Removing MP277 Control Panel Password via the LAN Service Interface

A Siemens SIMATIC MP277 10" Touch HMI is locked because the Control Panel password is unknown, and the panel cannot be reached through the touchscreen to change network settings, clear passwords, or perform a soft restart. Standard recovery methods that require knowing or modifying the panel's IP address from the Control Panel itself are impossible because the user cannot navigate past the lock screen. This article documents the field-proven recovery path that uses the MP277's LAN service interface plus Siemens ProSave, addressing the panel directly by its hardware MAC address without requiring a valid IP configuration on the panel.

1. Problem Definition: Locked MP277 Control Panel

The MP277 Multi Panel runs Windows CE 5.0 or CE 6.0 and hosts WinCC flexible 2008 SP2/SP3/SP4/SP5 projects. Unlike later Comfort Panels, the MP277 does not synchronize its administrative password with the engineering system (WinCC flexible or TIA Portal), and there is no native "forgot password" link or password hint mechanism. The only reliable recovery path when the password is lost is a factory reset through the service interface, accessible through either the Ethernet (LAN) service port using the panel's hardware MAC address or the RS232 service port with default ProSave settings.

Typical scenarios that lead to this condition include:

• Maintenance personnel change without complete documentation handover.
• Plant equipment is inherited from a previous integrator or OEM.
• A long-running installation has forgotten the administrative password due to personnel turnover.
• The HMI was previously commissioned by a third party who did not transfer credentials.
• A firmware update or power event corrupted the registry such that the Control Panel password prompt persists even though the password is blank.

2. Affected Hardware, Article Numbers, and Firmware

The procedure applies to the entire SIMATIC MP277 family and is functionally compatible with the broader 177/277/377 generation because they share the WinCE 5/6 service stack and ProSave communication protocol.

Related panels that share the same service interface methodology:

3. Prerequisites

Before starting the recovery, verify the following items are available and functioning:

3.1 Hardware

• A Windows PC with administrator rights. Supported hosts: Windows 7 SP1, Windows 10 (1809 or later), Windows 11 (21H2 or later). ProSave V13 SP2 is the last version with reliable MP277 support; newer ProSave releases may drop legacy panel entries.
• A free Ethernet port (RJ45) on the PC.
• Either a crossover Ethernet cable or a small unmanaged Ethernet switch/hub. Modern PCs and the MP277 NIC support Auto-MDIX, so a standard patch cable often works in practice.
• The MP277 panel itself, powered from a 24 V DC supply capable of at least 1.5 A continuous (the 10" Touch draws approximately 0.8 A typical, 1.2 A peak during backlight ramp-up).

3.2 Software

• Siemens ProSave tool. ProSave is bundled with WinCC flexible 2008 SP5 or available as a standalone component from the Siemens Industry Online Support. Search for "ProSave" under HMI tools at the official Siemens support portal.
• The MP277 OS image file (HSP) matching the panel's original CE version. Available from Siemens Industry Online Support under the WinCC flexible HSP packages.

3.3 Network

• Both PC and panel must be on the same physical Layer 2 segment or connected point-to-point.
• Disable any software firewall on the PC temporarily, or create inbound rules for TCP ports 102 (S7 communication), 5001 (ProSave data channel), and UDP port 2308 (panel discovery broadcast).

3.4 Documentation

• The MAC address of the panel, printed on the rear type plate.
• The original ordering number (MLFB / Article No.) to confirm the correct OS image.

4. Locating the Panel MAC Address

The MP277 MAC address is printed on the rear of the panel on the type plate (Typenschild). It is a 6-byte hexadecimal value formatted as:

The first three bytes (the OUI) are constant for SIMATIC HMI panels. The lower three bytes are unique per device. The format above uses hyphen separators; ProSave accepts both hyphenated and colon-separated forms.

If the rear label is missing, faded, or unreadable, use one of the following recovery methods:

1. Service Menu boot: Power on the panel while pressing on the upper-left corner of the touchscreen with a stylus. Some CE 6.0 images display the MAC on the boot loader screen.
2. Serial recovery: Connect via RS232 (see Section 7) and read the MAC from ProSave's panel information dialog.
3. Network ARP scan: Connect the panel via Ethernet and run an ARP scan from the PC. The MAC will appear regardless of the panel's IP state.

5. LAN Connection Procedure Without IP Configuration

The key insight is that ProSave uses the Siemens S7 discovery protocol that operates at Layer 2 for panel identification. This allows the service tool to find and connect to the MP277 on the LAN using only the MAC address, bypassing the need for a valid IP address on the panel.

5.1 Physical Connection

Option A — Direct crossover cable:

• Plug a crossover Ethernet cable directly between the PC NIC and the MP277 LAN port labeled X1.
• Auto-MDIX on both ends will negotiate the link automatically.

Option B — Via unmanaged switch:

• Connect both PC and MP277 to a small 4- or 5-port switch.
• The switch auto-negotiates link speed (10 or 100 Mbps) and duplex.

5.2 PC Network Adapter Configuration

Set the PC Ethernet adapter to a fixed IP address in a dedicated subnet to prevent routing conflicts:

Disable any secondary network adapters (Wi-Fi, VPN, virtual adapters). Disable the Windows firewall for the affected profile, or create explicit inbound rules for ProSave.

5.3 Power-Cycle the Panel

With the cable connected, power-cycle the MP277 to force a fresh CE network stack initialization:

1. Disconnect the 24 V DC supply from the panel.
2. Wait at least 10 seconds for bulk capacitors to discharge.
3. Reapply 24 V DC.
4. Wait for the panel to boot to either the WinCE desktop, the Start Center, or the project runtime screen if a project autostarts.

MP277 boot time from cold power is typically 30 to 60 seconds. Watch for the Siemens splash screen and the link LED on the LAN port (green for link, amber for activity).

5.4 Confirm Link Visibility

On the PC, open an elevated Command Prompt and execute:

Then:

The MAC address starting with 00-0E-8C should appear in the ARP cache, mapped either to an IP or to 0.0.0.0 if the panel has no IP. If the entry shows 0.0.0.0, the panel has not loaded an IP, which confirms the MAC-based discovery path is required.

6. Factory Reset Using ProSave Over Ethernet

ProSave's panel search function operates at Layer 2 for Siemens panels, allowing connection without an active IP. The steps below have been validated against ProSave V13 SP2 and WinCC flexible 2008 SP5 on Windows 7 and Windows 10 hosts.

6.1 Launch ProSave

1. Open ProSave from the Windows Start menu under Siemens Automation > SIMATIC > ProSave.
2. In the Panel Selection field, choose MP277.
3. In the Connection field, select Ethernet (TCP/IP).

6.2 Set the Target by MAC Address

In ProSave's Ethernet settings dialog:

1. Click the Settings... or Properties... button next to the Connection field.
2. In the Ethernet dialog, click the Search... or Browse Network... button.
3. ProSave performs a UDP broadcast on port 2308 to discover all Siemens panels on the local segment.
4. The MP277 panel should appear in the search results list, identified by its MAC address and possibly an old IP.
5. Select the entry corresponding to the recorded MAC. ProSave will use this MAC for direct connection regardless of the panel's current IP state.

If the panel does not appear in the search results, verify:

• The link LED on the panel LAN port is lit (green/amber).
• The PC firewall is fully disabled.
• The cable is functional (test with another device or use a cable tester).
• The panel has fully completed its CE boot (wait 60+ seconds).
• Any corporate VPN client is disconnected.

6.3 Initiate Reset to Factory Settings

1. In ProSave, click the OS Update tab.
2. Check the box Reset to factory settings or Reset operating system / device settings to factory state (the exact label varies by ProSave version).
3. If present, also check Reset Registry / Boot Settings to ensure the password is cleared from the CE registry.
4. Select the appropriate OS image file (the HSP matching the panel's MLFB and CE version).
5. Click Update or Transfer.

The reset process performs the following actions on the panel:

• Wipes the WinCC flexible runtime project.
• Resets all Windows CE settings, including the Control Panel password (cleared).
• Resets network configuration to DHCP or factory default (typically 192.168.0.1 or DHCP, depending on image).
• Resets regional settings, Start Center configuration, and CEadmin/CEuser passwords to factory defaults.
• Preserves the WinCC flexible runtime license in the protected license partition.

Typical reset duration: 3 to 8 minutes, depending on the panel's flash size and the image version. Do not power-cycle the panel during this window.

6.4 Wait for Panel Reboot

ProSave displays a progress bar and reports success when the reset completes. The MP277 reboots automatically. After reboot, the panel will display either:

• The Windows CE desktop (if no project autostart is configured).
• The WinCC flexible loader / Start Center, prompting to download a project.

7. RS232 Fallback Procedure

If the LAN path fails (damaged NIC, switch issues, or ProSave cannot find the panel over Ethernet), the MP277 supports a serial service interface. This is also useful when the panel's Ethernet port is damaged or the network stack is corrupted.

7.1 Identify the Serial Port

The MP277 has one or two serial interfaces depending on the variant:

Use IF1B for service. The pinout is documented in the MP277 manual:

7.2 Required Cable

Use a Siemens PC adapter cable:

This is a pre-built null-modem cable for SIMATIC HMI panels. Alternatively, build a null-modem cable with RX/TX crossed, RTS/CTS crossed, DSR/DTR crossed, and SG connected through. A USB-to-RS232 adapter (FTDI-based recommended) is acceptable on modern PCs that lack a built-in COM port.

7.3 ProSave Serial Configuration

Configure ProSave for serial connection with the following parameters:

Click Connect or Search. ProSave will ping the panel over the serial port and establish the S7-protocol handshake.

7.4 Reset via Serial

Once connected, perform the same Reset to Factory Settings operation described in Section 6.3. The procedure is identical; only the transport differs. The reset duration is typically longer over serial because the image transfer happens at the lower serial baud rate (expect 8 to 20 minutes).

8. Post-Reset Verification

After the reset completes, perform the following verification steps:

8.1 Boot State

The MP277 should boot to either the Windows CE Start Center or the Windows CE desktop. If the panel boots to a black screen, the image may be corrupt. Re-run ProSave with a full OS Update using the correct HSP image and let it complete without interruption.

8.2 Password Status

1. Tap Start > Settings > Control Panel.
2. The system should NOT prompt for a password (factory default = no password, or ceadmin for some images).
3. If a password prompt still appears, the reset did not complete the registry wipe. Re-run the reset and explicitly verify that the Reset Registry option is checked.

8.3 Network Configuration

• In Control Panel > Network, the LAN adapter should be set to DHCP or have a default IP. Common factory defaults:

Test connectivity by setting the PC to a compatible static IP and pinging the panel.

8.4 Project Status

The original WinCC flexible project is gone. Use ProSave Restore to load a backup .pdz file, or use WinCC flexible to transfer the current project from the engineering station.

8.5 Licensing

WinCC flexible runtime licensing is stored in the panel's protected license partition. A factory reset generally preserves licensing. If the runtime reports "license missing" after reset, the license must be re-transferred using the Siemens Automation License Manager.

8.6 Touch Calibration

After reset, recalibrate the touchscreen via Control Panel > Touch. Use a stylus and tap each of the four crosshair targets firmly and accurately. This step is critical for precise operator input on the 10" Touch variant.

9. Related Panels and Procedure Variants

10. Troubleshooting Matrix

11. Security, Backup, and Commissioning Notes

11.1 Document Passwords Post-Recovery

After successfully resetting and re-commissioning the panel, document the new Control Panel password in the plant password manager. Store the WinCC flexible project source code in version control. Export the project backup via ProSave Backup and store the .pdz file off-machine on a network share or version control system.

11.2 Disable Unused Service Interfaces

If the panel is on an isolated machine network, consider hardening:

• Disable the RS232 service port in the project where possible (this does not prevent ProSave but raises the difficulty).
• Use a managed switch with port security to lock the panel's MAC to its physical switch port.
• Apply a VLAN for HMI-only traffic to reduce exposure to the corporate network.

11.3 Comfort Panels Use a Different Procedure

For panels newer than the MP277 (Comfort Panels TP700, TP900, TP1200, TP1500, TP1900, MTP Unified series), the recovery procedure is different:

• Comfort Panels use TIA Portal's online Reset to factory settings via Ethernet.
• ProSave is largely replaced by TIA Portal's online functions.
• Passwords are managed in the TIA Portal project, not stored locally on the panel.

11.4 Safety Considerations

Working with industrial HMIs in a running plant requires:

• Permission from operations to take the HMI offline.
• Awareness that the operator screen will blank during the reset.
• Backup of the running process parameters (HMI tags may be lost; PLC tags remain on the controller).
• Coordination with the PLC engineer if the HMI is the only operator interface for the line.
• A coordinated window with operations, maintenance, and safety to minimize process interruption.

12. Frequently Asked Questions