We had this problem on a Omron CQM1, manufacturer had put in the password, we had to take it to the local omron office, and have a coffee while they looked at it- they brought it back 10mins later cracked.
I suspect they did 1 of 2 things;
1, Had a backdoor code.
2, Bruteforced it, by running a program that generated the necessary 4 digits(numerical).
As I recall the codes had a special section of data memory map.
We also once had to apply a code to a customer that did not pay- and a fallover timer of a year- payment resulted in a service call where the code and timer were removed.
I have software for remove protection in some Omron PLC.The name is Passremover, work ok, it`s free. Do you want this software?, i can send this program for email.
Best Regards
