Managing Access Protection, Role Management, and the Padlock Icon in SIMATIC PCS 7 Multiprojects

In SIMATIC PCS 7 and SIMATIC Manager, the appearance of a small padlock key symbol in the bottom-right corner of a Multiproject or individual user project icon indicates that SIMATIC Access Protection has been activated and Role Management (via SIMATIC Logon) is configured. This feature restricts project engineering actions (such as HW Config editing, CFC modifications, or CPU downloads) to authorized Windows domain or local users based on assigned role privileges, while maintaining an immutable Change Log for regulatory compliance (FDA 21 CFR Part 11). To configure or permanently remove Access Protection and the padlock symbol, an authorized administrator must select the subproject, right-click, navigate to 'Access Protection', and choose 'Remove Access Protection and Change Log'.

The Access Protection and Change Log Security Concept

In regulated manufacturing industries (such as pharmaceuticals, biotechnology, and nuclear processing), regulatory standards like FDA 21 CFR Part 11 and EU GMP Annex 11 mandate strict electronic signature verification and audit trailing for all automation software modifications.

To enforce these standards, SIMATIC PCS 7 incorporates SIMATIC Access Protection:
- Integrates directly with SIMATIC Logon, binding engineering actions to authenticated Windows operating system user accounts.
- Enforces Role Management: Restricts sensitive actions (e.g., downloading hardware configurations, forcing I/O, modifying safety logic) strictly to qualified engineering roles.
- Activates the Change Log: Automatically records every modification (who made the change, when, what was altered, and an optional operator justification comment) into a tamper-proof database.

Visual Indicators: Padlock Symbol States in SIMATIC Manager

The padlock overlay icon in the SIMATIC Manager project tree communicates distinct security states:
- Blue / Yellow Padlock with Open Shackle: Access Protection has been configured or initialized on the project, but the project is currently unlocked for the active authenticated session.
- Red Padlock with Closed Shackle: Access Protection is fully enforced. The project is locked against unauthorized modifications; any attempt to open HW Config or CFC charts triggers a SIMATIC Logon authentication prompt.
- No Padlock: Standard unprotected project; any user with operating system file access can modify and download code.

Configuring Roles and Permissions via SIMATIC Logon

Role Management allows granular assignment of engineering rights:
1. In SIMATIC Manager, right-click the project root and select Access Protection > Manage....
2. Define custom engineering roles (e.g., Lead Automation Engineer, Commissioning Technician, Read-Only Auditor).
3. Map Windows user groups or Active Directory domain groups to these roles.
4. Assign functional permissions:
- Download to PLC
- Modify Hardware Configuration
- Modify Continuous Function Charts (CFC)
- Modify Sequential Function Charts (SFC)
- Acknowledge Change Log

Step-by-Step Procedure: Removing Access Protection and the Padlock Symbol

If Access Protection was enabled inadvertently or is no longer required during bench testing:

Step 1: Authenticate as Project Administrator

In SIMATIC Manager, select the protected project.
If prompted, log in with an account belonging to the Project Administrator role.

Step 2: Enable Modification Access (If Locked)

Right-click the subproject and select Access Protection > Enable....
Authenticate the action if prompted. The padlock symbol updates.

Step 3: Remove Access Protection and Change Log

Right-click the subproject and select Access Protection > Remove Access Protection and Change Log....
A confirmation prompt appears warning that the Change Log history will be detached.
Confirm with Yes.
The padlock key symbol disappears from the project icon immediately.
Repeat this procedure for any other subprojects within the Multiproject container.

Comparative Security Matrix: Protected vs Unprotected Projects

The table below compares protected and unprotected engineering projects in PCS 7:

DimensionStandard Unprotected ProjectAccess-Protected Project (SIMATIC Logon)User AuthenticationNone (Windows file access only)Mandatory Windows / Domain loginAudit Trail (Change Log)InactiveTamper-proof Change Log activeDownload ControlAnyone on network can downloadStrictly authorized engineering rolesRegulatory ComplianceNon-compliant with 21 CFR Part 11Fully Compliant (Validated)Visual IndicatorStandard folder iconPadlock key symbol overlay

Verification

To confirm the security status of the project:
1. Visual Symbol Check: In SIMATIC Manager, inspect the project and subproject icons; confirm that the padlock overlay symbol has been completely removed.
2. Access Protection Menu State: Right-click the subproject and expand Access Protection; verify that the menu displays the initial option 'Activate Access Protection...', indicating that protection is currently dormant.
3. Unrestricted Editing Check: Open a CFC chart and modify a parameter; confirm that SIMATIC Manager saves the change without prompting for SIMATIC Logon credentials or Change Log comments.

Limitations and Operational Precautions

Engineering teams must observe the following precautions:
- Removing Access Protection deletes the active Change Log association; never remove Access Protection on a validated production facility without quality assurance authorization.
- Always ensure at least two independent administrative accounts are assigned to the Project Administrator role prior to activating Access Protection to prevent project lockout.
- Always validate final license quantities and MLFBs against the applicable Siemens catalog and authorized distributor quotation when procuring SIMATIC Logon packages.

Engineer FAQ

What license is required to use SIMATIC Access Protection?

Access Protection uses SIMATIC Logon, which requires a valid SIMATIC Logon Basic License (6ES7658-7...) installed on the Engineering Station via Automation License Manager.

What should I do if the administrator password for a protected project is lost?

If the domain credentials or local administrator account is permanently lost, recovering access requires contacting Siemens Technical Support with formal proof of project ownership to unlock the database.

Does Access Protection prevent someone from copying the project folder in Windows?

Access Protection protects the database within SIMATIC Manager. To prevent unauthorized copying or deletion of project files in Windows Explorer, enforce standard Windows NTFS file system permissions.