Unlocking Siemens S7 200 4

[coolidge]

Hello everybody.

I am new to this forum and i come here because i have noone else to turn to.

I work in a small family company that makes liquid soaps and we bought a labeling machine a few years ago from italy. After a few months the machine broke down and was in warranty. However the seller said that they do not provide service in my country and there is no representative here. They said we need to transport the machine back to them which ment several weeks without working. So we agreed that they have to come and fix it. We agreed to pay all the travelling costs of their technician but said that they should cover the working hours as the machine is in warranty. So the technician came, fixed it and we payed the travel and accomodation costs, took the technician to dinner, showed him the city and everything.

But they wanted to bill us for the hours too and the covered kilometers and overtime. which we refused and went seperate ways with them.

Now the machine is out of order again and we cant fix it. So we call the Siemens representative here and ask for support as the PLC is Siemens. They come and examine and say that they cant connect because the program is password locked.
The italians promised to give us the program and electrical schemes of the machine but delayed it and eventually didnt give anything. Now we are left alone in this mess and the production is severely slowed because of this.

The people at Siemens say that there is a program that can brake the password and allow connection to the program in the PLC but they dont know what it is. And we need to access the program to determain the location of the fault and resolve it. A month has passed now and we are running out of time.

So please, if anyone has any information that could help, it would be much appreciated.

 

[Henneshoe]

Not sure if this will help or not, but I found another forum in which someone was having a similar problem. Here is the URL:

http://www.searcheng.co.uk/dcforum/DCForumID4/97.html

I have not used the PLC in question, so I can not verify if this will work.

 

[Henneshoe]

After further research, it looks like entering the password reference in the forum in my previous thread will only allow you to erase the entire program. Probably not what you want to do. Sorry I couldn't help more.

http://www.plctalk.net/qanda/archive/index.php/t-12895.html

 

[CanadianTaff]

Probably will have to bite the bullet and go back to Italy, pay them through the nose and learn from the experience.

Whoever bought the machine without making sure that you had cover from the supplier and/or full access to the equipment should be shot.

 

[SteveBailey]

This machine has worked properly in the past. The fact that it is not working properly now is not an indication that the program in the PLC has worn out.

Granted, access to the PLC program is an effective diagnostic tool, but it is not the only way to get to the root of the problem. The cause of the problem is much more likely to be a blown fuse, broken wire, misaligned or broken sensor, or some other failure external to the PLC program. Locate that, and you'll have your machine back up and running.

I see this syndrome all too often. People place the blame on that which they understand the least. The attitude seems to be "I don't understand what that PLC thing does, but the machine isn't working, so I need to call somebody in to reprogram it".

 

[mikek10]

I agree in general - I get this all the time too - but I think you are doing the OP a disservice in this case.

"we need to access the program to determain the location of the fault and resolve it"

Without knowing the program or having schematics nontrivial problems would be hard to fix!

If a thorough inspection doesn't reveal anything then I don't see much option other than biting the bullet and paying the Italians the money.

I'd like to say that this wasn't typical of Italian manufacturers, unfortunately if I did I would be lying.

 

[itsmoked]

coolidge; I suggest you find a local guy to come in and fix the machine. This will give you an important local resource for the future. I would not go back to the thieves.

I also think SteveBailey has an excellent point. It likely isn't even a PLC problem. A good mechanical/electrical guy could probably puzzle it out for less than a round trip ticket price for the thieves.

I was faced with this type stuff continually at a local tannery where, "All good leather equipment is Italian!", caused this exact problem regularly. Kept me in good pocket change.

Where are you located? Maybe someone here could help.

Keith Cress
Flamin Systems, Inc.-

http://www.flaminsystems.com

 

[sparky1234]

Unfortunately, I've seen this situation all to often. Customers are stuck with equipment they can't effectively troubleshoot. It should always be a requirement that the program be turned over to the end user.
The problem is probably a field device, however it can be looking for a needle in a haystack without being able to do an online diagnostic.
If you don't want to deal with the OEM, then your best bet is to reverse engineer the machine. This can take quite of bit of time.
I recently worked on a labeling machine, in which we re-wrote the entire program, just to make it more reliable. The worst part was the original program was documented in Italian.

 

[SteveBailey]

It should always be a requirement that the program be turned over to the end user.

If that is your philosophy, then you should only purchase equipment from suppliers willing to do so. However, the fact that PLC manufacturers continue to provide mechanisms by which OEMs can protect their intellectual property is an indication that there are a significant number of people who disagree with that point of view. There are legitimate reasons for limiting access to the program controlling a piece of equipment.

The worst part was the original program was documented in Italian.

Just as bad, in my opinion is a poor translation to another language. I've lost count of the number of times when I've tried to figure out what a poorly translated manual was trying to say. I may be able to understand every individual word, but I have no idea what they mean when combined the way they are in the tranlation. Case in point: Quite often on forums like this you will run across an opening sentence like "I have a few doubts about the Brand X model Y...". It's obvious that the poster (or BabelFish or some some other translation service) has tranlated his word for "question" as "doubt". Now "doubt" is a perfectly legitimate synonym for "question", but the two words convey different concepts. The greater the number of words like that in a sentence, the harder it will be to understand that sentence. If the choice is between a manual in its original languge or a poor translation, I think I'd rather have the original language. With that I have something that preserves the original thoughts of the author and I can take it to someone who speaks both languages.

But, we're getting off-topic here. I wish coolidge would come back.

 

[itsmoked]

Baring having a local technical person puzzling out the problem, sans PLC code, I would also go for re-coding of the PLC.

I have looked at many complex machines but have some difficulty in seeing how a labeling machine could get horrendously complicated. A mixing, bottling, labeling machine.. Yes! But just labeling?

Be nice to see what this machine looks like.

Keith Cress
Flamin Systems, Inc.-

http://www.flaminsystems.com

 

[mikek10]

Reverse engineering would probably be better long term but is liable to be lengthy and expensive shortterm.

Only the OP knows where the balance lies.

I always allow the customer access to the PLC however this is usually only ancillary equipment and nothing worth protecting.

If it was my living I guess I would be more protective - on the other hand there is nothing in a PLC that can't be figured out pretty easily - Keiths point of view I suppose - its just a question of whether you can afford the time!!!

 

[coolidge]

Thanks for the suggestions everyone.
As SteveBailey said, the problem is probably not in the PLC, which i agree. But, in order to determain which part of the machine is faulty we need to check it during work to see which operation does not get carried out and why. Otherwise its just like looking through needles in a haystack. And about finding a local guy, no support here.

Siemens local representative sent their technician and he cant do anything without the password to the program. He was the one that suggesed we try to find a means of bypassing the password.
As for reverse engeneering, its like 1-2 months work and very expensive, and nobody wants to do it without the electrical schematics of the machine, which we also didnt get.

So my question here is does anyone know which language the program is written in, and other information that could be usefull because i guess i will have to find a programmer to crack the password.

Also, biting the bullet is not an option with them, as i called them and they said they would send me an offer but didnt. And the worst thing is that even if they did come, they would be unprepared like last time, and quite possibly just waste our time.

Once again thanks for your help everybody, but the only option we really have is to bypass the damn password so if anyone has any info or knows anyone that could help please let me know.

 

[mikek10]

I've spent quite a lot of time looking into this - the only solution I can find to removing the password on s7 200 if you don't know it is to clear the moemory

 

[mikek10]

I tried a bit harder and found this:

http://plc.net.ru/viewtopic.php?t=2005&highlight=unlock

I hope the link is allowed..

 

[coolidge]

Thank you very much mikek10.
I have checked out the link and think thats it.
The data is forwarded to the Siemens technician and im waiting for the results.

Again, thanks everybody for your time and help.

God bless.