ENDIS_PW: Locking and unlocking passwords of the CPU access levels (S7-1200, S7-1500) - STEP 7

Description

With the instruction ENDIS_PW (enable / disable password) you lock the passwords for the individual access levels of your CPU or release them again.

By locking the passwords, existing legitimized connections can be terminated.

If you call ENDIS_PW with signal state "0" at the parameter REQ, it is displayed for each access level of your CPU whether the associated password is currently locked (associated output parameter has the value "0") or is released (associated output parameter has the value "1"). When calling ENDIS_PW with REQ=0 no passwords are locked or released.

If you call ENDIS_PW with signal state "1" at the parameter REQ, the effect of the instruction depends on the signal state at the input parameters F_PWD, FULL_PWD, R_PWD and HMI_PWD:

• If the signal state "0" is pending, the password of the associated access level is locked. (If it was already locked, it remains locked.)

• If the signal state "1" is pending, the password of the associated access level is released. (If it was already released, it remains released.)

Each password can be locked or released independently of the other passwords. In this way, you can lock all passwords with the exception of the fail-safe password. In this case you limit the access to your fail-safe CPU to a few users.

The output parameters F_PWD_ON, FULL_PWD_ON, R_PWD_ON and HMI_PWD_ON display the current status of password permissibility for the individual access levels after the instruction has finished processing, namely independently of the state of the REQ parameter when the instruction is called.

Input parameters which belong to access levels for which you have not configured a password, must have the signal state TRUE (if you do not observe this rule, RET_VAL has a value different to "0".). After processing ENDIS_PW the associated output parameter has the value TRUE.

The same applies for the parameter F_PWD. Since the fail-safe password is only configurable for an F-CPU, the associated input parameter F_PWD in a standard CPU must always be interconnected with the signal state TRUE.

If the ENDIS_PW instruction returns an error, its call has no effect, meaning that all passwords can be used after the ENDIS_PW call in the same way as before the ENDIS_PW call.

Additional access protection for S7-1500 CPUs with display

In addition to the access protection via the ENDIS_PW instruction, you can also lock or release the passwords at the display of the individual access levels (local lock of the password) at the S7-1500 CPUs with display. The password lock can be set separately on the display for each access level.

The CPU saves the last change made to the password status - independently of whether it was made through a call of ENDIS_PW or through an input on the display.

You determine the currently valid password status for the individual access levels by calling the ENDIS_PW instruction with REQ=0.

Users and operating system actions and their effects on the existing password lock

The table below shows the effects of different user and operating system actions on a previously set password lock.

Note Locking the HMI password through ENDIS_PW If you have locked the HMI password by calling ENDIS_PW, the HMI systems cannot access your CPU anymore. Operating and observing your CPU via HMI systems is thus not possible anymore.

Note Already legitimized connections Existing connections which were legitimized before calling ENDIS_PW can be terminated through the execution of ENDIS_PW. This depends on the current password status for the individual access levels and the values at the inputs x_PWD. Example: A connection that is authorized with read access is terminated by calling ENDIS_PW with REQ = 1 and R_PWD = 0.

Preventing unintentional lockout on an S7-1500 CPU

You have the following two possibilities to prevent an unintentional lockout at an S7-1500 CPU:

• By calling ENDIS_PW you can release accidentally locked passwords on the display of the CPU again. (This is obviously only possible for S7-1500-CPUs with display.)

• Set the CPU into the operating mode STOP with the mode selector switch or the "STOP" mode selector key. This ends the password lock. The subsequent transition to the RUN operating mode (using the mode selector switch or the "RUN" mode selector key) sets the password lock again.

Preventing unintentional lockout of an S7-1200 CPU

Existing password locks are removed during the transition POWER OFF - POWER ON at an S7-1200 CPU. This means that it is possible and advisable to prevent unintentional lockout with the help of specific program sequences within your program.

To do so, program a time control either by means of a cyclic interrupt OB or a timer in the OB 1. This gives you the option of calling the ENDIS_PW instruction in the respective OB (for example OB 1 or OB 35) relatively quickly after a transition from POWER OFF to POWER ON. Call the instruction in the startup OB (OB 100) in order to keep as short as possible the time window in which the application is not active and thus ensure that no restrictions exist in the password legitimation. This procedure offers you the greatest possible protection against unauthorized access.

If there has been an accidental lockout, you can skip the call in the startup OB (by querying an input parameter, for example) and you have the set time (for example, 10 seconds up to 1 minute) to establish a connection to the CPU before the lock becomes active once again.

If there is no timer in your program code and a lockout has occurred, insert an empty transfer card or an empty program card into the CPU. The empty transfer card or program card deletes the internal load memory of the CPU. You must then download the user program once again from STEP 7 to the CPU.

Procedure for lost passwords with an S7-1200 CPU

If you have lost the password for a password-protected S7-1200 CPU, delete the password-protected program with an empty transfer card or program card. The empty transfer card or program card deletes the internal load memory of the CPU. You can then load a new user program from STEP 7 Basic in the CPU.

Warning

Inserting an empty transfer card When you insert a transfer card in a CPU during runtime, the CPU goes to STOP mode. If operating states are unstable, controllers may fail and thus cause the uncontrolled operation of the controlled devices. This leads to an unforeseen operation of the automation system which can cause deadly or serious injuries and/or damage to property. Once you have pulled the transfer card, the content of the transfer card is available in the internal load memory. Make sure that the card does not include a program at this point.

Warning

Inserting an empty program card When you insert a program card in a CPU during runtime, the CPU goes to STOP mode. If operating states are unstable, controllers may fail and thus cause the uncontrolled operation of the controlled devices. This leads to an unforeseen operation of the automation system which can cause deadly or serious injuries and/or damage to property. Make sure that the program card is empty. The internal load memory is copied to the empty program card. Once you have pulled the previously empty program card, the internal load memory is empty.

You must remove the transfer card or program card before you put the CPU into RUN mode.

Parameters

You can find additional information on valid data types under "See also".

Parameter RET_VAL

The following table shows the meaning of the values of the RET_VAL parameter: