FM 458-1 DP Know-How-Protect (6DD16070GA0): Technical Reference for D7-SYS Block Security

The FM 458-1 DP Know-How-Protect module (Siemens order number 6DD16070GA0) is a hardware security key designed for the SIMATIC S7-400 automation platform. It protects intellectual property embedded in user function blocks (FBs) generated with the D7 FB generator inside the D7-SYS engineering framework. This reference documents the architecture, scope of protection, configuration procedure, verification workflow, and operational constraints of the module based on the official Application Module FM 458-1 DP User Manual (A5E01078222-03, Edition 04.2011) and the related Siemens Industry Online Support entries, including the D7-SYS product support index (entry 13854).

1. Product Identification and Scope

The module is a physical plug-in subassembly for the FM 458-1 DP rack. When seated in the rack it is interrogated by protected user FBs through a system function call; if the module is missing, or if the unique identification does not match what the FB expects, the FB can be configured to react in a user-defined manner (typically by halting execution, returning an error, or signalling a fault to the supervising S7-400 CPU).

2. Functional Architecture and Placement

The FM 458-1 DP family is a series of computing-intense application modules that mount in the SIMATIC S7-400 rack alongside the CPU. Typical tasks include high-speed closed-loop control, position/speed control of drives, technological preprocessing, and complex arithmetic operations that exceed the throughput of a standard CPU. D7-SYS is the configuration system for these modules and uses CFC (Continuous Function Chart) as the primary programming paradigm.

The Know-How-Protect subassembly (6DD16070GA0) is not a stand-alone CPU; it is a small identification/security module that piggybacks on the FM 458-1 DP main board. Architecturally it occupies a slot on the FM 458-1 DP carrier and provides:

• A unique non-volatile identification (serial-style identifier burned into the module).
• A hardware-presence flag readable by user FBs through the D7-SYS runtime library.
• A matching service used by the D7 FB-Gen to embed the expected identifier into compiled user FBs at build time.

At runtime, every protected FB executes a system function (provided by the D7-SYS runtime) that polls the slot. The system function returns:

• TRUE + matching identifier — the FB proceeds with normal execution.
• FALSE — dongle missing, wrong slot, wrong order number, or identifier mismatch.

Detection of the failure is then acted upon by the FB-specific response (see Section 6).

3. Scope of Protection

Understanding exactly what the module protects — and, just as importantly, what it does not protect — is critical before deploying it as a security control.

3.1 What IS Protected

• User function blocks generated by D7 FB-Gen. These are FBs you write in CFC and expose through the D7 FB generator for reuse. Once compiled with Know-How-Protect enabled, the FB runtime contains the dongle check.
• The IP of the technology embodied in the FB. Even if the CFC source, the compiled binary, and the configuration are copied, the FB will refuse to execute productively on a system lacking the matching dongle.
• License-bound deployment. One dongle per machine/line: the integrator can deliver the same configuration to many end users, but only the end user with the dongle can run the protected FBs.

3.2 What is NOT Protected

• CFC charts containing only Siemens library blocks (PID, motor, drive, math, etc.). These are pre-compiled blocks shipped with D7-SYS; they have no slot for the dongle query and therefore cannot be "locked" by this hardware. If you wish to hide a chart, the only barrier is access to the engineering project files.
• The non-protected portions of a mixed chart. If only some FBs in a chart are protected, the unprotected FBs continue to run normally even without the dongle.
• S7-400 CPU logic, HMI screens, drive parameter sets. The dongle's reach is limited to the FM 458-1 DP runtime and the user FBs that explicitly call its system function.
• Reverse engineering at the source level. The dongle cannot prevent a determined attacker from reimplementing the algorithm from behavioural observation. It enforces licensing, not cryptographic secrecy.

4. D7 FB-Gen Workflow with Know-How-Protect

The D7 FB generator (D7 FB-Gen) is the D7-SYS subsystem used to wrap a CFC chart as a reusable, typed FB. The Know-How-Protect option is selected at this stage:

1. Open the D7-SYS project and the CFC chart that implements the technology to be protected.
2. Launch the D7 FB generator from the D7-SYS menu (Tools → FB Generator).
3. Configure the FB interface: inputs, outputs, static tags, and instance parameters as usual.
4. In the FB generation dialog, enable the Know-How-Protect option. At this point D7 FB-Gen reads the identifier of the dongle currently plugged into the programming station (or into the target rack) and embeds that identifier as the expected value inside the compiled FB.
5. Compile the FB. The resulting block is "tied" to the dongle ID observed at compile time.
6. Document the dongle ID and the FB version in your engineering change log. The ID will be required for any future recompilation that targets the same protected asset.

If the dongle is not present during compilation, the FB-Gen will refuse to embed the protection bit, or it will compile the FB in an unprotected state. Always verify the engineering station configuration before starting a build that is intended to be locked.

5. Runtime Behaviour and the Identification Check

Inside each protected FB, the D7-SYS runtime library exposes a system function that interrogates the FM 458-1 DP hardware for the dongle. The function returns three pieces of information:

Note: Exact return code numbering depends on the D7-SYS version. The D7-SYS V5.1 manual (referenced in the Siemens support index) and the FM 458-1 DP user manual should be consulted for the precise enumerations in your installed version.

6. Configuring the FB Response on Failure

The product documentation states explicitly: "The response in the case of a missing FM 458-1 DP Know-How-Protect module, or if the identification is incorrect, can be predetermined for each user function block individually." This means the developer chooses, per FB, what happens when the check fails. Typical response patterns include:

• Hard stop with output reset — all FB outputs are forced to safe defaults and the FB enters a latched fault state. Recommended for safety-relevant FBs.
• Output clamp with diagnostic bit — outputs held at last value or zero, a status boolean is set so the S7-400 CPU can alarm and the operator can be notified.
• Fault propagation through the FB status word — the FB completes its cycle with a quality code that the upstream logic evaluates, allowing graceful degradation.
• Shutdown request to the CPU — the FB sets a flag that the supervising S7-400 program interprets as a stop request. Use only when the system is designed for cold restart.

Whichever response you choose, document it in the FB header and in the safety/FMEA analysis. The response must be consistent with the risk assessment for the machine or process.

7. Step-by-Step Configuration Procedure

This procedure assumes D7-SYS V5.1, a working FM 458-1 DP application module in the S7-400 rack, and the Know-How-Protect subassembly 6DD16070GA0 physically installed on the FM 458-1 DP board.

7.1 Prerequisites

• SIMATIC S7-400 station with CPU (e.g., CPU 414, 416, 417).
• FM 458-1 DP application module mounted in the rack and configured in HW Config.
• Know-How-Protect subassembly 6DD16070GA0 plugged into the FM 458-1 DP module.
• D7-SYS V5.1 (or compatible) installed on the engineering station.
• STEP 7 / SIMATIC Manager matching the CPU firmware family.
• Administrative access to the engineering PC for compiling and downloading.

7.2 Procedure

1. Hardware verification. Power down the S7-400 station. Confirm the FM 458-1 DP module is seated and that the Know-How-Protect subassembly is correctly installed. Power up and check that the CPU diagnostics do not flag the FM 458-1 DP as faulty.
2. Open the D7-SYS project. Launch D7-SYS and open the project containing the technology to be protected.
3. Identify the FBs to protect. Decide which FBs you will lock. Remember: only FBs that you yourself generate through D7 FB-Gen can be protected.
4. Open D7 FB Generator. Inside D7-SYS, open the CFC chart that defines the FB and launch the FB generator.
5. Enable Know-How-Protect. In the generator dialog, set the Know-How-Protect attribute. D7 FB-Gen will read the dongle ID from the connected FM 458-1 DP and embed it in the FB.
6. Configure the failure response. Edit the FB body to handle the return code of the dongle-check system function. Wire the response to the FB's status outputs according to your chosen strategy (Section 6).
7. Compile. Generate the FB and verify there are no warnings about missing dongle or unmatched identifiers.
8. Download to target. Use STEP 7 to download the project (including the FM 458-1 DP configuration) to the S7-400 station.
9. Test positive path. With the dongle present, start the CPU and confirm the FB runs. Monitor the FB status word — it should report "protected, OK".
10. Test negative path. With the CPU in stop or in a controlled state, remove the dongle (or substitute the wrong dongle), restart the FB, and confirm the FB enters the configured failure response. Restore the dongle and confirm normal operation resumes.

7.3 Verification Checklist

8. Commissioning Field Notes

From a deployment perspective, treat the dongle as a deliverable line item. The integrator's project plan should explicitly reference 6DD16070GA0 as a separately shipped component that travels with the machine documentation. The end customer must understand that:

• Replacing the FM 458-1 DP module does not require a new dongle (the dongle is keyed to its own ID, not to the host module).
• Replacing the dongle requires re-compiling any FB that was originally tied to the old ID — keep a record of the ID in the project archive.
• Storing spare dongles off-site is recommended to avoid extended downtime after a dongle failure.

9. Limitations and Edge Cases

• Single dongle, single binding. The dongle binds one FB (or one set of FBs compiled at the same time with the same ID) to a specific identifier. To support a fleet, you need one dongle per machine.
• No cryptographic signature. The dongle check is an ID comparison, not a public-key signature. Do not rely on it to defend against a sophisticated reverse-engineering adversary.
• Compile-time vs. runtime ID. The ID is read from the dongle at compile time and embedded into the FB. If the dongle is later swapped without recompilation, the new ID will not match and the protected FB will fail.
• D7-SYS version dependency. Older D7-SYS versions may not support the Know-How-Protect attribute. Verify the FB-Gen dialog exposes the option before assuming a version supports the feature.
• Hardware fault on the dongle. The dongle is a physical component. Electrostatic damage, vibration, or thermal stress can render it unreadable. Spare units should be held in the maintenance stock.

10. Troubleshooting Matrix

11. Relationship to Other Siemens Protection Mechanisms

The Know-How-Protect module is one layer in a broader Siemens IP-protection ecosystem. Comparing it to adjacent mechanisms clarifies when to choose each:

For an S7-400 with FM 458-1 DP running time-critical technology, the FM 458-1 DP Know-How-Protect module is the strongest binding mechanism that Siemens offers at that layer. STEP 7's CPU-side know-how-protect is appropriate for normal PLC code but offers no enforcement against binary extraction.

12. Migration and Lifecycle Considerations

When planning projects that include protected FBs:

• Archive the dongle ID in the project archive metadata. Without it, recompiling after a lost dongle requires a new dongle plus a code-build event.
• Document the dependency between the FB version and the dongle generation. A dongle should outlast multiple FB revisions, but if the security model changes, plan a coordinated rollout.
• Plan for spare dongles. Lead time for a replacement 6DD16070GA0 may affect service-level commitments.
• Coordinate with your Siemens representative for end-of-life notifications on the FM 458-1 DP family and the Know-How-Protect accessory.

13. Quick Reference Summary

14. Frequently Asked Questions