Siemens SIMATIC CPU 410 System Manual page 135

Setting the protection level with SFC 109 "PROTECT"
You can set the following protection levels on your CPU with SFC 109:
● SFC 109 call with MODE=0: Setting the protection level 1. If the password legitimization
is locked, the lock is canceled by calling SFC 109 with MODE=0.
● SFC 109 call with MODE=1: Setting of protection level 2 with password legitimization.
This means you can cancel the write protection set with SFC 109 if you know the valid
password. The SFC 109 call with MODE=1 overrides any existing lock of password
legitimization.
● SFC 109 call with MODE=12: Setting of protection level 3 without password
legitimization. This means you cannot cancel the write and read protection set with SFC
109 even if you know the valid password. If a legitimate connection exists when you call
SFC-109 with MODE=12, the SFC-109 call has no effect on this connection.
Note
Setting a lower protection level
You can use SFC 109 "PROTECT" to set a lower protection level than the one you
configured with HW Config.
NOTICE
Use SFC 109 only with existing protection level
Only use SFC 109 if you have configured protection levels in HW Config.
Additional aspects
● Both fault-tolerant CPUs of a fault-tolerant system can have different protection levels in
STOP.
● The protection level is transferred from the master to the standby during link-up/update
operations.
● The set protection levels of both fault-tolerant CPUs are retained if you make
modifications to the plant during operation.
● The protection level is transferred to the target CPU in the following cases:
– Switch to CPU with modified configuration
– Switching to a CPU with modified PO limit
– Switching to a CPU with modified operating system
– Switching to a CPU using only one intact redundant link
CPU 410 Process Automation/CPU 410 SMART
System Manual, 05/2017, A5E31622160-AC
Special functions of the CPU 410
9.2 Security levels
135