Siemens SIMATIC C7-636 Factory Reset: Password Removal Guide

1. Problem Definition and Affected Hardware

The SIMATIC C7-636 Touch is a fully integrated control system that combines a SIMATIC S7-300 CPU 315-2DP, an OP270 5.7-inch operator panel, and the integrated onboard I/O of a CPU 314C-2DP in a single physical housing. Because the PLC program, the HMI configuration, and the WinCC flexible / ProTool project all live on the same unit, a forgotten password on any one layer can prevent re-commissioning a salvaged or inherited device. This article documents the layered reset procedure, the hardware prerequisites, and the verification steps required to return a C7-636 to its as-shipped state.

Locate the order number (MLFB / Siemens part number) on the nameplate on the back of the unit before any reset is attempted. The standard variant is 6ES7 636-2SC00-0AA0 (or -0AE0). Internally, the C7-636 consists of:

• PLC section: S7-300 CPU 315-2DP (6ES7 315-2AFxx-0AB0) with integrated PROFIBUS-DP master/slave interface (MPI/DP combined)
• Operator panel section: OP270 5.7-inch monochrome or color touch HMI
• I/O section: 24 DI / 16 DO / 4 AI / 2 AO inherited from the 314C-2DP
• MMC slot: 1 x MMC slot for the CPU program and project
• CF slot: 1 x CompactFlash slot used by the OP270 for runtime backup, recipe, and archive storage (not interchangeable with the MMC)

Per the official Siemens product announcement (entry ID 18153256), the C7-636 replaces the older C7-635 with a more powerful CPU and a touch-enabled OP panel. Firmware behavior of the embedded CPU 315-2DP is identical to a standalone 6ES7 315-2AF03 or later.

2. Password Protection Layers

Three independent passwords can be set on a C7-636, and each one must be cleared or bypassed to obtain a clean factory state:

All three layers are independent. Clearing only the PLC password leaves the OP project locked. Conversely, resetting the OP panel does not unlock the CPU program. A complete factory reset must address all three.

3. Pre-Reset Conditions and Safety

Before initiating any reset, observe the following prerequisites:

1. Disconnect the 24 V DC supply at the main isolator. The C7-636 backplane remains energized when the unit is in STOP, so a hard power cycle is required to clear transient faults.
2. Verify the AT1 / AT2 terminals on connector X1 of the C7-636 are bridged to feed 24 V to the onboard I/O. If the bridge is missing, the CPU will report I/O faults and the MRES sequence may be interrupted. Reference: Chapter 4.3 of the C7-636 Equipment Manual (Siemens manual set bundled with the unit).
3. Insulate any field wiring to the integrated digital and analog I/O. The 24 V outputs toggle during the reset sequence, and the analog outputs may drive to undefined values.
4. Confirm the MMC is seated and that the ejector is fully locked. The CPU will not boot without a valid MMC.
5. Have a Field PG (or equivalent programming device) with STEP 7 V5.5 + SPx and/or TIA Portal V13+ available, with a working MPI or PROFIBUS cable.
6. Document the current MPI / PROFIBUS / IP addresses of the unit before reset, because a factory reset returns the CPU to MPI address 2 at 187.5 kbps and the OP to its default IP.

4. CPU 315-2DP MRES Reset

The first hardware reset path is the MRES sequence on the CPU mode switch. This is the only way to attempt a CPU-level reset without an online connection. On a C7-636 the mode switch is reached through an access flap on the front of the unit.

4.1 Standard MRES Procedure

1. Set the mode switch to STOP. The STOP LED should be solid.
2. Move the switch to MRES and hold. The STOP LED turns off, then begins to blink slowly (the "request overall reset" pattern).
3. Continue holding MRES. After approximately 9 seconds the STOP LED lights continuously; this is the "ready to reset" state.
4. Within the next 3 seconds, release the switch and immediately move it back to MRES. The STOP LED now blinks rapidly during the delete procedure.
5. When the STOP LED returns to a steady ON, the overall reset is complete and the CPU is in STOP with an empty work memory.

4.2 What MRES Does Not Do on a C7-636

On a standalone S7-300 with no MMC, MRES clears work memory and the password list. On the C7-636 the MMC is mandatory, so MRES clears work memory but the password entry on the MMC is preserved. A standard MRES leaves the PLC online password intact. To clear the password as well, follow the TIA Portal or STEP 7 V5.x procedures in Sections 5 and 6.

5. TIA Portal Reset to Factory Settings

If an online connection to the CPU 315-2DP inside the C7-636 can be established (i.e. the PLC password is known or the MMC is unprotected), the cleanest path is the integrated TIA Portal function. The TIA Portal manual collection documents the procedure as follows:

1. In the project tree, right-click the C7-636 device and select "Online & Diagnostics".
2. Open the Functions folder.
3. Select "Reset to factory settings".
4. Optionally check "Keep IP address" if you need to re-flash the device from the same PG after the reset.
5. Confirm with Reset. The CPU restarts in STOP with default MPI address 2, default IP, and an empty work memory.

Reference: TIA Portal manual collection: Resetting the CPU to factory settings.

6. STEP 7 V5.x Equivalent (URLöschen)

For sites still on STEP 7 V5.5 or V5.6 (the typical toolchain for C7-636 era projects), the equivalent procedure is:

1. Open SIMATIC Manager and establish an online connection to the C7-636 CPU 315-2DP via MPI or PROFIBUS at 187.5 kbps (default address 2).
2. From the PLC menu, choose PLC → Operating Mode and force the CPU into STOP.
3. Choose PLC → Clear/Reset. In the dialog, select "Reset CPU to factory settings" (German: "URLöschen"). This is functionally identical to MRES on the S7-300 platform, but executed from the programmer.
4. Click OK. The CPU executes the overall reset, clears all passwords stored on the MMC, and returns to STOP.
5. Re-verify online connection. TIA Portal / SIMATIC Manager should connect without prompting for a password.

The "Reset to factory settings" option in STEP 7 V5.x is a deliberate user action that, unlike a hardware MRES, does clear the CPU password from the MMC. This is the recommended path if you have online access and a known IP or MPI route to the device.

7. OP270 Panel Reset Sequence

The operator panel is reset through its own service menu, independent of the CPU reset. There are two paths:

7.1 Soft Reset from the OP Front

1. Power-cycle the C7-636.
2. During the OP270 boot sequence, tap the upper-left corner of the touch screen as soon as the splash image appears. This enters the OP start-up menu.
3. Choose Start Center → Settings → OP Properties → Reset.
4. Select "Delete project on OP". The OP erases the resident WinCC flexible / ProTool project, including any project password.
5. Confirm and allow the OP to restart.

7.2 Hard Reset via Transfer Card

If the OP is not responding to touch or the boot sequence is corrupted:

1. Prepare a CF card with a fresh ProTool / WinCC flexible project named *.pdb for transfer.
2. Power down the C7-636.
3. Insert the transfer medium into the OP CF slot.
4. Power up. The OP detects the transfer file and auto-loads it, overwriting any password-protected project.
5. Remove the CF card when prompted.

8. MMC Handling and Replacement

The MMC is the central security element on the C7-636. The correct handling rules are:

• Do not format in Windows. The MMC uses a Siemens-proprietary file layout. A Windows format will leave the card readable by a PC but un-bootable by the CPU.
• Card type: The C7-636 ships with a 3.3 V MMC, sizes from 64 KB up to 8 MB depending on revision. Order replacements under 6ES7 953-8Lxxx-0AA0 series.
• Cloning: Use STEP 7 PLC → Copy RAM to ROM or TIA Portal Online → Download to device → Save to memory card to back up the MMC contents before any reset.
• Reset by replacement: If the password cannot be cleared any other way, removing the MMC and inserting a new, blank MMC causes the CPU to go to STOP with an "MMC not configured" fault. The new MMC can then be loaded with a fresh project from the PG.

9. CF Card vs. MMC Distinction

The C7-636 has two distinct removable media, and confusing them is the most common cause of irreversible lockouts:

The CF card is treated as ordinary FAT storage by the OP firmware. It can safely be read and formatted on a PC. The MMC must never be formatted on a PC, because the CPU firmware image on the MMC is signed and the bootable partition structure is not visible to a standard operating system.

10. AT1 / AT2 Terminal Wiring

The C7-636 X1 connector includes dedicated terminals for the sensor and load voltage supplies. AT1 (load voltage 24 V reference for the digital outputs) and AT2 (sensor voltage 24 V reference for the digital inputs) must be bridged to 24 V for the integrated I/O to function. If the bridge is missing, the CPU reports a group fault on the I/O subsystem and may refuse the MRES sequence partway through.

Confirm the bridge is intact before initiating a reset. If the terminals are open, close them with a short insulated wire link and re-attempt the procedure. Detailed wiring is in Chapter 4.3 of the C7-636 Equipment Manual. Note that bridging AT1/AT2 is not the same as supplying 1L+ / 1M; both pairs are required for the integrated 314C-2DP I/O section.

11. Verification Steps

After every reset path, verify success in the following order:

1. CPU mode: The mode switch is in STOP, the STOP LED is solid, and the RUN LED is off.
2. Diagnostic buffer: In TIA Portal or STEP 7, read the diagnostic buffer. The last entry should be "Overall reset completed" with no follow-up fault entries.
3. Password prompt: Attempt to go online without a password. TIA Portal / SIMATIC Manager should connect without prompting.
4. OP state: The OP270 should display the standard "No project" or WinCC flexible start screen. If a "passivated" or "password-protected" message remains, repeat the OP reset from Section 7.
5. MMC card ID: In STEP 7, PLC → Module Information → "Memory" should show the MMC as the active memory with 0 blocks in work memory.
6. Default addressing: The CPU reports MPI address 2 at 187.5 kbps and PROFIBUS DP address 2. The OP270 reports its default IP (192.168.0.1 or as shipped).

12. Troubleshooting Matrix and Escalation

If all three password layers (PLC, OP project, OP service) remain locked after exhausting the procedures above, the unit is effectively bricked for reuse as a standalone controller. Options at that point are:

• Order a replacement MMC (6ES7 953-8Lxxx-0AA0 series) and a replacement OP transfer image from Siemens.
• Open a service request through the Siemens Industry Online Support portal referencing the device order number on the nameplate.
• Use the unit as a parts donor for the integrated 314C-2DP I/O section or the OP270 display.