Understanding Block Protection (KNOW_HOW_PROTECT) and Safe Recovery Practices in SIMATIC PCS 7

In SIMATIC PCS 7 and STEP 7, know-how protection (KNOW_HOW_PROTECT) is a compiler directive applied to Function Blocks (FBs) and Functions (FCs) to protect proprietary intellectual property and prevent unauthorized logic modification. Protected blocks compile without source code, variable symbols, or network comments in the offline block container. The only manufacturer-supported and safe method to edit a protected block is utilizing the original source file (.scl, .awl) preserved in the S7 Program Sources folder. Attempting unauthorized database hacks (such as hex-editing blocks.dbf or subproj.ini) permanently corrupts block signatures and invalidates CFC delta compilation.

Architecture of Know-How Protection in SIMATIC STEP 7 / PCS 7

In industrial automation projects running SIMATIC PCS 7, software integrity and intellectual property (IP) protection are safeguarded by Know-How Protection:
* The KNOW_HOW_PROTECT Directive:
When authoring custom Function Blocks (FBs), Functions (FCs), or Data Blocks (DBs) in S7-SCL or Statement List (STL), developers include the compiler directive KNOW_HOW_PROTECT in the source header.
* The Protection Mechanism:
During compilation, the compiler translates human-readable statements into executable MC7 binary machine code, packages the block into the offline Blocks container, and strips away:
* Graphical network layouts.
* Internal variable names and comments.
* Symbolic cross-reference pointers.
* The User Interface Behavior:
When an unauthorized user attempts to open a protected block in the LAD/FBD/STL editor, SIMATIC Manager displays a lock icon and presents a dialog stating:
The block is protected (know-how protection). It cannot be opened or edited.

How KNOW_HOW_PROTECT Encapsulates Machine Code

Understanding how protection operates clarifies why reverse-engineering is inherently flawed:

Stripped Source Code:
The compiled binary block stored in the S7 project database (subproj.ini and *.dbf) contains purely the raw opcode instructions executed by the CPU. The source text, English descriptions, and structural indentations are never stored inside the compiled block.
Integrity Checksums:
In SIMATIC PCS 7, every block possesses an internal cryptographic hash and interface timestamp. If the block is an Advanced Process Library (APL) block or fail-safe block (S7 F Systems), altering even a single bit of the binary header causes checksum mismatch errors during CFC compilation.

Why Unauthorized Database Hacks (Hex-Editing) Break PCS 7 Projects

Online engineering forums occasionally discuss illicit methods to bypass know-how protection by using Microsoft Access or hex editors to clear the protection flag inside the project database file (pcf.dbf or blocks.dbf):

The Illusion of Success:
Clearing the flag in a hex editor allows the standard STEP 7 LAD/STL editor to open the block without prompting for a password.
The Catastrophic Reality in PCS 7:
1. Loss of Symbols: Because the compiler stripped variable names during the original compilation, the decompiled block displays only raw register calls (L P##temp_0, T #stat_1).
2. Corrupted CFC Database Signatures: In PCS 7, Continuous Function Chart relies on strict block type signatures. When a hacked block is saved, the editor recalculates the interface checksum.
3. Delta Compile Failure: The next time an engineer compiles CFC changes, the compiler detects an illegal block signature mismatch, aborts compilation, and demands an Entire Program Compile and Download in CPU STOP mode, threatening plant downtime.
4. Breach of OEM Warranty: Tampering with OEM protected blocks voids manufacturer warranties and equipment safety certifications.

Legitimate Engineering Recovery Workflow: SCL / STL Source Management

The only professional, certified, and safe engineering methodology to maintain, modify, or recover protected blocks is rigorous source code management:

The S7 Program Sources Folder:
Every properly engineered PCS 7 project retains the original source code files (.scl, .awl, .db) inside the Sources folder of the S7 Program container.
Unprotecting via Source:
If a developer needs to modify a protected block created by a colleague:
1. Open the original source file in the S7-SCL or STL editor.
2. The source file contains the complete, unencrypted human-readable code with all comments and technological tags.
3. Simply comment out or delete the line:
// KNOW_HOW_PROTECT
4. Edit the logic, recompile, and update block types across the CFC charts.

Comparison Table: Legitimate Source Recovery vs Unauthorized Database Hacks

The following table contrasts compliant source management against unauthorized database tampering:

| Engineering Dimension | Legitimate Source Management (.scl / .awl) | Unauthorized Database Hack (Hex / Access) |
|---|---|---|---|
| Code Readability | Complete comments, symbolic tags, clean logic | Decompiled raw machine code; zero comments |
| CFC Database Integrity | 100% Intact; valid block signatures | Corrupted signatures; broken relational pointers |
| Delta Download in RUN | Fully supported after type update | Blocked; forces full CPU STOP download |
| Safety Certification | Preserved (audit trail documented) | Completely invalidated (violates IEC 61511) |
| Manufacturer Support | Fully supported by Siemens Technical Support | Rejected immediately by Siemens Technical Support |
| Risk of CPU Halt | Zero | High (internal opcode corruption triggers OB121) |

Step-by-Step Procedure to Protect and Unprotect Blocks Compliantly

Follow this verified engineering procedure to manage block protection compliantly:

To Protect a Custom Function Block (SCL):
1. Open the SCL source file in the S7-SCL editor.
2. In the block header section, insert the keyword KNOW_HOW_PROTECT:
```scl
FUNCTION_BLOCK "FB_Custom_Interlock"
TITLE = 'Custom Interlock Logic'
{ S7_m_c := 'true' }
VERSION : '1.0'
KNOW_HOW_PROTECT

VAR_INPUT
In1 : BOOL;
END_VAR
// Executable logic
`` 3. Compile the SCL file (File > Compile`). The resulting block in the Blocks folder is now know-how protected.

To Unprotect and Modify a Block:
1. Locate the master source file in the Sources folder.
2. Open the file in the S7-SCL editor.
3. Remove or comment out KNOW_HOW_PROTECT.
4. Make the necessary technological modifications.
5. Recompile the source file.
6. In SIMATIC Manager, run Options > Charts > Update Block Types to synchronize all CFC charts cleanly.

Verification

Verify block protection status and program integrity:
1. In SIMATIC Manager, navigate to the offline Blocks container; verify that protected blocks display a small green/yellow padlock icon.
2. Double-click the protected block; verify that SIMATIC Manager displays the security dialog preventing modification of compiled machine code.
3. Open the original source file in the Sources folder; verify that the complete human-readable source code is preserved and compiles with 0 Errors.
4. In CFC, execute a test compilation (Chart > Compile > Changes only); verify that compilation finishes with 0 Errors, confirming valid database signatures.

Limitations and Operational Precautions

Missing Source Files: If a project was delivered without source files in the Sources folder, the customer must formally request the uncompiled source code from the original system integrator or OEM. Never attempt reverse engineering on active production systems.
Block Version Control: When modifying unprotected source code, always increment the VERSION attribute (e.g., from 1.0 to 1.1) to ensure clear change traceability in plant documentation.
Safety Instrumented Blocks (S7 F Systems): Fail-safe blocks from the F-library use specialized cryptographic signatures (F_SIG). Any unauthorized modification to an F-block invalidates the safety collective signature and locks the safety program.
Commercial Accuracy: Standard block authoring and protection utilize standard S7-SCL and STEP 7 engineering packages (6ES7658-2CX58-0YB5). Validate software options with an authorized Siemens distributor quotation.

Engineer FAQ

Can Siemens Technical Support unlock a know-how protected block for me?

Siemens Technical Support will not unlock or bypass block protection without written legal authorization and cryptographic proof of ownership from the original author or intellectual property holder.

Is KNOW_HOW_PROTECT password-protected in STEP 7 V5.5 / PCS 7?

In STEP 7 V5.5 / PCS 7, KNOW_HOW_PROTECT is an attribute-based lock; it does not prompt for a password upon opening. To edit the block, the user must have access to the source file. TIA Portal introduced modern password-encrypted block protection.

Why should source files always be archived inside the multiproject?

Archiving sources in the project's Sources folder ensures that whoever retrieves the project backup has the master blueprint needed to maintain and troubleshoot custom algorithms over the plant's 20-year lifecycle.

Does know-how protection protect data inside instance Data Blocks (DBs)?

No. KNOW_HOW_PROTECT protects the executable code within FBs and FCs. Instance Data Blocks can still be opened in the DB editor to monitor runtime parameters and dynamic process values.