Unlocking SW protection

Epec Programming and Libraries Manual

Supported platforms: CODESYS 3.5 SAFETY, CODESYS 3.5

The S Series / E Series firmware has password protection which prevents software updates and saving communication parameters.

The default user password is the four last digits of the serial number (e.g. serial 12345678 has user password 5678).

The user password can be changed if current password is known.

See unlocking protection with PUK code below if current password has been forgotten.

The password is control unit specific. Maximum string length is 20 ASCII characters, including terminating zero.

Use CODESYS node-ID for unlocking password from CAN bus.

The password and protection status OD indexes exist only in firmware's object dictionary.

It is advised to analyze the risk whether to keep or change the default product password.

Control unit reboot is always required to resume normal operation after protection has been unlocked or wrong password is attempted.

The following steps must be taken to unlock the protection with user password.

Send GFC message (COB-ID 1h, DLC 0) to CAN bus. Safe state is triggered to the control unit.
To make the unit configurable, write the user password in CANopen index 2031sub1h (string)
The status of password protection can be read from CANopen index 2032sub1h (byte).

Step	CANopen data	Description
1	Send GFC message (COB-ID 1h, DLC 0) to CAN bus	Control unit is set in a safe state
2	Read protection status from index 2032h sub-index 1 (size 1 byte)	If value = 0 continue to next step If value = AAh, unit already unlocked
3	Write control unit password string to index 2031h sub-index 1 (max length 20 ASCII characters, including terminating zero).	Opens protection. By default last 4 digits of serial number.
4	Read protection status from index 2032h sub-index 1 (size 1 byte)	If value = AAh download is enabled If value = FFh password was wrong and reboot is required

It is possible to unlock protection from the control unit's CODESYS application using SSeriesSystemExt library.

This moves the system automatically to the safe state and a control unit reboot is required.

Following example unlocks the protection using user password "1234".

Definitions:

error_code:EPEC_SYSTEM.SYSTEM_ERROR_CODES;

Code:

(*error code returns EPEC_SYSTEM.SYSTEM_ERROR_CODES.FW_ERR_OK when unlocking is passed*)

error_code := EPEC_SYSTEM.PasswordUnlock(

i_User := 'User',

i_Password := '1234'

);

If current user password is not known, it is possible to unlock the unit by writing PUK code to CANopen index 2034sub1h with any CANopen tool.

Sequence to unlock unit with PUK code is described below.

Unlocking PUK code moves control unit to the same state as giving actual user password.

After writing PUK code it is possible to change user password or to give restore command which returns unit's default parameters.

Step	CANopen data	Description
1	Send GFC message (COB-ID 1h, DLC 0) to CAN bus	Control unit is set in a safe state
2	Read protection status from index 2032h sub-index 1 (size 1 byte)	If value = 0 continue to next step If value = AAh, unit already unlocked
3	Write control unit PUK code string to index 2034h sub-index 1	Opens protection.
4	Read protection status from index 2032h sub-index 1 (size 1 byte)	If value = AAh download is enabled