Open TIA Portal. Even without the project file, you can access the "Project view." Navigate to "Online & Diagnostics" (usually under the "Online" menu or the left-hand navigation bar).
Connect your engineering PC to the PLC via PROFINET (Ethernet) or a direct Ethernet crossover cable. Set your PC's IP address to a static address in the same subnet as the PLC (e.g., if the PLC's last known IP was 192.168.0.1, set your PC to 192.168.0.100).
Click "Reset." The CPU will stop, erase its internal memory and the SIMATIC Memory Card, and reboot. The PLC will now have no password and no program. The "RUN/STOP" LED will likely flash, indicating it is waiting for a new program download. The Manual Method: Using the SIMATIC Memory Card If you cannot communicate with the PLC via TIA Portal because the network settings are completely unknown, you can use a physical SIMATIC Memory Card (SMC). This is more involved but effective.
The original controls engineer left six months ago. The password is not in the project documentation, the sticky note on the monitor is blank, and the maintenance logbook offers no clues. You are locked out.
Introduction: The Lockout Nightmare Imagine this: You are on a tight deadline to commission a critical production line. The Siemens S7-1500 PLC is installed, wired, and ready. You fire up TIA Portal (Totally Integrated Automation Portal), attempt to go online, and are met with a dreaded pop-up: "The module is protected by a password. Please enter the password."