Configuring WinCC Web Navigator User Session Exclusivity and Connection Disconnection in PCS 7

SIMATIC PCS 7 WinCC Web Navigator is an enterprise multi-client web architecture where concurrent user connections are governed by scalable client access licenses rather than single-seat console exclusivity. Consequently, Web Navigator does not natively support preemptive session hijacking (where a new login automatically terminates an existing active user's connection like Windows Remote Desktop). To enforce exclusivity or disconnect redundant sessions, engineers must configure WinCC User Administrator concurrent login policies, implement automated inactivity logoff timers in the Web Configurator, or deploy global C/VBS scripts that monitor @CurrentUser and invoke ExitWinCC().

WinCC Web Navigator vs Windows Remote Desktop Architecture

In process automation plants, control engineers and system administrators frequently compare WinCC Web Navigator with Microsoft Windows Remote Desktop Protocol (RDP).

Under standard Windows Remote Desktop (on workstation OS platforms like Windows 7 or Windows 10), only a single interactive desktop session is permitted. If User B connects via RDP while User A is logged on, Windows displays a prompt and automatically drops or disconnects User A's session, giving immediate priority to the latest user.

Engineers seeking to implement this exact 'last-user-takes-priority' behavior in PCS 7 Web Navigator often discover that the official Web Navigator manual contains no settings for automatic session dropping. Understanding the architectural divergence between thin-client web visualization and desktop remoting explains why this occurs.

Why Web Navigator Does Not Preemptively Drop Sessions

WinCC Web Navigator is fundamentally an Internet Information Services (IIS) web application, not a terminal desktop session:
1. Multi-User Concurrent Licensing: Web Navigator is designed specifically to allow multiple supervisors, process engineers, and maintenance managers to view plant graphics simultaneously. Licensing is governed by concurrent client packs (e.g., 1, 3, 10, 30, or 100 client access licenses).
2. Process Safety Restrictions: In a mission-critical process control plant, preemptively terminating an operator's active screen without warning could abort an active batch adjustment or blind a technician during a critical field operation.
3. Stateless HTTP/HTTPS Transport: Web Navigator clients communicate with the Web Server via HTTP/HTTPS and XML/SOAP. The server tracks active sessions, but does not enforce priority-based session eviction unless explicitly programmed.

Comparison Table - Session Management and Exclusivity Methods

The following table compares strategies for managing user sessions, license seats, and connection exclusivity in WinCC Web Navigator.

MethodMechanismEnforces Exclusivity?Drops Inactive Sessions?Implementation ComplexityWeb Auto-Logoff TimerWinCC Web Configurator settingNoYes (After idle timeout)Zero (Built-in setting)User Admin ExclusivitySingle concurrent user setting in User AdminYes (Blocks 2nd login)NoLow (Check box in WinCC)Custom Scripted DisconnectGlobal C/VBScript evaluating @CurrentUserYes (Forces drop)YesModerate (Custom script)Windows Remote Desktop (RDP)OS-level RDP console hijackYes (Kicks 1st user)NoNot compliant with PCS 7 Web standards

Step-by-Step Implementation of Inactivity and Exclusivity Controls

To manage Web Navigator sessions effectively and prevent orphan connections from locking out users, implement the following configuration:

Configure Automatic Inactivity Logoff in Web Configurator:
* On the Web Server, open WinCC Explorer.
* Right-click Web Navigator and select Web Configurator.
* Step through the configuration wizard to the Default Settings step.
* Check Automatic logoff after inactive time.
* Set the inactivity duration (e.g., 10 or 15 minutes).
* Complete the wizard. When a web user leaves a browser idle, the server automatically terminates the session and returns the license seat to the pool.
Configure User Login Exclusivity in WinCC User Administrator:
* In WinCC Explorer, open User Administrator.
* Select the designated operator group or user profile.
* Under user properties, verify concurrent login policies.
* If an account is restricted to single-seat access, a second login attempt will be rejected with: User already logged on, preventing unauthorized parallel access.
Implement Custom Session-Dropping Script (Optional):
* If plant operating procedures mandate that a remote technician must be able to disconnect an active session:
* Create an internal binary tag: @ForceWebDisconnect.
* In the main screen (@Welcome.pdl or @Screen.pdl), configure a cyclic background script (1-second trigger):
c if (GetTagBit("@ForceWebDisconnect")) { // Log the event in alarm logging // Terminate web client runtime view ExitWinCC(); }
* An authorized supervisor can toggle this tag from an engineering terminal to force all active web browser views to close immediately.

Verification

Confirm that session management and automatic disconnection function properly:

Verify Inactivity Timeout:
* Open Internet Explorer on an office PC and connect to the Web Navigator server.
* Log in with valid operator credentials.
* Leave the browser untouched without moving the mouse or pressing keys for the configured duration (e.g., 10 minutes).
* Confirm that Web Navigator displays a session expired prompt and returns to the initial login screen.
Verify License Release:
* In WinCC Explorer on the Web Server, open Status - Web Navigator.
* Verify that the active client count decrements by 1 immediately after the session times out.
Verify Re-Login Priority:
* Immediately log back in with another user account. Confirm that access is granted without license seat rejection.

Limitations and Operational Precautions

Operator Inactivity vs Process Monitoring: Never configure overly aggressive inactivity logoff timers (e.g., less than 5 minutes) on control room client screens; unexpected logoffs during process upsets impair operator response.
Web Navigator Licensing vs OS RT Licensing: Web Navigator client access licenses (CALs) are managed independently via Automation License Manager (e.g., 6AV6381-2BD07-4AX0 or version-specific MLFB). Ensure sufficient client packs are licensed.
Commercial Accuracy Disclaimer: Always validate Web Navigator license package order numbers and concurrent seat allocations against current Siemens catalogs and authorized distributor quotations.

Engineer FAQ

Can Web Navigator be configured to limit logins to specific IP addresses?

Yes. Using Microsoft Internet Information Services (IIS) Manager on the Web Server, you can configure 'IP Address and Domain Restrictions' to restrict web access exclusively to authorized subnets or specific MAC/IP addresses.

What happens if all Web Navigator client licenses are in use?

When all licensed client seats are active, any subsequent connection attempt receives the error: 'Maximum number of clients reached. Connection rejected.' Enabling automatic logoff ensures idle seats are promptly freed.

Does closing the browser window immediately release the license seat?

Yes. When a user properly closes the browser or clicks the Logoff button, the Web Navigator ActiveX control notifies IIS, releasing the license seat instantly. If the network cable is abruptly unplugged, the server releases the seat after an internal keep-alive timeout (typically 60 seconds).

Can Web Navigator run inside Google Chrome or Microsoft Edge?

In PCS 7 V8.0 and V8.1, Web Navigator relies on an ActiveX plugin and requires Microsoft Internet Explorer (32-bit) or Edge running in 'IE Mode'. Modern PCS 7 V9.1 and higher support HTML5-based web clients.