Siemens SIMATIC S7-1500 System Manual page 352

Rules for passwords
Ensure that passwords are sufficiently secure. Passwords must not follow a machine-
recognizable pattern.
Apply the following rules:
• Assign a password that is at least 8 characters long.
• Use different cases and characters: uppercase/lowercase, numbers and special characters.
Access levels for the CPUs
Table 11- 1 Access levels and access restrictions
Access levels Access restrictions
Full access including Users of STEP 7 and HMI applications have access to all standard and fail-safe functions.
fail-safe (no protec-
A password is not required.
tion)
Full access Users of STEP 7 have access to standard functions.
(no protection) HMI applications can access all functions (fail-safe and standard).
Required password: For additional access to the fail-safe functions, the user must enter the pass-
word for "Full access incl. fail-safe" in STEP 7.
Read access In this access level, only read access to the hardware configuration and the blocks is possible without
a password. HMI access and access to diagnostics data is also possible.
Neither blocks nor the hardware configuration can be downloaded to the CPUs without the pass-
word.
The following actions are not possible without the password either: Writing test functions and firm-
ware updates (online).
HMI access The same access restrictions apply to HMI access as to read access.
The following actions are not possible without the password either: Change of operating state
(RUN/STOP/SYNCUP) and display of online/offline comparison status.
No access (complete When the CPUs have complete protection, no read or write access to the hardware configuration or
protection) blocks is possible (without access authorization in the form of a password). HMI access is not possi-
ble either.
Authentication with the correct password provides full access to the CPUs again.
Reference
You can find a list of which functions are possible in the various protection levels in the
STEP 7 online help under "Setting options for protection".
Properties of the access levels
Each access level allows unrestricted access to certain functions without a password, for
example identification using the "Accessible devices" function.
The default setting of the CPUs is "No access (complete protection)". In the default access
level, the user is not allowed to read or modify the hardware configuration or the blocks. To
obtain access to the CPUs, assign parameters alternatively in the properties of the CPU:
• A password for the protection level "No access (complete protection)"
• Another protection level, e.g. "Full access (no protection)".
S7-1500R/H redundant system
System Manual, 01/2024, A5E41814787-AF
11.4 Configuring access protection for the CPU
Protection
351