Configuration and Use Manual
00809-0100-1600
Introduction to configuration and commissioning
November 2022
3 Introduction to configuration and commissioning
3.1 Security and write protection
The transmitter has several features that can help to protect it against intentional or unintentional access and configuration changes.
• When locked, the mechanical lock switch on the front of the upper puck prevents any configuration changes to the transmitter from any local or remote configuration tool.
• When enabled, the software setting Write Protection prevents any configuration changes. The setting can only be enabled if the transmitter does not have a display.
• If the Universal Service Port (USP) is disabled, the port cannot be used by any service tool to communicate with or make changes to the transmitter.
• When enabled, Security prevents any configuration changes being made from the display unless the appropriate password is entered.
3.1.1 Web server security
You can configure this transmitter using web services. There are multiple levels of security built into the transmitter that you can configure according to your needs and security standards, including:
• Disabling the web servers
• Allowing downloads of configuration and historian files, but disallowing file uploads to the transmitter through the Ethernet interface
• Configuring Transport Layer Security (TLS) on the web server to encrypt all data transmitted between the web server and the transmitter
• Requiring user authentication and strong passwords to access the web server and the transmitter
• Notifying users through alerts if the default password has not been changed
• Disallowing configuration changes from all interfaces including the Ethernet port using transmitter security switches, such as the lock switch or write protection
This transmitter:
• Was designed to be implemented in an industrial automation control system (Level 1 and Level 2 of the
Purdue Reference Architecture Model), with defense in depth security controls.
• Is not intended to be directly connected to an enterprise or to an internet-facing network without a compensating control in place.
3.1.2 Enable or disable the service port
Display
ProLink III
Web browser
Menu → Configuration → Security → Service Port
Not available
Not available
Configuration and Use Manual 17
Introduction to configuration and commissioning
November 2022
Configuration and Use Manual
00809-0100-1600
The service port is enabled by default. You can use the service port for connecting to ProLink III and for transferring files. If you want to completely prevent it from being used, you can disable it.
Note
Enabling or disabling the service port will not take effect until power has been cycled to the transmitter.
WARNING
Do not use the service port if the transmitter is in a hazardous area because using the service port means that you must open the transmitter wiring compartment. Opening the wiring compartment in a hazardous area while the transmitter is powered up can cause an explosion resulting in injury or death.
3.1.3 Enable or disable write-protection
Upper puck
ProLink III
Web browser
Use the mechanical switch on the upper puck.
Not available
Not available
When enabled, Write-Protection prevents changes to the transmitter configuration. You can perform all other functions, and you can view the transmitter configuration parameters.
Note
Write protection is available only by removing the display in order to access the upper puck component and using the lock switch to set the switch ON.
Figure 3-1: Removing the transmitter housing cover
18
A. Display Component
B. Upper Puck Component
Micro Motion 1600 with Ethernet Transmitters
Configuration and Use Manual
00809-0100-1600
Introduction to configuration and commissioning
Figure 3-2: Setting Switch 1 ON (to the left) to Set Write-Protection
November 2022
A. Switch 1
Write-protecting the transmitter primarily prevents accidental changes to configuration, not intentional changes. Any user who can make changes to the configuration can disable write protection.
3.1.4 Configure security for the display
Display
ProLink III
Web browser
Menu → Configuration → Security → Display Security
Device Tools → Configuration → Transmitter Display → Display Security
Not available
Configuration and Use Manual 19
Introduction to configuration and commissioning
November 2022
Configuration and Use Manual
00809-0100-1600
When using the display, you can require users to enter a password to do any of the following tasks:
• Enter the main menu
• Change a parameter
• Access alert data through the display
• Start, stop, or reset totalizers or inventories via the context menu
The display password can be the same or different from the totalizer/inventory context menu control password. If different, the display password is used to reset, start, and stop totalizers or inventories using
Menu → Operations → Totalizers .
Procedure
1. Configure Password Required as desired.
Option
At Write
Enter Menu
Description
When an user chooses an action that leads to a configuration change, they are prompted to enter the display password.
When the menu is selected from the process variable screen, the display password will be immediately required if Password Required is set.
Never (default) When a user chooses an action that leads to a configuration change, they are prompted to activate ⇦⇧⇩⇨ . This is designed to protect against accidental changes to configuration. It is not a security measure.
2. If the At Write or Enter Menu option was selected, enable or disable alert security as desired.
Option Description
Enabled If an alert is active, the alert symbol ⓘ is shown in the lower right corner of the display but the alert banner is not displayed. If the operator attempts to enter the alert menu, they are prompted to enter the display password.
Disabled If an alert is active, the alert symbol ⓘ is shown in the lower right corner of the display and the alert banner is displayed automatically. No password or confirmation is required to enter the alert menu.
Restriction
You cannot set Password Required to Never and enable alert security.
• If you did not enable Password Required , alert security is disabled and cannot be enabled.
• Alert security is disabled automatically if you set Password Required to Never after:
— Password Required is initially set to either At Write or Enter Menu
— Alert security is enabled
20 Micro Motion 1600 with Ethernet Transmitters
