Siemens S7-400 Read-Only security.

So I am in the midst of a lengthy project migrating a Bio-gas plant from a S7-400 to a CLX and replacing the old WinCC Scada with (sadly) FTSE.

The old S7 is destined for the bin in a few months time, but I need to add a couple of DB's so we can migrate the IO from the Siemens to the CLX, the CLX will then write the values / bits to the Siemens PLC via Derived Tags and Kepware until the CLX then takes over the control.

I have the original Step 7 project from when the plant was built, along with all changes over the years, so all straight forward so far.

Here is my problem though: the project is read-only and the password is unobtainable as the OEM went out of business years ago, so I can't just add my db's and download them.

I can and have done an upload to the PG, so surely it's a case of doing that, changing the protection in the HW Config and re-downloading?

(The card in the S7-400 is a RAM not an eeprom, so that shouldn't need anything doing)

If that is the case, was security really that slack? How would this prevent someone doing anything?

Or have I completely missed the point of the old password protection.

Write protection security is there to prevent one or two employees to change something whilst the system is working but still needing to see what is going on.

This is still the case where you can just replace the card and download your copy of the software without protection. It is however, miles better than a key that you can buy with a few hundred dollars from a distributor.

If someone is worried about safety of the application, the password would have been a complete block.
Additionally, the fact that the password is no longer activated is enough sign that someone messed with the system and any liability or warranty would be out of the window. This was the very first step everyone at one of my previous jobs did and would be reported straight away along with a few checks on differences and what not.

The RAM card is clearly because at a certain point plenty of changes were going on and no one wanted to burn a new card with the changes... or potentially, the PLC doesn't have all the memory required by the application.

Is it the entire program or some af the program blocks that are locked?

I have not heard before that whole program are locked, but I know that the individual blocks can be.
Unlocking of individual blocks can be solved as there are methods for unlocking the blocks.