Issue

In EcoStruxure Control Expert v16, after a download of a new project to a Modicon M580 PLC, the next subsequent Login only allows Monitoring Mode.

It is no longer possible to get into Programming Mode.

Product Line

EcoStruxure Control Expert v16.x

Modicon M580 PLCs

Environment

PLC Configuration software connected to physical PLC via either Ethernet or USB cable

Cause

In EcoStruxure Control Expert v16.x, there is a new feature called "Engineering Link Mode" for the M580 PLC. This applies to firmware versions v4.20 and greater.

This can setting can be modified by going to the Project Browser, expanding the CPU node, and double-clicking on the EIO node. The Security Tab will show this new security feature:

By default in a new project, the "Engineering Link Mode" is set to "Filtered".

If the application is downloaded to the PLC and the "Engineering Link Mode" is set to "Filtered" or "Enforced", the next subsequent login will require a Certificate-Encrypted connection. To set up your computer to allow this secure connection, you must go through a procedure using the Security Editor Tool. The Resolution section below will go through the steps for this.

In Control Expert v15.3 and older, there were only the unsecured login options (purple):

In Control Expert v16.x, in the "Set Address...." dialog now has more options for the Encrypted login session:

The green options are the Certificate-encrypted connection modes.

The purple connection methods are the old unsecure Modbus modes.

Per the two screenshots above, prior to v16, the names were "Modbus TCP" was called "TCPIP", and "Modbus TCP via USB" was called "USB"

IMPORTANT:

1) If you have downloaded a project that has the "Engineering Link Mode" set to "Filtered" or "Enforced", you must use the HTTPS connection modes (in the green box) for login in order to get out of Monitoring Mode and allow Programming.

2) If you wish to leave the PLC encrypted, any installation of EcoStruxure Control Expert that will be subsequently accessing or logging into the secured PLC will need to go through the Trusted Certificate Procedure in order to obtain programming capability.

Resolution

You must (a) first have the Security Editor set up. Following this, you will need to (b) use the Security Editor tool to trust the Certificate from the connected physical PLC.

A) If you have never used the Security Editor Tool before, you will need to initialize it using the following steps:

1) Go to the Start Menu and type in "Security Editor"

2) Run this Security Editor tool as Administrator.

3) It will first prompt you "Control Expert Security Installation" "Do you want to start the installation process" [Yes] [No]

4) Click [Yes] and it will install the tool

5) You'll be prompted to create a username and password for the tool. IMPORTANT:  DO NOT lose these credentials! You will need this to launch the Security Editor tool.

Result: The Security Editor will set itself up by creating the new user in Windows and the associated database files in your computer.

B) Then, in order to use the encrypted "HTTPS" Login methods, you need to follow these steps:

1) Run the Security Editor tool.

2) Go to the "Certificate whitelist" tab

3) Click [Add]

4) In the popup that appears, type in the IP address of the PLC and use Port 443. Optionally, for USB cable, use 90.0.0.1.

5) Hit [OK]

6) Wait for the Status to show "Valid"

7) Tick the checkbox in the first column left of "HTTPS" to select the PLC.

8) Click [Trust Certificate]

-> This will transfer the certificate from the PLC and install it into your computer's Trusted Certificates.

9) Once this is complete, close the Security Editor tool.

10) Launch Control Expert Classic as Administrator

11) Go to PLC > Set Address...

12) Change the Communication Protocol to "HTTPS" for TCP/Ethernet connection and fill in the IP Address.

(or "HTTPS via USB" for USB connection and use "SYS" for the Address field)

13) Hit [OK]

14) Login to your PLC -> this will allow Programming Mode instead of restricting Control Expert to Monitoring Mode.

If you want to use the Unencrypted modes of Login ("MODBUS TCP" and "MODBUS TCP via USB"), you must change your PLC project (under the the CPU > EIO settings > Security Tab) to have "Engineering Link Mode" set to "Full Access"

Then redownload this modified application to the PLC.

If this article does not answer your question, check out our FAQ database that has answers to more commonly asked questions:

Frequently Asked Questions - Schneider Electric (se.com)

If this FAQ did not solve your issue, you can chat with us at chat with us or e-mail us at customer.services@se.com to create a case with our Technical Support Team.

If you are not located in North America, please contact your local Customer Care Center for assistance:

Support | Schneider Electric Global (se.com)

Released for: Schneider Electric USA