C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Resolving Greyed-Out Picture Tree Navigation and Area Authorization Errors in WinCC OS Clients

Resolving Greyed-Out Picture Tree Navigation and Area Authorization Errors in WinCC OS Clients

In SIMATIC PCS 7 OS Clients, greyed-out Picture Tree navigation buttons and the runtime error prompt 'No authorization for this area available' when clicking alarm rows occur when the logged-in Windows domain user group has not been mapped to corresponding Plant Hierarchy area authorizations in WinCC User Administrator, or because SIMATIC Logon working environment settings are misconfigured across the client-server architecture. To resolve this, open WinCC User Administrator on the Engineering Station, import the Windows user group via SIMATIC Logon, explicitly grant 'Authorization 5 (Process controlling)' and 'Authorization 6 (Higher process controlling)' for each specific plant area, configure SIMATIC Logon on OS Clients to query the designated domain controller or OS Server, recompile the OS with 'Picture Tree', and download the project to the OS Server.

Table of Contents

Executive Summary

In SIMATIC PCS 7 distributed architectures, the Picture Tree Manager and User Administrator collaborate with SIMATIC Logon to govern operator navigation, process control permissions, and alarm acknowledgment rights across the plant hierarchy. When an operator logs onto an OS Client workstation, the runtime system evaluates the user's role against configured area permissions. A frequent commissioning fault occurs where an operator successfully authenticates, but the top-level Picture Tree hierarchy buttons remain disabled (greyed out) and clicking on alarm list entries triggers the security warning: 'No authorization for this area available.'

While system administrators often verify that the user group exists in Windows Computer Management or Active Directory, WinCC requires explicit technological area mapping. In PCS 7, access rights are segregated by plant areas (e.g., Area 1, Boiler, Fermentation). If a Windows user group is created but not granted area-specific functional permissions within the WinCC User Administrator database, WinCC automatically disables navigation to those areas to enforce safety boundaries. This technical guide analyzes the interaction between SIMATIC Logon, Windows domains, and the Picture Tree Manager, detailing the exact procedure to assign area authorizations and resolve client-server permission mismatches.

Architecture and Fundamental Mechanics

The security and authorization pipeline in SIMATIC PCS 7 operates across three coordinated layers:
1. Authentication Layer (SIMATIC Logon):
* SIMATIC Logon acts as the central authentication broker. In a Windows Domain or Workgroup environment, it queries local or domain security accounts.
* The Working Environment tab in the SIMATIC Logon configuration determines the query scope: 'This computer or a Windows domain' or 'Another computer' (pointing to the OS Server hostname).
* If an OS Client's SIMATIC Logon environment is set to local query while user accounts reside on the server, authentication may succeed using cached credentials, but group security identifiers (SIDs) fail to resolve.
2. Authorization Layer (WinCC User Administrator):
* User accounts are not configured directly in WinCC; instead, Windows user groups are mapped to WinCC User Groups.
* WinCC provides standard system authorizations:
* Authorization 1: User Administration
* Authorization 2: Activate/Deactivate Runtime
* Authorization 5: Process controlling (Standard operation: opening faceplates, switching manual/auto, acknowledging alarms)
* Authorization 6: Higher process controlling (Setpoint changes, parameter tuning, interlock overrides)
* Authorization 1000+: Plant Area Authorizations automatically created from the Plant Hierarchy (PH) folders.
3. Navigation and Picture Tree Evaluation:
* The Picture Tree Manager dynamically checks the active user's permissions against the area assigned to each picture container.
* If the user group lacks Authorization 5/6 for a specific plant area, the navigation button for that area in @Overview1.pdl is disabled (greyed out).
* In @AlarmOneLine.pdl and the alarm journal, alarms originating from unauthorized areas can still be viewed (for safety awareness), but clicking or attempting to acknowledge them triggers the system prompt: 'No authorization for this area available.'

Step-by-Step Implementation Procedure

Step 1: Align SIMATIC Logon Working Environments Across Stations

  1. On the OS Server, open Windows Start menu > Siemens Automation > SIMATIC > SIMATIC Logon > Configure SIMATIC Logon.
  2. On the Working Environment tab, ensure it is set to This computer or a Windows domain.
  3. On each OS Client workstation, open Configure SIMATIC Logon:
    * In a domain environment: set to This computer or a Windows domain.
    * In a workgroup environment without a domain controller: select Another computer and enter the exact computer name of the primary OS Server (OS_SRV01).

Step 2: Map the Windows Group in WinCC User Administrator on ES

  1. In SIMATIC Manager on the Engineering Station, open the OS project in WinCC Explorer.
  2. Open User Administrator.
  3. Ensure the option 'SIMATIC Logon' is enabled in the User Administrator properties.
  4. Click Import User Groups (or right-click Groups > Add Group).
  5. Select the newly created Windows user group (e.g., Domain\Plant_Operators).

Step 3: Assign Functional and Area-Specific Authorizations

  1. In User Administrator, select the imported user group.
  2. In the right pane, locate the authorization matrix.
  3. In the global authorizations section, check:
    * Authorization 5 (Process controlling)
    * Authorization 6 (Higher process controlling, if parameter modification is allowed)
  4. Expand the Areas section:
    * For every plant hierarchy area (e.g., RawMaterials, Reaction, Utilities), explicitly assign Authorization 5 (and 6 if permitted).
    * If an area checkbox is left blank, users in this group will be locked out of that area.
  5. Save and close User Administrator.

Step 4: Recompile the OS and Update Picture Tree

  1. In WinCC Explorer, open Picture Tree Manager.
  2. Verify that the hierarchy containers match the Plant Hierarchy in SIMATIC Manager. Select Options > Recalculate if needed.
  3. In SIMATIC Manager, right-click the OS station and select Compile.
  4. Select 'Tags and screen objects' and ensure 'Picture Tree' is checked.
  5. Complete the OS compilation.

Step 5: Download the OS Project to the OS Server and Clients

  1. Download the updated OS project from the ES to the OS Server (Target System > Download).
  2. Download the OS Client projects to each physical client station.
  3. On the OS Client, log off and log back in using the target domain credentials.

Verification

  1. On the OS Client in WinCC Runtime, press Ctrl+Shift+L or click the login button to log in with an operator account belonging to the newly configured group.
  2. Observe the runtime overview header: verify that all Picture Tree area buttons transition from greyed-out (disabled) to normal enabled state.
  3. Click each area button: confirm that WinCC navigates smoothly to the assigned process pictures.
  4. Open the active alarm list: highlight an active alarm and click it.
  5. Verify that the alarm can be acknowledged without the message 'No authorization for this area available' appearing.
  6. Click a block icon to open a faceplate and verify that operator controls (e.g., Auto/Manual toggle) are active and responsive.

Limitations and Operational Precautions

  1. User Administrator changes made on the Engineering Station do not take effect on runtime servers until an OS Compile and OS Download are performed.
  2. If Windows domain controllers are temporarily unreachable over the terminal bus, SIMATIC Logon will fall back to cached credentials; new users created while the DC is offline will fail to authenticate.
  3. Authorization 5 is required for basic alarm acknowledgment; granting only Authorization 1 or 2 will not allow operators to interact with process alarms.
  4. Do not delete standard default WinCC user authorizations (1 through 19), as internal system scripts rely on fixed authorization index numbers.

Engineer FAQ

Why are Picture Tree buttons greyed out even if the user can log in?

Authentication (logging in) only proves identity. If the user's group is not assigned Authorization 5 (Process controlling) for that specific plant area in WinCC User Administrator, the button is disabled.

What is the difference between Authorization 5 and Authorization 6?

Authorization 5 permits standard process controlling (e.g., manual start/stop, switching auto mode, acknowledging alarms). Authorization 6 permits higher process controlling (e.g., altering setpoints, tuning limits, overriding interlocks).

Why must SIMATIC Logon on OS Clients point to the OS Server in a workgroup?

In a workgroup, computers do not share a common Active Directory database. Pointing the client's SIMATIC Logon to the OS Server centralizes user validation onto the server computer.

Can I configure users directly in WinCC without SIMATIC Logon?

While classic WinCC supported internal user management, PCS 7 mandates SIMATIC Logon for FDA 21 CFR Part 11 electronic signature compliance and centralized access governance.

Does adding a new plant area require an OS compile?

Yes. Creating or renaming hierarchy folders in SIMATIC Manager requires an OS compile with 'Picture Tree' selected to generate the corresponding area authorizations and navigation containers.

Technical References

Related Articles

Related Tags

  • Picture Tree
  • WinCC User Administrator
  • SIMATIC Logon
  • Area Authorization
  • OS Client
20 respuestas