S7-300 CPU Password: Force Re-Authentication on Every Download

1. Problem Statement

Engineers running production cells with S7-300 (CPU 315-2DP, order number 6ES7315-2AH14-0AB0) or S7-400 (CPU 416) frequently rely on the CPU's built-in password to prevent unauthorized program modification. A common field complaint is:

1. An operator or commissioning engineer enters the correct CPU password once during an online download.
2. The download proceeds.
3. Subsequent online operations (download, upload, monitor with write access) succeed without prompting for the password again, even though the project's HW Config still lists Protection Level 1, 2, or 3.

The password dialog only reappears after the engineer manually clears the access session via Simatic > PLC > Access Right > Cancel. If the engineer forgets to clear it before leaving the workstation, any other person who opens the same STEP 7 project on the same PC can download or modify blocks without re-authentication. The same risk exists if STEP 7 is left running overnight on a shared engineering workstation, or if a contractor uses the same PG login as a process engineer.

This is documented behavior of STEP 7 V5.x, not a defect: the password is bound to the active online session, not to the individual download transaction. Knowing how the protection model is implemented is essential for designing a control system that truly enforces password re-authentication on every download.

2. CPU Protection Levels in STEP 7 V5.x

Every S7-300/S7-400 CPU exposes three discrete protection levels. The setting is stored in the CPU's system data and is configured in HW Config under CPU Properties > Protection.

Levels 2 and 3 are the only levels that cause STEP 7 to systematically prompt for the password on every relevant operation. Level 1 is intended for environments where the password is required only to authorize the first download and is then trusted for the rest of the session.

3. Why the Password Dialog Disappears After the First Entry

STEP 7 V5.x maintains an in-memory access token per online connection. The token is created when:

• The password is correctly entered against the CPU.
• The user clicks the checkbox in the password dialog that says "Use the same password for the next online operations" (or its localized equivalent, e.g., "Passwort für weitere Online-Operationen verwenden").

Once the token is active, STEP 7 will not prompt again for the duration of the project session. The token is cleared only by:

• Closing the SIMATIC Manager project.
• Closing SIMATIC Manager entirely.
• Selecting PLC > Access Rights > Cancel (clears the current PG-side rights for the active online connection).
• Restarting the PG.
• CPU restart or memory reset that drops the online connection.

For Level 1 protection, the dialog does reappear after a session is closed or cancelled, but it is the act of closing/cancelling, not the protection level itself, that triggers the prompt. For Levels 2 and 3, the CPU itself refuses to service write (or read) requests without a fresh password, so the PG-side dialog is forced even if the in-memory token would otherwise have allowed the operation.

3.1 Diagnostic buffer entries when protection is active

If the CPU receives an online request that violates the active protection level, it writes a diagnostic buffer entry. The exact text depends on firmware, but the typical entries are:

• Protection violation - write access denied (Level 2 or 3, write request without password)
• Protection violation - read access denied (Level 3, read request without password)
• CPU password changed (any level, after the password was updated)

These entries are visible in STEP 7 via PLC > Diagnostic/Setting > Diagnostic Buffer. Always read the buffer first when a download fails mysteriously after a protection change.

4. Configuring HW Config for Persistent Re-Authentication

The reliable method to force a password dialog on every download is to use Protection Level 2 or Level 3 in HW Config. The configuration is part of the CPU's system data and travels with the project, so every PG that downloads the project enforces the same policy.

4.1 Procedure (STEP 7 V5.x)

1. Open SIMATIC Manager and the project containing the target CPU.
2. Expand the station and double-click Hardware to launch HW Config.
3. Click the CPU in the rack (slot 2 for S7-300, slot 3 for S7-400) to select it.
4. Open Object Properties (double-click the CPU, or right-click > Object Properties).
5. Switch to the Protection tab.
6. Select Write protection (Level 2) or Write/Read protection (Level 3). For the dialog to appear on every download, choose Level 2; for the dialog to appear on every monitor/upload as well, choose Level 3.
7. Enter the CPU password in the Password field and confirm. The password is up to 8 characters, case-sensitive, and ASCII-only.
8. Click OK to close the dialog.
9. Save and compile HW Config (Station > Save and Compile).
10. Download the configuration to the CPU (PLC > Download). The CPU performs a re-initialization if the protection level changed.

4.2 Verifying that the protection level took effect

After the download:

1. Open PLC > Accessible Nodes or PLC > Monitor/Modify.
2. STEP 7 should now prompt for the password on the very first online operation.
3. For Level 2: try PLC > Download. Without re-entering the password, the CPU must reject the operation with diagnostic entry Protection violation - write access denied.
4. For Level 3: try PLC > Upload to PG. Without the password, the upload must fail.

4.3 Confirming the configured level on the live CPU

To confirm the live CPU matches the project without re-downloading:

1. Go online (PLC > Connect to Target System > CPU 315-2DP or similar).
2. Open PLC > CPU Messages or PLC > Diagnostic/Setting > Module Information.
3. Select the Protection tab. STEP 7 displays the currently active protection level and the password status from the CPU's perspective.

If the displayed level does not match the offline project, the system data was not yet downloaded, or a different project was downloaded earlier and overwrote the protection setting.

5. Managing Access Rights in the Active Session

Even with Level 2/3 protection, STEP 7 still caches the password for the duration of the open project. If you want the dialog to appear on the next operation in the same session, force a clearance:

5.1 Clear the access token (PG-side)

1. Menu: Simatic > PLC > Access Right > Cancel.
2. Alternatively: PLC > Access Rights > Cancel in the HW Config online view.
3. The next online operation against the CPU now prompts for the password.

5.2 Scripted logout via SFC / SFB

Some engineering teams prefer to clear the PG access from a button on the HMI. There is no direct SFC that wipes the PG-side access token from inside the user program; the operation is PG-resident. The recommended HMI-side pattern is:

1. Operator presses a "Release engineering access" button on the HMI.
2. The HMI writes a tag that the PLC user program uses only as a status indicator (e.g., M0.0 "Engineering_LoggedIn").
3. The PG engineer must explicitly close the project or run PLC > Access Rights > Cancel when leaving the workstation.

For an automated logout, drive a Windows scheduled task that closes SIMATIC Manager after a configurable idle period; combine this with a Windows workstation lock (Win+L).

6. Know-How Protection for FBs and FCs

The CPU-level password controls online access to the CPU as a whole. To protect the intellectual property inside individual blocks, STEP 7 V5.5 and later support know-how protection on FBs and FCs.

6.1 Standard know-how protection

The workflow in STEP 7 V5.x is:

1. Open the FB or FC in the LAD/FBD/ST editor.
2. Select File > Know-How Protection > Set (or Edit > Know-How Protection, depending on the editor version).
3. Enter and confirm a block-specific password (independent of the CPU password, up to 8 characters).
4. Save the block.

Once set, the block compiles with an encrypted payload. Online, only the interface (IN, OUT, IN_OUT, STAT, TEMP) is visible; the code section is replaced by a placeholder. Anyone trying to view or edit the code must supply the block password.

6.2 Removing know-how protection

From the Siemens official documentation for removing block know-how protection:

• To remove know-how protection from a single block, open it in the editor, choose File > Know-How Protection > Remove, and enter the password.
• To remove know-how protection from multiple blocks at once in SIMATIC Manager, select the blocks in the block container, right-click > S7 Block Privacy > Remove Know-How Protection. All selected blocks must share the same password; otherwise the operation aborts with a "Password mismatch" diagnostic.

6.3 S7-Block Privacy (enhanced encryption, STEP 7 V5.5 and later)

From Siemens Knowledge Base article 45632073 - Encrypted block protection for FBs and FCs from STEP 7 V5.5: STEP 7 V5.5 introduced stronger encryption via the add-on S7-Block Privacy. The package must be installed from the STEP 7 DVD (or downloaded from the Siemens support portal). After installation, blocks protected through the S7-Block Privacy menu use a 128-bit algorithm and resist offline brute-force attacks that were feasible against the original know-how protection.

7. Multi-User Scenarios: Admin Write, Guest Read

A common requirement is to allow different Windows users on the same engineering PC to have different privilege levels against the CPU. STEP 7 V5.x does not implement per-Windows-user CPU access. The CPU only knows "a PG with a valid password" versus "a PG without a valid password." Privilege differentiation is therefore done by either CPU-side capabilities, workstation-side controls, or both.

7.1 Multiple CPU passwords on classic S7-300

The classic S7-300 CPU (including 6ES7315-2AH14-0AB0) supports exactly one CPU password. Different users cannot have different passwords against the same CPU without changing the password between shifts, and the password change itself requires the current password (or a memory reset that erases the program).

7.2 Extended access levels on supporting S7-400 CPUs

Higher-end S7-400 CPUs (CPU 41x-2 PN/DP from firmware V6 and later, see the Siemens Industry Online Support portal) support an Access levels extension with up to four authorization levels, each with its own password. Configuring multiple access levels is done in HW Config > Protection > "Extended password protection" (visible only on supporting CPUs). Check the CPU's firmware release notes (Help > About > Firmware in STEP 7) to confirm whether your CPU supports this option.

7.3 Workstation-side mitigation

If the engineering PC must be shared between an admin and a guest user:

• Maintain a single CPU password at the admin level.
• Use Windows user accounts with different privilege for the engineering tools themselves (SIMATIC Manager installation folder, project folder ACLs).
• Educate the guest user: do not enter the CPU password. Use the program in offline mode only, or rely on Level 3 to prevent any read access without the password.
• Forbid the "remember password" checkbox in the STEP 7 dialog for the guest account by deploying a registry key or a wrapper script that always clicks the "Cancel" default button.

8. Verification Procedure

After changing the protection configuration, perform the following test sequence on the bench or in the cabinet:

1. Power-cycle or reset the CPU to ensure the new system data is active.
2. Open the project in STEP 7.
3. Go online (PLC > Connect to Target System).
4. Confirm that the password dialog appears.
5. Enter the correct password — confirm the download/monitor operation succeeds.
6. Re-attempt the same operation immediately, without closing the project — the dialog should not appear (Level 2/3 keeps the password cached for the session).
7. Select PLC > Access Rights > Cancel.
8. Re-attempt the operation — the dialog must reappear.
9. Close SIMATIC Manager and re-open the project.
10. Re-attempt the operation — the dialog must reappear.

If step 6 keeps prompting instead of succeeding, the CPU is rejecting the cached password; check that the CPU password in the offline project matches the actual CPU password (HW Config > Protection tab) and that the project has not been silently re-saved with a stale password by a second engineer.

9. Troubleshooting Matrix

10. Operational Checklist

1. Define the protection level in the project standard: Level 2 is the recommended baseline for production cells.
2. Document the CPU password in a controlled location (plant password vault) and limit distribution.
3. Add a "Log out" step to the shift handover procedure: PLC > Access Rights > Cancel.
4. Use Windows workstation lock (Win+L) when leaving the desk; combine with an auto-lock policy.
5. For IP-sensitive blocks, enable S7-Block Privacy know-how protection in addition to the CPU password.
6. Periodically test the protection by attempting an online write from a PG that has not been authenticated — confirm rejection.
7. Coordinate password changes between commissioning, operations, and OEMs to avoid forgotten passwords that force a memory reset.

11. Interaction with the Operating Mode Selector

For physical security, the CPU 315-2DP and CPU 416 families include a key-operated mode selector (MRES / STOP / RUN / RUN-P). The selector has a direct relationship with the password:

• RUN-P permits online write access with a valid password.
• RUN blocks online write access regardless of the password (read-only).
• STOP permits password-protected write access but the CPU is not executing OB1.
• MRES performs a memory reset that clears the password to default and erases the user program and data blocks (load memory). Retentive data is preserved only on warm restart; cold restart via MRES wipes all retentive data.

12. Notes on Migrating to TIA Portal

Projects migrated from STEP 7 V5.x to TIA Portal carry the CPU password over, but the access-token behavior differs slightly:

• In TIA Portal, the password is bound to the online connection, not to the project session. Closing the project or going offline clears it automatically.
• Know-how protection in TIA Portal uses a similar but independent mechanism; blocks protected under S7-Block Privacy remain encrypted, and removal requires the block password as documented in the Removing block know-how protection reference.
• Some S7-300 CPUs older than the 6ES7315-2AH14-0AB0 revision may need a firmware update before being recognized by TIA Portal V16+. Always check the device catalog compatibility list in TIA Portal before migration.
• The CPU protection level names change: TIA Portal renames "Write protection" and "Write/Read protection" but the underlying enforcement is identical. The three-level model is preserved.

13. Field-Proven Recommendations

• Adopt Level 2 as the project standard for production S7-300/S7-400 cells; switch to Level 3 only where the OEM contract requires it.
• Store the CPU password in the plant's central credential vault (e.g., CyberArk, BeyondTrust) with audit logging; avoid spreadsheet-based password lists.
• Train every engineer who uses STEP 7 on the PLC > Access Rights > Cancel step; treat it as part of "leaving the workstation," like Win+L.
• Combine the CPU password with know-how protection on IP-sensitive FBs/FCs through S7-Block Privacy (STEP 7 V5.5+).
• For multi-user engineering PCs, deploy Windows Group Policy to enforce screen lock after 5 minutes idle and to prevent the SIMATIC Manager "remember password" checkbox from being saved by automated installers.
• Test the protection quarterly: from a fresh SIMATIC Manager session with a clean Windows user profile, attempt an unauthorized online operation and confirm rejection.