How to Configure User Rights, Password Verification, and Operator Authorization for PCS 7 Faceplates

In SIMATIC PCS 7 V8.1, protecting critical operator actions (such as setting an interlock bypass bit M60.0 or starting high-pressure machinery) with user authorization and password verification is achieved through the integrated WinCC User Administrator and APL operator permissions. Rather than prompting for a manual password on every mouse click, PCS 7 enforces role-based access control (RBAC). In WinCC Graphics Designer, assigning authorization level 'Process Controlling' (Level 5) or 'Higher Process Controlling' (Level 6) to the button's 'Authorization' property automatically blocks unauthorized users and displays 'You are not authorized for this action'. If a direct password prompt is mandatory, an electronic signature dialog can be invoked via standard WinCC C-actions.

Role-Based Access Control Architecture in SIMATIC PCS 7

In regulated pharmaceutical and chemical manufacturing facilities, preventing unauthorized process overrides is a strict regulatory mandate (FDA 21 CFR Part 11 / EU Annex 11):
* The PCS 7 Architectural Philosophy:
* Operators log into an OS Client once per shift using their personal Windows or WinCC credentials.
* Every technological block icon, faceplate button, and manual override pin evaluates the active user's permissions dynamically.
* If the logged-in user lacks adequate privileges, the control button is disabled, greyed out, or displays: You are not authorized to perform this operation.
* Centralized vs Local Authorization: Configured centrally on the Engineering Station inside WinCC User Administrator and distributed across all OS Servers and Clients.

WinCC User Administrator Levels (Level 5 and Level 6)

PCS 7 standardizes operator authorization across predefined authorization tiers:

Authorization Level 5: Process Controlling:
Standard plant operator level.
Permits routine actions: changing manual/automatic modes, adjusting normal PID setpoints, starting/stopping standard pumps and agitators.
Authorization Level 6: Higher Process Controlling:
Supervisor, lead operator, and process engineer level.
Required for high-risk operations: overriding interlocks, bypassing safety trips, changing critical recipe parameters, forcing digital bits (e.g., M60.0).
Authorization Level 1100+: SIMATIC BATCH & Electronic Signatures:
Special permissions governing recipe release, electronic sign-off, and audit trail annotations.

Configuring Authorization Properties on Graphic Screen Objects

To secure a custom button or faceplate object with Level 6 authorization:

Assign Authorization in Graphics Designer:
* Open the target picture in Graphics Designer.
* Select the button or operator input field.
* Open the Properties window: select Miscellaneous > Authorization.
* Double-click Authorization: select Higher process controlling (Level 6).
Configure Button Click Action:
* In the Event tab under Mouse > Mouse Click, attach the action that sets bit M60.0:
c // C-Action to set marker bit M60.0 safely SetTagBit("M60.0", 1);
Automatic System Enforcement:
* If a user with Level 5 attempts to click the button, WinCC automatically inhibits execution and posts a system message without running the script.

Implementing Electronic Signatures and Dynamic Password Prompts

If regulatory compliance strictly demands that an operator re-enter their password before asserting M60.0:

Deploying SIMATIC Logon:
* Install SIMATIC Logon on the OS Clients and Servers.
* SIMATIC Logon integrates WinCC user administration with corporate Active Directory / Windows user accounts.
Calling the Electronic Signature Dialog:
* In the button's C-action, call the standard SIMATIC Logon verification function:
```c
#include "apdefap.h"
void OnClick(char lpszPictureName, char lpszObjectName, char* lpszPropertyName)
{
BOOL bAuthorized = FALSE;
// Query SIMATIC Logon for Level 6 password re-authentication
bAuthorized = PWRTCheckPermission(6, TRUE); // 6 = Higher Process Controlling, TRUE = Prompt Dialog

if (bAuthorized) {
SetTagBit("M60.0", 1);
} else {
MessageBox(NULL, "You are not authorized to perform this action", "Security Alert", MB_ICONSTOP);
}
}
```
3. Audit Trail Logging:
* SIMATIC Logon records the electronic signature event, user ID, timestamp, and action directly into the WinCC Alarm Logging audit trail.

Comparison of Operator Authorization Methods in PCS 7

The table below compares operator authorization strategies deployed on PCS 7 operator stations.

Authorization StrategyUser FrictionRegulatory ComplianceImplementation ComplexityBest ApplicationRole-Based (Level 5/6)Zero (Log in once per shift)High (Standard DCS practice)Minimal (Assign property)Standard motor/valve operationsElectronic SignatureModerate (Re-enter password)Maximum (FDA 21 CFR Part 11)Moderate (PWRT script)Safety bypasses & recipe editsPhysical Key-SwitchPhysical key requiredHighHardware wiringLocal cabinet emergency actionsHardcoded Script PasswordHighProhibited (Zero Security)Poor engineeringNever permissible in DCS

Verification

To confirm that password protection and user rights function properly:
1. In WinCC User Administrator, configure User A with Level 5 rights and User B with Level 6 rights.
2. Log in as User A: click the protected button.
3. Verify that WinCC denies the action and displays You are not authorized to perform this operation, while tag M60.0 remains 0.
4. Log out and log in as User B: click the protected button.
5. If electronic signature is configured, confirm that the password prompt dialog appears.
6. Enter User B's password: confirm that verification succeeds, tag M60.0 transitions to 1, and an audit trail entry is logged in WinCC Alarm Logging.

Limitations and Operational Precautions

Never hardcode user passwords in C-actions or VBScripts; hardcoded credentials violate cybersecurity standards and can be viewed by anyone opening Graphics Designer.
Do not bypass SIMATIC Logon by creating unauthenticated Windows accounts on client stations.
Ensure that the automatic screen lock timer (e.g., 10 minutes of operator inactivity) is configured in WinCC to prevent unattended operator stations from being misused.
Always validate final software licensing, SIMATIC Logon options, and system security documentation against the applicable Siemens catalog and authorized distributor quotation.

Engineer FAQ

Can I use Windows domain accounts for WinCC faceplate authorization?

Yes. SIMATIC Logon enables Windows domain users and Active Directory security groups to map directly to WinCC authorization levels (Level 5, Level 6).

Why did the authorization popup say 'Insufficient rights' even for the Administrator?

The local Windows Administrator account must be explicitly added to the WinCC Administrators user group and granted Level 5 and Level 6 permissions in WinCC User Administrator.