Siemens S7-300 Know-How Protection Recovering Protected FC Blocks

Overview: Know-How Protection in SIMATIC S7-300 / S7-400

Siemens know-how protection is a built-in block-level access control feature in STEP 7 V5.x and TIA Portal. It allows a programmer to compile a Function (FC), Function Block (FB), Organization Block (OB), or Data Block (DB) in a form that is callable from the user program but whose internal logic, variable declarations, and comments are not readable. The protection mechanism is implemented at compile time and is stored as a marker inside the compiled block's S7 file, paired with a SHA-1 password hash that the engineering software validates before revealing content.

On the SIMATIC S7-300 platform, the S7-313C (6ES7313-5BF03-0AB0), S7-314C, S7-315-2 DP, S7-317, and S7-319 CPUs all support know-how protection identically. The same protection grammar applies to the S7-400, ET 200S, and ET 200SP CPUs. The user's original question concerned a protected FC 1 on an S7-313C — the procedures below apply to that CPU and its family.

How Know-How Protection Works Internally

When you compile a block in STEP 7 (or TIA Portal) with the know-how protection checkbox enabled, two things happen:

1. A KNOW_HOW_PROTECT directive is written into the block header of the generated .awl / STL source representation, marking the block as protected.
2. The compiled S7-Program/Files version of the block (FC1 as a binary SFC-type container) has its symbol/information area sealed. The CPU executes the machine code identically to an unprotected FC; only the offline editor in STEP 7 enforces the read lock.

The protection is enforced by the engineering software (STEP 7 / TIA Portal), not by the CPU firmware. The PLC itself does not contain the protection logic — once a protected FC is downloaded, the CPU runs the compiled STL/MC7 code without any access check. This is why protected blocks can still be called, monitored online (limited), and overwritten by another compiled block, even though the editor refuses to display the contents.

STEP 7 V5.x: Legitimate Access Procedure

The standard, Siemens-supported method to view the contents of a protected FC on a S7-313C is to enter the password in the editor. The procedure is identical in STEP 7 V5.5, V5.6, and V5.7:

1. Open SIMATIC Manager and load the project containing the S7-313C station.
2. Expand S7-Program > Blocks in the project tree.
3. Double-click the protected FC 1. STEP 7 displays the Access Protection dialog.
4. Enter the case-sensitive password in the Password field. The password is up to 24 characters; any ASCII character is allowed.
5. Click OK. The block opens in LAD/FBD/STL editor with the KNOW_HOW_PROTECT header stripped from the working copy.
6. Optionally: File > Save As exports a new non-protected STL source by unchecking the Know-how protection option in the block properties dialog.

STEP 7 V5.x: Source Code Folder Approach

The Source folder in STEP 7 V5.x is a parallel, text-based representation of the offline project. It contains .awl (Anweisungsliste / STL) files for each block. If the source files were generated before know-how protection was applied, they are unprotected and can be opened with any text editor (Notepad++, vim, etc.) or recompiled via Options > Compile.

However, if the source was exported after protection was activated, STEP 7 writes only a stub to the .awl file:

FUNCTION FC 1 : VOID
TITLE =
VERSION : 0.1
  KNOW_HOW_PROTECT
VAR_INPUT
  // (no input parameters declared)
END_VAR
VAR_OUTPUT
  // (no output parameters declared)
END_VAR
VAR_TEMP
  // (no temporary variables declared)
END_VAR
BEGIN
  // (block body is protected)
END_FUNCTION

This is exactly the state the user observed — an empty Source container with a KNOW_HOW_PROTECT directive. Removing the directive line and recompiling does not regenerate the logic; it only produces an empty FC because the body is gone from the source. The compiled block on the PLC, however, still contains the full machine code. To extract the body, you must open the compiled block and enter the password.

STEP 7 V5.x: Generating STL Source from the Compiled Block

The legitimate path to recover source from a compiled (online or offline) protected block is:

1. Open the project offline in SIMATIC Manager.
2. Right-click the protected FC 1 in the Blocks container and select Generate Source (or File > Generate Source from the menu).
3. Choose an empty source file or create a new one (e.g., FC_Sources.awl).
4. STEP 7 prompts for the know-how password. Enter it.
5. The unprotected STL source is written to the Sources folder and can be opened in LAD/FBD/STL editor.

TIA Portal Procedure (V13 SP1 to V18 / V19)

For S7-300 stations that have been migrated to a TIA Portal project, the procedure is documented in the official Siemens TIA Portal Help under Protection of know-how. The portal implementation matches the ET 200SP documentation referenced by Siemens.

Per the official TIA Portal documentation (TIA Portal: Know-How Protection):

1. Open the TIA Portal project and navigate to the Program blocks folder.
2. Double-click the protected block (e.g., FC1). The editor opens the Access protection dialog.
3. Enter the password in the Password field and click OK. The block contents are decrypted and displayed.
4. To remove protection permanently, right-click the block → Properties → Protection tab → uncheck Know-how protection → enter the password → confirm with OK.
5. Compile the project (Compile > Software (rebuild all)) and download to the S7-313C.

Removing the KNOW_HOW_PROTECT Marker After Password Recovery

After entering the password, the block opens with all logic visible. To permanently remove the protection on the offline block:

1. STEP 7 V5.x: Right-click the block → Object Properties → Protection tab → clear the Know-how protection checkbox → confirm.
2. TIA Portal: Project tree → right-click block → Properties → Protection → clear the Enable know-how protection checkbox → enter password → OK.
3. Recompile the project and download the new block to the CPU. The PLC will replace the protected compiled block with the unprotected one. The old protection metadata is purged at this point.

Source Code Folder State in TIA Portal

TIA Portal's Program blocks > Sources folder uses .scl, .db, and .udt source files. When a block is compiled with know-how protection, TIA Portal does not export the body to the source file — only the interface section and a {S7_Optimized_Access := 'TRUE'} attribute block. The KNOW_HOW_PROTECT keyword from STEP 7 V5.x is not written; instead, the editor uses a separate binary metadata field in the project file (.apXX).

Attempting to open a protected .scl source in an external editor (VS Code, Notepad++) will show only the interface, since the body is stored separately in the compiled representation within the TIA Portal project database. The only supported way to recover the source is the password dialog in the editor.

Password Recovery When the Password Is Lost

If the original password is lost, Siemens does not provide a backdoor or recovery tool for know-how-protected blocks. This is by design — the protection exists precisely to prevent unauthorized access to proprietary logic. The supported paths are:

• Check the project archive, version control system (SVN, TIA Project Server), or backup tapes for an older non-protected source.
• Contact the original programmer or system integrator for the password.
• Reconstruct the logic from functional specifications, I/O lists, and online monitoring data.

Online monitoring (Monitor & Force in STEP 7, Online & diagnostics → Monitor in TIA Portal) reveals the running variable states but does not expose the program code. For an FC, monitoring shows only the I/O tag values during the call; the network-by-network STL is not accessible.

Why the Source Folder Appears Empty

The user's screenshot showed an empty Source folder. This is a common situation when:

1. The original programmer never generated STL source files; only the compiled blocks were saved.
2. The source was generated after know-how protection was applied, leaving the KNOW_HOW_PROTECT stub.
3. The project was opened in a different STEP 7 version that did not import the source files (e.g., a STEP 7 V5.4 project opened in V5.5 with a partial migration).
4. The MMC card was deleted, and the offline project contains only the compiled blocks from the last online download.

The fix is not to manually edit the KNOW_HOW_PROTECT line in the source — that approach leaves the FC with an empty body. The fix is to use Generate Source on the compiled block and enter the password when prompted.

Best Practices for Protecting Your Own Blocks

Troubleshooting Matrix

CPU-Specific Notes: SIMATIC S7-313C

The S7-313C referenced in the original question is a compact CPU with integrated digital and analog I/O. The two most common part numbers in service today are:

• 6ES7313-5BF03-0AB0 — CPU 313C, 32 DI / 32 DO onboard, MPI, firmware V3.3 (replacement: 6ES7313-5BG04-0AB0, firmware V3.3).
• 6ES7313-5BG04-0AB0 — Successor with extended diagnostics.

Both CPUs run the same STEP 7 V5.x programming environment. The firmware revision is irrelevant to know-how protection enforcement — the protection is entirely a STEP 7 / TIA Portal feature. However, the firmware revision determines which TIA Portal versions can download to the CPU. TIA Portal V18 SP1 and later support S7-313C with firmware V3.3 via the legacy S7-300/400 target support package. Earlier TIA Portal versions (V13 SP1 through V17) also support it, but V18 and later require the legacy CPU support add-on.

Verification Steps After Recovery

After successfully entering the password and viewing the FC body, perform these checks to confirm full project integrity:

1. Compile the project (Project → Compile All). The build should complete with zero errors and zero warnings.
2. Compare the online and offline block versions (Online → Compare). Both sides should match exactly.
3. Generate STL source from the unprotected block to confirm the source export works. Save the source under a versioned name (e.g., FC1_v2.1.awl).
4. Re-archive the project to capture the new source files in the backup.
5. If the FC will be reused in a new S7-300 station, copy the block via Options → Manage Multilingual Texts or via the project library to preserve the protection settings if desired.

FAQ