Sinumerik 840C Password Recovery: CL800 R11 Parameter Method

1. Problem Definition: Sinumerik 840C Start-Up Password Lockout

The Siemens Sinumerik 840C CNC controller protects the Start-Up (Inbetriebnahme) area, machine data, and setting data behind a four-digit numeric password. The OEM-default value is 1111, but on retrofitted machines, second-hand turn-mill centers (e.g., Gildemeister), and machines that have been serviced by non-OEM personnel, the password is frequently changed to a non-standard value and the new value is lost when the OEM relationship is severed.

When the password is unknown, the following operations are blocked:

• Modifying machine data (MD) such as axis gains, servo loop parameters, and feed limits
• Modifying setting data (SD) including tool offsets, work offsets, and protection zones
• Accessing the Start-Up menu (Softkey Inbetriebnahme / Startup)
• Clearing the alarm history and PLC status displays
• Performing reference point adjustment and encoder calibration routines

This article documents the CL800-language bypass that uses an MDA (Manual Data Automatic) routine to copy the active password into readable R-parameter R11. The method is applicable to the entire Siemens Sinumerik 8xx family (810M, 810T, 840C, 850, 880, 805) and is the field-standard procedure when no OEM backup exists.

2. Password System Architecture on Sinumerik 8xx

On the 840C and related 8xx controllers, the start-up password is stored in a protected memory cell that is normally only addressed through the system operator panel softkey chain. The active password is referenced by a system call during the softkey callback handler that checks the four-digit entry before granting access to the start-up area.

The CL800 (Compact Language 800) interpreter on these controllers exposes a system function — identified by the designator @300 with a sub-function selector — that copies the contents of this protected cell into a user-visible R-parameter. Selecting the parameter index K11 targets register R11, which is the convention used by Siemens for the password register on the 8xx generation.

The R-parameter file is freely readable from the operator panel at any time without password challenge, which is what makes the bypass non-destructive: the password is read out, not overwritten, by the routine.

3. Prerequisites

Before executing the recovery procedure, verify the following prerequisites:

1. Controller identification: Confirm the operator panel label is 840C (or 810M / 810T / 850 / 880 / 805). The CL800 dialect used in this procedure is not present on later Sinumerik 840D / 840D sl / ONE controllers, which use a different NCK language (SLC / DIN 66025 extended).
2. Operator panel access: The 8xx must be powered up, PLC in run or stop as appropriate, and the NCK must be in a state where the MDA operating mode is selectable. Clear any axis-movement alarms or EMERGENCY-STOP conditions that would lock out the operating mode selector.
3. Machine data backup: Archive current machine data, setting data, R-parameters, and PLC program using the V24 (RS-232) port and the Services / Data Output softkey, or extract a copy from the FDD/PCP card if equipped.
4. Mode selection authority: The mode selector key switch (REF / JOG / MDA / AUTO) must have the password-protected key position enabled. On some installations the key is removable in AUTO only; ensure the operator can switch to MDA.
5. Override and feed-hold: Set rapid override to 0% and feed-rate override to 0% during the procedure to prevent unintended axis motion if the routine is accidentally run in AUTO mode instead of MDA.

4. Step-by-Step Password Recovery Procedure

Execute the following steps in order. Do not deviate from the syntax; the @300 directive is case- and whitespace-sensitive on some firmware versions.

Step 4.1 — Enter MDA Mode

Turn the operating-mode selector to the MDA position. The mode indicator on the screen header must read MDA. If the indicator still reads JOG, AUTO, or REF, the mode change has not been recognized — confirm the key-switch position and re-attempt.

Step 4.2 — Compose the CL800 Routine

Open the MDA buffer and enter the following three-block program exactly:

This single line invokes system function @300 with the constant selector K11 (password register index) and writes the result into the user R-parameter R11. The line number N5 matches the field-proven convention; any unused block number above the active NCK reset point is acceptable (N1 through N9 are all safe).

Step 4.3 — Cycle Start

Press CYCLE START (green button on the operator panel). The program executes in MDA. There is no tool motion — the @300 directive is a system-service call and does not require any axis to be referenced. Execution typically completes in under 200 ms.

Step 4.4 — Read the Resulting R11 Value

Navigate from the MDA screen to the parameter area:

1. Press the PARAMETER area softkey
2. Press PROGRAM PARAMETER
3. Press R PARAMETER

Locate register R11. The value displayed is the active four-digit start-up password.

Step 4.5 — Record and Reset

Write the recovered password down on a paper record, then navigate to:

1. START-UP area softkey (the same one that originally rejected the entry)
2. Enter the recovered password when prompted
3. Open the PASSWORD / PASSWORT submenu
4. Change the password back to a known value (the default is 1111; many service engineers use a service-unique code such as the machine serial number, a four-digit date stamp, or 0000 for non-production units)
5. Confirm the new password by re-entering it when prompted
6. Power down the controller, wait 30 seconds, and power back up to confirm the new password is retained in non-volatile storage

5. Error 3004 Diagnosis and Resolution

One of the most common failure modes reported in the field is the alarm:

Alarm 3004 channel 1 means the CL800 interpreter has rejected the program block at line N5. The Fehler bei CL800 - Programmierung suffix translates to Error in CL800 programming. This alarm prevents the @300 directive from executing and leaves R11 unchanged.

5.1 — Typical Recovery Cycle After Alarm 3004

1. Press RESET on the operator panel to clear the alarm condition
2. Delete the contents of the MDA buffer completely
3. Re-enter only the line N5 @300 K11 R11 with no trailing characters, no leading spaces, no comment
4. Verify the mode is still MDA
5. Press CYCLE START
6. If alarm 3004 recurs, perform an NCK cold restart (typically by turning the NCK section off, waiting 10 seconds, and restoring power)

6. Common Password Values to Try First

Before running the CL800 bypass, it is field-proven practice to attempt the high-probability candidates first. On used machines the password has frequently been changed to one of the following:

7. Sinumerik 8xx Family Compatibility Notes

The CL800 @300 K11 R11 routine has been field-verified by service engineers across the full Sinumerik 8xx line. Compatibility caveats follow.

7.1 — Sinumerik 805

The 805 is the entry-level 8xx controller. The routine is supported on all 805 firmware versions that include CL800 language support, which is essentially the full production run. The 805 has no FDD and stores machine data on battery-backed SRAM — verify the lithium battery is healthy before any password reset, as a dead battery will clear the password anyway but also clear all machine data.

7.2 — Sinumerik 810M / 810T

The 810M (milling) and 810T (turning) variants are the most common 8xx controllers on Gildemeister, Index, Boehringer, and EMAG turning machines of the late 1980s and 1990s. The routine is fully supported. Field reports indicate the password area on 810T is the same as on 840C.

7.3 — Sinumerik 840C

The 840C is the subject controller of this article. The routine is supported across all 840C firmware releases. The 840C has a slightly different softkey layout from the 810 — the parameter area path may be labeled PROGRAM PARAMETERS rather than PROGRAM PARAMETER.

7.4 — Sinumerik 850 and 880

The 850 and 880 are higher-end 8xx controllers used on large milling and turning centers. The routine is fully supported. On 880 controllers, the parameter area may require a deeper softkey navigation, but the underlying register mapping is identical.

8. Verification

After executing the recovery procedure and resetting the password, perform the following verification steps:

1. Password acceptance test: Navigate to the start-up area, enter the new password, and confirm a Start-Up softkey becomes accessible.
2. Read/write machine data: Open a non-critical machine data field (e.g., MD 200* series display parameters), read its current value, write the same value back, and confirm acceptance.
3. Power-cycle retention: Power down the controller, wait 30 seconds, power back up, and re-enter the new password to confirm retention in non-volatile memory.
4. Mode switching test: Cycle the controller through REF, JOG, MDA, AUTO modes to confirm the mode-change password check (if enabled) is unaffected.
5. Backup refresh: Re-archive the complete machine data and PLC user program with the new password-protected start-up state.

9. Troubleshooting Matrix

10. Best Practices and Long-Term Recommendations

1. Maintain a written password log for every 8xx controller on the shop floor, stored in a secure location separate from the machine itself.
2. Archive the complete machine data set on a regular schedule (quarterly minimum) and store the archive with the password log.
3. Audit password changes — every password reset should be documented with the date, the engineer who performed it, and the reason. This prevents the scenario of co-workers changing the password and not communicating the new value.
4. Avoid common PINs such as 0000, 1234, 1111, or the year, which are the first candidates tried by unauthorized personnel.
5. Verify the lithium battery on the NCU / CCU at each scheduled service interval. A dead battery will clear the password along with all machine data.
6. Document the controller firmware version at the time of any password change, so that future service engineers can verify the @300 routine is supported on the running build.

11. Limitations and Scope Boundaries

The CL800 @300 K11 R11 method is limited to the Sinumerik 8xx family running CL800 firmware. It is not applicable to:

• Sinumerik 840D / 840D sl / 840Di (uses SLC / DIN 66025 with different system function calls)
• Sinumerik 802D / 808D / 828D / 840D sl (SLC-based, requires different bypass via specific NCK variables)
• Sinumerik ONE / Sinumerik MC (current generation, requires Siemens service credentials)

For controllers outside the 8xx family, the recovery path is to engage Siemens service directly with proof of ownership, or to use the OEM's machine data archive. The method documented here must not be applied to controllers where it is not supported, as the @300 directive will trigger an undefined-behavior alarm on non-8xx NCK firmware.

12. FAQ