The CPU firmware, not Micro/WIN, decides what an upload request returns, and at protection level 4 it returns a flat refusal instead of a password challenge. Micro/WIN opens its password dialog only when the CPU answers password required; level 4 answers not permitted for the program block, the data block, and the system block, so no dialog appears and no menu path produces one. Holding the correct password changes nothing for upload. It changes one thing that matters: level 4 still permits a password-authorized write of the program to an EEPROM memory cartridge, and that cartridge is the only backup available.
The term protection level here means the CPU access setting stored in the system block and downloaded with it, numbered 1 through 4, with 4 the most restrictive. Level 4 is know-how protection: it is designed so the program cannot be extracted even by someone who holds the password.
Symptom Interpretation
| Observed behaviour | Reading | Next action |
|---|---|---|
Micro/WIN connects, CPU information reads, File > Upload reports password protection with no entry dialog |
Protection level 4; block reads refused categorically | Clone to a memory cartridge |
| Upload raises a password entry dialog | Level 3 or lower; the password gates the operation | Enter the password and upload normally |
| Cartridge write command prompts for the password and completes | Level 4 with a valid password; the permitted export path is open | Label and retain the cartridge as the master copy |
| Cartridge write command refuses without prompting | CPU not in STOP, or cartridge not seated / not an EEPROM type the CPU accepts | Recheck mode switch and cartridge seating |
| After transfer into a second CPU, SF/DIAG lights solid | Target CPU rejected the transferred blocks — CPU class, firmware, or variant mismatch | Read the fatal error code in the PLC information dialog |
| Same cartridge loads into a standard CPU but fails on a CN CPU | CN variant handling in the programming software | Use the Chinese-language Micro/WIN and a later service pack |
Communication working proves the PD/PC interface, cable, and baud rate are correct. It proves nothing about upload rights. Treat "I can go online" and "I can read the program" as unrelated results.
The Level 4 Mechanism
Password enforcement lives in the CPU. Micro/WIN issues a service request; the CPU evaluates it against the protection level held in its system block and replies with permission, a password challenge, or a denial. At levels 2 and 3, a block read produces a challenge, which is what raises the dialog. At level 4, the read of the program block, the data block, and the system block is denied outright, so the client has nothing to challenge and shows only the refusal message.
Operations that do not export block contents stay available: establishing the connection, reading CPU type and firmware revision, and writing the program to a memory cartridge. That last one is password-gated, and it is the asymmetry the recovery depends on. A missing installation file or a corrupt Micro/WIN setup produces different symptoms — failed connections, missing menu items, driver errors — not a clean online session with one refused service.
Protection travels with the program. The system block written to the cartridge carries the level-4 setting and the password, so any CPU loaded from that cartridge is protected identically and equally unreadable. The clone is a runnable copy, never recovered source.
Recovery Options
| Goal | Action | Result | Cost |
|---|---|---|---|
| Spare or replacement CPU that runs the same machine | Password-authorized write to EEPROM memory cartridge, then power-up transfer into the target CPU | Bit-identical program, data, and system block | Program remains unreadable and uneditable |
| Editable source for modification | Obtain the project file from whoever commissioned the machine | Full source | None technical; no upload path exists |
| Reuse the hardware for a new application | Clear the CPU using the master password CLEARPLC at the clear prompt |
Program, data, and system blocks erased; protection returns to unprotected default | Existing program destroyed permanently |
Order matters. The cartridge clone must exist and be verified before any clear operation touches the CPU.
Memory Cartridge Clone Procedure
- Select an EEPROM memory cartridge sized for the program — the 32K cartridge
6ES7 291-8GE20-0XA0covers a CPU 224-class application. - Record the source CPU type and firmware revision from the Micro/WIN PLC information dialog. This is the reference for target compatibility.
- Remove power from the CPU, open the access door, and seat the cartridge fully. Never insert or remove a cartridge with the CPU energized.
- Restore power and put the CPU in STOP, either with the mode switch or the Micro/WIN STOP command. Cartridge programming runs only in STOP.
- Run the memory-cartridge write command from the PLC menu — the operation the protection table lists as copy data to memory card. Select program block, data block, and system block.
- Enter the level-4 password when prompted. This is the one operation at level 4 for which the password is accepted.
- Let the write finish without interruption. Do not remove power or the cartridge during the transfer.
- Remove power, extract the cartridge, and label it with the source CPU order number, firmware revision, machine, and date.
- To load a target CPU: with power removed, insert the cartridge, then apply power. The CPU copies the cartridge contents into program memory during power-up initialization.
Verification Checks
- Check 1 — status LEDs after the power-up transfer. Expect SF/DIAG off. A solid SF/DIAG means the target CPU rejected the transferred blocks; nothing about the run state is trustworthy until it clears.
- Check 2 — fatal error code. Go online and open the PLC information dialog. Expect no fatal error reported and the last non-fatal error cleared after a power cycle.
- Check 3 — CPU identity match. Compare the CPU type and firmware revision reported by the target against the values recorded in step 2 of the procedure. Expect the same CPU class; any difference is the first candidate when a transfer is rejected.
- Check 4 — run state. Command RUN. Expect the RUN LED on, STOP off, and a stable scan with no non-fatal error appearing in the status bits.
- Check 5 — retention without the cartridge. Remove power, extract the cartridge, and power up again. Expect the program to run from internal memory, confirming the copy landed in the CPU rather than executing from the cartridge alone.
Recurring Pitfalls on CN Hardware
CLEARPLC is a demolition tool, not a recovery tool. Entered at the clear prompt in place of the user password, it wipes program, data, and system blocks and returns the CPU to the unprotected default. There is no master password that grants read access to a level-4 program, and no service that reconstructs one. Running it first is how a machine loses its only copy.
Programming-software vintage decides whether CN hardware behaves. STEP 7-Micro/WIN v4.0 SP5 predates the service packs that address CN CPUs; SP8 and later were released with CN CPU handling. Pull the current service pack through a Siemens sales or support channel before blaming the CPU.
CN CPUs are the China-market variant, identified by a different final suffix in the order number — for example for a CPU 224 CN. A cartridge that transfers cleanly into a standard-variant CPU and lights SF/DIAG on a CN CPU points at the programming environment, not the cartridge: install the Chinese-language Micro/WIN and set the Windows regional settings to match before repeating the transfer.
Cartridge compatibility tables list standard CPU designations only. No Siemens document declares CPU 22x CN and CPU 22x interchangeable, so select the cartridge as though the unit were a CPU 224 and prove it on a spare rather than on the running machine. Confirm the target CPU is cleared before the load; a transfer into a CPU holding an older protected system block is a common source of unexplained rejections.
Final check: with the clone loaded and running, attempt File > Upload on the target CPU. Expect the same refusal with no password dialog — that refusal proves the level-4 system block crossed over intact and the copy is faithful.
Frequently Asked Questions
Can I upload the program from an S7-200 set to protection level 4 if I have the password?
No. Level 4 denies reads of the program block, data block, and system block regardless of password, which is why Micro/WIN never opens a password dialog. The only export path is a password-authorized write to an EEPROM memory cartridge.
Does the CLEARPLC master password recover a protected program?
No. CLEARPLC erases the program, data, and system blocks and returns the CPU to the unprotected default. Use it only after a verified memory-cartridge clone exists, or when the existing program is genuinely expendable.
Can I use a standard CPU 224 memory cartridge with a CPU 224 CN?
Select it as though the unit were a CPU 224 — no Siemens document declares the CN and standard variants interchangeable. Validate with a test transfer into a spare CN CPU and confirm SF/DIAG stays off before relying on the cartridge.
Does the Micro/WIN version matter when working with CN CPUs?
Yes. v4.0 SP5 is old for CN hardware; SP8 and later address CN CPUs, and CN units may require the Chinese-language Micro/WIN with matching regional settings. A cartridge that loads into a standard CPU but fails on a CN CPU is the signature of that mismatch.