Configuring Graphic Object Authorization and Resolving 'No Access Protection' in SIMATIC PCS 7 WinCC

In SIMATIC PCS 7 WinCC (v8.0 to v9.x), newly created user authorization levels in WinCC User Administrator failing to appear under the 'Authorization' property of graphic objects—displaying only 'No access protection' or raw numeric values—occurs because WinCC Graphics Designer caches user levels at project opening. When user levels are defined while Graphics Designer is open, the internal schema cache is not refreshed. To resolve this, save and close Graphics Designer, update the authorization configuration in User Administrator, reopen Graphics Designer, and assign the appropriate authorization level to the object's 'Operator Control' property.

WinCC User Administrator and Graphic Authorization Architecture

In SIMATIC PCS 7 OS (WinCC), access control enforces role-based operator security compliant with FDA 21 CFR Part 11 and IEC 62443:
* User Administrator: Central repository inside WinCC Explorer where Authorizations (numeric levels 1 to 999), User Groups (e.g. Operators, Maintenance, Engineers), and Individual Users are defined.
* Standard PCS 7 Authorizations:
* Level 5: Process controlling (standard start/stop, manual setpoint adjustments).
* Level 6: Higher process controlling (mode changes, alarm threshold modifications).
* Level 1000+: Custom technological authorizations.
* Graphics Designer Object Authorization: Graphic objects (buttons, I/O fields, sliders, faceplate icons) have a property Miscellaneous -> Authorization (or Operator Control -> Authorization). If an operator's assigned group lacks the required level, WinCC suppresses mouse clicks and displays an operator permission denial cursor.

Root Causes of 'No Access Protection' and Missing Permission Levels

When newly defined authorization levels fail to appear in Graphics Designer:
1. Graphics Designer Schema Caching: Graphics Designer queries the WinCC project SQL database schema only upon startup. Defining new levels in User Administrator while pictures are open leaves Graphics Designer using the old cached list.
2. Missing Group Assignment: Creating an authorization level without assigning it to at least one User Group prevents the level from registering as active.
3. APL Operation Permission Interlock: On APL (Advanced Process Library) faceplates, operator control is controlled by the block's OS_Perm and Op_Level parameters in CFC. Assigning permissions solely in WinCC Graphics Designer does not override AS controller-level interlocks.

Step-by-Step Authorization Configuration Workflow

Follow this procedure to configure and assign graphic object authorizations:

[Phase 1: Configure Authorizations in WinCC User Administrator]
   │  • Open WinCC Explorer -> Double-click "User Administrator"
   │  • In left pane, select "Authorizations":
   │      - Click in an empty row -> Assign Number (e.g. 10) and Name: "Chemical_Dosing"
   │  • Select "Groups" -> Select target group (e.g. "Lead_Operators"):
   │      - Check the box next to authorization 10 ("Chemical_Dosing")
   │  • Click "Save" and close WinCC User Administrator
   │
[Phase 2: Refresh Graphics Designer Schema Cache]
   │  • Save and close all open pictures in WinCC Graphics Designer
   │  • Close WinCC Graphics Designer completely
   │  • Re-open Graphics Designer from WinCC Explorer
   │
[Phase 3: Assign Authorization to Graphic Objects]
   │  • Open the target process graphic picture (*.pdl)
   │  • Select the graphic object (e.g. Pushbutton or Valve Icon)
   │  • In Object Properties -> Miscellaneous (or Operator Control):
   │      - Double-click property "Authorization"
   │      - Select "Chemical_Dosing" from the refreshed dropdown list
   │  • Save the picture -> Runtime enforces the security restriction immediately!

WinCC Authorization Levels and Role Assignment Matrix

Compare standard PCS 7 authorization levels and their intended operational scope:

Authorization LevelAuthorization NameStandard Industrial User RoleOperational ScopeLevel 1User AdministrationSystem AdministratorCreate users, assign passwords, modify security groups.Level 5Process ControllingPlant OperatorStart/stop motors, open/close valves, adjust standard SPs.Level 6Higher Process ControllingLead Operator / SupervisorChange operating modes (Manual/Auto), override interlocks.Level 7System OperationsProcess EngineerArchive exports, time synchronization adjustments.Level 1000+Custom AuthorizationMaintenance TechnicianCalibration overrides, diagnostic test routines.

Verification

To confirm that graphic object authorization functions accurately:
1. In WinCC Explorer, activate Runtime.
2. Log on with an Operator account possessing only Level 5 (Process Controlling).
3. Click the protected object assigned to Level 6 or custom Level 10; verify that the action is blocked and a lock icon or permission error appears.
4. Log on with a Supervisor account possessing Level 6 / custom Level 10.
5. Click the protected object; verify that the action executes immediately and logs the user name into the WinCC Operation List.

Limitations and Operational Precautions

Never set critical safety or plant shutdown pushbuttons to 'No access protection'. Doing so allows unauthenticated users or walk-up operators to command dangerous equipment. In APL projects, always configure both WinCC User Administrator authorization levels and CFC block OS_Perm bitmasks in parallel to prevent authorization conflicts between the SCADA client and AS controller.

Engineer FAQ

Why does Graphics Designer only show authorization numbers instead of names?

If User Administrator was edited after Graphics Designer was opened, the names are not refreshed. Closing and reopening Graphics Designer resolves the text labels.

Can I assign multiple authorization levels to a single button?

No. Standard WinCC graphic properties accept one authorization level per object. For compound conditions, evaluate permissions via dynamic VBScript or C-actions using PASSCheckLevelPermission().

How do I protect faceplates from unauthorized operator control?

Faceplates inherit security from APL system tags (@APLAuthorization). Configure operator permissions directly in CFC using the block's OS_Perm configuration.

Where are WinCC user credentials and passwords stored?

They are stored in the local WinCC project Microsoft SQL Server database in encrypted form, or integrated with Windows Active Directory via SIMATIC Logon.