Tag-driven HMI password: enter the value, not the tag name

What the tag name option does

On the pushbutton password option tab there are two ways to set the credential. One is a fixed value typed into the project, and the panel accepts that value for the life of the project. The other is the Tag Name radio option, and it changes what the credential is: the panel reads the PLC word the tag points to, and the value in that word is the password.

So the answer to the usual question is yes. The word must already hold a value, and the person at the panel types that value. The tag name is an address label into the panel's tag database; it tells the panel which word to read and it is never the text anyone types.

The payoff is rotation from the PLC side. A supervisor rewrites the word through whatever protected write path the installation provides, and the new value is the password immediately, with no project edit and no reload.

A password tag is one 16-bit word, so the working value lies anywhere from 0 to 65535 decimal. Any four-digit code fits: 9999 is well inside that 16-bit range.

Symptoms and what each one points to

• The panel rejects a code you are sure is right. Either the word's current value is not the code you remember, or the tag's label got typed in by habit. Read the word as below and type what it actually holds.
• No password prompt appears on the button at all. The object is a momentary pushbutton, and the password function is not applicable to momentary pushbuttons. No tag value or setting adds the prompt; move the password to a switch and reproduce the momentary behavior in the PLC.
• The right value is rejected anyway. The object is pointed at a different word than the one you checked, or the panel is running a project other than the one you edited. Confirm the tag named in the object's password configuration matches the word you read, and that the project on the panel is current.
• A role reaches a screen it should never see. An unprotected route leads there. Protect every screen-change button that opens that screen, on every path.
• An operator needs to see a setpoint but not change it. Visibility and access are being treated as one requirement. Display the value to everyone who needs it and put the password on the control that writes it.

Read the word before you type anything

Work in this order:

1. Open the object's password configuration and confirm it uses the Tag Name radio option. Note which tag it names.
2. In the tag database, confirm which 16-bit PLC word that tag points to.
3. Read that word's current value, a number from 0 to 65535, in the PLC programming software or in the panel's runtime diagnostics.
4. Type that number at the prompt.

Type the number, never the label. The entry has to equal the value in the word, and a name is not a number.

The whole diagnostic takes about 10 minutes on a panel already in service: 2 minutes to check the object's configuration, 5 minutes to find the tag and read the word, and the rest to type the value and confirm the screen opens.

Reading a word out of the panel and writing one back is the same job as any V-memory write from the screen. Make an HMI pot read and write a PLC V-memory value walks through the panel side of that. On a panel without a touch screen the entry path differs as well; Password entry on an HMI panel with no touch screen covers typing a value there.

Example: commission a 4271 code, then rotate it to 9308

Say the supervisor tier needs its own code and the code will change every quarter.

1. Reserve one spare 16-bit word in the PLC data memory for the supervisor code. That word holds 0 to 65535 decimal.
2. Pick a four-digit code: 4271. The range check is 9999 < 65535, so any four-digit code fits the single word.
3. During commissioning, write 4271 into the word with the PLC programming software and read it back. Budget 15 minutes for the write, the readback and a first entry test.
4. At the panel, press the protected screen-change button. The prompt appears. Type 4271. The screen opens.
5. Type the tag's label by mistake and the prompt rejects the entry, because the entry has to equal the number in the word.
6. At quarter's end, every 3 months, the supervisor rewrites the word to 9308 through the protected write path. Retest: 4271 now fails, 9308 opens the same screen. Nothing in the panel project was edited and nothing was reloaded.

A momentary command behind a password: switch plus SET and RST

The password function is not applicable to momentary pushbuttons. Retrying settings on a momentary object goes nowhere; the object type is the problem, not the value.

The documented route is to put the password on a switch, which the password function does cover, and let the PLC produce the momentary behavior. The authorized operation SETs the target bit, and a RST rung clears it at the point in the sequence where the command should end. Confirm the reset fires both when the step finishes normally and when it is interrupted, before the machine returns to service.

Because the latched bit stays on until that RST runs, the usual companion is a one-shot rung, so downstream logic sees a single rising edge per authorized press. Why a one-shot (OSR) instruction is used with momentary pushbuttons explains that pattern.

One safety note: a panel password decides who may reach a control. Guarding, e-stop circuits and every safety function stay on their own safety-rated hardware, and no HMI password belongs in a safety path.

Four tiers with protected screen-change buttons

For an Engineer, Manager, Supervisor, Operator ladder, protect the screen-change buttons instead of chasing every object. Assign each navigation button the codes of the roles allowed to reach its destination screen. The Engineer's code opens everything; the Operator's opens the least.

Build the tree the same way. The broad group passes the first protected button onto a screen that carries more buttons; a smaller group needs another code for the button that leads deeper. An object can also carry several codes at once: give a protected object both the Engineer and Manager codes and either role opens it while the tiers below stay out.

Navigation and object access are two separate decisions. Write down, per screen, which roles may view it and which may operate its controls, then assign the passwords to match. Four distinct codes fit in four 16-bit words, a 64-bit block you can document on one line.

Document the mapping, test both directions

Keep a short table in the project documentation: which word feeds which object, and which role opens what. Leave the live codes out of any document that circulates.

Then test every role in both directions on the final panel: the allowed case, such as the Engineer code opening the maintenance screen, and the denied case, such as the Operator code failing on the same button. With four roles that is 8 entries minimum, 2 per role, and 15 to 20 minutes at the panel. Walk each route through the tree, because a correct entry on one button tells you nothing about the rest. Where a password word must hold still through a machine stage, Lock a PLC V-memory value from HMI writes during a stage shows how to keep stray panel writes off it.

Which option to pick

Recommendation: Use the Tag Name radio option when the code has to rotate without a project edit, and give the write path for that word to the supervisor tier only. Use a fixed password when the code never changes and nobody at the site needs PLC-side writes. For a momentary command behind a password, configure the password on a switch and produce the pulse with SET and RST in the PLC.

Questions