The password is stored in the of the CPU, specifically in the protected system area of the load memory. It is NOT erased by a standard power cycle. This is why your first instinct – turning the PLC off and on – does nothing.
Here is the technical reality of the S7-1500 protection mechanism and your limited options for recovery. siemens s7-1500 password reset
This process can take 24-72 hours. It is not suitable for emergency breakdowns. Siemens charges a fee for this service (typically €200-€500 depending on region). The password is stored in the of the
Insert the blank SMC back into the PLC and restore power. siemens s7-1500 password reset