C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

How to Restrict Interlock Bypass and Simulation Rights on PCS 7 Faceplates

How to Restrict Interlock Bypass and Simulation Rights on PCS 7 Faceplates

To prevent plant operators from bypassing safety interlocks or placing analog/digital signals into simulation mode from SIMATIC PCS 7 WinCC faceplates, configure authorization levels in WinCC User Administrator and restrict block-level permissions via parameter OS_Perm. In the Advanced Process Library (APL) and specialized industry libraries (such as CEMAT), high-privilege actions like interlock bypassing and signal simulation are decoupled from standard process control (Level 5 / 6) and tied to dedicated authorization levels (such as Level 1100 "Process controlling" and Level 1101 "Higher process controlling"). By removing these authorizations from operator user groups and masking bit permissions on technological blocks in CFC, bypass and simulation toggles appear permanently grayed out on runtime faceplates.

Table of Contents

Role-Based Access Control Architecture in PCS 7 WinCC

In process automation facilities, operational safety mandates strict role separation:
- Standard Process Control: Operators must have rights to start motors, adjust valve setpoints, and acknowledge alarms.
- Maintenance / Safety Interventions: Forcing interlock bypasses or simulating field signals overrides safety logic and must be restricted strictly to authorized instrument technicians, process engineers, or shift supervisors.
- The Dual-Enforcement Model: PCS 7 enforces authorization across two distinct barriers:
1. HMI Layer (WinCC User Administrator): Evaluates whether the currently logged-in Windows/WinCC user belongs to a group with the necessary numerical authorization privilege.
2. Controller Layer (AS Block Configuration): Evaluates the block parameter OS_Perm (Operator Permission Mask). If a specific bit in OS_Perm is set to 0, the operation is completely prohibited on that block, regardless of who logs in on WinCC.

APL and CEMAT Authorization Levels for Bypassing and Simulation

WinCC User Administrator organizes user rights into standardized authorization levels:

Authorization LevelStandard APL DesignationCEMAT DesignationOperational FunctionalityLevel 5Process controllingOperatingBasic operator commands: switching Auto/Manual, starting/stopping drives.Level 6Higher process controllingInterlockingAltering tuning parameters, alarm thresholds, and recipe targets.Level 1100Advanced process controllingExtended operatingAuthorizes placing input channel drivers into simulation mode (SimOn).Level 1101Safety & Interlock overridesBypass rightsAuthorizes setting interlock bypass flags on Intlk02, Intlk04, Intlk08.

If operators are granted Level 5 and Level 6 access but excluded from Levels 1100 and 1101, simulation checkmarks and interlock bypass buttons are automatically deactivated.

Method 1: Configuring User Groups in WinCC User Administrator

To establish site-wide security policies, configure group authorizations in WinCC Explorer:

Step 1: Open User Administrator

  1. In SIMATIC Manager, open the target WinCC OS project in WinCC Explorer.
  2. Double-click User Administrator.
  3. Expand the Groups folder in the left navigation pane.

Step 2: Configure Operator and Maintenance Groups

  1. Select the Operators group:
    - In the authorization checklist on the right pane, enable Level 5 (Process controlling).
    - Ensure that Level 6, Level 1100, and Level 1101 (or custom bypass authorization numbers) are unchecked.
  2. Select or create the Supervisors / Maintenance group:
    - Enable Level 5, Level 6, Level 1100, and Level 1101.
  3. Create individual user accounts and assign them exclusively to the Operators group.

Step 3: Verify Faceplate Authorization Tag Bindings

  1. In standard APL and CEMAT installations, standard faceplate views (@pg_*.pdl) read internal authorization tags linked to the logged-in user.
  2. Save the configuration and close User Administrator.
  3. On distributed OS Client-Server systems, ensure User Administrator changes are saved on the master OS project and downloaded to OS Clients.

Method 2: Enforcing Block-Level Restrictions via OS_Perm in CFC

If specific critical drives (such as reactor agitators, high-pressure relief valves, or kiln burners) must never be bypassed under any circumstances—even by an engineer—configure the controller block mask:

Step 1: Locate Parameter OS_Perm on the Technological Block

  1. Open the CFC chart containing the target block (e.g., MotL, VlvL, Intlk08).
  2. Locate the 32-bit input parameter OS_Perm (or OS1Perm).
  3. Expand the parameter to reveal individual boolean permission bits.

Step 2: Mask Simulation and Bypass Bits

In the APL Intlk08 interlock block:
- OS_Perm.Bit1 (Bypass): Controls whether operator bypassing is permitted. Set to 0 (FALSE) to permanently disable bypass functionality for that interlock block.
In channel driver blocks (Pcs7DiIn, Pcs7AnIn):
- OS_Perm.Bit1 (Simulation): Controls whether software simulation (SimOn) can be toggled from the OS. Set to 0 to lock the block to physical I/O readings.
4. Save the chart and perform a CFC Change Download to the AS CPU in RUN mode.

Verification

To verify that unauthorized access is successfully blocked:
- Log into WinCC Runtime using a standard operator account.
- Open a motor faceplate: confirm that the operator can start and stop the drive in Manual mode.
- Navigate to the Interlocks view on the faceplate: confirm that the Bypass checkbox is grayed out and cannot be clicked.
- Navigate to the Preview / Simulation tab on the associated channel driver faceplate: confirm that the Simulation toggle button is disabled, displaying a padlock or grayed-out state.
- Log out and log in with an authorized Maintenance/Supervisor account: verify that the Bypass and Simulation controls instantly become enabled and operational.

Limitations and Operational Precautions

  • Auditing Safety Bypasses (FDA 21 CFR Part 11): In regulated industries, every interlock bypass must generate an audit trail event. Ensure that SIMATIC Logon and WinCC Audit are active to record the electronic signature and justification whenever an authorized technician enables a bypass.
  • SIMATIC Logon Integration: If the plant uses SIMATIC Logon connected to Windows Active Directory (AD), configure role mapping in the SIMATIC Logon Configuration tool so that corporate domain groups map to the identical WinCC authorization numbers.
  • Emergency Field Overrides: Restricting software bypasses does not replace physical hardwired emergency stop safety circuits (SIL / SIS). Never rely solely on software interlock permissions for personnel protection.

Engineer FAQ

Can an operator bypass an interlock if they know the engineering password?

Only if their user account in WinCC User Administrator possesses Level 1101 authorization. If password-protected actions are configured, entering credentials prompts a re-authentication dialog verifying user rights.

Where is the OS_Perm bit layout documented?

The complete bit mapping for OS_Perm on every block is documented in the SIMATIC PCS 7 Advanced Process Library (APL) manual under the section "Operator permissions" for each individual block type.

What is the difference between SimOn and BypAct?

SimOn (Simulation On) overrides the incoming process measurement at the channel driver block with a virtual test value. BypAct (Bypass Active) tells an interlock block to ignore a tripped interlock condition and evaluate the output as healthy.

Why do some faceplate buttons remain disabled even for administrators?

If an operational condition is locked by the PLC logic (for example, if parameter OS_Perm bit is set to 0 in CFC, or if an interlock is already tripped with Feature.Bit0 reset), the faceplate enforces the controller interlock and disables the button regardless of user privilege.

Technical References

  • Siemens Industry Online Support: SIMATIC PCS 7 Advanced Process Library (APL) Manual.
  • SIOS Entry 109742323: PCS 7 Compendium Part A - Configuration Guidelines (Section: User Rights and Security).
  • SIOS Entry 109809264: SIMATIC Process Control System PCS 7 Security Concept.
  • CEMAT System Manual: Engineering and Authorization Management in Mineral Processing.

Related Articles

Related Tags

  • User Administrator
  • Interlocks
  • Bypass
  • Simulation
  • APL
  • CEMAT
  • Industrial Automation
20 respuestas