Configuring STEP 7 V5.5 Project and S7-400 CPU Passwords

Overview

Two distinct, independent password mechanisms protect a SIMATIC S7-400 automation cell: the STEP 7 V5.5 project password (offline, source-code level) and the CPU protection password (online, target-level). Engineers routinely confuse the two because both involve the word "password," but they live at different layers of the system and are enforced by different software components.

This reference covers both layers for an S7-400 station built around a SIMATIC CPU 416-2 DP (order number 6ES7416-2XN05-0AB0) programmed with STEP 7 V5.5 + SPx on Windows. It documents the SIMATIC Logon Service architecture required for project access protection, the three-level CPU Protection tab in HW Config, know-how protection for individual blocks, the verification sequence, and the most common field failures with their root causes.

The procedure is independent of the STEP 7 service pack level (SP1 through SP4 have all been observed in the field), but the project-protection menu tree shown here applies to the SIMATIC Manager application, not the newer TIA Portal. A short section at the end maps the equivalent TIA Portal V20 path for migration.

Prerequisites

Before configuring either password layer, verify the following prerequisites. Missing any one of them typically produces an immediate failure that is reported in SIMATIC Manager as "Access protection function not available" or, for the CPU, as "Protection level cannot be set."

1. SIMATIC Logon installed and licensed. STEP 7 V5.5 does not ship with a built-in project password database. It delegates user authentication to the SIMATIC Logon Service. Per the Siemens entry ID 25470496, the access-protection menu is only enabled when SIMATIC Logon is present. SIMATIC Logon is a separately licensed component (see the SIMATIC Logon product page at the Siemens automation software portal) and is typically delivered with PCS 7 but must be purchased separately for a stand-alone STEP 7 V5.5 install.
2. Local administrator or equivalent rights on the engineering station. The Logon Service writes per-user credentials to %ProgramData%\Siemens\Automation\SimaticLogon\ and modifies registry keys under HKLM\SOFTWARE\Siemens\SIMATIC Logon. A standard user can authenticate to an already-protected project but cannot create the protection scheme.
3. STEP 7 V5.5 with a matching project file. The project (*.s7p, with subfolder Global, S7As, etc.) must be writable on the engineering station. Archive projects (*.zip) must be unpacked first because SIMATIC Logon cannot write back into a read-only archive.
4. Online connection to the target CPU (only for the CPU protection tab). The PG/PC interface (e.g., TCP/IP via S7ONLINE or MPI/DP) must be reachable. For CPU 416-2 DP, the integrated DP and MPI/DP interfaces share a physical X1 port; do not select a non-existent interface or Online > Accessible Nodes will time out at 30 s.

SIMATIC Logon Architecture

SIMATIC Logon is a Windows service (S7LogonSrv.exe) plus an MMC snap-in (SIMATIC Logon Administrator) that maps Windows domain or local user accounts to SIMATIC role-based access rights. STEP 7 V5.5 invokes the service to verify the user whenever an access-protected project is opened.

The administrator tool defines at least one project password per project. The password is stored inside the project file in a hashed form, so it travels with the project when it is archived and transferred to another engineering station. The Logon Service also keeps a Windows user to "editor" role mapping that survives project transfers.

Enabling the STEP 7 V5.5 Project Password

Follow this procedure to protect a STEP 7 V5.5 project from unauthorized editing. The procedure is the canonical one described in Siemens KB 25470496.

1. Open SIMATIC Manager and load the target project (*.s7p) on the engineering station.
2. From the menu bar, choose Options > Access Protection > Enable. If this command is greyed out, SIMATIC Logon is not installed (see Prerequisites).
3. The first time the command is invoked on a given project, a SIMATIC Logon sign-in dialog appears. Authenticate with a Windows user that is a member of the SIMATIC Logon "Project Editor" role.
4. After a successful sign-in, the Enable Access Protection dialog opens. Enter the desired project password in the two fields (minimum 8 characters, case-sensitive; Siemens does not enforce a complexity policy but recommends it).
5. Click OK. SIMATIC Manager writes the hashed password into the project file and registers the project with the Logon Service.
6. Close and reopen the project. Any subsequent user is now prompted for the password before the project can be edited. Read-only browsing is still possible for users who know the password but do not have the "Project Editor" role on their workstation.

S7-400 CPU Protection Levels

The CPU-side protection is configured in HW Config > CPU Properties > Protection. The CPU 416-2 DP implements three discrete protection levels plus a password field. Selecting a higher level restricts what the engineering station can do via the online interface.

The mode selector on the front panel of the CPU 416-2 DP adds a fourth, hardware-only override: with the selector in the STOP position the password is bypassed and a cold restart is permitted (the so-called "STOP bypass"). With the selector in MRES, a memory reset clears the CPU program memory; if a password was assigned, it is preserved unless the CPU is reset to factory settings via SFC 45 or the mode selector sequence "MRES -> STOP -> MRES" (the latter is a master reset that does clear the password on S7-400).

Configuring the CPU Password

This is the online procedure that writes the protection level and password into the target CPU 416-2 DP.

1. Open the project, double-click SIMATIC 400 Station > Hardware to launch HW Config.
2. Double-click the CPU 416-2 DP slot (rack 0, slot 3 for the typical S7-400 layout) to open the Properties - CPU 416-2 DP dialog.
3. Select the Protection tab.
4. Under Protection level, select radio button 3: Read/write protection (recommended for production cells) or level 2 if read access for the maintenance crew is required.
5. Enter the password in Password and confirm in Confirm password. The maximum length is 8 characters; passwords longer than 8 characters are silently truncated by older STEP 7 builds, so stay within the 8-character limit.
6. Click OK to close the dialog. The change so far is local to the HW Config data block; it has not yet been written to the CPU.
7. From the HW Config menu, choose Station > Save and Compile, then PLC > Download to Target System (or CPU > Download User Program to Memory Card if the program is to be loaded from a flash card).
8. After the download, the CPU restarts in the configured protection level. From now on, every online operation from SIMATIC Manager (upload, download, online block view, online PG functions) prompts for the password.

To later change or remove the password, repeat steps 1-7 with the new value (or a blank value for level 1). The current password must be entered once during step 5 to authorize the change; if the password is lost, a master reset is the only recovery path on S7-400 CPUs.

Know-How Protection for Blocks

Independent of the CPU protection level, individual FB/FC/DB blocks can be encrypted with know-how protection via File > Properties > Know-How Protection in the LAD/FBD/ST editor. Know-how protection obfuscates the compiled code so that the source is unreadable in any editor without the password, but it does not hide the block from the online view of an authorized user.

The two mechanisms complement each other. A typical production cell protection setup is:

• Project password on the offline project (prevents casual editing of source).
• CPU protection level 3 with password (prevents unauthorized uploads and online changes).
• Know-how protection on the safety FB and proprietary algorithm blocks (prevents reverse engineering of source).

Project Password vs CPU Password Comparison

Verification

After the configuration has been saved and downloaded, perform the following verification steps on the same engineering station and on a second, "untrusted" engineering station.

1. Close and reopen the project. SIMATIC Manager must prompt for the password before any block can be edited. Read-only navigation in the project tree should still be possible without the password.
2. From the engineering station: in SIMATIC Manager choose PLC > Accessible Nodes. The CPU 416-2 DP must appear with its MPI/DP or IP address.
3. Open an online block view (PLC > Monitor/Modify or by double-clicking a block and selecting the Online tab). The CPU must request the password before the block view populates.
4. Attempt an unauthorized upload (PLC > Upload Station to PG) from the untrusted engineering station. The upload must fail with error 33:16672 (Password-protected CPU) or "Operation not permitted with current protection level."
5. Verify the mode selector override: physically move the CPU mode selector to STOP and try an upload from the untrusted station. The upload must succeed because STOP bypasses the password on S7-400. This is by design and should be documented in the plant's security policy.
6. Check the protection level stored in the CPU. In HW Config, with the project online, open the CPU Properties > Protection tab. The radio button shown must match the level that was downloaded.

Troubleshooting Common Failures

Migrating to TIA Portal V20

STEP 7 V5.5 is in the classic-product maintenance phase and new installations are typically delivered with TIA Portal. The project protection model in TIA Portal V20 is similar but the menu tree differs. Per the TIA Portal V20 documentation, project protection is enabled from Project tree > Security settings > Settings > Protect this project, which prompts for a user name and password. The CPU protection tab is conceptually identical (three levels, 8-character password, mode-selector bypass).

Migrating an existing V5.5 project with SIMATIC Logon protection to TIA Portal V20 requires the migration tool in TIA Portal and re-establishing the user/role mapping because the Logon Service database schema differs between versions.

Security Best Practices

• Use different passwords for the project, the CPU, and the know-how-protected blocks; do not reuse the same 8-character string.
• Store passwords in a controlled vault (e.g., a credential manager), never in plain text on the engineering station.
• Document the mode-selector STOP bypass behavior in the plant operating procedures so that maintenance technicians do not unintentionally allow uploads during troubleshooting.
• Restrict physical access to the CPU mode selector with a locked cabinet; the STOP bypass is a hardware feature that cannot be defeated by software.
• Audit SIMATIC Logon role assignments quarterly. Remove accounts of users who have left the project team.
• Maintain a sealed envelope in the plant's safe with the current CPU password so it can be recovered after a forgotten-password incident without requiring a master reset.

FAQ