Enforcing Read-Only Access for External OPC Clients in SIMATIC OpenPCS 7 (OPC UA and OPC DA)

In SIMATIC OpenPCS 7, denying write access to process tags for external OPC UA and OPC DA clients is achieved through layered security controls: 1) Configuring OPC UA user role permissions with digital certificates and User Token authentication, 2) Restricting Windows user group privileges via SIMATIC Logon by excluding external client accounts from the 'SIMATIC HMI' operator groups, and 3) Configuring the WinCC Tag Management access rights or removing write attributes on AS technological block parameters.

OpenPCS 7 Interface Security Architecture (OPC UA and OPC DA)

SIMATIC OpenPCS 7 serves as the standardized, manufacturer-supported gateway connecting PCS 7 automation systems to higher-level Manufacturing Execution Systems (MES), Enterprise Resource Planning (ERP), and third-party data historians.

OpenPCS 7 exposes plant data through four standard specifications:
1. OPC DA (Data Access): Classic COM/DCOM-based real-time process value streaming.
2. OPC HDA (Historical Data Access): Queries historical Tag Logging archives.
3. OPC A&E (Alarms & Events): Real-time alarm and event notifications.
4. OPC UA (Unified Architecture): Cross-platform, firewall-friendly binary protocol with integrated cryptographic signing and encryption.

In many industrial security architectures, external business networks require full read visibility of plant telemetry but must be strictly prohibited from commanding valves, motors, or modifying setpoints.

Restricting OPC UA Client Write Access via User Roles and Certificates

In OpenPCS 7 OPC UA server configuration:
* Certificate Authentication: External OPC UA clients must exchange X.509 digital certificates with the OpenPCS 7 server. Unsigned or unapproved client certificates are placed into the Rejected certificate store, preventing connection.
* User Identity Tokens: Rather than allowing anonymous access, configure the OPC UA server to enforce Username / Password authentication.
* Role-Based Access Control: In the OpenPCS 7 OPC UA configuration file (OpcUaServerWinCC.xml), map the authenticated external user credentials to a Read-Only role, revoking WriteAttribute and WriteValue permissions across all address space nodes.

Enforcing Read-Only Authorization via SIMATIC Logon and Windows Groups

For classic OPC DA and OpenPCS 7 integration, access permissions are governed by Windows User Management and SIMATIC Logon:

[Windows User Accounts on OpenPCS 7 Station]
   │
   ├─► Create Dedicated User Account: "MES_OPC_Client"
   │
   ├─► Assign Group Memberships:
   │     • Add to: "SIMATIC HMI Viewer" (Grants read/browse permissions)
   │     • DO NOT ADD TO: "SIMATIC HMI" (Operator write permission)
   │     • DO NOT ADD TO: "SIMATIC HMI Administrators" (Full administrative write)
   │
   ▼
[WinCC User Administrator Configuration]
   │  • Verify that Authorization Level 5 ("Process Controlling / Writing") 
   │    is denied to the MES_OPC_Client role
   ▼
[Runtime Enforcement]
   │  • External OPC client authenticates via DCOM or OPC UA
   │  • Read requests (OPC_READ) return STATUS_OK
   │  • Write requests (OPC_WRITE) are intercepted and rejected with E_ACCESSDENIED

Tag-Level and Block-Level Protection in PCS 7 Engineering

The table below outlines security mechanisms across the DCS architecture:

Security LayerEnforcement PointTechnical MechanismOperational EffectTransport LayerOpenPCS 7 OPC UA ServerCertificate validation & encryptionBlocks unauthorized physical network clients.User Role LayerSIMATIC Logon / WinCC User AdminWindows Group membership (SIMATIC HMI Viewer)Rejects all write commands (E_ACCESSDENIED).Tag Property LayerWinCC Tag ManagementOCM Tag Access Right parameterLocks specific tag subsets to read-only.Controller LayerS7-SCL Block AlgorithmParameter declaration in VAR_OUTPUT onlyPhysical impossibility to overwrite outputs from HMI.

Verification

To confirm that write access is properly blocked for external OPC clients:
1. Connect to the OpenPCS 7 server using a diagnostic OPC UA client (such as UAExpert or Siemens OPC Scout) utilizing the external client credentials.
2. Browse the tag hierarchy; verify that all plant variables, analog values, and binary states are readable and update dynamically.
3. Select an operational analog setpoint (e.g. TIC101.SP) and execute a synchronous write command (OPC_WRITE).
4. Verify that the OPC client receives an explicit error response: BadUserAccessDenied (0x801F0000) or E_ACCESSDENIED (0x80070005).
5. Open the WinCC and OpenPCS 7 diagnostic logs; confirm that an unauthorized write attempt was recorded in the security audit trail without altering controller memory.

Limitations and Operational Precautions

Never use classic DCOM authentication with blank passwords or anonymous guest accounts for OpenPCS 7 OPC DA. Anonymous access bypasses SIMATIC Logon role verification and may permit unauthenticated write requests. Always assign dedicated, password-protected Windows service accounts with strict minimal privileges for external software integrations.

Engineer FAQ

Can I make only specific tags read-only while allowing writes to others?

Yes. In the WinCC User Administrator, assign different authorization levels to specific tag groups or pictures. Users lacking the authorization level assigned to a specific tag will be denied write access to that tag.

Why does OPC DA write fail silently in some third-party clients?

Some legacy OPC DA clients execute asynchronous writes (IOPCAsyncIO2) without evaluating write complete callbacks. In OpenPCS 7, unauthorized writes return an error callback, but poorly designed clients may fail to display the rejection.

Does OpenPCS 7 require a separate license?

Yes. OpenPCS 7 requires an engineering and runtime license (OpenPCS 7 V8.x) installed on the OpenPCS 7 station via Automation License Manager.

Is OPC UA more secure than OPC DA for external connections?

Yes, significantly. OPC UA incorporates native cryptographic signing, 256-bit AES encryption, user authentication tokens, and traverses corporate firewalls using a single configurable TCP port (typically 4862), eliminating fragile DCOM configurations.