Siemens Comfort Panel Secure Mode Reset Using ProSave OS Update

When a Siemens SIMATIC Comfort Panel (TP700, TP900, TP1200, TP1500, TP1900, TP2200, KP700, KP900, KP1200, KP1500) becomes locked behind an unknown Secure Mode password, the operator can no longer access the Control Panel, Taskbar, or any Desktop shortcut. Only the Start Center and the auto-start runtime application remain visible. Because the Secure Mode password is unknown and the original TIA Portal project is unavailable in most field cases, the only documented recovery path is to perform an Operating System (OS) Update via ProSave with the Reset to factory settings option enabled. This procedure deletes the runtime project, all recipes, user administration data, and the Secure Mode password lock, returning the panel to its out-of-box state. The application can subsequently be reloaded from a backup .BRF file, a TIA Portal transfer, or by restoring the \SIMATIC\ folder manually from external media.

Problem Description

The Comfort Panel operating system offers a "Secure Mode" toggle in Control Panel > Security > SecureMode. When activated by an operator, either intentionally or by accidental click on a desktop shortcut, the panel hides all standard Windows CE shell elements:

• The Windows CE taskbar is suppressed.
• The Control Panel becomes password-protected.
• Desktop shortcuts cannot be launched.
• Only the Start Center, the auto-start runtime, and the system tray remain accessible.
• Recess to Start > Programs > Control Panel is denied without the Secure Mode password.

Field symptoms reported on TP700 Comfort, TP900 Comfort, and similar Unified Comfort Panels include a panel that boots straight into the runtime, never returns to the Start Center, and rejects the configured Control Panel password. If the project was created on a workstation whose TIA Portal project file (.ap13, .ap14, .ap15, .ap16, .ap17, .ap18, .ap19, .ap20) is unavailable, and no Pack-and-Go file or unencrypted .BRF backup exists, recovery requires a full OS rebuild.

Root Cause

Secure Mode is a panel-wide shell lockdown designed by Siemens to harden operator stations against unauthorized configuration changes. The password is stored in a non-volatile area of the Windows CE registry hive on the panel's internal flash. Once the password is set and unknown, no standard operator workflow can unlock the shell. The only documented administrative override path is a firmware-level OS Update through ProSave or TIA Portal, which rewrites the OS partition and resets the registry, including the Secure Mode flag.

Per the official SIMATIC HMI Comfort Panels manual, Section 4.3.6.3 ("Operating the Control Panel"), the only way to clear an unknown Control Panel / Secure Mode password is an OS update with the Reset to factory settings option enabled. There is no Siemens-approved utility to extract or brute-force the Secure Mode password hash from a .BRF archive.

Available Backup and Restore Options on Comfort Panels

Siemens ProSave and TIA Portal transfer dialogs expose the following discrete backup targets on a Comfort Panel:

The .BRF archive format is a signed, compressed container. The application files are not stored as plain *.fwx on the panel — they are embedded within \SIMATIC\HMI\ and protected. Editing or partial extraction is not supported by Siemens tools.

Solution: OS Update with Reset to Factory Settings

The recovery procedure below restores the Comfort Panel to its factory state, eliminating the Secure Mode password lock. The runtime project, recipes, and user administration are erased in the process and must be reloaded afterwards.

Prerequisites

• A Windows PC (Windows 10 / Windows 11, 64-bit) with ProSave installed. ProSave is bundled with every TIA Portal installation (starting with TIA V13 SP1) and can also be installed standalone from the TIA Portal installation media under Support > ProSave.
• The correct OS image file (*.img) matching the panel model. Obtain it from the TIA Portal installation under \Support\Images\ or via the Siemens Industry Online Support portal (entry ID 109746955 for the current Comfort Panel image repository).
• Ethernet cable (RJ45) connected directly between the PC and the panel's X1 Ethernet port, or via a managed switch. Static IP addressing recommended (panel default: 192.168.0.2, PC: 192.168.0.1, subnet mask 255.255.255.0).
• If the runtime project must be preserved separately, an empty USB stick or SD card formatted as FAT32.

Step-by-Step Recovery Procedure

1. Power the panel down using the proper shutdown sequence: close the runtime, then trigger the standard Windows CE shutdown through the Control Panel. If the Control Panel is inaccessible (which it is in Secure Mode), hold the panel's power button until the screen goes blank. Wait 10 seconds.
2. Power on the panel and confirm it boots into the Start Center or auto-launches the runtime. Note the panel's current IP address from Start Center > Network. If Start Center is suppressed by Secure Mode, derive the IP from the runtime's network diagnostics screen or from your switch's ARP table.
3. Configure the PC network adapter with a static IP in the same subnet (e.g., 192.168.0.1 / 24). Disable any secondary network interfaces to prevent routing conflicts.
4. Launch ProSave from Start > Siemens Automation > ProSave. Select the device type matching your panel (TP700 Comfort, TP900 Comfort, etc.) from the Device dropdown. Enter the panel's IP address under Connection > Ethernet. Leave the default RTS/CTS setting unless your network topology requires otherwise.
5. Establish a connection by clicking Connect. ProSave will prompt for transfer mode and credentials only if the panel's transfer settings have been customized. With default settings, the connection completes silently.
6. Navigate to OS Update in the left tree. Check Reset to factory settings. Browse to the correct *.img file (example: TP900_Comfort_V16_16.0.0.19.img) and click Update OS.
7. Confirm the warning dialog. ProSave will report that all runtime, recipe, and user data will be erased. Click Yes to proceed. The panel reboots and the image is written to flash, typically taking 2-6 minutes depending on panel model and image size.
8. Wait for the panel reboot. After the OS update completes, the panel restarts and displays the Start Center with no Secure Mode lock, no Control Panel password, and no runtime project. Default CE credentials (user Administrator, password 100) apply.
9. Restore the application (see next section).

Restoring the Runtime Application After OS Update

After the OS Update with Reset to Factory Settings, the runtime project must be reloaded. The available methods, ranked from most to least preferred:

Method 1 — Restore from a Complete Backup (.BRF)

If you captured a complete .BRF before the OS update, use ProSave > Restore > browse to the .BRF file > click Start Restore. The progress bar dialog appears both in ProSave and on the HMI device. Caveat: if the .BRF was captured from a panel still in Secure Mode, restoring it returns the panel to Secure Mode. Use this method only with a clean .BRF.

Method 2 — Transfer from TIA Portal

Open the original TIA Portal project, select the panel device in the project tree, right-click and choose Compile > Software (rebuild all), then Download to device > Software (and firmware, if necessary). TIA Portal pushes the *.fwx runtime and overwrites the OS if the firmware versions differ. The default Comfort Panel download password (if set) is 100.

Method 3 — SIMATIC HMI Memory Card (Service Pack)

The SIMATIC HMI memory card catalog number 6AV2181-8XP00-0AX0 (and its predecessors 6AV2181-8AV00, 6AV2181-8AW00) is a 4 GB SD card preloaded with the Comfort Panel service packs. Inserting this card into the System SD card slot (X50) while the panel is powered off and powering it back on triggers an automatic OS update from the card. This is the canonical field-service recovery media, but it has the same effect as Method 1's OS Update — it does not preserve the runtime project.

Method 4 — Manual File Copy Workaround (Unofficial)

Before performing the OS Update, if the panel is reachable via file explorer (e.g., through Start > Programs > Windows Explorer or an SMB share), navigate to \Flash\SIMATIC\ and copy the entire SIMATIC folder to a USB stick or SD card. After the OS Update completes, boot into the freshly installed Windows CE shell, open Windows Explorer, and copy the saved folder back to \Flash\SIMATIC\. Reboot the panel.

Preventing Secure Mode Lockouts

1. Document the Secure Mode password in the project documentation as soon as it is set in TIA Portal > Runtime settings > Services > SecureMode.
2. Avoid placing Secure Mode shortcuts on the runtime desktop. Configure the Secure Mode toggle only via the Control Panel (Control Panel > Security) where the password prompt is explicit.
3. Use centralized user administration with SIMATIC Logon where possible, decoupling shell access from operator credentials.
4. Schedule a complete .BRF backup after every project change. Store at least two generations offline.
5. Maintain the TIA Portal source project under version control (Git, SVN, or TIA Project Server) so that recompilation is always possible.

Verification

After the OS Update and application restore, verify the following on the panel:

• Boot into the Start Center. No Secure Mode prompt should appear.
• Open the Control Panel via the taskbar. The default password (100) should work if the project has not yet been reloaded.
• Re-transfer the runtime project from TIA Portal or restore from .BRF.
• Launch the runtime. All configured screens, tags, and alarms should load without license errors.
• Re-test recipe handling, user logon, and any alarm-history persistence if those were in use.
• Confirm the panel's IP, PROFINET device name, and any HMI-to-PLC connections match the plant network topology.

Troubleshooting Matrix

Reference Specifications

Related Configuration Notes

• For Unified Comfort Panels (MTP700, MTP900, MTP1200, MTP1500, MTP1900, MTP2200), the recovery workflow is similar but uses WinCC Unified images and the Unified runtime licensing mechanism. Secure Mode behavior is preserved across the Unified line.
• On panels running WinCC Comfort V16+, ensure the PC's ProSave version matches the panel firmware major version. Mixing V15 ProSave with a V16 panel triggers a version mismatch abort during the OS Update.
• If the panel is integrated into a TIA Portal project as a slave device with central user administration, the OS Update does not erase the central user DB on the PLC — only the local cache on the panel.
• The .BRF file is bound to the panel's article number (MLFB). A .BRF from a 6AV2 124-1JC01-0AX0 cannot be restored onto a 6AV2 124-1JC01-0AX1.

FAQ