PLCforum.uz.ua

Hello,

Unfortunately I have a S7-200 SMART (SR40 CPU) v2.01 on a machine from China that has a dead output. I cannot read nor write to the PLC because of Level 4 protection.

Is it possible to swap the EEPROM to another working PLC (without burned output) of the same model to keep the program and parameters?


The program is level 4 protected and the manufacturer of the machine is out of business.

I hope EEPROM swap could work or is there a way to downgrade to level 3 on the SMART S7-200 v2.01? I could modify the program to use another output which is fine (unused)





I have some tools for the S7-200 to decrypt bin file from EEPROM but I have S7-200 SMART (SR40 CPU) v2.01 will this work on this newer unit??


Any clues will greatly help!

Thank you very much!!!

Steve

If you are in China,you can contact the cracker who can erase the Smart password and upload the program.
The fee is about 1800RMB.
http://www.jiemiplc.com/

Thanks!

I guess this unit is very hard to crack.

Another question... where is the program block / parameters stored in the PLC? On the EEPROM or inside the MCU?

There are 3 pcb in the box,1 for cpu,1 for IO,and 1 for power,
You can just replace the IO board.