S7-300 CPU 315-2DP Password Protection: Upload Backup Guide

Overview of Password Protection on S7-300 CPUs

CPU-level password protection on the SIMATIC S7-300 family is enforced by the firmware of the CPU and is independent of the programming device (PG), the project file on the engineering station, or the type of online connection. Once a CPU password has been configured and downloaded, every subsequent online operation against the CPU is evaluated by the firmware using three discrete protection levels: no protection, write protection, and read/write protection. Each level is bound to a single password string that the user enters in the CPU properties dialog inside STEP 7 V5.x or TIA Portal and that the PG transfers to the CPU only after a successful authentication handshake.

The S7-300 CPU 315-2DP (typical order numbers 6ES7315-2AFxx-0AB0 and 6ES7315-2AGxx-0AB0 depending on firmware generation) is fully covered by this protection mechanism. Because the 315-2DP has no internal load memory, every user program lives on the Micro Memory Card (MMC) seated in the CPU; the same MMC is what the firmware reads to enforce the protection level and what the PG attempts to authenticate against during an upload or download. The implication is direct: if the MMC is removed, the CPU goes into STOP with a memory error (SF LED lit, diagnostic buffer entry "Memory card not inserted or MMC defective") and no program can run, but the protection-level data is physically located on the card itself, not on the CPU silicon.

The behaviour described in field practice follows the firmware contract published in the S7-300 CPU data manuals and STEP 7 help texts on the Siemens Industry Online Support portal. The S7-300 system manual describes the three protection levels and the upload/download matrix in chapter 4 (CPU protection / Access protection); see the SIMATIC S7-300 Automation System manual at Siemens support entry 109751655 for the canonical reference.

CPU 315-2DP Hardware and Firmware Context

Several 315-2DP variants exist in the field, and the protection implementation is identical across them, but the firmware generation controls which programming environment is supported and which features (like block consistency) are available during an upload.

All variants require the MMC to be present for the user program to be retained through a power cycle; the CPU does not have a built-in remanent Flash area for user blocks. Therefore any backup strategy must consider the MMC as a first-class asset: the same MMC that holds the program also holds the password hash that the firmware evaluates during online authentication.

The CPU front panel provides an integrated MPI/DP interface (X1) and, depending on variant, an additional PROFINET or DP interface (X2). Online operations used to upload or download blocks are routed through either interface using S7 communication (port 102, ISO-on-TCP). A password is enforced uniformly across both interfaces, so a project cannot be extracted from a parallel network path while protection is active.

The Three CPU Protection Levels

The protection dialog reachable via PLC > Object Properties > Protection (STEP 7 V5.x) or Device properties > Protection & Security > CPU access protection (TIA Portal) exposes the same three options. The PG transfers the selected level and the password hash to the CPU on the next download; the CPU stores them in the system data area on the MMC.

STEP 7 documentation states explicitly that with Level 2 (write protection) the PG can still upload the program back to the project for documentation or backup purposes, while Level 3 blocks both directions. This behaviour is firmware-enforced and cannot be overridden by toggling the mode selector, by swapping the PG, or by attempting to use the S7 communication raw channel: every write attempt is intercepted by the protection handler and returns an error event with event ID 0xE0FE or 0xE0FF in the diagnostic buffer.

Upload vs. Download Behaviour per Protection Level

The following matrix is the operational contract that field engineers must verify against before attempting any backup. It is derived from the STEP 7 V5.5 help on "Access protection for the S7-300/400" and the equivalent TIA Portal help on "CPU access protection".

The important consequence for backup is that Level 2 is the only protected state from which an upload succeeds without the password. Level 3 — the strongest — requires either the correct password or a path that bypasses the firmware's authentication handler entirely (see the MMC recovery section below).

Know-How Protection for Blocks vs. CPU Protection

Two protection mechanisms exist in the S7-300 ecosystem and they are independent: the CPU access protection described above and block know-how protection. The latter is set per-block via Block Properties > Know-how protection in STEP 7 V5.x or via Properties > Protection & Security > Block access protection in TIA Portal. It scrambles the compiled code section (the CODE area) of a function (FC) or function block (FB) so that, even after a successful upload, the block opens in the editor as a placeholder with the symbol table and interface visible but the program body opaque. A separate block password is required to unscramble.

Engineers routinely confuse the two. Concretely:

• A CPU at Level 3 with no know-how-protected blocks will still refuse to upload any blocks.
• A CPU at Level 1 with know-how-protected blocks will upload the blocks, but they remain encrypted until the block password is supplied at open time.

Both passwords can coexist on the same CPU. A full backup of the project must therefore recover (a) the project archive (or a clean upload), (b) the CPU password (or a legal alternative path), and (c) every per-block know-how password. The CPU password is stored only on the MMC; the block passwords are stored inside the corresponding blocks on the MMC as well, but they are also embedded into the encrypted block on the PG side after a download.

Password Storage on the MMC

The password is not stored in clear text. STEP 7 and TIA Portal use a one-way hash derived from the password string with a CPU-specific salt; the resulting hash is stored in the system data area of the MMC, specifically within the SBDAT.DAT / SDB configuration blocks written by the CPU at download time. During online authentication, the PG transmits a challenge response derived from the entered password and the same salt; the firmware compares it locally and grants or denies the operation.

Because the hash and salt are resident on the MMC, several practical implications follow:

1. Moving the MMC to another 315-2DP CPU of the same MLFB carries the password with it. The receiving CPU will enforce the same protection.
2. Moving the MMC to a different S7-300 family member (e.g. 314 or 318-2) does not carry the password, because the hash is computed with a CPU-specific constant. The receiving CPU treats the SDBs as foreign and ignores the protection payload.
3. Formatting the MMC removes all SDBs, including the password hash, but it also removes the user program.
4. Pulling the MMC and reading it in a third-party MMC reader (the S7-300 MMC uses a standard FCI/Berg connector and a FAT16-compatible file system) yields the system files in raw form. The password hash is present in SBDAT, but reversing it requires a brute-force attack against the STEP 7 hash function and is both a security and a legal concern (see below).

Configuring Password Protection in STEP 7 V5.x

1. Open the SIMATIC Manager and the S7 project that targets the 315-2DP station.
2. Select SIMATIC 300 Station > CPU 315-2DP in the project tree, right-click and choose Object Properties.
3. In the dialog, switch to the Protection tab.
4. Select the protection level (1, 2, or 3) from the radio group.
5. Enter the password in both fields. STEP 7 V5.5 enforces a minimum of four characters; the maximum is 32. The recommended policy is 8+ characters mixing upper, lower, digit, and punctuation.
6. Confirm with OK. The password hash is written to the offline project and is sent to the CPU on the next download.
7. Download the hardware configuration (PLC > Download to Target) while the CPU is in STOP. The CPU returns an OK status with the protection level now active.
8. Verify by attempting to upload with no password: STEP 7 should report "No online connection possible" for Level 3 or should accept the upload for Level 2.

Configuring Password Protection in TIA Portal

1. Open the TIA Portal project, expand Devices & Networks, and select the CPU 315-2DP device.
2. Open Device view > Properties > Protection & Security.
3. In CPU access protection, tick the box for the desired level: No protection, Read-only access (corresponds to write protection, Level 2), or Complete protection (Level 3).
4. Enter the password twice. TIA Portal V15 and later enforce a minimum length and a complexity meter. The hash is stored locally in the project and transferred on the next download.
5. Compile the device configuration (HW > Compile) and download (Online > Download to device).
6. Verify by checking the Online & diagnostics view: the active protection level appears under Protection.

When upgrading a STEP 7 V5.x project that contains a protected CPU into TIA Portal, the password is preserved in the project. The password itself is not migrated from a stand-alone MMC — if the offline project is missing, the password must be re-entered manually before the CPU will accept a download from TIA Portal.

Backup Strategies for Protected CPUs

Selecting a strategy depends on whether the project archive exists and on the active protection level. The following decision tree covers the cases encountered in field service:

The single most important pre-emptive measure is to keep an up-to-date project archive. STEP 7 V5.x and TIA Portal both support an automated archive function triggered by every successful download, and these archives should be stored in a versioned, off-machine location (network share, source control, plant documentation system). When the CPU is later backed up via Upload to PG, the upload will produce blocks marked with the timestamp of the last online change rather than the timestamp of the original download — a useful forensic signal that the project on the CPU has diverged from the archive.

MMC Password Recovery — Method and Legality

Field engineers sometimes ask whether the password can be recovered directly from the MMC without the cooperation of the original programmer. The technical answer is: the password hash is recoverable from the MMC by reading the system data blocks off the card with a third-party reader, and the hash function used by STEP 7 has been discussed in security research contexts. The practical answer is that reversing the hash to a usable password requires a brute-force search whose cost depends on password length and complexity; an 8-character mixed-case password with digits and symbols is effectively out of reach of a casual attacker but is reachable by a well-resourced attacker.

For the legitimate recovery path, Siemens offers a paid support service: open a support request via the Siemens Industry Online Support portal (support.industry.siemens.com) with the CPU order number, serial number, and proof of ownership. The support team can issue a CPU-specific reset procedure that revalidates the password without disclosing the original string.

Verification Checklist After a Backup

1. Open the uploaded project in STEP 7 / TIA Portal and confirm that CPU 315-2DP appears in the station with the correct order number and firmware version.
2. Open the block folder and confirm that the block count, block numbers (OB1, OB35, OB82, OB100, OB121/122, FB/FC/DB as expected), and block timestamps match the expected plant state.
3. Compare the offline project against the CPU using PLC > Compare (STEP 7 V5.x) or Online > Compare (TIA Portal). Any block marked as "different" indicates an in-field edit not present in the offline project.
4. Open Online & Diagnostics > Diagnostic buffer and check the most recent entries. Look for event IDs 0x4300–0x43FF (operating mode changes) and 0xE0FE/0xE0FF (access-protection rejections) to confirm that no failed authentication attempts preceded the backup.
5. Archive the project (STEP 7: File > Archive, producing a *.zip or *.ard; TIA Portal: Project > Archive). Store the archive alongside the password in a secured, versioned location.

Troubleshooting Matrix

Field-Proven Tips and Safety Notes

• Set the protection level to Level 2 (write protection) rather than Level 3 (read/write protection) when you want to deter casual modification while still allowing service engineers to retrieve the project. Level 2 is the practical sweet spot for service-friendly protection.
• Reserve Level 3 for cases where the program contains proprietary algorithms or trade-secret process knowledge, and pair it with know-how protection on the critical FBs.
• Always perform a memory reset (MRES) before pulling the MMC for any reason. The MRES clears work memory and any volatile diagnostic state but does not clear the password stored in the SDB on the MMC; this is the safest ordering.
• Document the password using the same process as for a network service password: plant document management system, sealed envelope in the control cabinet, and the integrator's project archive. Do not paste the password into source code comments.
• If the CPU is part of a Safety Integrated application (F-CPU pairing), password handling must follow the safety lifecycle procedure defined in the F-CPU manual; unauthorized changes to the safety program are a SIL violation regardless of the password status.
• For migration to a new CPU generation (e.g. S7-1500), the CPU password from the S7-300 is not transferred; the new CPU starts with no password, and the protection policy must be re-applied after commissioning.

Standards and Reference Documents

• SIMATIC S7-300 Automation System, system manual — entry 109751655 on Siemens Industry Online Support.
• STEP 7 V5.5 Programming and Operating Manual — entry 50203404 on Siemens Industry Online Support.
• TIA Portal help "Protecting blocks and the CPU" — integrated help in TIA Portal V13 and later; index online at support.industry.siemens.com.
• Siemens S7-300 product page — siemens.com/s7-300 for current catalogues and successor product information.