Can access to a password protected AC500-eco PM554ETH(via setpwd from PLC Browser) be restored???

Never had this before - but some security freak set a password and then managed to loose it! The software is of no importance, the PLC is.
Any idea how to recover the PLC to an unprotected state state? Unfortunately I have no access to such a device - and on-site experiments are an absolute NO GO, and yes, the matter is urgent!
Thanks in advance!

Comments (1) New comment

occam Rank: 985

Asked 1 year ago

Answer this question Follow

Voted best answer

Hi Emil

this is a big problem! I'm refer to the cyber-security maniacs working with PLCs, of course.

AFAIK it's no possible restore the normal operation without re-write the complete SW in to the PLC.

You must power off the cpu and move the Run-Stop selector in position Stop, thi able you to have the original setup communication with you cpu.

If you have one copy of original SW without PW, now you can download it to the cpu.

But if you have the SW locked with PW, IMHO you need to ask to your local ABB Service network that , probably - I hope - have the necessary tool.

Hope this help you, let us know about the results

Comments (7) New comment

by occam Rank: 985 on 8/6/2018 6:36:25 AM | Like (0) | Report

Hi Flavio! I managed to find a a PM554 PLC and did some experiments! Your method works FINE! If a bootstrap project is created BEFORE the password is set on the PLC logon is possible even without setting the RUN/Stop switch - power ON/OFF does it! BUT... If You happen to create a bootstrap project AFTER the password has been set - the PLC is stoned and no logon without password is possible, regardless of RUN/Stop switch position and power ON/OFF sequences! I can only hope that this is not the case at the plant ....
Best regards and thanks for your effort!

by occam Rank: 985 on 8/8/2018 9:13:03 AM | Like (0) | Report

Well, all experiments with the PLC on site went wrong - the PLC is stoned !
Any further suggestions? I'll phone the ABB people - maybe they have better ideas, apart from buying a fresh PLC! If so - the first thing to do will be to set the password myself!!!
Regards!

by Flavio Mussolin AKS expert

Rank: 4 on 8/8/2018 11:33:54 PM | Like (0) | Report

Hi Emil
with your locked PLC, are you able to go online? If this operation is done with TK cable or Eth cable is not very important, but if you can go online with the cpu, from Automation Builder, you can try the command "delappl" from menù PLC browser. Pay attention that thi command erase all of you application code inside the cpu, then is preferable that you made first a test with one spare cpu, then you use it in your plant
Hope this help you

by occam Rank: 985 on 8/9/2018 3:05:58 AM | Like (0) | Report

Hi Flavio, I'm not able to go online without the password - COM 1 is used with TK cable(no Ethernet!). The software is available - so loosing it in the PLC is not a problem. ABB Tech Support here seems to be on vacation - no phone is answered, Swiss headquarters refuses to help as well! Can't believe someone will come up with a protection solution for a PLC as if it were a smartphone !
Well, Flavio - thanks for your time - I'll be grateful if you can come up with any idea!

by Flavio Mussolin AKS expert

Rank: 4 on 8/9/2018 7:28:30 AM | Like (0) | Report

Hi Emil
perhaps do you have one SD card? In this case you can evaluate my tutorial - App - in this site and use it to try a unlock you cpu. One question before: the locked cpu going in run mode? It's only to exclude one damage at the locked cpu.
Try the app at the follow links:
https://forum-controlsystems.abb.com/Document/20197046/How-to-write-AC500-program-in-SD-card

and

https://forum-controlsystems.abb.com/Document/20194821/How-to-make-a-AC500-clone-with-SD-card

Of course with one simple program, only to verify if is possible ovewrite the cpu.

Let me know if there are any news

by occam Rank: 985 on 8/18/2018 2:55:32 AM | Like (0) | Report

Hello Flavio!
The SD card did it! Powered down the PLC, inserted the SD card adapter and after power on the boot record got updated without the Automation Builder Interface! Now I can access the PLC!
Thanks for Your suggestions and have a nice weekend!

by Flavio Mussolin AKS expert

Rank: 4 on 8/18/2018 10:18:59 AM | Like (0) | Report

Hi Emil

I'm glad that my help has solved your problem, have a nice week end too

Add new comment

Flavio Mussolin AKS expert

Rank: 4

Answered 1 year ago

Question details

Can access to a password protected AC500-eco PM554ETH(via setpwd from PLC Browser) be restored???

Voted best answer

Other questions needing answers

Related topics

AKS experts