Using The Display To Set Additional Password Protection - Siemens SIMATIC S7-1500 System Manual

4. In the "Enter password" column, specify a password for the access level "Full access" in the
first row. In the "Confirm password" column, enter the selected password again to avoid
incorrect entries.
5. Assign additional passwords as required for other access levels.
6. Download the hardware configuration for the access level to take effect.
The CPUs log the following actions with an entry in the diagnostics buffer:
• Input of the correct or incorrect password
• Changes to access level configuration
Behavior of a password-protected CPU during operation
The protection of the CPUs takes effect for an online connection after you have loaded the
settings into the CPUs. If you set a higher access level and download it to the CPU, all other
online connections will be interrupted. You will then need to establish a new online
connection.
Before an online function is executed, STEP 7 checks the necessary permission and, if
necessary, prompts the user to enter a password. The functions protected by a password can
only be executed by one programming device/PC at any one time. Another programming
device/PC cannot log on.
Access authorization to the protected data applies for the duration of the online connection
or for as long as you have STEP 7 open. The menu command "Online > Clear access rights"
cancels the access authorization.
You can limit access to a password-protected CPU in RUN locally on the display. This prevents
access even with a password.
Access levels for F-CPU
For the fail-safe CPU, there is an additional access level besides the four access levels
described. For additional information on this access level, refer to the description of the fail-
safe system SIMATIC Safety Programming and Operating Manual SIMATIC Safety - Configur­
ing and Programming (https://support.industry.siemens.com/cs/ww/en/view/54110126).
10.4

Using the display to set additional password protection

Blocking access to a password-protected CPU
You can block access to password-protected CPUs (local password block) on the CPU display.
The block is effective if the mode selector is set to RUN.
The access block requires a configured protection level in STEP 7 and applies regardless of
password protection. Even if someone accesses the CPUs via a connected PG/PC and has
entered the correct password, access to the CPUs is denied.
Set the access block separately for each access level on the display.
The backup CPU takes over the settings during SYNCUP. Changes to the access block for
primary CPU or backup CPU in RUN-Redundant system state are also applied to the other CPU.
S7-1500R/H redundant system
System Manual, 11/2022, A5E41814787-AD
10.4 Using the display to set additional password protection
Protection
239