Control Expert Security Editor

A security configuration tool is used to define software users and their respective authorizations. Control Expert access security concerns the terminal on which the software is installed and not the project, which has its own protection system.

For more detailed information, refer to EcoStruxure™ Control Expert, Security Editor, Operation Guide.

Recommendation: Set a dedicated password to the super user and limit other users authorizations with a restricting profile.

Programming and Monitoring Mode

Two modes are available to access the CPU in Online mode:

  • Programming mode: The CPU program can be modified. When a terminal is first connected to the CPU, the CPU becomes reserved and another terminal cannot be connected as long as the CPU is reserved.

  • Monitoring mode: The CPU program cannot be modified, but the variables can be modified. The monitoring mode does not reserve the CPU, and an already reserved CPU can be accessed in monitoring mode.

To choose a mode in Control Expert , select: Tools > Options... > Connection > Default connection mode .

More details on those modes are provided in the Services in Online Mode topic.

Recommendation: Set the Online CPU access mode to Monitoring whenever possible.

Program Sections Protection

The section protection function is accessible from the Properties screen of the project in offline mode. This function is used to protect the program sections. More details are provided in the Section and Subroutine Protection topic.

NOTE: The section protection is not active as long as the protection has not been activated in the project.

Recommendation: Activate the sections protection.

CPU Memory Protection

The memory protection prohibits the transfer of a project into the CPU and modifications in online mode, regardless of the communication channel.

NOTE: The CPU memory protection cannot be configured with Hot Standby CPUs. In such cases, use IPsec encrypted communication.

The memory protection is activated as follows:

Recommendation: Activate the CPU memory protection whenever possible.

CPU Remote Run/Stop Access

NOTE: The CPU remote run/stop access cannot be configured with Hot Standby CPUs. In such cases, use IPsec encrypted communication.

The remote run/stop access management defines how a CPU can be started or stopped remotely and depends on the platform:

Modicon M580:

CPU remote access to run/stop allows one of the following:

  • Stop or run the CPU remotely by request.

  • Stop the CPU remotely by request. Denies running the CPU remotely by request, only a run controlled by the input is available when a valid input is configured.

  • Denies to run or stop the CPU remotely by request.

Refer to the Managing Run/Stop Input for CPU configuration options that help prevent remote commands from accessing the Run/Stop modes section.
Modicon M340:

CPU remote access to run/stop allows one of the following:

  • Stop or run the CPU remotely by request.

  • Stop the CPU remotely by request. Denies running the CPU remotely by request, only a run controlled by the input is available when a valid input is configured.

Refer to the Configuration of Modicon M340 Processors section.
Modicon Premium:

CPU remote access to run/stop allows one of the following:

  • Stop or run the CPU remotely by request.

  • Stop the CPU remotely by request. Denies running the CPU remotely by request, only a run controlled by the input is available when a valid input is configured.

Refer to the Configuration of Premium\Atrium Processors section.
Modicon Quantum:

CPU remote access to run/stop allows to:

  • Stop or run the CPU remotely via request.
Modicon MC80:

CPU remote access to run/stop allows one of the following:

  • Stop or run the CPU remotely by request.

  • Stop the CPU remotely by request. Denies running the CPU remotely by request, only a run controlled by the input is available when a valid input is configured.

  • Denies to run or stop the CPU remotely by request.

Refer to the Configuration of Modicon MC80 Processors section in MC80 user manual.

Recommendation: Deny running or stopping the CPU remotely by request.

CPU Variables Access

Recommendation: To protect CPU data at run time from illegal read or write access, proceed as follows whenever possible:

  • Use unlocated data.

  • Configure Control Expert to store only HMI variables: Tools > Project Settings... > PLC embedded data > Data dictionary > Only HMI variables .

    Only HMI variables can be selected only if Data dictionary is selected.

  • Tag as HMI the variables that are accessed from HMI or SCADA. Variables that are not tagged as HMI cannot be accessed by external clients.

  • Connection with SCADA has to rely on OFS.

Data Memory Protection

You can activate data memory protection in Control Expert by navigating to Tools > Project Setting > PLC embedded data, then select Apply. This feature helps protect both located and unlocated data.

For more information on the data memory protection feature, refer to the topic Data Memory Protection.