Password protect the HMI setup menu key path

Why the screen password misses the Setup keys

Two doors lead to the parts of the panel operators should never reach. The application screens are one door, and a screen password closes it. The F1 + F5 combination is the other: it is a panel-level key operation that opens the Setup Menu regardless of which application screen is showing, so the screen password has no effect on it.

The combination was chosen to prevent accidental entry, not to keep a person out, and anyone who experiments with the keys finds it in seconds. Treat it as known. The lockout therefore needs two pieces wired together: the screen password that guards the button, and the system tag that the button sets. Screen-level security is still worth doing properly; HMI screen access control for a protected operator view covers that side of the job. The tag closes the documented key path. Any other service path into panel memory is a separate subject, listed in the panel's own manual.

What you need

• The panel's project software, the running project, and the transfer method that loads a project onto the panel.
• The panel's system tag list, in the software's tag picker. It shows two relevant tags: SYS DISABLE USE F1 + F5 SETUP, which controls the key operation, and SYS GO TO SETUP MENU, which names the Setup Menu navigation function. This procedure uses the first one. Pick it from the list; do not type the name freehand.
• One Push button object.
• One screen that only authorized staff open, to hold the button. Hiding a screen behind an invisible trigger is a separate technique with its own failure mode; why taps never open a hidden setup screen walks that case.
• The password for that screen, set at Screen Menu > Screen Option > Password.

Set up the lockout

1. Open the screen only authorized staff use, the maintenance or commissioning screen.
2. Add a Push button object to it and assign SYS DISABLE USE F1 + F5 SETUP as the button's action tag.
3. Set the screen password: open Screen Menu > Screen Option > Password for that screen and configure it with the software's supported password settings.
4. Transfer the project to the panel and run it.
5. Press the button once. The tag's On/Off status goes to the disabled state and stays there until the project is erased or a new project is transferred.

Check the lockout on the panel

With the project running and the button pressed, work through these checks on the panel itself:

• Press F1 and F5 together, the combination the tag name describes. The Setup Menu must stay closed.
• Enter the protected screen with the password and confirm the button is present and shows the disabled state.
• Leave the screen, move through the screens operators normally use, and try the key combination again. The disable holds through ordinary operation.
• If Setup still opens, check three things in order: the project is running, the button is assigned to the tag from the tag list, and the button was pressed after the most recent transfer. A password cannot compensate for a button that was never pressed.
• If the button itself will not respond, check for a PLC-side lockout first; a PLC password that blocks HMI button presses covers that fault.

Run the first full test on a bench panel or during a planned stop, and leave memory-reset functions alone on any panel that is running a line.

On mixed fleets the same protect-the-screen pattern appears in other engineering tools; password protecting a single KTP400 screen in TIA Portal is one walkthrough of it on a different panel family.

Example: one maintenance screen on a filling-line panel

Inputs, and where each comes from:

• 2 function keys, F1 and F5, the documented Setup entry (the tag name and the panel manual).
• 1 system tag, SYS DISABLE USE F1 + F5 SETUP, on 1 Push button object, on 1 password-protected screen (the setup above).
• 1 reactivation press per project transfer, because the documented On/Off behavior says the state remains until the project is erased or a new project is transferred.
• 4 project transfers per 12 months, the one assumed input: this line's revision schedule. Swap in your own count and the result moves by 1 press per transfer.

The rule in words: presses per year = 1 press at commissioning + (transfers per year x 1 press). Each press takes about 1 minute: 1 password entry, then 1 key test that must do nothing.

The arithmetic: 1 + (4 x 1) = 5 guarded presses per 12 months, plus 5 key tests, so 10 deliberate actions per year, roughly 10 minutes of maintenance time.

The result: with those 5 presses done on schedule, the F1 + F5 entry is closed for every shift between transfers, and ordinary operators never see Setup.

The decision: 10 logged actions per year is trivial bookkeeping, so keep the button on the password-protected screen. The point where the habit breaks down sits near 1 transfer per month: 12 transfers x 2 actions = 24 password entries and key tests per 12 months, and presses start getting skipped. Past that point, move the press onto the written transfer sign-off sheet so it is checked off, not remembered.

After every project transfer

The disabled state lives with the running project, and it remains until the project is erased or a new project is transferred. Treat every transfer as a lockout reset: transfer the project, open the protected screen with the password, press the button again, try the key combination once, and only then release the panel to production.

Keep the password, the screen, and the button in the controlled project documentation so a new technician can repeat the sequence without guessing. Record the return path there too: the tag holds an On/Off status, so decide now how your project sets it back to Off, wire that path deliberately, and test it on the bench while the panel is still in your hands.

The decision

Recommendation: Assign the disable tag to one push button on a password-protected screen, press it once at commissioning and again after every project transfer, and try the F1 + F5 combination before each release to production. If your panel's system tag list has no disable tag for the Setup keys, close the path with the panel's own user-security features instead; do not build the lockout around a control the panel does not offer.

Questions