Siemens S7-1200 Password Reset: MMC Factory Reset Procedure

Overview: The Password-Locked S7-1200 Problem

Recovering a Siemens SIMATIC S7-1200 CPU that has been pulled from a decommissioned machine is a common first project for an automation student. The hardware usually powers up correctly: the STOP/RUN LED sequence passes, the Ethernet port negotiates, and TIA Portal discovers the device on the network. The wall arrives when the engineer tries to go online. TIA Portal prompts for the CPU protection password, and there is no record of the original credential because the program was authored by an integrator on a now-defunct contract.

The CPU is not bricked. The program blocks are intact and the project still scans. The protection is a logical lock managed by the CPU's internal password table and the know-how protection attribute stored with each block. The only sanctioned way to bring a CPU back to a clean state without the password is to overwrite the internal load memory with a project delivered through a SIMATIC Memory Card (SMC), formally referred to as a transfer card.

This article documents the complete transfer-card reset workflow, the SIMATIC memory card catalog numbers, the TIA Portal diagnostics paths, firmware-version-specific behavior, and the verification checks that confirm a successful reset. The procedure applies to CPU 1211C, 1212C, 1214C, 1215C, and 1217C across the major firmware generations that Siemens has shipped since the platform's 2009 launch.

S7-1200 Protection Levels Explained

The TIA Portal security model is defined in the SIMATIC S7-1200 Programmable Controller system manual under the "Protection" section of the CPU properties. The CPU supports four discrete states, selectable under CPU Properties > Protection in the project tree:

A "factory reset" initiated through Online & Diagnostics > Reset to Factory Settings in TIA Portal will always demand the configured CPU password on levels 2, 3, and 4. There is no master password and no Siemens backdoor. The TIA Portal "Reset to factory settings" command performs an MRES-equivalent operation only when the operator authenticates against the active password table.

This is precisely why the transfer-card workflow exists. Writing a new project to the SMC and powering the CPU with the card inserted forces the loader to overwrite the internal load memory and reset the password table to whatever the new project declares (typically "no protection" while the engineer is learning).

Why a Memory Card Is Required

The S7-1200 boot loader treats the SIMATIC Memory Card as a higher-priority boot source than internal load memory. Inserting a populated card and performing a power cycle causes the CPU to enter Transfer mode. In transfer mode, the loader reads the project file structure from the card, writes it to internal work memory, and clears any prior block-level know-how protection because the new project's protection table replaces the old one.

The S7-1200 does not support the legacy S7-300/400 MMC format. It requires the SMC (SIMATIC Memory Card) form factor. Third-party SD cards will not be recognized; the CPU bootloader checks for the Siemens-specific file system header that the TIA Portal card writer applies during the PLC > Memory Card File Browser download step.

Prerequisites: Hardware and Software Required

Before the reset procedure can be performed, gather the following:

• Target CPU: S7-1200 family (CPU 1211C / 1212C / 1214C / 1215C / 1217C). All variants use the same SMC interface.
• SIMATIC Memory Card (SMC): 4 MB minimum, 24 MB recommended. See the catalog table in the next section.
• PC with TIA Portal: V15.1 or later is recommended for compatibility with current firmware (FW 4.4 and later). V13 SP1 / V14 will work for FW 4.x CPUs but lacks FW 4.6+ support.
• Ethernet cable: Direct PC-to-CPU connection on the CPU's PROFINET port. A switch works as well.
• 24 VDC power supply: Adequate for the CPU and any attached signal modules. A bench supply is acceptable for a learning project.
• Empty TIA Portal project: A new project with a placeholder program (e.g., a single OB1 with an empty Main) and the CPU's protection set to "No protection".

Compatible SIMATIC Memory Cards (SMC)

The Siemens catalog numbers for SMC are documented in the SIMATIC S7-1200 Programmable Controller - System Manual, entry ID 109751587, in the "S7-1200 accessories" appendix. The relevant catalog numbers are:

For a beginner's reset, the 4 MB or 24 MB card is sufficient. The 4 MB card is the cheapest new-from-stock option; the 24 MB card is the most commonly available on the secondary market. Cards labeled Helmholz 700-954-8LC03 are functionally compatible pin-for-pin with the Siemens 6ES7954-8LC03 and use the same Siemens-proprietary file system. The Helmholz part numbers follow the same capacity scheme (8LC03 = 4 MB, 8LE03 = 12 MB, 8LF03 = 24 MB, 8LL03 = 256 MB).

Method 1: TIA Portal Online Factory Reset (Requires No Password in Specific Cases)

On S7-1200 CPUs with firmware V4.0 and later, an undocumented-but-supported path exists that may bypass the password prompt in specific configurations: if the CPU is in STOP mode and the online connection is made via the CPU's PROFINET port on the same subnet, TIA Portal sometimes offers a "Reset to factory settings" entry under Online & Diagnostics > Functions even when the CPU is fully protected. This behavior is inconsistent across firmware revisions and is not guaranteed.

The reliable sequence is:

1. Open TIA Portal and create a new project with the matching CPU order number (e.g., 6ES7214-1AG40-0XB0 for CPU 1214C DC/DC/DC, FW 4.x).
2. Click Project tree > Online & Diagnostics.
3. From the "Online access" dropdown, select the network adapter that can reach the CPU.
4. Click the Go online button. If the CPU is reachable, TIA displays the diagnostic dashboard.
5. Navigate to Functions > Reset to factory settings.
6. If the CPU prompts for a password, this method has failed; proceed to Method 2.
7. If the prompt does not appear, check the box "Keep IP address" (optional) and click "Reset".
8. Wait for the CPU to perform the reset (typically 30-60 seconds). The status LEDs will cycle through STOP, flash, and return to STOP with a solid green RUN/STOP LED off.

Method 2: Transfer Card Reset (Primary Method, Always Works)

This is the canonical Siemens-approved procedure for clearing a password-protected S7-1200. The procedure overwrites the internal load memory with a clean project stored on the SMC, which simultaneously clears the password table.

Step 1: Create a Minimal TIA Portal Project

1. Launch TIA Portal and select Create new project.
2. Add a new device: Add new device > SIMATIC S7-1200 > CPU > [exact order number from the CPU's front label]. The order number encodes the firmware version; matching it ensures TIA builds a compatible configuration.
3. Open CPU Properties > Protection and select No protection. Leave the password fields empty.
4. Add a new OB1 (Main) if the project does not contain one: Project tree > Program blocks > Add new block > Organization block > OB1.
5. Compile the project: Project tree > [CPU name] > Compile > Software (rebuild all). Compilation must complete with zero errors before the project can be written to the SMC.

Step 2: Write the Project to the SMC

1. Insert the SMC into the PC's SD card slot. If the PC has no SD slot, use a USB SD reader.
2. In TIA Portal, navigate to Project tree > [CPU] > Online & Diagnostics, or use the menu path Online > Memory card file browser > [SD card drive letter].
3. Drag the CPU device from the project tree onto the SD card icon in the Memory Card File Browser, or right-click the CPU and select Card Reader/USB memory > Write to memory card.
4. Confirm the dialog. TIA Portal will format the card if needed and write the project file structure. The card will contain a SIMATIC.S7S directory, a S7_JOB directory, and the project-specific FWUPDATE.S7S file if a firmware update is included.
5. Safely eject the SMC from the PC.

Step 3: Transfer the Project to the CPU

1. Verify the CPU is powered off. The CPU's RUN/STOP LED should be off.
2. Insert the SMC into the CPU's card slot. The slot is located behind a small flap on the top or front of the CPU, depending on the variant. The card label faces outward.
3. Apply 24 VDC to the CPU. The CPU will boot, detect the SMC, and enter Transfer mode.
4. Observe the LED sequence: MAINT flashes orange, RUN/STOP flashes yellow/green, then the CPU copies the project from the SMC to internal load memory. This typically takes 10-30 seconds for a minimal project.
5. When the transfer completes, the CPU performs an automatic restart and enters STOP mode (the inserted SMC's configuration takes priority over any prior internal project).
6. The CPU is now unlocked. The old program blocks have been overwritten; the old password has been cleared.

Step 4: Remove the SMC and Verify

1. Power off the CPU.
2. Remove the SMC. The CPU will now boot from internal load memory, which contains the new empty project.
3. Apply power. The CPU enters RUN if the new project contains an OB1; otherwise it stays in STOP.
4. Connect TIA Portal and go online. TIA should connect without a password prompt because the new project is configured with "No protection".

Method 3: Helmholz or Compatible Third-Party Card

The Helmholz 700-954-8LC03 (4 MB) and 700-954-8LF03 (24 MB) cards are functionally equivalent to the Siemens 6ES7954-8LC03 and 6ES7954-8LF03. They use the same controller chip and the same Siemens-proprietary file system. TIA Portal recognizes them transparently as "SIMATIC Memory Card" and writes the project identically.

Pricing comparison as of the article's authoring:

Firmware-Specific Behavior

The transfer-card procedure is stable across firmware versions, but specific behaviors vary:

On all firmware versions, the password table is part of the CPU's configuration data. Overwriting internal load memory with a new project's configuration always resets the table. There is no firmware version in which the password survives a transfer-card operation.

Verification Procedures

After completing the reset, perform the following checks to confirm a clean state:

1. Online connect without password: In TIA Portal, go online. TIA should connect immediately without a credential prompt.
2. CPU diagnostic buffer: Open Online & Diagnostics > Diagnostic buffer. The most recent entries should show the power-on sequence and the OB1 scan, with no entries referencing the old program.
3. Block list check: In the project tree's online view, confirm the only blocks are those from the new project (OB1 and any system blocks).
4. Protection state: Open Online & Diagnostics > Properties > Protection. The active level should be "No protection".
5. IP address preservation: If the original CPU had a static IP address and you want to preserve it, open Online & Diagnostics > Functions > Assign IP address and re-enter the address, or use the TIA "Keep IP address" option during the initial project write.
6. Firmware version check: Confirm the CPU's firmware version in the diagnostic buffer matches the order number on the front label. A mismatched firmware would indicate a failed transfer or an incorrect CPU device selection in TIA.

Troubleshooting Matrix

Alternative Beginner Platforms to Consider

If the S7-1200 project is purely a learning exercise and there is no requirement to use Siemens hardware specifically, several entry-level controllers ship without password protection and require no SMC for factory reset:

• Allen-Bradley Micro800 (2080-LC30, 2080-LC50): Connected Components Workbench provides a one-click "Reset to out-of-box configuration" that clears all project data without authentication.
• Omron NX1P (NX1P2-9024DT): Sysmac Studio supports a clean-all function that requires no credential.
• AutomationDirect ProductivityOpen: P-series CPUs reset via the Productivity Suite software without a password challenge.
• Schneider Modicon M221 / M241: EcoStruxure Machine Expert Basic provides a "Reset Controller" command accessible without authentication.

These platforms trade the S7-1200's industry footprint for a lower learning curve on the reset workflow. If the learning goal is "how to program a PLC" rather than "how to operate TIA Portal", a non-S7 controller reduces the time-to-first-program from hours to minutes.

Safety and Handling Notes

The S7-1200 retains a supercapacitor-backed real-time clock and retains volatile bit memory for several days after power-off, but the project and password table are stored in flash that is not affected by power cycling. Repeated power cycles do not weaken the protection.

Frequently Asked Questions