Siemens S7-400 CPU 412-2DP: OEM Speed-Lock Password Recovery

Overview

Packaging-line OEMs such as Sidel, Krones, and SIDEL ship many PET bottle machines from a single mechanical platform and differentiate them in software. A 4600 bottles/hour (b/h) machine and a 5600 b/h machine on the same platform can use the same SINAMICS/Micromaster drive set, the same preform oven, the same starwheel geometry, and the same Siemens SIMATIC S7-400 CPU 412-2DP (order number 6ES7412-2EK06-0AB0 for the latest -2EK06 revision). The only difference is a single software enable that selects a higher setpoint in the cycle-time logic. The OEM then sells access to that enable through a password entered on the HMI.

This article documents the engineering question that arises when that password is lost, the PLC is memory-reset, or the line is recommissioned: will downloading a backup of the program restore the 5600 b/h state, or is the password still required? The short answer is that a program download alone is not sufficient; the 5600 b/h state is held in a data value, not in the program code. The remainder of this article explains the S7-400 memory architecture behind that statement and the diagnostic and remediation steps available to the maintenance engineer using STEP 7 V5.3 and a standard Power-PG.

1. S7-400 Memory Architecture Relevant to the Unlock

The CPU 412-2DP partitions its storage into four regions. Understanding which one holds the unlock bit is the entire problem.

The CPU 412-2DP exposes 8 KB of bit memory (M0.0 – M255.7), 2048 timers, 2048 counters, and a configurable retentive slice that is set in HW Config under CPU Properties → Retentive Memory. By Siemens default, the first 16 bytes of bit memory (MB0 – MB15) and the first 8 timers/counters (T0–T7, C0–C7) are retentive; the remaining system memory is cleared on a cold restart or MRES. A full list of retentive defaults for the S7-400 family is in the S7-400 Automation System, Module Data manual.

Data blocks (DBs) are retentive only if the DB's properties have the "Retentive" attribute set. The "Non-retentive" checkbox in STEP 7's DB properties is the wrong default to assume: an unticked DB is retentive only if it is listed in the CPU's retentive DB table in HW Config. With the CPU 412-2DP, the retentive DB area is 0 to 4095 by default (16 KB) and can be expanded in the HW Config dialog.

2. Why the Password "Disappears" After a Reset

The HMI password routine, when triggered, sets a tag in the PLC that gates the higher production rate. If that tag is stored in a non-retentive location, a cold restart, MRES, or power cycle with battery failure clears it, and the next cold start comes up at 4600 b/h. Three storage locations account for virtually every OEM speed-lock implementation seen in the field:

2.1 Single-bit M-flag pattern

| Password_OK_HMI  |------( S )--[ M 200.0 ]--[ High-Speed-Enable input of FC50 "CycleTime" ]
    (BOOL tag)                          (non-retentive)

M200.0 is read by the cycle-time FC and selects the multiplier between 1.0000 (4600 b/h) and 5600/4600 = 1.21739 (5600 b/h). If M200.0 is outside the CPU's retentive range, every cold start returns it to 0 and the machine starts at the lower setpoint.

2.2 Data-block word pattern

DB100.DBX  0.0  BOOL   Unlock_HighSpeed    := FALSE;   // password routine sets TRUE
DB100.DBD  2.0  REAL   Speed_BPH_Setpoint  := 4600.0;   // overwritten by HMI script

DB100 is non-retentive (its initial values are restored from load memory on cold restart). After a memory reset, the initial value 4600.0 is reloaded and the high-speed path is disabled.

2.3 Indirect branch / pointer pattern

      +----[ M 250.0 ]----( JCN )--+
      |                              |
      v                              v
  FC50_HighSpeed                 FC50_Standard
  (5600 b/h cycle)               (4600 b/h cycle)

Functionally identical to §2.1; the gating condition is still a flag, just used in a jump rather than a multiplier.

3. Will Downloading the Backup Program Restore 5600 b/h?

No. A backup program download via PG (PLC → Download) writes the offline project from the programming device to the CPU's load memory and, after a STOP/RUN transition, to work memory. The downloaded program is byte-identical to the program that was in the CPU before the memory reset — the OEM's password routine is in the HMI project, not in the PLC program. The difference between a 4600 b/h and a 5600 b/h state is not in the program code; it is in one data value in the CPU's work memory that the password routine writes through the HMI tag binding.

Therefore:

• Downloading the program alone does not raise the speed.
• Re-entering the password on the HMI raises the speed, but only if the enable bit is preserved through the power cycle. If the bit is non-retentive, the password must be re-entered after every memory reset.
• Storing the enable bit in a retentive location (one line of AWL/STL plus a tick in HW Config) is a 5-minute change, but it is a software modification that has the implications discussed in §6.

4. Prerequisites for Diagnosis

• STEP 7 V5.3, V5.4, or V5.5 (the source specifies V5.3). The STEP 7 V5.3 SP3 update is the most stable release for offline analysis of an existing project. STEP 7 V5.7 (TIA Portal precursor) can be used for offline analysis but requires a project upgrade.
• The original S7 project archive (*.S7P / *.ARJ / *.ZIP) with all blocks, system data, and source files. Without the archive, online analysis is the only path, and CPU protection (if set) will block it.
• A programming device with an MPI/PROFIBUS interface. The recommended adapter is the PC Adapter USB A2 (6ES7972-0CB20-0XA0) on USB, or a CP 5611 / CP 5613 / CP 5711 in a PCI/PCMCIA slot.
• The HMI project file (WinCC flexible 2004 / 2007 / WinCC TIA Portal) so that the password routine can be located.
• Access to the CPU's online protection password if a CPU password is set (CPU 412-2DP supports write-protection and read/write-protection levels 1, 2, 3 in HW Config → CPU Properties → Protection).

5. Step-by-Step Diagnostic Procedure

5.1 Read the current online program

1. Open the project in STEP 7 V5.3.
2. Set the PG/PC interface to PC Adapter (MPI) or CP5611 (PROFIBUS) in the Windows Control Panel → SIMATIC → Set PG/PC Interface.
3. In the SIMATIC Manager, right-click the S7 program object → PLC → Upload Station to PG. This reads the CPU's current online program back to the offline project, including any online-only patches the OEM may have applied.
4. Save the project as a new archive (File → Archive) before any change.

5.2 Cross-reference the speed setpoint

1. Open the symbol table or invoke Options → Cross-reference (Ctrl+Shift+F3).
2. Search for the constants 4600 and 5600 in the AWL/STL source. Typical locations: an FC for cycle time, a DB for recipe data, an FB for the cam profile, or a sin/cosine generator for the stretch-rod.
3. Note every FC/FB/DB that references the constants and trace upstream to the condition that selects between them.

5.3 Identify the enable bit

1. In the symbol table, look for symbols containing Passw, Unlock, SpeedClass, Performance, Premium, High, or 5600.
2. Monitor these tags online with Monitor/Modify (Ctrl+F7 or the glasses icon). Force a value change on a non-critical flag first to confirm the monitor path works.
3. Verify the flag is non-retentive: open HW Config → CPU 412-2DP properties → Retentive Memory tab. Anything not listed in Retentive Bit Memory, Retentive Timer, Retentive Counter, or Retentive DBs is cleared on cold restart.

5.4 Test the password routine in the HMI

1. If the HMI is WinCC flexible 2004/2007, open the project in the same tool used to compile the runtime. In the source, locate the script that fires on the password-entry button (VBScript: Sub OnClick...End Sub, or C script in older WinCC flexible).
2. The script will either set a tag like Unlock_HighSpeed (BOOL) and the PLC tag-binding does the rest, or it calls a script function in the PLC via raw S7 read/write, setting a specific DB bit.
3. Re-enter the password and observe the suspected enable bit transition from 0 → 1 in the online monitor.

5.5 Confirm dependency

1. With the bit at 1, capture the cycle-time FC inputs and outputs in a VAT table.
2. Toggle the bit to 0 manually (Monitor/Modify → Modify to 0) and confirm that the machine drops back to 4600 b/h setpoints within one scan cycle.
3. Restore the bit to 1 immediately. This test should only be done on a stopped machine or with the safety circuit active.

6. STEP 7 Procedure to Make the Unlock Persistent

6.1 Identify and document

• Symbol name, address, type, and current value of the enable bit.
• Scan cycle (OB1, OB35) in which it is evaluated.
• All locations that read it (cross-reference output saved as RTF or XLS).

6.2 Make the change offline

1. In the offline project, open HW Config → CPU 412-2DP → Properties → Retentive Memory.
2. Tick the MB containing the enable bit (e.g., MB200) in Retentive Bit Memory from MB0 to MB… and set the upper bound to at least 201.
3. Save, compile HW Config (Station → Save and Compile).
4. Download HW Config (PLC → Download to Target System). This is a separate download from the block download; the CPU may request a STOP/RUN transition. Confirm with the operator that the line is in a safe state.

6.3 Verify

1. Cold-restart the CPU (MRES or power cycle with battery).
2. After CPU returns to RUN, monitor the enable bit (M200.0). It should already be 1 if the password routine ran last time the HMI was online; if it is 0, the password routine in the HMI must still be triggered once to set it.
3. Verify the machine cycle time matches the 5600 b/h setpoint (1.2174 × 4600).
4. Run the line for 30 minutes, then check: drive currents on each SINAMICS/Micromaster (none should exceed rated current); heater currents on the preform oven (within rated kW); starwheel and conveyor motor temperatures (within rated); reject rate from the vision system (no change).

7. State-Diagram of the Reset / Unlock Cycle

8. Why OEMs Lock Performance Behind a Password

OEMs like Sidel build a single mechanical platform and sell it at multiple throughput tiers. The 4600 b/h tier and the 5600 b/h tier often share the same gearboxes, drives, and PLC program; the higher tier is enabled in software and the user pays a software-unlock fee. The practice keeps the catalog simple (one part number for several capacity ratings) and allows the OEM to charge for capacity as an ongoing service item. It is also why, in the field, a "used" 4600 b/h machine often shows the same hardware as a 5600 b/h machine in the OEM's catalogue — the only difference is a bit inside the S7-400.

From the OEM's perspective, the password gate also serves a commercial purpose: if a single service call could turn a 4600 b/h machine into a 5600 b/h machine permanently, no customer would ever buy the higher tier up front. The lock is therefore a revenue-protection mechanism, not a safety mechanism. Safety limits are enforced by the drive's I²t model, the motor thermal model, and the mechanical design envelope — those are independent of the password.

9. Mechanical and Electrical Limits of Running at 21.7% Higher Throughput

The diagnostic above confirms the software unlock. It does not validate the mechanical envelope. A 21.7% throughput increase (5600 / 4600 = 1.21739) is significant and stresses every subsystem. The following table summarises the field-observed deltas. The numbers below come from typical PET line designs; consult the OEM's machine data sheet for exact values for the platform.

For these reasons, an unlock that is not accompanied by the OEM's higher-tier drive / oven / compressor hardware is not a 5-minute engineering change. It is a re-validation exercise. The 5-minute change is the diagnostic; the engineering decision is the operator's.

10. Backing Up the Online Project After Password Entry (No-Code-Change Workaround)

If site policy forbids any code modification, the simplest workaround is to back up the online project after the password has been entered, and to download that archive after any memory reset. The procedure is:

1. Enter the password on the HMI, confirm the machine is at 5600 b/h, and let the line run for 10 minutes to confirm stability.
2. From the PG, upload all online blocks (PLC → Upload Station to PG). Save as a new archive with a distinct name.
3. After any future memory reset, download this archive to the CPU before triggering the HMI. The downloaded program will set the enable bit to its initial value (which is 0 if the DB defaults are 0), so the machine will still come up at 4600 b/h. The HMI must be told "password OK" via the standard procedure.

This workaround does not actually persist the unlock — it only persists the program code, which was already the same. The operator must still enter the password. What it does buy is a clean, known-good offline archive to compare against if the line ever fails to come up correctly after a reset.

11. CPU Battery and Retentive Memory

The CPU 412-2DP uses one or two AA lithium backup cells, depending on the order number. The standard battery is the 6ES7971-0BA00. The diagnostic buffer records "Battery failure" with event ID 16#01:02:0B (or 16#01:02:01 depending on firmware version) and the BATF LED on the CPU front lights up. If the battery is dead, the entire retentive area is lost on the next power-down. Replace the battery with the CPU powered up to preserve retentive data, or schedule a controlled shutdown.

Battery life at 25 °C ambient is typically 3–5 years. Plan replacement at the 4-year mark. The battery is hot-swappable on the CPU 412-2DP; an EXTF LED on the front will be on if the battery is not in place. The CPU does not enter STOP on battery failure alone, but it does clear retentive memory on the next power loss.

12. Drive Integration and Fault Codes

When running at the higher setpoint, the drive train will be the first subsystem to complain. Common drive fault codes that follow an unlock without a corresponding drive re-sizing:

If any of these faults appears within minutes of unlocking, the drive is the limit. Revert the unlock and contact the OEM for a drive re-sizing. The 5-minute software change is not the right answer when the bottleneck is the power section.

13. S7-400 Memory Card Notes

For long-term archival of the project, fit a FLASH Memory Card to the CPU 412-2DP. The card retains its contents without battery. Order numbers:

Note: a FLASH card can be used to update the firmware, while a RAM card can be written to from the PG at runtime. The project archive stored on the card is loaded into work memory on CPU power-up. Even with a FLASH card, the unlock bit (in work memory) is not persistent unless it is in the retentive area.

14. STEP 7 V5.3 Specifics

The source explicitly references STEP 7 V5.3. Specific features of that version that apply to this diagnostic:

• Cross-reference lives under Options and produces a tab-separated table that can be exported as RTF. The cross-reference is a live read of the symbol table, so symbol renames do not break the report.
• Monitor/Modify supports edge-triggered single-shot modifications (the Trigger button), useful for testing the enable bit without leaving the monitor window open.
• S7-PLCSIM V5.3 is bundled with STEP 7 V5.3 and can be used to validate the retentive-memory change offline. PLCSIM does not support the HMI side, but the password routine logic can be simulated by setting the enable bit directly in PLCSIM and stepping through the cycle-time FC.
• Upload Station to PG uploads system data (SDB) including the HW Config. The SDBs for the CPU's retentive memory and protection are uploaded only with the right CPU access level. If the CPU has write-protection, the retentive-memory change can still be performed by the OEM; the maintenance engineer can only read.

15. Troubleshooting Matrix

16. Frequently Asked Questions