Configuring Operator Authorizations and Access Levels for SFC Faceplates in SIMATIC PCS 7

In SIMATIC PCS 7, operator authorizations for Sequential Function Chart (SFC) faceplates are governed by the central SFC runtime options in WinCC Explorer and the WinCC User Administrator, rather than individual block icon properties in Graphics Designer. To assign custom authorization levels to specific SFC types or instances, configure the authorization level in the WinCC SFC configuration dialog, assign plant hierarchy area permissions in User Administrator, and parameterize instance-level control inputs in CFC.

Architecture of SFC Faceplate Authorization in PCS 7

In SIMATIC PCS 7 batch and sequential process control, Sequential Function Chart (SFC) types and SFC instances are controlled from the Operator Station (OS) via standardized faceplates (@pg_@sfc_type.pdl and @pg_@sfc_rt.pdl). Operators execute commands such as Start, Hold, Stop, Abort, Mode Change (Auto/Manual), and modify target setpoints.

Engineers frequently encounter a limitation when trying to customize permissions: modifying the Authorization attribute on the SFC block icon in Graphics Designer does not alter the permission checks inside the opened faceplate. Clicking control buttons on the faceplate continues to query the global SFC runtime authorization level (by default, Level 5 Process controlling or Level 6 Higher process controlling).

This behavior is architectural: SFC faceplates are generic system dialogs instantiated dynamically by the SFC runtime engine (sfcrt.exe and CSFCRecipeLogic). When an operator interacts with a button on the faceplate, the internal C-script evaluates:
1. The user's membership in the WinCC User Administrator.
2. The authorization level assigned in the WinCC Explorer > SFC Configuration dialog.
3. The specific plant hierarchy area assigned to the OS picture from which the faceplate was opened.
4. The instance-specific parameterization on the SFC block in CFC (such as BA_EN, OCCUPIED, and ENAUT).

SFC Runtime Operator Authorization Hierarchy Table

The following authorization matrix defines how default WinCC authorization levels map to SFC operational actions:

WinCC Authorization LevelStandard NamePermitted SFC Faceplate OperationsConfiguration InterfaceLevel 5Process controllingStart, Hold, Resume, Reset, and Setpoint modifications in Manual modeWinCC User Administrator & WinCC Explorer SFC SettingsLevel 6Higher process controllingMode change (Auto <-> Manual), Step control mode (T, T or C, C), and Target step selectionWinCC User Administrator & WinCC Explorer SFC SettingsLevel 1100SFC Emergency OperationAbort, Emergency Stop, and Force Transition execution under interlocked conditionsWinCC User Administrator (System Level)Area-Specific Level 5/6Area-Dependent ControllingRestricts faceplate operation exclusively to operators logged into that plant unitWinCC User Administrator Area AssignmentInstance CFC Op_LevelCustom Instance PermissionOverrides standard authorization level per individual SFC chart instanceCFC Chart Object Properties / I/O Parameterization

System security note: Ensure operator workstation profiles strictly adhere to plant safety authorization matrices.

Configuring Authorization Levels in WinCC Explorer SFC Settings

To adjust the global authorization requirements for SFC faceplates across the project:

Open SFC Configuration in WinCC Explorer:
* On the OS server or single station project, open WinCC Explorer.
* In the navigation tree on the left, locate and right-click SFC.
* Select Open (or double-click) to open the SFC Settings dialog.
Configure Authorization Levels:
* Navigate to the Options or Authorization tab.
* Review the assigned authorization levels for:
- Standard Operations: Defaults to Authorization Level 5 (Process controlling).
- Advanced / Supervisory Operations: Defaults to Authorization Level 6 (Higher process controlling).
- If plant operating procedures require that only supervisors start or hold SFCs, reassign Standard Operations to Level 6 or a custom authorization level (e.g., Level 8).
Save and Synchronize:
* Click OK to apply changes to the local project database.
* If running redundant OS servers, ensure changes are performed on the Engineering Station and downloaded to both servers.

Plant-Area and Instance-Level Permission Assignment

When different operating teams must be restricted to their respective plant areas (e.g., Area A operators cannot command Area B SFCs):
1. Assign Area Permissions in User Administrator:
* Open WinCC User Administrator.
* Select the operator user group.
* Under the Authorizations tab, expand the Plant Hierarchy nodes.
* Grant Authorization Level 5 and 6 only for the specific technological areas (e.g., Reactor_1, Distillation_2).
* When an operator opens an SFC located in an unauthorized area, the faceplate command buttons remain greyed out with an unauthorized lock symbol.
2. Restrict Instance Execution via CFC Interlocks:
* Open the SFC Type or SFC Chart in CFC Editor.
* Connect process interlock signals or external authorization enable tags to block inputs ENSTRT (Enable Start), ENHOLD (Enable Hold), or BA_EN (Batch Enable).
* Setting BA_EN = 1 locks out manual operator intervention from standard OS faceplates, reserving control exclusively for SIMATIC BATCH recipes.

Verification

Confirm authorization enforcement through the following procedure:
1. Log into WinCC Runtime with an operator account assigned only Authorization Level 5 (Process controlling) for Area A.
2. Open the SFC faceplate in Area A: Confirm that Start, Hold, and Resume buttons are active, while the Mode Switch (Auto/Manual) button remains disabled.
3. Open an SFC faceplate in Area B: Confirm that all control buttons are disabled and locked.
4. Log into an engineering account with Authorization Level 6 and Level 1100: Confirm that mode changes, step selection, and emergency abort controls become fully accessible.

Limitations and Operational Precautions

Never disable Authorization Level 1100 (SFC Emergency Operation) or remove it from safety personnel, as operators must retain the ability to abort runaway batch sequences in emergencies.
Editing the graphic properties of @pg_@sfc_type.pdl directly in Graphics Designer is discouraged; manual script changes will be overwritten during subsequent OS-Project Editor runs or library updates.
Ensure client-server time synchronization is within 100 milliseconds; authentication tokens and audit trail entries in WinCC SIMATIC Logon require valid synchronized timestamps.

Engineer FAQ

Why did changing the 'Authorization' attribute on the SFC icon have no effect?

The block icon's authorization attribute only controls whether the operator is allowed to click the icon to open the faceplate window. Once the faceplate opens, permission to press internal command buttons is evaluated independently by the SFC runtime engine based on WinCC SFC settings and User Administrator rights.

Can I use SIMATIC Logon to manage SFC operator permissions?

Yes. SIMATIC Logon integrates with Windows Active Directory domains. You can map Active Directory domain user groups directly to WinCC User Administrator authorization levels (5, 6, 1100).

How do I prevent operators from switching an SFC to Manual mode during batch execution?

Interlock the SFC input ENMAN (Enable Manual) with the batch allocation signal (OCCUPIED or BA_ID > 0). When the batch system occupies the unit, ENMAN is set to 0, locking the SFC in Auto mode.