Siemens Simatic S7-1500 - Page 124

Security
4.6 Configuring access protection for the CPU
S7-1500
124 Getting Started, 05/2014, A5E03981761-AC
Access levels of the CPU
Access levels
Access restrictions
Complete
access (no
protection)
The hardware configuration and the blocks can be read and changed by all users.
Read access With this access level, read-only access to the hardware configuration and the
blocks is possible without entering a password, which means you can download
hardware configuration and blocks to the programming device. HMI access and
access to diagnostics data is also possible.
Without entering the password, you cannot load any blocks or hardware
configuration into the CPU. Additionally, the following are
not
possible without the
password: Test functions which write, changing the operating mode (RUN/STOP),
and firmware update (online).
HMI access With this access level only HMI access and access to diagnostics data is possible
without entering the password.
Without entering the password, you can neither load blocks and hardware
configuration into the CPU, nor load blocks and hardware configuration from the
CPU into the programming device. Additionally, the following are
not
possible
without the password: Test functions which write, changing the operating mode
(RUN/STOP), and firmware update (online).
No access
(complete
protection)
When the CPU is completely protected, no read or write access to the hardware
configuration and the blocks is possible. HMI access is also not possible. The
server function for PUT/GET communication is disabled in this access level
(cannot be changed).
Authentication with the password will again provide you full access to the CPU.
Each access level allows unrestricted access to certain functions without entering a
password, e.g. identification using the "Accessible devices" function.
The CPU's default setting is "No restriction" and "No password protection". In order to protect
access to a CPU, you must edit the properties of the CPU and set up a password.
Communication between the CPUs (via the communication functions in the blocks) is not
restricted by the protection level of the CPU, unless PUT/GET communication is deactivated.
Entry of the right password allows access to all the functions that are allowed in the
corresponding level.
Note
Configuring an access level does not replace know-how protection
Configuring access levels
prevents unauthorized changes to the CPU, by restricting
download privileges. However, blocks on the SIMATIC memory card are not write
- or read-
protected. Use know
-how protection to protect the code of blocks on the SIMATIC memory
card.