Implementing Role-Based Engineering Access and CFC Download Restrictions in SIMATIC Logon

In SIMATIC PCS 7, restricting engineering privileges—such as allowing maintenance technicians to monitor CFC charts online while preventing them from compiling or downloading to automation controllers—cannot be achieved by creating arbitrary custom Function Rights in SIMATIC Logon. Instead, engineers must activate 'SIMATIC Logon Access Protection' (Project Protection) in SIMATIC Manager. Once enabled, SIMATIC Logon integrates with standard STEP 7 Function Rights ('Download to Automation System', 'Compile Program', 'Test Mode / Monitor'), allowing administrators to map Windows user groups to specific engineering operations so that compilation and download buttons are disabled for unauthorized personnel.

Engineering Access Control Architecture in SIMATIC PCS 7

In regulated industrial environments (such as pharmaceuticals, chemical processing, and energy), plant management must restrict engineering software access to prevent unauthorized program changes, unvalidated downloads, or accidental controller halts.

SIMATIC PCS 7 provides access control across two distinct domains:
1. Runtime Access Control: Managed within WinCC User Administrator and SIMATIC Logon. Governs operator actions on faceplates, setpoint changes, and alarm acknowledgments.
2. Engineering Access Control: Managed through SIMATIC Logon Access Protection (Project Protection) within SIMATIC Manager and the Engineering System (ES). Governs who can open projects, edit CFC/SFC charts, compile programs, enter online test mode, or download code to S7-400 controllers.

Without Project Protection enabled, any user with Windows login access to an Engineering Station can open SIMATIC Manager, modify logic, and download to active controllers.

Role Management vs Project Access Protection

A common misconception among maintenance managers is attempting to define new custom 'Function Rights' directly inside the standalone SIMATIC Logon Role Management console.

The SIMATIC Logon service acts as a centralized authentication provider linked to Microsoft Windows Active Directory (or local Windows user groups). It does not create application-level permissions independently. The engineering permissions—specifically the ability to compile, download, or monitor—are strictly defined by the STEP 7 Engineering System Function Rights Catalog.

To enforce role-based segregation where junior technicians can monitor CFC charts in Test Mode while download and compilation buttons are disabled, an administrator must activate Access Protection on the Multiproject and bind the pre-defined STEP 7 Function Rights to Windows user groups.

Configuring Role-Based CFC Download Restrictions

To configure role-based engineering restrictions in SIMATIC PCS 7:

Step 1: Enable Access Protection on the Project

Launch SIMATIC Manager on the Engineering Station.
Open the Multiproject.
Select the Multiproject root folder, right-click, and select Object Properties.
In the Properties dialog, select the Protection tab.
Click Activate Access Protection....
When prompted, authenticate with an authorized Windows administrator account. The project database is encrypted and locked against unauthenticated access.

Step 2: Open SIMATIC Logon Role Management

In SIMATIC Manager, select menu Options > SIMATIC Logon Service > Access Protection > Define Roles....
The SIMATIC Logon Role Management window opens, displaying the available STEP 7 Function Rights.
Create two distinct application roles:
- Lead Engineers: Granted full engineering rights.
- Maintenance Technicians: Granted read-only and monitoring rights.

Step 3: Assign Function Rights to Roles

Select the Lead Engineers role and enable all Function Rights:
- Modify Project Data
- Compile Program
- Download to Automation System
- Test Mode / Online Monitoring
Select the Maintenance Technicians role and enable ONLY:
- Test Mode / Online Monitoring
- Open Project / Display Only
- Ensure Download to Automation System and Compile Program are unchecked.

Step 4: Map Windows User Groups to Roles

In the right pane of SIMATIC Logon Role Management, browse your Windows Domain or local computer accounts.
Assign the Windows group DOM_Lead_Engineers to the Lead Engineers role.
Assign the Windows group DOM_Maintenance_Techs to the Maintenance Technicians role.
Save and close the Role Management dialog.

Standard STEP 7 Engineering Function Rights Matrix

The following matrix details the standard engineering rights governing CFC, SFC, and HW Config:

STEP 7 Function RightPermitted Actions When GrantedImpact When DeniedDownload to Automation SystemFull and delta download to AS controller'Download' buttons in CFC/SFC and SIMATIC Manager are disabled (grayed out)Compile ProgramCompiles CFC/SFC charts as program; generates module drivers'Compile Charts as Program' menu option is grayed outModify Project DataAdding/deleting blocks, changing interconnections, editing parametersCFC charts open in read-only mode; parameter fields lockedTest Mode / Online MonitoringSwitching CFC/SFC to Test Mode (monitoring live values)User cannot connect online to monitor block valuesHardware ConfigurationModifying HW Config, parameterizing modulesHW Config opens in read-only display modeChange Change LogEntering comments in the SIMATIC Version Cross Manager / Change LogSystem forces mandatory comment entry upon changes

Verification

To confirm that role-based engineering access is properly enforced:
1. Log into the Engineering Station using a user account belonging to DOM_Maintenance_Techs.
2. Launch SIMATIC Manager and open the Multiproject: The system authenticates the user via SIMATIC Logon without error.
3. Open a CFC chart: The chart opens normally.
4. Click the Test Mode button (glasses icon): The chart successfully connects online and displays live process values in yellow fields.
5. Inspect the Compile and Download icons on the CFC toolbar: Both icons must be completely grayed out and disabled.
6. Attempt to delete a block or modify an interconnection: The editor prevents changes and displays an access denial notification.
7. Log out and log in with an account belonging to DOM_Lead_Engineers: Verify that Compile and Download icons become fully enabled.

Limitations and Operational Precautions

Observe the following precautions when implementing project access protection:
- Emergency Project Unlocking: Always document and securely archive the administrative Windows credentials used to activate Access Protection. If the administrator password is lost or domain controllers become unreachable, unlocking the project requires formal support from Siemens Customer Support.
- CPU Password Protection vs SIMATIC Logon: SIMATIC Logon controls access at the Engineering Station software level. If a technician connects a separate, unmanaged programming laptop directly to the CPU's PROFINET/MPI port, SIMATIC Logon cannot prevent downloads. To secure the controller hardware itself, configure CPU Access Protection (Password Protection) in HW Config.
- SIMATIC Logon Availability: If the Engineering Station loses network connectivity to the central SIMATIC Logon server or Active Directory domain controller, cached credentials allow local login if configured in SIMATIC Logon settings.

Engineer FAQ

Can I create completely custom Function Rights with unique names in SIMATIC Logon?

No. Function Rights are hardcoded into the client application software (e.g., STEP 7, CFC, WinCC). SIMATIC Logon allows you to create custom Roles and map user groups to existing, supported Function Rights.

Does SIMATIC Logon Project Protection require an additional license?

Yes. SIMATIC Logon requires a base software license on the Engineering Station. In PCS 7, SIMATIC Logon is typically included in standard engineering software bundles, but verify license keys in Automation License Manager.

How does this differ from CPU Password Protection in HW Config?

CPU Password Protection (configured in HW Config under Protection Level 1, 2, or 3) requires entering a password inside the CPU hardware before downloading. SIMATIC Logon Access Protection controls user permissions within the engineering software interface without requiring operators to know a shared hardware password.