Resolving TIA Portal V17 Greyed-Out Access Level Configuration

The Access level field in the CPU Properties dialog of TIA Portal V17 (including Update 1, Update 2, and Update 3) is one of the most common control elements reported as greyed-out by commissioning engineers. The field controls the four PLC protection levels (No protection, Write protection, Read/write protection, and Complete protection) defined in IEC 61131-3 and implemented on S7-1200, S7-1500, ET 200SP CPU, and Software Controller targets. When the dropdown list is inactive, the engineer cannot establish a new password, downgrade protection after commissioning, or transfer an offline configuration that contains a different protection level than the one currently active in the CPU.

This reference documents every verified root cause for the greyed-out condition, the exact menu path to validate it, the offline-to-online transfer sequence, the SINUMERIK ONE startup change introduced in CNC software V6.24, and the password-reset workflow that does not require the original password. The article is written for control engineers performing factory acceptance tests (FAT), site acceptance tests (SAT), and field service on existing S7-1200/S7-1500/SINUMERIK ONE machines.

1. Affected Products, Firmware, and Software Versions

2. Root Cause Matrix

Five distinct root causes have been confirmed in the field. Use the matrix below to triage the symptom; the right-hand column links to the matching solution section.

3. Solution R1: Break the Online Connection

The most common cause. STEP 7 V17 binds the CPU device object to an online snapshot of the live device. While the snapshot is bound, the editor exposes a read-only view of hardware properties to prevent a parameter mismatch between the offline configuration and the running firmware.

3.1 Procedure — Standard S7-1500 / S7-1200 / ET 200SP CPU

1. In the TIA Portal project tree, right-click the CPU device (e.g. PLC_1 [CPU 1515-2 PN]).
2. Select "Go offline" from the context menu. The orange "online" indicator next to the device name turns grey.
3. Verify by opening the bottom status bar: it should read "Offline" and not "Online — connected".
4. Double-click Device configuration to open the hardware editor.
5. Select the CPU module icon in the rack. The inspector window on the right opens the CPU properties.
6. Navigate to Properties > General > Protection & Security > Access level.
7. The Access level dropdown is now active. Choose one of:
   • No protection — every user has full read/write access.
   • Write protection — read only without password; write requires password.
   • Read/write protection — HMI read access without password; PLC read/write requires password.
   • Complete protection — HMI read-only without password; PLC read requires password; write is denied even with the password by default.
8. Enter a password in the Password and Confirm password fields (4 to 30 characters, case-sensitive, ASCII 0x20 to 0x7E).
9. Click Apply, save the project, then right-click the CPU and choose "Download to device" to transfer the new protection level.

3.2 Procedure — S7-PLCSIM Virtual CPU

PLCSIM instances keep a virtual online channel that is not visible in the project tree. The instance must be stopped before the Access level field becomes editable.

1. In TIA Portal, open Online > S7-PLCSIM (start/stop) from the menu bar.
2. Click Stop to terminate the running PLCSIM instance.
3. Confirm that the PLCSIM window closes and the status bar returns to Offline.
4. Open Device configuration > CPU > Properties > Protection & Security > Access level.
5. Apply the new protection level and download to the PLCSIM instance you will start next.

4. Solution R3: Clear an Inherited Block Protection

If the Access level is editable in the hardware editor but the field becomes greyed out when accessed from a code block (OB, FB, FC, DB), the online block has inherited a write protection that the offline configuration does not hold.

1. Switch to the project tree view Program blocks.
2. Identify any block with the small lock overlay on the icon — this indicates "Know-how protection" (block-level password) or "Write protection" assigned online.
3. Right-click the locked block and select Know-how protection > Remove. Enter the block-level password if known.
4. For an unknown block password, perform a full "Reset to factory settings" on the CPU (Section 7). This removes every know-how protection and every access-level assignment from the live CPU firmware.

5. Solution R4: Apply the Latest TIA V17 Update

Early TIA V17 updates shipped with a known regression in the Protection tab parser. If the Access level field is not present at all (the entire Protection & Security node is missing from the inspector), the installation is missing a hotfix.

1. Open the Siemens Support Download portal and search for STEP 7 V17 updates.
2. Install at least STEP 7 V17 Update 2; recommended: Update 5 (the last V17 update released before V18 GA).
3. After installation, open the TIA Portal with administrator privileges (right-click > Run as administrator) so the installer can repair the registry entries for the device editor.
4. Open the affected project, navigate to CPU Properties > Protection & Security, and confirm the Access level field is now present.

Reference: the official Siemens knowledge base article 109988507 documents the access-level configuration procedure and is the canonical reference for SINUMERIK and S7 CPU targets.

6. Password Reset Without the Original Password

If the Access level is reachable but the existing CPU password is unknown, perform a CPU reset to factory settings. The procedure differs between S7-1200 and S7-1500.

6.1 S7-1200 Reset

1. Set the operating mode selector on the CPU to STOP.
2. Power-cycle the CPU (power off, wait 5 s, power on).
3. While the CPU is booting, set the selector to MRES and hold for 3 seconds.
4. Release, then move the selector back to MRES within 3 seconds. The CPU performs a factory reset; the RUN/STOP LED flashes yellow, then returns to solid yellow (STOP).
5. Download the project from TIA Portal to re-establish the desired access level and password.

6.2 S7-1500 Reset

1. Open TIA Portal, go online with the CPU.
2. Right-click the CPU in the project tree and select Online & diagnostics.
3. Navigate to Functions > Reset to factory settings.
4. Select "Delete the IP address of the Ethernet interface" only if you are using PROFINET device names; otherwise leave it unchecked.
5. Check "Reset PLC to factory settings" and click Reset.
6. Confirm the prompt; the CPU restarts and clears all passwords, access levels, and remanent data.
7. Re-download the project and re-assign the access level.

7. Protection Level Reference Table

The following table consolidates the four protection levels defined by TIA V17 and the resulting behavior for HMI access, PG/PC read, and PG/PC write. Use it as a verification matrix after every change.

8. Field Commissioning Verification Procedure

After the Access level is changed and downloaded, perform the following five-step verification before signing the SAT report.

1. Online diagnostic read: Go online with the CPU, navigate to Online & diagnostics > General, and read the active access level from the Protection group. The reported level must match the configured value.
2. Forced login test: Disconnect, then re-establish the PG/PC connection. Attempt to read a tag without the password — for levels 3 and 4 the read attempt must fail with diagnostic buffer entry "Access denied — write/read protection active".
3. Password acceptance test: With a second PG/PC, enter the configured password in the connection dialog. Read/write access must be granted.
4. HMI behavior test: Trigger a write from an HMI panel to a writable tag. Writes must succeed for levels 1 and 2; for level 3 the HMI must hold read-only and the write must return "HMI write protection active".
5. Remanence check: Power-cycle the CPU and confirm that the access level and password are preserved (CPU does not revert to "No protection").

9. SINUMERIK ONE Specific Procedure (CNC software V6.24 and higher)

Siemens changed the access-level startup procedure for SINUMERIK ONE with CNC software V6.24. Below this version, the field appears in PLC Properties; at and above V6.24, the field is reached through a different navigation path inside the Create MyConfig / SinuTrain project context. The official Siemens support entry 109988507 documents the new startup flow.

1. Open the TIA Portal project that contains the SINUMERIK ONE NCU.
2. Right-click the NCU device and select Properties. The properties dialog opens with a Sinumerik tab that is not present on standard S7-1500 CPUs.
3. Navigate to Sinumerik > Access levels > PLC access. The Access level field is present and active here even when the equivalent field under Protection & Security is greyed out.
4. Choose the desired level, enter the password, click Apply.
5. Compile the project (Project tree > NCU > Compile > Software (rebuild all)).
6. Download to the NCU. The startup procedure runs once after the next NCU power-up; access-level changes are not applied to a running NCU.

10. TIA Portal Version-Specific Notes

Always download the latest V17 update from the official Siemens SIOS portal. Do not install TIA V18 or V19 patches on a V17 installation; mixing major versions corrupts the project file format.

11. Diagnostic Buffer Error Codes

When a write to a protected CPU is rejected, the diagnostic buffer records a specific event code. Match the code to the appropriate remediation step.

12. Field-Proven Caveats

Five real-world caveats that are not covered in the TIA Portal help text but appear on commissioning sites:

1. Multi-user TIA projects: When the project is hosted on TIA Portal Multiuser Server, the lock state is reported to the team. A second engineer going online will cause the Access level field to grey out for everyone. Coordinate online sessions through the Multiuser server dialog.
2. Version mismatch: If the project was last saved on a workstation with TIA V17 Update 5 and is opened on a workstation with Update 1, the Protection tab is hidden entirely. Re-save on the older workstation only after the version has been updated to match.
3. Firmware password on S7-1500 V2.6: Firmware V2.6 introduced a separate Firmware update password independent of the PLC access level. The Access level dropdown does not affect the firmware password field; they are managed independently in the inspector.
4. PG/PC interface set to PLCSIM: When the PG/PC interface is set to PLCSIM and no PLCSIM instance is running, TIA Portal reports the project as online with a non-existent target. The Access level field is greyed out even though the project is logically offline. Switch the PG/PC interface to the real Ethernet adapter before editing.
5. Safety Integrated password: On F-CPU types (S7-1516F, ET 200SP F-CPU), the Safety Integrated password is configured in a different tab (Safety Integrated > Access protection) and is not affected by the PLC access level. Mistaking one for the other will leave the field greyed out indefinitely.

13. Quick-Reference Decision Flow

Use this flow on-site before raising a support ticket:

1. Is TIA Portal status bar showing Online? → Click Go offline. (Fix R1)
2. Is a PLCSIM instance running? → Click Online > S7-PLCSIM > Stop. (Fix R2)
3. Is the entire Protection & Security tab missing? → Install latest V17 update. (Fix R4)
4. Is the target a SINUMERIK ONE? → Use Sinumerik > Access levels > PLC access. (Fix R5)
5. Is the password unknown? → Factory reset (Section 6) and re-download project.
6. All other cases → Open a Siemens SIOS support request with the diagnostic buffer export attached.

14. Related Reference Documentation

• Siemens KB 109988507 — Why can't the access level be configured in TIA Portal?
• STEP 7 Professional V17 system manual (entry ID 109798572 on SIOS)
• S7-1500 CPU 1515-2 PN manual (entry ID 59191792)
• S7-1200 Programmable Controller system manual (entry ID 109759718)
• SINUMERIK ONE commissioning manual (entry ID 109831011)

FAQ