There are legacy tools available (often shared on automation forums) that attempt to guess the password. Fatek PLCs generally utilize an 8-digit numeric password. Mathematically, an 8-digit numeric password has 100,000,000 combinations ($10^8$). While modern computers are fast, the communication speed over serial (RS232/RS485) or Ethernet creates a bottleneck. A brute force attack can take days or even weeks, during which the machine is unusable. Furthermore, some PLCs have lockout mechanisms that freeze communication after a certain number of failed attempts.

If you are an OEM or a system integrator, this situation should serve as a lesson for your own deployments. How do you prevent your customers from ending up in this "locked out" scenario?

If you do not need the existing program (you have a backup on paper or a hardcopy), you can physically clear the PLC. On Fatek FBs, shorting the V0 pin to ground on the programming port during power-up performs a factory reset. This erases the password AND the program. You then download a fresh program.

If you want, I can:

When you search for Fatek password unlockers, you will likely encounter two categories of software: