SCALANCE S602 Security Configuration Tool: Fix Deutsch Default

Overview: SCALANCE S602 and the Security Configuration Tool

The SCALANCE S602 (order number 6GK5602-0BA10-2AA3 in the 2AA3 hardware revision) is a Siemens industrial security appliance designed to protect automation cells and machine networks from unauthorized access. It sits in front of a SIMATIC PLC, HMI, or drive system and provides stateful inspection firewall, NAT, VPN (IPsec), and a DMZ-capable bridging/routing layer between the trusted office network and an untrusted automation network.

The device is commissioned through a Windows-based PC utility called the Security Configuration Tool (SCT). The SCT is the only officially supported method for pushing IP, routing, firewall, and VPN policies to the S602; the on-board Web Based Management (WBM) is a read-only diagnostic surface for the bulk of security parameters and is intentionally locked for write operations on most firmware builds.

Siemens documentation positions SCT as a multilingual installer: the same setup binary is shipped with German, English, French, Italian, Spanish, and (in later releases) Chinese-Japanese resource files. The installation wizard should present a language picker on first run, but a known field issue is that the wizard silently inherits the system locale of the host operating system at the moment the installer is launched. If the host machine is set to de-DE, de-AT, or de-CH, the SCT will install and launch entirely in Deutsch, with no obvious re-entry point into the language switcher. There is no in-tool "Language" menu under Extras > Options; the language is bound to the installation, not to the user profile.

Product Identification and Firmware Version Map

Before forcing a language change, identify the exact SCT release you have. The installer stamps a four-segment version code in the About dialog and in the Windows registry under HKLM\SOFTWARE\Siemens\SecurityConfigurationTool.

The Ausgabestand string is the German term for "issue/revision level"; it appears on the printed CD sleeve and in the EKB Install log (%TEMP%\Siemens\SCT_Setup.log). Treat V02.00.00.01_01.00.00.01 as a composite key: the first triple is the SCT executable revision, the second triple is the S602 firmware image that the SCT will push. If you re-image the S602 with a newer firmware, the SCT will refuse to load older project files unless you re-save them through the newer SCT build first.

Symptoms: SCT Defaults to Deutsch

The reported failure mode is straightforward and reproducible across multiple sites:

1. Installer is launched from the SCALANCE S602 product CD or from an FTP share provided by a Siemens regional support center.
2. Setup completes without ever showing a language selection dialog.
3. All menu items, dialogs, tooltips, and tree-view nodes render in German: Konfiguration, Zielgerät, Firewall-Regeln, VPN-Tunnel, Diagnose, Speichern.
4. Editing the installer's .ini to set DefaultLanguage=en-US before re-running Setup has no effect — the installer ignores that key.
5. No "Language" or "Sprache" toggle exists anywhere in the application UI.

The root cause is not a corrupted installer; the binary itself is multilingual. The cause is that the SCT installer reads the Windows GetUserDefaultUILanguage() Win32 API at startup, not a flag you can override. If that API returns a German LCID (1031, 3079, 5127, 4103 for de-DE/de-AT/de-CH/de-LU), the installer hard-codes German as the display language for the entire install, including the splash, EULA, and post-install first-run.

Root Cause Analysis

Three contributing factors stack to produce the Deutsch default:

The non-Unicode (system) locale is the most common hidden trigger. A US-English Windows install with the display language set to English but the non-Unicode language left at German (a frequent state on machines originally built in German-speaking regions) will still force the SCT installer into German. Power users may also have set the system locale deliberately to de-DE to allow older engineering tools with German-only string tables to render their ä, ö, ü characters correctly.

Resolution: Obtaining an English SCT Installation

You have four supported paths to get an English-language SCT. Pick the one that matches your contractual relationship with Siemens.

Path A — Channel Partner / SIAC

Siemens Industry Automation (SIAC) and the Automation & Drives competence centers stock multilingual CDs and can hand you a freshly-burned disc or a one-off share link from their internal file server. The original procurement route for the S602 is the US competence center in Johnson City, TN:

• Siemens Industry, Inc. — Automation & Drives
  One Internet Plaza, Johnson City, TN 37604
  Phone: +1 800 333 7421 or +1 423 262 2522
  Fax: +1 423 262 2231

Ask specifically for the SCALANCE S Security Configuration Tool CD, current English revision, and quote the article number 6GK5602-0BA10-2AA3. The CD label should show Ausgabestand V02.00.00.01_01.00.00.01 or higher.

Path B — Siemens Online Support (SIOS) Entry

The product-related entry for the SCALANCE S602 on the Siemens Industry Online Support portal documents the toolchain and links to the latest publicly distributed SCT. Bookmark the entry and check the "Associated Downloads" tab for an Security Configuration Tool package; if a public download is not available, the entry contains a "Request" link that opens a service request against your Siemens customer number.

Reference page: SCALANCE S602 — SIMATIC NET Industrial Ethernet Security (SIOS).

Path C — Field File Server (Project Internal)

Many system integrators maintain a Norcross, GA mirror (Siemens US headquarters for Digital Industries) that hosts the latest SCT builds. If you have an active project with Siemens or a certified Solution Partner, request an FTP/ShareLink URL rather than a physical CD. The file name pattern is SCT_SCALANCE_S_V<major.minor.maint.build>_Setup.exe and the SHA-256 is published on the SIOS download page once the build is GA.

Path D — Rebuild the Engineering Workstation

If a clean image is acceptable, rebuild the host with en-US as both the display language and the non-Unicode system locale before installing the SCT. This path is the most reliable for teams that manage dozens of engineering laptops with a single golden image.

Step-by-Step: Force the SCT Installer to English

1. Close the SCT if it is running. Open services.msc and stop the Siemens SCT Background Service if present (added in V02.10+).
2. Open Control Panel > Clock and Region > Region > Administrative. Click Change system locale... and set it to English (United States). Reboot when prompted. This step is required even if the display language is already English.
3. Verify the change took effect: powershell -c "[System.Globalization.CultureInfo]::CurrentUICulture; [System.Globalization.CultureInfo]::CurrentCulture" Both should report en-US.
4. Uninstall the existing German SCT through appwiz.cpl. Remove any residual directory under %ProgramFiles%\Siemens\SecurityConfigurationTool and the registry keys under HKLM\SOFTWARE\Siemens and HKCU\SOFTWARE\Siemens.
5. Insert the English SCT CD (or mount the ISO from the file server share). Right-click Setup.exe > Run as administrator. The wizard will now show the English splash.
6. During installation, accept the default install path (C:\Program Files\Siemens\SecurityConfigurationTool) and the default communication port (5001/TCP for the SCT daemon).
7. When prompted, select English (United States) in the language dropdown. Older V02.00.00.01 builds may skip this step; if absent, the installer has correctly inherited the system locale from step 2.
8. Reboot a second time. Launch the SCT and confirm the menu bar reads File / Edit / View / Target / Tools / Help rather than Datei / Bearbeiten / Ansicht / Zielgerät / Extras / Hilfe.

Network Configuration with the SCT

Once the English UI is in place, the standard commissioning flow is:

1. Create a new project. File > New Project, name it after the cell (e.g., Cell22_PaintLine_S602), and pick the SCALANCE S602 template.
2. Assign the management interface. Target > Interfaces > Internal (Trusted): set IP 192.168.10.1/24 if it is the default cell gateway. External (Untrusted): assign the uplink VLAN IP from your plant scheme.
3. Define firewall rules. Firewall > Packet Filter > User-defined. Use a default-deny posture: permit only the IP pairs required for HMI polling, drive telegrams, and OPC UA. The SCT will translate the rule set into a iptables-equivalent on the S602 at push time.
4. Configure the IPsec VPN (optional). VPN > IPsec Tunnels > New. Define a Phase 1 IKEv1 or IKEv2 policy, a Phase 2 ESP proposal (AES-256/SHA-256/DH14 recommended), and the remote peer. The S602 supports up to 32 simultaneous IPsec tunnels and 100 firewall rules in the base image.
5. Save and download. Target > Download > To Device. The SCT uses the dedicated RJ-45 management port (Port 1) or the front-panel serial port (115200 8N1) to push the configuration. The device reboots and applies the new policy.
6. Verify. Connect to the S602 WBM on the management IP and check Information > Security Log for the "Configuration changed by SCT" event.

Firewall, NAT, and Security Functions Reference

Commissioning Verification Checklist

• [ ] SCT UI is in English (menu bar reads File, not Datei).
• [ ] SCT project version string reads V02.00.00.01_01.00.00.01 or newer in Help > About.
• [ ] S602 firmware in WBM Information > Version matches the version the SCT expects to push.
• [ ] Management interface pingable from the SCT host on Port 1.
• [ ] Serial console available at 115200 8N1 as a backup path.
• [ ] Firewall ruleset reviewed cell-by-cell; no implicit "permit any any" left over from the template.
• [ ] Syslog server reachable and receiving test events.
• [ ] NTP synchronized; certificate lifetimes checked against plant CA.
• [ ] A backup of the SCT project file (.sctproj) is stored in version control alongside the PLC program.

Troubleshooting Matrix

Field-Proven Caveats

• Always reboot the S602 (System > Reboot in WBM) after a successful SCT download. Some firewall counters reset incorrectly if you skip the reboot.
• If you are migrating from an older SIMATIC NET CP with a German-only SCT legacy project, the importer is under File > Import > S6 Configuration (Legacy). The translated column headers (e.g., Schnittstelle → Interface) will appear only after the language switch is complete.
• The SCT stores the language of the last installer run in HKCU\Software\Siemens\SCT\UI. If you re-install with a German image for any reason, expect the registry to flip back to German and re-install to restore English.
• For audit traceability, capture the installer language by exporting %TEMP%\Siemens\SCT_Setup.log after every install. The log contains the LCID the installer selected.