A Siemens PLC can be visible in TIA Portal, respond to ping and show normal Ethernet LINK indications—yet still refuse monitoring, uploading, downloading or changing from STOP to RUN.

Typical messages include:

• access denied;
• insufficient access rights;
• read access is not permitted;
• write access is not permitted;
• password required;
• user does not have the required function right;
• confidential PLC configuration password does not match;
• CPU configuration cannot be loaded;
• protected CPU cannot be accessed.

The main causes are:

• read access is restricted;
• write access is restricted;
• confidential configuration password in the project does not match the CPU;
• replacement CPU contains old protection information;
• logged-in user lacks the required access level or role;
• additional local protection is active on the CPU display;
• the wrong type of Siemens password is being entered.

A particularly important Siemens behaviour is that a mismatch between the password protecting confidential PLC configuration data in the project and the password stored in the CPU can prevent the CPU from entering RUN mode. The correct password must be set—or the existing password must be deleted using an authorised procedure—before the CPU can use the protected configuration.

Quick Troubleshooting Table

First Identify Which Protection Is Blocking Access

Siemens projects can contain several independent protection mechanisms.

Entering the correct password for one mechanism does not unlock the others.

CPU Access Protection

CPU access protection controls which engineering actions are permitted.

Depending on the CPU generation and configuration, permissions may include:

• full access;
• read access;
• HMI access;
• no access;
• full access including fail-safe functions.

Read access may permit viewing or uploading information while preventing changes. Complete protection can block both read and write access unless the user authenticates with sufficient rights.

Local Users and Roles

Newer S7-1500 firmware can use local user management instead of relying only on fixed access-level passwords.

A user receives one or more roles, and those roles contain function rights for individual CPUs.

Examples include:

• full access;
• read access;
• HMI access;
• full access including fail-safe.

For applicable S7-1500 systems, Siemens states that at least one user must have the Full access function right before a CPU configuration can be compiled and downloaded. A user without the necessary function rights has no corresponding access to the CPU.

Confidential PLC Configuration Password

This password protects sensitive configuration data stored in or downloaded to the CPU.

It is different from the normal access-level password.

The CPU needs the same confidential-configuration password that was used to protect the downloaded project data. If the project and CPU passwords differ, the CPU cannot interpret the protected configuration correctly and may remain in STOP.

Project Protection

A TIA Portal project can itself be protected against unauthorised opening or editing.

Project protection affects access to the engineering project on the computer.

It does not automatically provide:

• access to the online CPU;
• the CPU’s confidential configuration password;
• safety-program authorisation;
• know-how-protected block passwords.

Know-How Protection

Know-how protection protects individual blocks against being opened or modified without the block password.

A user may have full CPU access and still be unable to open a know-how-protected FB or FC.

Conversely, knowing a block password does not grant permission to download to a protected CPU.

Safety-Program Protection

An F-CPU can require additional safety permissions and credentials.

A standard full-access account may not automatically provide:

• full fail-safe access;
• safety-program modification rights;
• authority to download a changed F-program.

Keep these mechanisms separate while diagnosing the problem.

1. Read Access Is Restricted

Read protection prevents unauthorised users from retrieving or inspecting parts of the CPU configuration and program.

Possible symptoms include:

• blocks cannot be uploaded;
• online/offline comparison is unavailable;
• program status cannot be displayed;
• PLC tags cannot be monitored;
• hardware configuration cannot be read;
• TIA Portal requests authentication when going online.

Read Access vs HMI Access

HMI access is normally more limited than engineering read access.

An HMI may continue reading and writing its configured process tags while an engineering user cannot:

• upload blocks;
• compare the project;
• inspect program logic;
• read hardware configuration.

This is intentional.

An operating panel does not need the same permissions as an engineer maintaining the program.

Check the Active User

In TIA Portal, verify:

• which user is logged in;
• which roles are assigned;
• whether the role has read access to this specific CPU;
• whether the user account is enabled;
• whether anonymous access is disabled;
• whether credentials belong to another project or CPU.

On systems using local users and roles, function rights are assigned separately for individual CPUs. A role that gives access to one PLC does not necessarily provide access to every PLC in the project.

Anonymous User Behaviour

On applicable S7-1500 configurations, the anonymous user is disabled by default. A person who does not log in may therefore receive no access unless anonymous access has been deliberately enabled and assigned suitable rights.

Do not enable broad anonymous access merely to avoid logging in.

Create or use an authorised account with only the required permissions.

2. Write Access Is Restricted

Write protection allows some diagnostic or monitoring functions but prevents changes to the PLC.

Possible symptoms include:

• online program can be viewed but not modified;
• download button is unavailable;
• loading is rejected after authentication;
• hardware changes cannot be transferred;
• operating mode cannot be changed;
• firmware update is blocked;
• data-block values cannot be written.

Full Access Is Usually Required for Downloads

Downloading changes generally requires a higher permission than reading the CPU.

For applicable user-role systems, the user may need:

• Full access;
• Full access including fail-safe for an F-CPU;
• specific additional security or configuration rights.

Siemens documents the hierarchy so that full access includes read and HMI rights, while read access includes HMI rights but not full modification permissions.

Hardware Changes May Need More Than Program Access

A user who can download an ordinary software block may still lack permission to modify:

• hardware configuration;
• user administration;
• certificates;
• CPU protection settings;
• confidential configuration protection;
• safety configuration.

Read the complete access-denied message.

Do not assume every rejected download is caused by the same access level.

Additional Local Display Protection

Some S7-1500 CPUs allow access to be restricted locally through the CPU display.

The display can apply an additional lock independently of the configured password protection—for example, permitting local read access while preventing write access.

Check the CPU display if:

• the correct engineering account works on another CPU;
• the offline project shows suitable permissions;
• write operations remain blocked only on one physical PLC.

Do not change local access protection without operational authorisation.

3. Confidential Configuration Password Does Not Match

This problem is more serious than entering the wrong password into a login dialog.

The password protecting confidential PLC configuration data is used to protect and decrypt configuration information downloaded to the CPU.

If the CPU stores one password but the project configuration was protected using another password, the CPU cannot use the loaded data correctly.

Siemens states directly that when the password in the CPU does not match the password in the project, the CPU cannot go into RUN mode.

Typical Symptoms

• CPU remains in STOP.
• RUN command is rejected.
• Diagnostic buffer reports a confidential configuration password mismatch.
• Download appears to complete, but startup fails.
• CPU enters STARTUP and returns to STOP.
• Project worked on the original CPU but not on the replacement.
• Restored backup cannot be activated.
• CPU reports that protected configuration data cannot be evaluated.

How the Mismatch Happens

Common scenarios include:

• wrong project downloaded;
• project password changed but CPU password was not;
• configuration restored from another CPU;
• replacement CPU was previously used;
• used spare still contains another machine’s password;
• factory reset did not delete the confidential password;
• password was deleted from the project but remains in the CPU;
• CPU has no project password while the loaded configuration requires one.

The CPU diagnostic buffer detects a mismatch between the stored password and loaded protected configuration and can provide information about the likely cause and remedy.

Corrective Options

The exact procedure depends on whether:

• the correct current password is known;
• the CPU contains a valid production configuration;
• write access is available;
• the machine can be placed in STOP;
• the CPU or memory card can be reset safely.

Authorised options may include:

1. Set the CPU to use the same confidential configuration password as the project.
2. Delete the existing confidential password from the CPU.
3. Correct the project so that it uses the password already expected by the CPU.
4. Completely prepare a replacement CPU and reload the approved project.

Deleting or changing this password on a configured CPU generally requires write access and STOP mode.

4. Replacement CPU Contains Old Protection Data

A replacement CPU may not be truly empty.

This often happens when the spare:

• was previously commissioned;
• came from another machine;
• was returned from testing;
• was reset using the wrong method;
• still contains an old SIMATIC memory card;
• retains a confidential configuration password.

The new project may then conflict with protection information already stored in the replacement CPU.

Recommended Replacement State

Siemens advises that a replacement CPU configured through TIA Portal should not already contain another configuration or confidential-configuration password.

If the replacement has previously been configured, Siemens recommends resetting it with options that:

• delete the password protecting confidential PLC configuration data;
• format the memory card.

This prepares the CPU to accept the intended project without inheriting another machine’s security state.

Replacement Scenario

Suppose the production project uses:

Confidential configuration password: Machine-A-Password

The spare CPU was previously used on another machine with:

Confidential configuration password: Test-Bench-Password

The replacement is installed and the production memory card or project is loaded.

The CPU now contains:

• protected configuration encrypted for Machine A;
• a stored password belonging to the test bench.

The CPU cannot evaluate the configuration and remains in STOP.

Used Spare Checklist

Before installing a used replacement CPU:

1. Record its complete order number and firmware.
2. Remove or inspect any existing memory card.
3. Connect using an authorised engineering computer.
4. Read the diagnostic buffer.
5. Determine whether a confidential password is stored.
6. Back up anything that must be retained.
7. Reset the CPU using the approved password-deletion and memory-card options.
8. Load the correct project.
9. Set the required confidential password.
10. Confirm the CPU enters RUN.

Do not treat a used CPU as a blank replacement simply because its RUN LED is off.

5. Factory Reset Did Not Remove the Password

Not all factory-reset methods have the same effect.

This is a common trap.

For applicable S7-1500 systems, Siemens documents that a factory reset performed using the physical mode switch or selector can delete the CPU IP address while retaining the password protecting confidential PLC configuration data.

Therefore, this sequence may occur:

1. Technician performs a physical factory reset.
2. PLC loses its IP address and program.
3. Technician assumes all protection is removed.
4. New project is loaded.
5. CPU still contains the old confidential password.
6. Password mismatch prevents startup.

Reset Through TIA Portal

When resetting through Online & Diagnostics, explicitly select the option to:

Delete password for protection of confidential PLC configuration data

If that option is not selected, the password may remain stored. Siemens also recommends formatting the memory card in relevant replacement or repeated-startup scenarios.

Reset Through the CPU Display

On supported S7-1500 devices, a factory reset performed through the CPU display can delete the confidential configuration password, while the mode-selector reset behaves differently.

Always follow the procedure for the exact CPU family and firmware.

Do not assume that “factory reset” has one universal meaning.

6. User Does Not Have the Required Access Level

The right password can still fail to authorise an action if the corresponding user or role does not have the necessary function right.

Examples include:

• user has HMI access but needs read access;
• user has read access but needs full access;
• standard administrator is working on an F-CPU requiring fail-safe access;
• role provides rights to PLC1 but not PLC2;
• anonymous user has no permissions;
• account has been disabled or changed;
• online CPU contains another user configuration.

Access Hierarchy

For newer S7-1500 user-role systems:

• Full access includes read and HMI access.
• Read access includes HMI access.
• HMI access does not provide engineering read or write access.
• A user without the relevant rights has no access for that operation.

Check the Online CPU, Not Only the Offline Project

The physical CPU may contain a different user and role configuration from the project open on the laptop.

This can happen when:

• another engineer downloaded security changes;
• an old project was opened;
• replacement CPU contains another configuration;
• only part of the project was downloaded;
• CPU was restored from backup.

Compare the online and offline security configuration before making changes.

F-CPU Access

A fail-safe CPU may require the function right:

Full access including fail-safe

Do not grant broader safety rights simply to complete a routine software task.

Use an account approved for the required operation and follow the machine’s safety-change procedure.

Passwords Commonly Confused in TIA Portal

When a password is rejected, read the dialog title and requested protection type.

Do not cycle through every known machine password.

Step-by-Step Troubleshooting Procedure

Step 1: Make the Machine Safe

Changing protection, loading configuration or returning the CPU to RUN can restore outputs and automatic sequences.

Control:

• motors;
• valves;
• cylinders;
• heaters;
• brakes;
• suspended loads;
• remote stations.

Step 2: Record the Exact Message

Copy:

• error text;
• error number;
• requested password type;
• required access right;
• CPU operating mode.

Step 3: Read the Diagnostic Buffer

Look for:

• confidential password mismatch;
• protected configuration cannot be evaluated;
• user authentication failure;
• access denied;
• CPU startup failure;
• replacement or memory-card problem.

Step 4: Identify the Protection Mechanism

Determine whether the problem concerns:

• project access;
• CPU access level;
• local users and roles;
• confidential configuration;
• know-how protection;
• safety access.

Step 5: Confirm the Correct Project and CPU

Compare:

• CPU order number;
• IP and MAC address;
• project name;
• configured CPU;
• firmware;
• machine identity.

A password mismatch can be a sign that the wrong project is being loaded.

Step 6: Check the Active User

Verify:

• username;
• assigned role;
• rights for this CPU;
• full access where required;
• full fail-safe access where required.

Step 7: Check Local CPU Protection

On supported S7-1500 CPUs, inspect the display for an additional local access lock.

Step 8: Compare Confidential Password States

Determine whether:

• project uses a password;
• CPU already contains a password;
• both values are intended to match;
• password protection has been removed from only one side.

Step 9: Place the CPU in STOP

Changing or deleting the confidential configuration password on an already configured CPU generally requires STOP mode and write access.

Step 10: Set or Delete the Password

In Online & Diagnostics, use the documented function for the confidential PLC configuration password.

Depending on the situation:

• enter the correct password;
• delete the existing password;
• set the password used by the project.

Step 11: Restart the CPU

After synchronising the protection state, restart the CPU and check the diagnostic buffer.

Step 12: Compile and Download Consistently

Compile:

• hardware;
• software;
• security configuration;
• safety program where applicable.

Download the approved complete configuration.

Step 13: Confirm RUN and Access

Verify:

• CPU enters RUN;
• diagnostic event clears;
• online access works with the authorised account;
• write access behaves as intended;
• HMI and secure communications remain operational.

Recovery When the Current Password Is Unknown

If the authorised organisation no longer knows the required password, the available recovery options depend on:

• which password is missing;
• whether the CPU contains the only program copy;
• whether a current project backup exists;
• whether write access is still possible;
• the CPU family and firmware;
• safety and security requirements.

For an already loaded CPU, deleting the confidential configuration password online requires write access and STOP mode. Siemens warns that deleting a password while the loaded project still requires it can prevent the project from working until the correct password is restored.

A complete reset may erase:

• program;
• hardware configuration;
• IP settings;
• retained values;
• memory-card contents;
• security configuration.

Resetting confidential-configuration protection can also affect certificates used for services such as PG/PC, HMI, web server or OPC UA communication, requiring them to be recreated or reassigned.

Do not perform a destructive reset until:

1. The approved project has been found.
2. Current process values have been backed up where necessary.
3. Certificates and security settings are documented.
4. The machine can tolerate a complete recommissioning.
5. Authorisation has been obtained.

There is no legitimate troubleshooting shortcut that should bypass a protection mechanism without authorisation.

Symptom-Based Troubleshooting

CPU Can Be Monitored but Not Downloaded

Check:

1. Active user role.
2. Full-access function right.
3. local display write lock.
4. safety access for an F-CPU.
5. hardware or security-specific permissions.

CPU Cannot Be Read or Compared

Check:

1. Read-access permission.
2. anonymous-user configuration.
3. correct user account.
4. local display protection.
5. correct target CPU.

CPU Remains in STOP After Download

Check:

1. Diagnostic buffer.
2. confidential configuration password mismatch.
3. correct project.
4. memory-card contents.
5. replacement CPU protection state.

Download Fails After CPU Replacement

Check:

1. Whether replacement was previously used.
2. stored confidential password.
3. old memory card.
4. factory-reset method.
5. full order number and firmware.
6. correct project and password.

Factory Reset Did Not Remove Protection

Check:

1. Which reset method was used.
2. whether Delete password for protection of confidential PLC configuration data was selected.
3. whether the memory card was formatted.
4. whether the CPU display or mode selector was used.

HMI Works but TIA Portal Is Restricted

This may be normal.

The CPU can be configured to permit HMI communication while restricting engineering read and write access.

Correct User Still Cannot Write

Check:

1. Role rights for this specific CPU.
2. local display lock.
3. online user configuration.
4. full access vs read access.
5. fail-safe access requirement.
6. whether another protection mechanism is requesting a different password.

What Not to Do

Avoid these common mistakes:

• Do not factory-reset the CPU before reading diagnostics.
• Do not assume every Siemens password serves the same purpose.
• Do not repeatedly guess passwords.
• Do not weaken anonymous access permanently.
• Do not give all users full access.
• Do not bypass fail-safe authorisation.
• Do not assume a used replacement CPU is empty.
• Do not rely on the mode-selector reset to remove the confidential password.
• Do not delete the password while the loaded project still requires it.
• Do not format the memory card before backing it up.
• Do not load an unidentified project simply because its password is accepted.
• Do not return the CPU to RUN without controlling the machine.
• Do not remove security controls solely to make commissioning easier.

The objective is not to eliminate protection.

The objective is to align the approved project, physical CPU and authorised user correctly.

Why Password or PLC Protection Prevents Access

Siemens PLC access can be blocked at several independent levels:

• CPU read protection;
• CPU write protection;
• user and role permissions;
• confidential PLC configuration protection;
• project protection;
• know-how protection;
• fail-safe access control.

The most serious startup problem occurs when the confidential configuration password in the CPU does not match the password used by the project. In that condition, the CPU cannot use the protected configuration and may remain in STOP.

Use this diagnostic order:

Exact message → protection type → active user → required function right → project/CPU password match → replacement CPU state → documented reset or password procedure

For replacement CPUs, make sure old protection data has been removed before loading the production project. For existing CPUs, avoid destructive resets until the program, data and security configuration have been safely backed up.

A protected PLC is not necessarily faulty.

It may simply be refusing an operation that the current project, password or user is not authorised to perform.