Password for the access to a password-protected S7-200 does not exist
How do I get access to the program of a password-protected CPU if I do not know the password?
Even if the CPU is furnished with a password protection, the subsequent CPU-Functions can be conducted unlimitedly:
- Reading and writing of user data
- Start, Stopp and Restart of the CPU
- Reading and setting the real-time
There is no possibility for the user, to read a program of a password-protected CPU with protection level 3 or to modify - without having the knowledge about the password.
If the password entered in the CPU is unknown, a memory reset of the CPU has to be conducted and the program has to be reloaded into the CPU. During the memory reset, the net address, baudrate, realtime and - if existing - the program in the memory submodule are not modified.
- To implement that, please proceed as follows:
- Select "Target system > memory reset".
- Afterwards, select all three block types to be cleared and confirm it with "OK".
Fig. 1: Selecting blocks to be cleared
- Enter "CLEARPLC" in the dialog window.
Fig. 2: Entry of the password in order to clear
- An additional possibility to reset the CPU is provided by the
program "Wipeout.exe". This program is located on the
Installation-CD of STEP7-Micro/WIN or is available in the Internet
under Entry-ID: 2123168 .
On the contrary to the reset via STEP7-Micro/WIN, the program "Wipeout.exe" does not only delete the user program, the data block and the configuration information, but also the baudrate is reset to 9,6 kbit/s and the netaddress is reset to address 2. The CPU is reset into the pristine status of supply.
- Alternatively, the memory submodule can also be plugged with another unprotected program into the CPU. When reswitching the voltage, this program is loaded into the CPU and overwrites the program with the unknown password. Afterwards, the access to the CPU is possible.
We therefore always recommend to keep a copy of the program available on a data medium. Moreover, the comments of the program are only available in the Offline-Project and are not loaded into the CPU.
More information regarding the password protection can be found in the manual S7-200 under Entry-ID: 1109582.