Configuring OPC UA Tag Access Restrictions and Write-Protection in OpenPCS 7 V9.1

In SIMATIC PCS 7 V9.1, granular access restriction for process tags exposed via the OpenPCS 7 OPC UA server is configured directly in the Process Object View (POV) within SIMATIC Manager. Under the 'OS Variables' (or OS Tags) tab in Process Object View, each compiled WinCC tag features a dedicated 'Write-protected' property checkbox. Checking 'Write-protected' restricts OPC UA client operations on that tag to read-only (AccessLevel: CurrentRead), preventing external third-party systems from modifying setpoints or outputs. Leaving the box unchecked permits both read and write operations (CurrentRead and CurrentWrite), subject to WinCC User Administrator credentials and OPC UA certificate authorization.

Executive Summary

OpenPCS 7 provides an open, standardized communication gateway connecting PCS 7 automation systems to higher-level Manufacturing Execution Systems (MES), Enterprise Resource Planning (ERP), and plant data analytics platforms via OPC UA, OPC DA, and OPC HDA. However, exposing industrial control tags to external enterprise networks introduces severe operational risks if unauthorized or erroneous write commands are dispatched to live controllers. Starting in PCS 7 V9.1, Siemens introduced native tag-level write protection in the engineering environment. Understanding how to configure write protection in Process Object View guarantees secure data exchange without compromising plant safety.

Architecture and Fundamental Mechanics

The security and access restriction architecture of OpenPCS 7 operates across multiple layers of authentication and data attributes:

The OpenPCS 7 Server Architecture:
* OpenPCS 7 acts as an aggregation server that gathers live process values, alarms, and historical archives from multiple WinCC OS Servers.
* It exposes this technological data model to third-party OPC clients via standardized OPC UA binary protocols.
OPC UA Node Attributes and AccessLevel:
* Every OPC UA variable node contains an AccessLevel attribute that dictates client capabilities:
- CurrentRead (0x01): Client applications can subscribe to and read data points.
- CurrentWrite (0x02): Client applications can issue write requests to update the value.
The PCS 7 V9.1 Write-Protection Mechanism:
* Prior to PCS 7 V9.1, restricting write access required complex DCOM permissions, custom scripts, or external network firewall rules.
* In PCS 7 V9.1, SIMATIC Manager integrates write protection directly into the Process Object View database.
* Setting the 'Write-protected' attribute on an OS tag forces the OpenPCS 7 server to strip the CurrentWrite flag from that node's OPC UA metadata.
* If an external OPC client attempts a Write service call against a protected node, OpenPCS 7 rejects the request at the protocol boundary, returning error status Bad_NotWritable (0x803B0000).

Step-by-Step Implementation Procedure

Follow these procedures to configure tag-level write protection for OpenPCS 7 in PCS 7 V9.1:

Open Process Object View in SIMATIC Manager:
* In SIMATIC Manager, open your PCS 7 V9.1 Multiproject.
* Select View > Process Object View (or click the Process Object View tab in the project window).
Navigate to the OS Variables Tab:
* In the Plant Hierarchy tree on the left, select the plant folder or root project node containing the target tags.
* In the right-hand table, select the OS Variables (or OS Tags) tab.
Filter and Select Process Tags:
* The table displays all WinCC tags compiled from CFC charts (e.g., setpoints, process values, valve states).
* Locate the column header labeled Write-protected (in German: Schreibgeschützt).
Apply Write-Protection Settings:
* Check the Write-protected box for all tags that must be restricted to read-only access (e.g., safety limits, raw transmitter measurements, PID tuning parameters).
* Leave the box unchecked only for designated writable variables (e.g., remote supervisory setpoints or batch start commands).
* You can use standard table copy/paste functions to apply write protection to hundreds of tags simultaneously.
Compile and Download OS Project:
* Save changes in Process Object View.
* Right-click the OS Server project and select Compile (AS-OS Compile).
* Download the compiled configuration to the OS Server and OpenPCS 7 station.
Verify OpenPCS 7 OPC UA Security Configuration:
* On the OpenPCS 7 station, launch the OpenPCS 7 OPC UA Configuration Tool.
* Verify that server endpoints enforce digital certificate signing and encryption (Basic256Sha256).
* Verify client certificate authorization in the trusted certificates store.

Verification

Connect an OPC UA test client (such as UAExpert) to the OpenPCS 7 server endpoint. Browse the address space to a tag marked as write-protected. Verify that the node attributes display AccessLevel: Read. Attempt to write a new numerical value to the tag; verify that the test client reports write failure Bad_NotWritable. Browse to an unprotected tag; write a valid test value and confirm that the value updates successfully in WinCC Runtime and the AS controller.

Limitations and Operational Precautions

Tag-level write protection configured in Process Object View is only natively supported starting in PCS 7 V9.1; older PCS 7 releases require third-party OPC data diode appliances or custom script validation. OpenPCS 7 requires dedicated runtime licenses based on connected client counts and data points.

Engineer FAQ

Is tag-level write protection available in PCS 7 V9.0 or earlier?

No. The integrated 'Write-protected' attribute in Process Object View was introduced in PCS 7 V9.1; earlier versions required external firewalling or scripting.

What error does an OPC UA client receive when writing to a protected tag?

The OpenPCS 7 server returns the standardized OPC UA service error code Bad_NotWritable (0x803B0000).

Can write protection be toggled dynamically during runtime?

No. Write protection is a compiled engineering property configured in Process Object View and requires an OS compile and download to update.

Does write protection affect operator actions on WinCC faceplates?

No. Write-protected OPC settings apply exclusively to external OpenPCS 7 clients; internal WinCC operator faceplates operate normally according to WinCC user permissions.