Reviewing the Siemens S7-1500 password reset process reveals it is designed as a high-security measure; there is no "backdoor"
or master password to recover a lost one without wiping the device
. If you have lost your password, you must essentially perform a factory reset, which will permanently delete
the user program and configuration from the CPU and memory card. Critical Reset Methods
Based on technical documentation and community reviews, here are the most effective ways to reset a locked S7-1500: Siemens TIA Portal Tutorial | Factory Reset
Resetting a Siemens S7-1500 Password: A Complete Guide Forgetting a password on a Siemens S7-1500 is a common headache for automation engineers. Whether you have lost the "Access Level" password or the "PLC Configuration Data" protection password, you can regain control of your hardware—though often at the cost of the existing program and data. 1. Using the PLC Display (Easiest Method)
If you have physical access to the PLC and the hardware allows, you can wipe the user program directly from the integrated screen. Navigate to Card handling Delete user program and confirm with
Once the program is deleted, the CPU will no longer require an access password for downloading a new project. 2. The SIMATIC Memory Card (SMC) Wipe Since the S7-1500 requires a SIMATIC Memory Card
to operate, resetting the password often involves clearing this card. Step-by-Step Procedure: Stop the PLC : Ensure the CPU is in STOP mode. : Switch off the supply voltage. Remove the SMC
: Take the card out and insert it into a standard SD card reader on your PC. Delete Files (Do NOT Format) : Open the card in Windows Explorer. Delete the S7_JOB.S7S file and folders like SIMATIC.S7S : Never format the card using Windows. Do NOT delete hidden files like crdinfo.bin , as this will render the card useless. Reinsert & Power On
: Place the card back into the CPU and power it up. You can now download your project from the TIA Portal without being prompted for the old password. 3. Online Factory Reset via TIA Portal
If you can still establish an online connection (even if you can't access the program), you can perform a factory reset. Online & Diagnostics for the CPU. Reset to factory settings Check the box
Delete password to protect confidential PLC configuration data siemens s7-1500 password reset
. Note that this clears the work memory and most retentive data. 4. Resetting via Mode Selector (MRES)
If you don't have a PC or access to the display, you can use the physical mode selector switch: Power off the CPU and remove the SMC. Hold the selector switch in the position while powering the PLC back on.
Follow the LED blinking patterns (typically release and re-hold MRES within 3 seconds) to trigger the factory reset. Summary Table: Reset Methods Requirements Data Impact PLC Display Physical access to front panel Deletes user program SMC Manual Wipe PC with SD card reader Deletes program & data TIA Portal Reset Online connection (MAC or IP) Full factory reset Mode Switch Physical access Full hardware reset How to remove/delete protection password - SiePortal
Forgotten or lost passwords for a Siemens SIMATIC S7-1500 PLC Go to product viewer dialog for this item.
can halt maintenance and updates. While there is no "recovery" tool to retrieve an existing password, you can reset the password by clearing the CPU memory. Note that resetting the password via factory reset will erase the entire user program and hardware configuration. 1. Resetting via the SIMATIC Memory Card (SMC)
This is the most common method if you cannot go online due to the forgotten password. By clearing the SIMATIC Memory Card, you force the PLC to start with an empty configuration. Step 1: Power off the CPU and remove the SMC. Step 2: Insert the card into a standard PC card reader.
Step 3: Use Windows Explorer to delete the user program files. Delete the S7_JOB.S7S file and the SIMATIC.S7S folder. CRITICAL: Do NOT format the card in Windows.
CRITICAL: Do NOT delete hidden files like __LOG__ or crdinfo.bin, as these make the card recognizable to the PLC.
Step 4: Reinsert the card into the CPU and power it on. The CPU will now be empty and ready for a new download without a password prompt. 2. Reset to Factory Settings (TIA Portal)
If you can still establish an online connection (e.g., if you have "Read access" but lost the "Write access" password), you can use TIA Portal to perform a factory reset.
Open the Online & Diagnostics view for the CPU in TIA Portal. Navigate to Functions > Reset to factory settings. Choose whether to keep or delete the IP address.
Important: Check the box "Delete password for protection of confidential PLC configuration data" if applicable. Click Reset and confirm the prompt. 3. Reset via the CPU Display Reviewing the Siemens S7-1500 password reset process reveals
Many S7-1500 models feature an onboard display that allows for a password reset without a PC. Navigate the menu to Settings > Reset > Factory settings. Confirm the selection with OK.
Resetting via the display deletes the password for protecting confidential PLC configuration data. 4. Manual Hardware Reset (Mode Selector)
You can also use the physical mode selector switch on the front of the CPU: Set the switch to STOP. Remove the memory card.
Hold the selector in the MRES position until the RUN/STOP LED lights up steadily for the second time (approx. 3 seconds), then release it.
Within 3 seconds, switch back to MRES and then back to STOP. Password Reset via SMC Factory Reset (TIA) Reset via Display Data Loss Yes (Total) Yes (Total) Yes (Total) Requires PC Yes (Card Reader) Yes (TIA Portal) Hardware Access Online Access
Do you have a backup of the original project to reload onto the PLC after the reset?
This method requires you to have TIA Portal (V13 SP1 or newer) installed on a laptop physically connected to the PLC.
Step 1: Establish a Physical Connection Connect your engineering PC to the PLC via PROFINET (Ethernet) or a direct Ethernet crossover cable. Set your PC's IP address to a static address in the same subnet as the PLC (e.g., if the PLC's last known IP was 192.168.0.1, set your PC to 192.168.0.100).
Step 2: Access the "Online & Diagnostics" View Open TIA Portal. Even without the project file, you can access the "Project view." Navigate to "Online & Diagnostics" (usually under the "Online" menu or the left-hand navigation bar).
Step 3: Detect the Locked PLC Click "Accessible devices." TIA Portal will scan the network. When your S7-1500 appears, select it. You will likely see a small padlock icon next to the CPU. Select the device and click "Online & Diagnostics."
Step 4: Navigate to the Reset Function In the Diagnostics window, expand the "Functions" folder. Look for "Reset to Factory Settings." (Note: If you do not see this option, you may not have sufficient access rights in TIA Portal, or the CPU is in a state preventing the reset).
Step 5: Configure the Reset Options A dialog box will appear with checkboxes: This method requires you to have TIA Portal
Step 6: Enter a "Reset Password" (The Catch) If the PLC is currently password-protected, Siemens requires you to prove you are physically present at the machine. You must enter a one-time reset password that is printed on the side of the physical CPU. Look at the silver serial number sticker on the side of the S7-1500. You will see a field labeled "Reset password" (usually a 10-character alphanumeric code). If you cannot find this, scan the QR code on the CPU to view the electronic rating plate.
Step 7: Execute the Reset Click "Reset." The CPU will stop, erase its internal memory and the SIMATIC Memory Card, and reboot. The PLC will now have no password and no program. The "RUN/STOP" LED will likely flash, indicating it is waiting for a new program download.
Before attempting a reset, you must understand what you are up against. The S7-1500 series (firmware version 2.0 and above) uses a multi-layered protection system.
An S7-1500, when powered on with a blank, bootable memory card inserted, will attempt to load a program from the card. If the card has a valid, unencrypted program, it overwrites the internal load memory. If the card is blank, the CPU will clear its internal memory and revert to factory state, including password removal.
A common inquiry in automation forums is whether software exists to "hack" or "retrieve" a password from an S7-1500.
The Reality: For the S7-1500 series, legitimate password retrieval tools do not exist for the end-user. Unlike the older S7-300/400 series, which had known vulnerabilities regarding password extraction from memory cards, the S7-1500 utilizes a sophisticated security controller and encrypted storage mechanisms.
Siemens regards the protection concepts of the S7-1500 as a critical cybersecurity feature. Consequently, there is no "backdoor" password accessible via TIA Portal or external software. If a password is lost, it cannot be "recovered"; the controller must be reset to a state where the password does not exist.
Have you ever had to reset a locked S7-1500 on a running machine? Share your experience below.
In your company’s engineering standard, mandate that every CPU's "Reset password" sticker is photographed and stored in a secure SharePoint or project document. This is your physical failsafe.
In the past, with an S7-300, you could often perform a "Memory Reset" (MRES) via the hardware switch or a PG (Programming Device). This would wipe the work memory and restore the PLC to a factory state, removing the password.
This does not work on the S7-1500.
The S7-1500 stores protection data in a non-volatile, secure area. If you attempt to wipe the memory:
This is an intentional security feature designed to prevent malicious actors from walking up to a machine, wiping the controller, and injecting ransomware or malicious code.