Resolving the TIA Portal V19 PLCSIM "Password Needed for HMI and Diagnostic Access" Error

The TIA Portal V19 + PLCSIM combination can lock a developer out of an S7-1500 simulation instance with a "a password is needed to obtain HMI and diagnostic access to a protected device" dialog the moment a Go Online or Upload attempt is made. The error appears even when the migrated project never had a password configured, the physical PLC accepts anonymous access, and the same program downloads and runs successfully inside PLCSIM. This article documents the root cause, the two field-proven workarounds, and the underlying Siemens protection model so that engineers can pick the right fix for their commissioning, FAT, and training environments.

1. Problem Description and Reproduction Path

The failure mode is consistent and easily reproduced:

1. Open an existing TIA Portal project that was originally created in V16 (or V15.1, V17, V18 - any pre-V19 release).
2. Open the project in TIA Portal V19 and allow the standard migration / upgrade dialog to complete.
3. Compile the S7-1500 station without modification.
4. Start PLCSIM V19 (or PLCSIM Advanced V19) and select the matching CPU type (for example, CPU 1515-2 PN).
5. Download the compiled station to the simulated CPU. The download completes with status "Successful - RUN" and the user program executes.
6. Right-click the CPU and choose Go Online → Go Online from the project tree, or select Online & diagnostics from the device view.
7. TIA Portal pauses at the connection dialog with the message: "A password is needed to obtain HMI and diagnostic access to a protected device."
8. There is no password field populated, no hint of which user the system is asking for, and "Anonymous logon" is either disabled or rejected.

To rule out environmental causes, the same project is then downloaded to a physical S7-1500 CPU of the same order number. The Go Online action completes in under two seconds with full diagnostic access and no password prompt. The issue is therefore isolated to the interaction between TIA Portal V19, the migrated project metadata, and the PLCSIM runtime.

2. Root Cause Analysis

Three independent factors combine to produce the lockout:

2.1 The V19 Migration Injects Default Protection Settings

Beginning with TIA Portal V17, and tightened further in V18 and V19, the project migration path automatically applies a CPU protection level to every S7-1500 station in the project. This is described in the Siemens SIMATIC S7-1500 - Protection manual (entry ID: 109751652) and in the TIA Portal Help under Configuring protection for the CPU. The default that TIA Portal V19 applies on migration is "Complete protection (no access)" with a hidden, internally generated password slot, rather than the legacy "No protection" setting that V16 stored in the project XML.

The relevant CPU property is located in the device view under Properties → Protection & Security → Access protection. The three classic Siemens protection levels are:

The critical detail: level 4 ("Complete protection") was introduced in S7-1500 firmware V2.9. Firmware V2.8 and earlier do not know how to negotiate this level with PLCSIM V19. The result is that the project metadata advertises a level the simulated CPU cannot honour, and the TIA Portal online service responds by demanding a password that was never set by the user.

2.2 PLCSIM and the Real CPU Handle the Legacy Level Differently

The physical S7-1500 CPU contains a protected storage area for the protection password that survives project downloads, including when the password slot in the project XML is empty. The CPU effectively interprets an empty password slot as "no password set" and falls back to the most permissive compatible level, which is why the real PLC accepts anonymous HMI/diagnostic access.

PLCSIM, in contrast, does not retain a password store between sessions and binds strictly to the protection level declared in the downloaded project data. If the project says "Complete protection", PLCSIM enforces it literally and refuses anonymous access. There is no prompt for an empty password - the dialog simply states that a password is required and offers no way to bypass it.

2.3 The Virtual SIMATIC Memory Card Holds the Leftover Project Data

PLCSIM Advanced emulates a SIMATIC Memory Card (SMC) at %LOCALAPPDATA%\Siemens\Automation\PLCSimAdvanced\Instances\<InstanceID>\<PLCName>.simatic or, in older builds, in C:\ProgramData\Siemens\Automation\PLCSimAdvanced\PLCSim\<Instance>. The V19 download process writes not only the active program blocks but also a "Somatic" (sic) Virtual Memory Card image that contains a copy of the protection configuration, the know-how-protected block list, and any leftover CPU passwords. The first workaround documented in this article - deleting the contents of the Virtual Memory Card folder before re-downloading - removes the stale protection data and forces PLCSIM to start from a clean state.

The misspelling "Somatic" appears verbatim in the PLCSIM Advanced V19 user interface; the engineering intent is "automatic" - the virtual card that PLCSIM auto-creates when an instance is launched. The folder name in the UI is fixed and cannot be edited.

3. Workaround A - Upgrade the Simulated CPU to Firmware V2.9 (or Later)

This is the cleanest fix and is the one that the original reporter adopted. It works because firmware V2.9 of the S7-1500 / ET 200SP CPU family is the first release that fully understands the Complete protection level that TIA Portal V19 injects during migration.

3.1 Procedure

1. In the TIA Portal V19 project tree, right-click the S7-1500 CPU and select Change device → Device version.
2. In the Version column, click the dropdown and select a firmware version of V2.9 or later. Common production builds as of the TIA V19 release window are 2.9.0, 2.9.1, 2.9.2, and the V2.9.x security-update trains. PLCSIM supports the same versions listed in the SIMATIC S7-1500 catalog (entry ID: 109751652).
3. Click Apply and confirm the device change.
4. Recompile the project (Project tree → CPU → Compile → Software (rebuild all blocks)).
5. Stop the running PLCSIM instance, restart it, and download the recompiled project.
6. Attempt Go Online. The password dialog should no longer appear; the connection establishes with the level of access configured in the project.

3.2 Why This Works

Firmware V2.9 added two relevant behaviours:

• Full implementation of CPU protection level 4 (Complete protection) including the empty-password fallback for HMI/diagnostic read access when the project slot is empty.
• Updated PLCSIM handshake in the V19 PLCSIM runtime that mirrors the V2.9 CPU behaviour, allowing the simulated CPU to advertise the same protection level as the real hardware.

When the project and PLCSIM both speak V2.9, the online service negotiates the level cleanly and the user-facing dialog disappears.

4. Workaround B - Clear the PLCSIM Virtual Memory Card

Use this approach when the simulated CPU must remain at firmware V2.8 (or any other version that the production fleet uses) and the development team cannot change the device version. The fix is a one-time housekeeping operation on the virtual SMC that PLCSIM Advanced maintains.

4.1 Procedure (PLCSIM Advanced V19)

1. Stop the running PLCSIM Advanced instance (right-click the instance in the PLCSIM Advanced control panel and choose Stop, or close the instance window).
2. Close the PLCSIM Advanced control panel completely.
3. Open the instance directory in Windows Explorer. The default path is: %LOCALAPPDATA%\Siemens\Automation\PLCSimAdvanced\Instances
4. Open the subfolder for the specific instance, then the subfolder for the PLC (for example, CPU_1515_2PN.simatic).
5. Locate the folder labelled "Somatic Virtual Memory Card" (or, in some localized builds, Automatische SIMATIC Memory Card). This is the auto-generated virtual SMC that PLCSIM Advanced created on first download.
6. Click the radio button / dot in front of the folder to select it, then choose Delete. Confirm the deletion. If Windows refuses because the file is in use, ensure that the PLCSIM Advanced control panel is fully closed and retry.
7. Return to TIA Portal V19 and re-download the project to the (now empty) PLCSIM instance. The download will recreate the Virtual Memory Card fresh, with no leftover protection data from the V16 source project.
8. Attempt Go Online. The connection should complete without a password prompt.

4.2 Procedure (PLCSIM V19, non-Advanced)

Standard PLCSIM (the in-TIA variant launched from the toolbar) does not expose a "Somatic Virtual Memory Card" folder in the UI, but the same data is stored in the user's PLCSIM workspace directory:

• %USERPROFILE%\AppData\Local\Siemens\PLCSim\<ProjectGUID> on Windows 10/11
• %USERPROFILE%\Documents\Automation\PLCSim\<ProjectName> on older Windows builds

Close PLCSIM, delete the folder matching the project name or GUID, and restart PLCSIM. The fresh instance will accept the project without the migrated protection block.

5. Verification Procedure

After applying either workaround, perform the following checks to confirm that the configuration is correct and that no protection has been inadvertently weakened on the production target.

1. Online access in PLCSIM: From the project tree, right-click the CPU and choose Online & diagnostics. The connection should establish within two seconds. The status bar should read "Connected (online)" and the diagnostic buffer should be readable.
2. Access level confirmation: In Online & diagnostics → Online access, the displayed level should be the one configured in the project (e.g., Full access including F-CPU for level 1, or Complete protection for level 4 if explicitly enabled).
3. HMI tags update: If a WinCC Unified or WinCC Comfort panel is part of the project, force a tag and confirm the value updates on the HMI. This verifies the HMI access path is not blocked.
4. Physical CPU parity: If the same project is later downloaded to a real S7-1500 CPU of the same firmware version, the access level should match the PLCSIM behaviour. Mismatches indicate that the project still contains migrated protection metadata that should be re-reviewed.
5. Protection setting audit: Open Properties → Protection & Security → Access protection and confirm that the Permit access with PUT/GET communication from remote partners checkbox is set to the value the application requires. This is the toggle that HMI panels and third-party SCADA systems depend on when they are not part of the TIA project.

6. Configuring the Protection Level Manually (Best Practice)

Whether the team is using the firmware bump (Workaround A) or the SMC reset (Workaround B), it is good engineering practice to deliberately set the protection level in TIA Portal V19 rather than rely on the migration default. This makes the behaviour auditable and avoids surprises during commissioning.

6.1 Recommended Settings for a Development / FAT PLCSIM Instance

• Access protection level: No protection (level 1), or Write protection (level 2) if accidental writes from HMI should be blocked.
• Permit access with PUT/GET: Enabled (this is the default for level 1).
• Know-how protection: Off for the simulation CPU; protect only the production CPU.
• Copy/RAM protection: Off for the simulation CPU.
• Security event logging: Enabled - this writes the access attempts to the diagnostic buffer for audit.

6.2 Recommended Settings for a Production S7-1500

• Access protection level: Complete protection (level 4) on firmware V2.9+ with a strong, rotated password stored in a password manager. Maintain the password in the protected storage slot of the CPU so that anonymous access is impossible.
• Permit access with PUT/GET: Disabled unless the HMI / SCADA requires it. Third-party OPC UA servers should use the S7-1500 native OPC UA server interface instead of PUT/GET.
• Know-how protection: On for any block containing proprietary control logic.
• Security logging: Enabled, with a SIEM forwarder or syslog collector for compliance.

6.3 Where to Find the Settings in TIA Portal V19

The exact navigation is:

1. Open the device view for the S7-1500 CPU.
2. Open Properties → Protection & Security.
3. Select the Access protection section.
4. Choose the Access level from the dropdown.
5. If a password is required, click Define password and supply a strong password (12 characters minimum, mixed case, digits, symbols).
6. If a level-4 protection is set, verify the Connection mechanisms section is configured: Allow access via PUT/GET communication can be toggled independently of the access level.

7. Affected Configurations and Compatibility Matrix

8. Diagnostic Buffer Signatures

When the access is blocked, the PLCSIM diagnostic buffer records one of the following entries. The text strings are the actual messages emitted by the V19 runtime:

Open the diagnostic buffer via Online & diagnostics → Diagnostics → Diagnostic buffer in TIA Portal. The buffer is read-only; events cannot be deleted, only acknowledged. Use the timestamps to correlate the failed Go Online attempts.

9. Related Siemens Protection Mechanisms

The Complete protection (level 4) symptom is one element of a broader Siemens security model in V19. Engineers should be aware of the adjacent settings because they interact with PLCSIM in similar ways.

9.1 Know-How Protection

Block-level protection that encrypts the code of FB, FC, OB, or DB blocks. The password is stored on the SIMATIC Memory Card for S7-1500 and on the CPU's protected storage for S7-1200. PLCSIM honours know-how protection exactly as the real CPU does, but the password must be present in the project when the block is compiled. Forgetting to enter the password during the V16 → V19 migration is another common cause of "password needed" prompts.

9.2 Copy Protection (Anti-Counterfeit)

Binds the block to a specific CPU serial number. PLCSIM emulates a serial number derived from the instance ID, so copy-protected blocks will only run in the specific PLCSIM instance whose serial number was registered in the protection setup. If the project was originally bound to a real CPU and is now run inside PLCSIM, the binding mismatch triggers a separate password / serial-number prompt.

9.3 OPC UA Security

The S7-1500 OPC UA server (firmware V2.8+) maintains its own user/password store. When the PLC is configured for Complete protection, OPC UA clients that authenticate with anonymous credentials are rejected by default. PLCSIM V19 supports the same OPC UA server profile, so the same password rules apply.

9.4 Security Event Logging

With firmware V2.9 and TIA Portal V19, the CPU can forward security events to a syslog server over TLS. This includes failed Go Online attempts, password mismatches, and unauthorized HMI access. Recommended for any production cell.

10. Frequently Asked Questions