Rockwell Automation Allen-Bradley Logix5000 Owner's manual

Programming Manual
Logix5000 Controllers Security
Catalog Numbers 1756 ControlLogix, 1769 CompactLogix, 1789
SoftLogix, PowerFlex 700S with DriveLogix

Important user information
Read this document and the documents listed in the additional resources section about installation, configuration, and operation of this
equipment before you install, configure, operate, or maintain this product. Users are required to familiarize themselves with installation and
wiring instructions in addition to requirements of all applicable codes, laws, and standards.
Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required to be carried
out by suitably trained personnel in accordance with applicable code of practice. If this equipment is used in a manner not specified by the
manufacturer, the protection provided by the equipment may be impaired.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use or
application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and requirements
associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for actual use based on the
examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software described
in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
WARNING: Identifies information about practices or circumstances that can cause an explosion in
a hazardous environment, which may lead to personal injury or death, property damage, or
economic loss.
ATTENTION: Identifies information about practices or circumstances that can lead to personal
injury or death, property damage, or economic loss. Attentions help you identify a hazard, avoid a
hazard, and recognize the consequence
Important:
Identifies information that is critical for successful application and understanding of the product.
Labels may also be on or inside the equipment to provide specific precautions.
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to
alert people that dangerous voltage may be present.
BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert
people that surfaces may reach dangerous temperatures.
ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control
center, to alert people to potential Arc Flash. Arc Flash will cause severe injury or death. Wear
proper Personal Protective Equipment (PPE). Follow ALL Regulatory requirements for safe work
practices and for Personal Protective Equipment (PPE).
Allen-Bradley, Rockwell Software, Rockwell Automation, and TechConnect are trademarks of Rockwell Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.

Rockwell Automation Publication 1756-PM016H-EN-P - March 2015 3
Summary of changes
This manual contains new and updated information. Changes to this manual
are documented in the following table.
Change
Topic
Reordered sections on source keys
Applying source protection on page 34
through Source key file on page 40
Added information on License-Based
Source Protection
Configuring source protection in the
Logix Designer application on page 33

Rockwell Automation Publication 1756-PM016H-EN-P - March 2015 5
Table of contents
Studio 5000 environment ...................................................................... 7
Additional resources ............................................................................. 8
Legal notices ......................................................................................... 8
Chapter 1
Introduction ......................................................................................... 11
FactoryTalk Security ........................................................................... 12
FactoryTalk Directories ................................................................ 12
Chapter 2
Introduction ......................................................................................... 13
Installing the Rockwell Software Security Emulator.......................... 13
Enabling security ................................................................................ 13
Installing FactoryTalk Services Platform software............................. 15
Securing a Logix Designer application project file ............................ 16
Applying security to a controller resource .......................................... 22
Chapter 3
Introduction ......................................................................................... 27
Importing a security server database................................................... 27
Importing Status text file .............................................................. 31
Organizer import result ................................................................. 31
Resource Editor ............................................................................. 32
Chapter 4
Introduction ......................................................................................... 33
Enable source protection ..................................................................... 33
Disable the Configure Source Protection menu option....................... 33
Apply Source Key protection to a component .................................... 34
Specify a Source Key file and location ......................................... 34
Protect components with Source Keys ......................................... 36
View components without a key ................................................... 42
Verify source key protection on a component .............................. 43
Remove access to a protected routine ........................................... 43
Apply License protection to a component .......................................... 44
Protect components with Licenses ................................................ 44
Apply License Protection to one or more components ................. 46
Share License privileges with other users on your network ......... 47
Summary of changes
Preface
Security
Configuring
FactoryTalk Security
with Logix Designer
application
Migrating from a
security server
database to a
FactoryTalk server
Configuring source
protection in the
Logix Designer
application

Table of contents
6 Rockwell Automation Publication 1756-PM016H-EN-P - March 2015
Chapter 5
Introduction ......................................................................................... 55
Installing the Logix CPU Security Tool ............................................. 55
Securing a ControlLogix controller with the Logix CPU Security Tool
............................................................................................................. 55
Accessing a secured controller...................................................... 59
Removing security from a controller with the CPU Security Tool
....................................................................................................... 62
Removing a password ................................................................... 64
Securing a
ControlLogix
controller
Index

Rockwell Automation Publication 1756-PM016H-EN-P - March 2015 7
Preface
This manual explains how to configure security for the Logix Designer™
application. It also explains how to set up source protection for your logic
and projects. This manual is one of a set of related manuals that show
common procedures for programming and operating Logix5000™
controllers.
For a complete list of common procedures manuals, refer to the Logix5000
Controllers Common Procedures Programming Manual.
The term Logix5000 controller refers to any controller that is based on the
Logix5000 operating system.
The Studio 5000 Automation Engineering & Design Environment™
combines engineering and design elements into a common environment. The
first element is the Studio 5000 Logix Designer™ application. The Logix
Designer application is the rebranding of RSLogix™ 5000 software and will
continue to be the product to program Logix5000™ controllers for discrete,
process, batch, motion, safety, and drive-based solutions.
The Studio 5000® environment is the foundation for the future of
Rockwell Automation® engineering design tools and capabilities. The Studio
5000 environment is the one place for design engineers to develop all
elements of their control system.
Studio 5000
environment

Preface
8Rockwell Automation Publication 1756-PM016H-EN-P - March 2015
These documents contain additional information concerning related products
from Rockwell Automation.
Resource
Description
Industrial Automation Wiring and
Grounding Guidelines
Provides general guidelines for
installing a Rockwell Automation
industrial system.
FactoryTalk Security System
Configuration Guide
Provides additional information on
FactoryTalk™ security.
Product Certifications website,
http://ab.rockwellautomation.com
Provides declarations of
conformity, certificates, and other
certification details.
You can view or download publications at
http://www.rockwellautomation.com/literature/. To order paper copies of
technical documentation, contact your local Allen-Bradley™ distributor
or Rockwell Automation™ sales representative.
Copyright Notice
© 2015 Rockwell Automation, Inc. All rights reserved. Printed in USA.
This document and any accompanying Rockwell Software products are
copyrighted by Rockwell Automation, Inc. Any reproduction and/or
distribution without prior written consent from Rockwell Automation, Inc. is
strictly prohibited. Please refer to the license agreement for details.
End User License Agreement (EULA)
You can view the Rockwell Automation End-User License Agreement
("EULA") by opening the License.rtf file located in your product's install
folder on your hard drive.
Trademark Notices
Allen-Bradley, Rockwell Automation, Rockwell Software, CompactLogix,
ControlLogix, DriveLogix, FactoryTalk, FactoryTalk Administration
Console, FactoryTalk AssetCentre, FactoryTalk Batch, FactoryTalk
Additional
resources
Legal notices

Preface
Rockwell Automation Publication 1756-PM016H-EN-P - March 2015 9
Directory, FactoryTalk Integrator, FactoryTalk Security, FactoryTalk
Services Platform, FactoryTalk View Machine Edition, FactoryTalk View
SE, Logix5000, Logix Designer, RSLinx Classic, Rockwell Software
Security Emulator, RSLogix 5000, and Studio 5000 are trademarks of
Rockwell Automation, Inc.
Any Rockwell Automation software or hardware not mentioned here is also a
trademark, registered or otherwise, of Rockwell Automation, Inc.
Other Trademarks
CmFAS Assistant, CmDongle, CmStick, CodeMeter, CodeMeter Control
Center, and WIBU are trademarks of WIBU-SYSTEMS AG in the United
States and/or other countries.
All other trademarks are the property of their respective holders and are
hereby acknowledged.
Warranty
This product is warranted in accordance with the product license. The
product’s performance may be affected by system configuration, the
application being performed, operator control, maintenance, and other related
factors. Rockwell Automation is not responsible for these intervening factors.
The instructions in this document do not cover all the details or variations in
the equipment, procedure, or process described, nor do they provide
directions for meeting every possible contingency during installation,
operation, or maintenance. This product’s implementation may vary among
users.
This document is current as of the time of release of the product; however,
the accompanying software may have changed since the release. Rockwell
Automation, Inc. reserves the right to change any information contained in
this document or the software at any time without prior notice. It is your
responsibility to obtain the most current information available from Rockwell
when installing or using this product.
Environmental Compliance
Rockwell Automation maintains current product environmental information
on its website at
http://www.rockwellautomation.com/rockwellautomation/about-us/sustainabi
lity-ethics/product-environmental-compliance.page
Contact Rockwell
Customer Support Telephone — 1.440.646.3434
Online Support — http://www.rockwellautomation.com/support/

Preface
10 Rockwell Automation Publication 1756-PM016H-EN-P - March 2015

Rockwell Automation Publication 1756-PM016H-EN-P - March 2015 11
Chapter 1
Security
This chapter discusses security related features available in the Logix
Designer application.
In version 20 or later of the application, security enhancements provide:
Security Server Validation—When enabled, and a user attempts to
access a secured controller or project file, the application makes sure
that the user is authorized by a FactoryTalk® Directory trusted by that
controller or project file. For more information, refer to Securing a
Logix Designer application project file on page 16.
Change Detection—Two new Controller attributes were added:
ChangesToDetect and AuditValue. You can configure these attributes
programmatically or by using the Security tab found in the Controller
Properties dialog box. You can monitor the audit value from an HMI,
historian, remote controller, and from Logix Designer application. For
more information about Change Detection, see Logix5000 Controllers
Information and Status Programming Guide.
Restricted communications through trusted slots—When enabled,
ControlLogix® controllers only accept communications through
selected slots. For more information about trusted slots, refer to
Securing a Logix Designer application project file on page 16.
The Logix platform, version 18 or later, provides Data Access Control
through two new tag attributes: External Access and Constant. Together,
these attributes let you control access to tag data and help to safeguard tags
by preventing unwanted changes to their values. For more information about
Data Access Control, see the Logix5000 Controllers I/O and Tag Data
Programming Guide.
Introduction

Chapter 1 Security
12 Rockwell Automation Publication 1756-PM016H-EN-P - March 2015
FactoryTalk® Security integrates a common security model across all
FactoryTalk enabled products. FactoryTalk® Services Platform (FTSP)
includes the FactoryTalk Administration Console that provides the interface
for configuring your system.
FactoryTalk Directories
The FactoryTalk Directory is an important aspect to implementing
FactoryTalk Security. In the FactoryTalk architecture, there are two separate
Directory types, Local and Network. A FactoryTalk Local directory is
sometimes utilized when all the Rockwell Automation Software products run
on a single computer. Use the Local FactoryTalk Directory for products such
as FactoryTalk® View Machine Edition (ME) and FactoryTalk® View Site
Edition (SE). Use the FactoryTalk Network Directory when multiple
Rockwell Automation Software products need to share information across
multiple computer systems. The FactoryTalk Network Directory allows these
systems to share a common FactoryTalk Directory for products, such as
FactoryTalk View SE, FactoryTalk® Integrator, FactoryTalk® Batch, and
FactoryTalk® Asset Center.
Important:
In version 20 or later of the application, the FactoryTalk Local
Directory is not supported.
When securing controllers using version 20 or later of the application, only
the Network Directory is supported. If you are securing controllers using an
earlier version of the application, you can use either the FactoryTalk Local
Directory or the Network Directory. If you are trying to coordinate security
across multiple computers, you need a Network Directory implementation of
FactoryTalk Security. If all of your products reside on a single computer, you
can use the Local Directory. If you have a choice, you might want to use the
Network Directory for forward compatibility with version 20 and later. You
can host the Network Directory locally on each machine just like the Local
Directory.
For more information about FactoryTalk Security, see the FactoryTalk
Security System Configuration Guide.
FactoryTalk
Security

Rockwell Automation Publication 1756-PM016H-EN-P - March 2015 13
Chapter 2
Configuring FactoryTalk Security
with Logix Designer application
FactoryTalk Services Platform (FTSP) software is installed during the
installation of the Logix Designer application.
RSLogix 5000™ software version 19 or earlier uses the Rockwell Software
Security Emulator™ to communicate with FactoryTalk Security. Starting
with version 20, the application obtains security information directly from
the FactoryTalk Services Platform and does not require RSSecurity
Emulator.
If you are using RSLogix 5000 version 19 or earlier, follow these instructions
to install the Rockwell Software Security Emulator.
1. Click the Start button, then click All Programs, then click Rockwell
Software, then click FactoryTalk Tools, and then click RSSecurity
Emulator Install.
2. Follow the installation prompts to complete the installation.
If the Security commands are unavailable, as shown in this picture, you
must enable security for the application.
For version 20 or later of the application, if the security commands are
unavailable, you need to install FactoryTalk Services Platform. See Installing
the FactoryTalk Services Platform software on page 15. If you are using
version 20 or later, and the security commands are available, skip to step 5
below.
If you are using RSLogix 5000 version 19 or earlier, you need to use
SetSecKeys to enable security. Follow the instructions below.
Introduction
Installing the
Rockwell Software
Security Emulator
Enabling security

Chapter 2 Configuring FactoryTalk Security with Logix Designer application
14 Rockwell Automation Publication 1756-PM016H-EN-P - March 2015
1. For RSLogix 5000 version 19 or earlier, the SetSecKeys software is
added to the system during installation.
In Windows Explorer, browse to and then expand the Program Files
folder, then expand Rockwell Software, then expand RSLogix 5000,
then expand ENU, then expand vxx, then expand Security, and then
double-click the SetSecKeys.exe file. For this example, we are using
RSLogix 5000 version 16.
2. If prompted to locate the project file, in the Locate Project File dialog
box, select the RS5000Keys.ini file and click Open. The Locate
Project File window appears.
ATTENTION: For RSLogix 5000 version 19 or earlier, if you
need to disable FactoryTalk Security for RSLogix 5000,
please contact Rockwell Automation Technical Support.
3. In the Enable/Disable Security Keys dialog box, select the RSLogix
5000 check box, and then click OK.
4. If the RSLogix 5000 Security: Enable dialog box appears, click OK.
5. Open the FactoryTalk Administration Console:
a. Click the Start button, then click All Programs, then click
Rockwell Software, and then click FactoryTalk
Administration Console.
b. Select the FactoryTalk Directory option and click OK.
Important:
For version 20 or later of the application, security
settings come from the FactoryTalk Network
Directory. RSSecurity Emulator is not required and
the FactoryTalk Local Directory is not supported.
c. If prompted to log on to FactoryTalk, type your FactoryTalk
user name and password, and then click OK.

Configuring FactoryTalk Security with Logix Designer application Chapter 2
Rockwell Automation Publication 1756-PM016H-EN-P - March 2015 15
Tip:
If you cannot log on to FactoryTalk, see "I cannot log on
to the FactoryTalk Directory" in FactoryTalk Help.
6. Open the RSLogix 5000 Feature Security Properties dialog box:
a. In Windows Explorer, browse to System, then go to Policies,
then go to Product Policies, and then go to RSLogix 5000.
b. Right-click Feature Security and then click Properties.
7. Secure the RSLogix 5000 controller:
a. In the Feature Security Properties dialog box, select
Controller:Secure and then click Browse.
b. In the Configure Securable Action dialog box, click Add to
select the user accounts or groups that you want to configure.
c. In the Select User and Computer dialog box, select the user
accounts or groups and click OK.
d. Follow the instructions to complete the configuration.
If you find that the Security feature is not enabled in the Logix Designer
application, then you need to make sure FactoryTalk Services Platform
(FTSP) software is installed properly.
Follow these instructions to install the FTSP software.
1. On the installation disk, browse to \System\FTSP and double-click the
Setup.exe file.
2. Follow the installation prompts to complete the installation.
The installation automatically configures and backs up all existing
local and network FactoryTalk Directory files. For new installations, it
backs up the pre-configured FactoryTalk Directory files. The backups
let you restore the Factory Talk Directory files to a previous software
version.
After the installation is complete, refer back to Enabling security on page 13.
If you are having problems, refer to the FactoryTalk Security System
Configuration Guide.
Installing
FactoryTalk
Services Platform
software

Chapter 2 Configuring FactoryTalk Security with Logix Designer application
16 Rockwell Automation Publication 1756-PM016H-EN-P - March 2015
Once you have configured the Logix Designer application to be security
aware, the next step is to enable security in a project file. Follow these steps
to secure a project file.
1. Open Logix Designer.
a. Click the Start button, then click All Programs, then click
Rockwell Software, and then click Studio 5000.
b. If prompted to Log On to FactoryTalk, type your FactoryTalk
User name and Password, and then click OK.
In the example below, the FactoryTalk Directory (FTD) was
configured with an account called FTADMIN.
Securing a Logix
Designer
application project
file

Configuring FactoryTalk Security with Logix Designer application Chapter 2
Rockwell Automation Publication 1756-PM016H-EN-P - March 2015 17
2. Open the project file that you want to secure. This example uses the
DayOfWeek project file, which is installed with the software. From the
Menu bar, click Help, then click Vendor Sample Projects. On the
Quick Start screen, click Open Sample Projects, and then find the
DayOfWeek.ACD file. Click the DayOfWeek.ACD and then click
Open.
3. On the menu bar, click Edit, and then click Controller Properties.
4. Click the General tab to find the controller name. Write down the
name that appears in the Name field. By default, this is the name of the
ACD file that you use later when applying security to a controller
resource on page 22 in the FactoryTalk Administration Console.

Chapter 2 Configuring FactoryTalk Security with Logix Designer application
18 Rockwell Automation Publication 1756-PM016H-EN-P - March 2015
In this example, the name is DayOfWeek.
5. Click the Security tab or the Advanced tab, depending on the version
of the application, to configure the security settings.
Click the Security tab if it appears in the Controller Properties
dialog box.

Configuring FactoryTalk Security with Logix Designer application Chapter 2
Rockwell Automation Publication 1756-PM016H-EN-P - March 2015 19
a. In the Security Authority list, select FactoryTalk Security.
Important:
When you select a security authority for a project,
you can only access the project and any controller
that contains it when you have been granted
access in FactoryTalk Security.
b. To associate the project with a specific authority, select the
Use only the selected Security Authority for Authentication
and Authorization check box.
To remove the association to the specified Security Authority
for this project, go online with the controller and then clear this
check box.
When you associate a project with a specific Security
Authority, you are associating the project with a specific
FactoryTalk Network Directory that is identified by a security
authority identifier. Projects that are secured and bound to a
specific Security Authority cannot be recovered if the Security
Authority identifier of the FactoryTalk Network Directory
used to secure the project no longer exists.
Important:
Before you associate this project with a specific
Security Authority, we recommend that you back
up the FactoryTalk Directory and save unsecured
versions of this project file in (.ACD) or (.L5X or
.L5K) formats, and save them in a secure location.
For details about backing up a FactoryTalk
Directory see the FactoryTalk Help. Click the Start
button, then click All Programs, then click
Rockwell Software, then click FactoryTalk Tools,
and then click FactoryTalk Help.
Tip:
The check box is available when you are using
FactoryTalk Services Platform 2.50 or later and a version
of the application that supports associating a project with
a specific Security Authority.
c. For information about the parameters on the Security tab, click
the Help button.

Chapter 2 Configuring FactoryTalk Security with Logix Designer application
20 Rockwell Automation Publication 1756-PM016H-EN-P - March 2015
Click the Advanced tab if the Security tab does not appear in the
Controller Properties dialog box.
In the Security box, select FactoryTalk Security.
6. Click OK. If prompted to confirm whether to confirm the controller
settings, click Yes.
Important:
When you select a security authority for a project,
you can only access the project and any controller
that contains it when you have been granted
access in FactoryTalk Security.
7. Save the project file.