hardware configuration.”
    I would guess that the possible genders is dependent on your model of printer.