 Password protection

The ISaGRAF Workbench includes a full data protection system, which enables the user to password protect projects and library elements. A library element can be an I/O configuration, an I/O board or complex equipment, a function or function block written in IEC languages, a "C" function, function block or conversion function. A password protection data base is dedicated to one project or library element, and cannot be shared between several ones.

Protection levels

Defining password protection

Accessing protected data

Links with the archive manager

Setting individual protection for variables and I/O channels


Protection levels

Within one project or library element, the user can define up to 16 access levels, corresponding to different passwords. Access levels are sorted in a hierarchy system. They are numbered from 0 to 15. The higher access level is numbered 0. When a user knows a password, he can access all the items protected by the corresponding access level, plus all the ones protected with lower levels. Each elementary command or data of a project or library element can be separately protected with an access level. For example, the "Make application code" command from the ISaGRAF menus can be protected separately. Elementary data can be a program, a list of options, the technical note of a library element, etc...


Defining password protection

The "Set password" command of the ISaGRAF menus is used to define the passwords and access levels for one project or one library element. This command is called from the menus of the ISaGRAF Project Manager (for a project), or the ISaGRAF Library Manager (for a library element). No password is required when first running this command. If passwords are already defined, the user must enter the highest level password he knows, before accessing this command. Upper level passwords and protected items then cannot be modified. The "Set password" command enables the user to define the passwords corresponding to the different access levels, and to protect elementary commands or data with the defined levels.

Passwords (corresponding to protection levels) are entered by double clicking on a line of the upper list. The following box is used to enter a password.

The list in the lower area shows the different items (data or functions) which can be protected, and current protection level attached to either "read access" or "full access" permissions. Assigning a protection level to "read" permission enables you to prevent users whitout sufficient permission even to open or print a document.

Double click on a line in the lower list to set permissions for the selected item or data. The following box is open:

Both permissions can be set either to "free access", or to a protection level defined by a password. Full access permission cannot be attached to a level with less priority than the one selected for read access.

Note that for some documents, naturally visible when using ISaGRAF Workbench, such as project descriptor, read access cannot be protected with a password.


Accessing protected data

No password or user's name is asked when the Workbench is started. Each time a user wants to have access to a protected data or function, he must enter the required password in a dialog box.

If the user enters the required password (or a password attached to a higher access level), he can continue normally. Each time a password is entered by the user, it is stored in memory, so the user will not have to enter it again later. Stored passwords are held each time an ISaGRAF tool is run from another ISaGRAF tool (for example, the Project Manager runs the Program Manager). Stored passwords are lost when the last remaining ISaGRAF window is closed. Passwords entered during project editing, or by using the Library Manager, or by using the Archive manager cannot be shared. If the user enters a bad password, he cannot run the selected function.


Links with the archive manager

When saving an object (project or library element) on archive disk, the data protection item named "Backup on archive" is invoked. This corresponds to the data protection system attached to the object in the Workbench (hard disk). No test is performed on the data protection system of the object on the archive disk if it already exists. The "Backup" command of the ISaGRAF Archive Manager saves the data protection information with the object on the archive disk.

When restoring an object which already exists in the Workbench (hard disk), the data protection item named "Overwrite with archive" is invoked. This corresponds to the data protection system attached to the object in the Workbench (hard disk). No test is performed on the data protection system of the object on the archive disk. If this command is validated, the restored data protection information will then replace the existing one on the hard disk.


Setting individual protection for variables and I/O channels

The ISaGRAF workbench provides a complete data protection system based on hierarchized passwords. Variable declaration and I/O connection can be globally protected by a password. Additionaly, ISaGRAF enables you to set individual protection to any variable or I/O channel. This assumes that:

- passwords are already defined in the password definition system (use the "Project / Set password" command of the Project Management window) so that protection levels are available for individual protection.

- you use protection levels with higher priority for individual protection compared to global variable or I/O protection.

When a variable or an I/O channel has individual protection, a small icon is draw close to its name in dictionary or I/O connection window.

Use the "Set protection" and "Remove protection" commands of the "Edit" menu in dictionary or I/O connection windows to set or remove an individual protection for selected variable or channel. Both commands ask you to enter a valid password so that a protection level can be attached to the variable or channel. Then, each time you want to change a variable or a connection to a channel having individual protection you must enter a password with sufficient priority level.

Warning: if a variable or channel is protected with a level, and the corresponding password is removed from protection system, and if no higher level password is defined, variable or channel cannot be changed anymore unless a new password with sufficient level is defined.