Configuring Read-Only Project Access and Dynamic Documentation in SIMATIC PCS 7

Granting read-only access to large SIMATIC PCS 7 multiprojects—enabling process engineers and managers to inspect automation logic without the ability to modify charts, download to controllers, or alter online parameters—requires a multi-layered governance architecture. Native STEP 7 lacks a single global 'view-only' switch. Recommended implementation deploys an isolated Client-Server Engineering workstation or virtual machine (VM) with network plant bus access severed, project-level Access Protection managed via SIMATIC Logon, CPU protection levels set in HW Config to prohibit unauthorized downloads, and automated dynamic project documentation generated using the Plant and User Documentation Manager.

Governance Challenges with Read-Only Engineering Access

In large industrial automation facilities, plant managers, process technologists, and validation engineers often require detailed insight into Continuous Function Charts (CFC), Sequential Function Charts (SFC), and interlock matrices. However, providing standard SIMATIC Manager access presents significant operational risks: accidental chart editing, unintentional online forcing, or unauthorized controller downloads.

Because classic STEP 7 and CFC are designed as active development tools, enforcing strict read-only access requires combining software access permissions, controller hardware protection levels, and network isolation.

Multi-Layered Architecture for Read-Only Inspection

The following table details the four protective tiers required for a secure read-only inspection station:

Protective TierImplementation MethodOperational Enforcement1. Network IsolationVirtual Machine (VM) without Plant Bus (CP 1623/ISO) network adapter.Eliminates any physical communication path to online AS controllers; online monitoring and downloads are physically impossible.2. SIMATIC Logon Access ProtectionSIMATIC Manager Access Protection (File -> Access Protection -> Protect...).Enforces role-based project access; read-only viewers cannot modify blocks, delete charts, or save edits.3. CPU Hardware ProtectionHW Config CPU Properties -> Protection Level 2 or Level 3.Restricts write/download commands on the physical CPU via password protection, preventing uncommanded code execution.4. WinCC Web/View-Only ClientWinCC Web Navigator or dedicated OS Client with Viewer role.Provides real-time dynamic process visibility without permitting setpoint modification or manual valve actuation.

Automated Dynamic Documentation Generation

To provide continuous, 100% up-to-date documentation without distributing raw project files:

1. Plant and User Documentation Manager for PCS 7

Siemens provides the Plant and User Documentation Manager for SIMATIC PCS 7 (Entry ID 109748882), an automated tool that parses the multiproject structure and generates synchronized, searchable documentation:

Automated PDF/HTML Export: Compiles CFC charts, SFC state diagrams, hardware configurations, and symbol tables into navigable vector PDFs or intranet web portals.
Version Comparison: Automatically identifies differences between engineering versions, highlighting modified interlocks and parameter changes.
Scheduled Execution: Can be scripted to run overnight on the master Engineering Station, publishing the latest plant documentation to a corporate file share or SharePoint portal.

Verification

To verify that the read-only inspection environment is fully secured:

Log into the inspection station using the viewer account credentials.
Open SIMATIC Manager and load the mirrored multiproject.
Open a CFC chart: attempt to add a block or modify an interconnection. Verify that the editor blocks changes or prompts for authorization.
Attempt to initiate a controller download (PLC -> Download): confirm that the action is blocked by missing communication adapters or Access Protection.
Open the dynamic documentation portal: verify that all recent chart revisions and unit hierarchy designations match the engineering baseline.

Limitations and Operational Precautions

Operational boundaries when configuring read-only environments:

Project Synchronization Cadence: When using mirrored offline project copies or VMs, establish an automated synchronization procedure to refresh the project copy whenever authorized engineering changes are commissioned.
Password Custody: CPU protection passwords (Protection Level 2/3) must be strictly managed by lead automation engineers; lost passwords necessitate a complete memory reset (MRES).
License Requirements: Running SIMATIC Manager and CFC inside a viewer VM still consumes SIMATIC STEP 7 and CFC engineering software licenses.

Engineer FAQ

Can SIMATIC Manager natively open a project in read-only mode without special tools?

No. STEP 7 opens projects with full editing capability by default. Access Protection via SIMATIC Logon or physical network isolation must be configured to enforce read-only behavior.

What is the simplest way to prevent accidental downloads from an inspection PC?

Remove the Plant Bus network interface card (or disconnect the virtual switch in VMware). Without a physical connection to the controllers, downloads are impossible.

How does the Plant and User Documentation Manager keep documentation current?

It automatically extracts CFC, SFC, and HW Config data from the multiproject on a scheduled basis, generating updated HTML and PDF documentation sets.

Does CPU Protection Level 2 prevent operators from reading diagnostics?

No. Protection Level 2 permits read-only diagnostic buffer access, variable monitoring, and status display, but blocks all write, force, and download commands without the password.