Configuring APL Extended Operation Levels (1101 and 1102) in SIMATIC PCS 7 WinCC User Administrator

In SIMATIC PCS 7, missing authorization levels '1101 Extended operation 1' and '1102 Extended operation 2' in WinCC User Administrator occur when a project migrated from PCS 7 v7.x retains an older User Administrator database schema. APL blocks rely on four-digit authorization levels (1100, 1101, 1102) to restrict sensitive operations. To enable them, open WinCC User Administrator, navigate to Authorization Levels, and manually add levels 1101 and 1102, or execute the OS Project Editor with updated PCS 7 v8.x base data to re-import standard APL authorization profiles.

The APL Authorization Hierarchy and Extended Operation Levels

In the SIMATIC PCS 7 Advanced Process Library (APL), operational parameters and faceplate commands are segregated into distinct security tiers:
* Standard Authorization Levels:
* Level 5 (Operator process control): Routine operator actions (e.g., auto/manual mode switching, starting motors, setting standard setpoints).
* Level 6 (Higher process controlling): Supervisory modifications (e.g., adjusting PID tuning gains, altering alarm limits).
* The Extended Authorization Levels:
* Level 1100 (Highest process controlling): Critical administrative interlock operations.
* Level 1101 (Extended operation 1): Special operations reserved for senior process supervisors (e.g., dosing batch overrides, valve tracking overrides).
* Level 1102 (Extended operation 2): Maintenance operations (e.g., simulation activation, forcing digital states, sensor calibration bypasses).

Why Migrated PCS 7 Projects Lack Levels 1101 and 1102

When migrating an older plant project (e.g., from PCS 7 v6.1 or v7.1) to PCS 7 v8.0 or v8.2:
* Legacy 32-Level Schema:
The classic STEP 7 / WinCC User Administrator schema only defined levels 1 through 32 (e.g., Level 5 = Process controlling, Level 6 = Higher process controlling).
* The Migration Gap:
If the migration was performed as a 'Software update without utilization of new functions' or if the WinCC OS Project Editor was skipped, the WinCC SQL database retains the legacy 32-level table without the new four-digit APL extended authorization IDs (1100, 1101, 1102).
* The Symptom:
When engineers open APL faceplates or attempt to assign level 1101 to a custom parameter, the faceplate buttons remain disabled or grayed out because WinCC cannot find level 1101 in the active user profile.

Authorization Level Mapping Matrix: CFC Attributes to WinCC Rights

The table below details the standardized relationship between CFC block attributes and WinCC User Administrator authorization levels:

Authorization Level IDDesignation in User AdministratorTypical APL Block FunctionsTarget User ProfileLevel 5Operator process controlOpen/Close valve, Start/Stop motor, SP changeField OperatorLevel 6Higher process controllingAlarm limits (SP_HiLim, SP_LoLim), Monitoring timesShift SupervisorLevel 1100Highest process controllingEmergency reset, Interlock bypass confirmationPlant Manager / LeadLevel 1101Extended operation 1Recipe setpoint scaling, Ratio tuningProcess Chemist / LeadLevel 1102Extended operation 2Simulation mode toggle (SimOn), Hardware forceMaintenance Technician

Step-by-Step Procedure to Add Extended Operation Levels to User Administrator

Open WinCC User Administrator:
In WinCC Explorer, double-click User Administrator.
Access Authorization Levels Configuration:
* In the left tree view, select the root User Administrator node.
* In the center pane, switch to the Authorization Levels tab (or click the Authorization Levels button depending on WinCC version).
Manually Insert Extended Levels:
* In the authorization levels table, scroll to the bottom.
* Add a new entry:
- Number: 1101
- Name: Extended operation 1
- Add another entry:
- Number: 1102
- Name: Extended operation 2
- Click Save (diskette icon) or press Enter to commit changes.
Alternative Method via OS Project Editor:
* If extensive project migration artifacts exist, open OS Project Editor.
* On the Layout tab, select the standard PCS 7 monitor resolution.
* On the Basic Data tab, ensure standard templates are selected.
* Click OK. The OS Project Editor imports all default PCS 7 authorization levels automatically into the WinCC database.

Configuring User Groups and Assigning Extended Rights in WinCC

Once levels 1101 and 1102 are defined:
1. In User Administrator, select your target user group (e.g., Maintenance_Techs or Supervisors).
2. In the rights matrix, check the boxes for authorization levels 1101 and 1102.
3. Assign plant area authorizations (e.g., grant area-specific rights or global access).
4. Save the configuration and perform an OS download to redundant servers.

Verification

To verify that extended operation rights are effective:
1. Log into WinCC OS Runtime as a standard operator (assigned Level 5 only).
2. Open an APL faceplate (e.g., PIDConL or VlvL) and navigate to the parameter or maintenance view. Confirm that parameters requiring Level 1101 or 1102 are disabled/grayed out.
3. Log out and log in as an administrator or supervisor with Level 1101/1102 rights.
4. Return to the faceplate. Confirm that the input fields and buttons are now active and accept operator input.

Limitations and Operational Precautions

Area Authorization Dependencies: In PCS 7, authorization levels interact with Area Authorizations (Picture Tree Manager). Even if a user possesses Level 1101, they cannot operate an object if their user account is not authorized for the specific plant unit/area.
Smart Card / SIMATIC Logon: If using SIMATIC Logon (6ES7658-7...), ensure that Windows Active Directory user groups are mapped to the corresponding WinCC authorization groups in the SIMATIC Logon configuration.
Licensing Disclaimer: SIMATIC Logon packages (6ES7658-7...) and PCS 7 upgrade licenses must be validated against the applicable Siemens catalog and authorized distributor quotation.