Resolving Inactive Process Area Permissions in PCS 7 User Administrator

When operator permissions for 'Process Controlling' (Level 5) and 'Higher Process Controlling' (Level 6) fail for specific process areas on PCS 7 OS Clients while global permissions work, and diagnostic function PCS7_UpdatePermission_V6 returns 0, the root cause is a string mismatch—typically an accidental trailing or leading space—in the technological area name between the Plant Hierarchy, Picture Tree Manager, and the WinCC Component List Editor. The permission evaluator performs an exact, case-sensitive string comparison. Resolve the failure by checking the Component List Editor in WinCC Explorer, removing accidental spaces in Plant Hierarchy folder names, running OS Compile, and reassigning area rights in User Administrator.

How PCS 7 Evaluates Area-Specific Operator Permissions

In SIMATIC PCS 7 Operator Stations, user access security is partitioned by plant areas (e.g. Area_Reactor, Area_Distillation). In WinCC User Administrator, users and groups can be granted permissions globally across the entire facility or restricted to specific operational areas:

Authorization Level 5: Process controlling (standard operation: starting motors, toggling valves, setting manual setpoints).
Authorization Level 6: Higher process controlling (advanced operation: changing PID tuning parameters, overriding alarms).

When an operator navigates to a graphic picture or clicks a faceplate, the Basic Process Control script subsystem executes internal C-functions—primarily PCS7_UpdatePermission_V6 or GetAreaPermission. The script queries the logged-in user's token, reads the area string assigned to the active screen, and checks if the user possesses permission for that specific area name. If authorized, the function returns 1 (enabling control buttons); if unauthorized, it returns 0 (locking buttons).

Mechanism of String Mismatches in Picture Tree Manager and User Administrator

When an engineer selects 'Authorisation' (global master rights) in User Administrator, the user is permitted in all areas, bypassing area string filtering. However, when selecting permissions on an area-by-area basis, subtle typographical defects break the security check:

Accidental Trailing Whitespace: An engineer renaming a Plant Hierarchy folder in SIMATIC Manager types "Area 1 " (with a trailing space to separate words). The Plant Hierarchy stores "Area 1 ".
Database Propagation: During OS Compile, Picture Tree Manager imports "Area 1 " into the SQL database table dbo.TM_Hierarchie, while graphic picture properties and block icons may register "Area 1".
Failed String Comparison: The C-script function strcmp(szUserArea, szPictureArea) performs an exact byte-for-byte comparison. Because ASCII 16#20 (space) does not match 16#00 (null terminator), the string comparison evaluates to FALSE. PCS7_UpdatePermission_V6 returns 0, rendering control buttons disabled and grayed out.

Step-by-Step Procedure to Diagnose and Resolve Area Authorization Faults

Execute the following procedure to identify and repair area string inconsistencies:

Inspect Area Strings in Component List Editor:
- In WinCC Explorer on the OS, open the Component List Editor (or open Picture Tree Manager).
- Review the list of configured process areas.
- Carefully inspect each area name for leading spaces, trailing spaces, or non-standard punctuation.
Correct Plant Hierarchy on Engineering Station:
- Open SIMATIC Manager and switch to the Plant Hierarchy view.
- Right-click the affected hierarchy folder, select Rename.
- Delete any leading or trailing whitespace (e.g. change "Area 1 " to "Area 1").
- Ensure the folder is designated as an Area in folder properties.
Execute Clean OS Compilation:
- In SIMATIC Manager, right-click the OS project and select Compile.
- In the compilation wizard, ensure Picture Tree reorganization is enabled.
- Execute the compilation to regenerate the dbo.TM_Hierarchie table cleanly.
Reconfigure User Administrator:
- Open WinCC Explorer -> User Administrator.
- Verify that the corrected area name appears in the area list.
- Re-check the authorizations (Level 5 and 6) for the target operator groups.
- Save the configuration and download changes to the OS.

Diagnostic Matrix for WinCC User Administrator Area Authorization Failures

The following table correlates authorization symptoms with underlying database causes and fixes:

Observed SymptomPCS7_UpdatePermission_V6 Return ValueGlobal Authorization BehaviorUnderlying Root CauseCorrective Engineering ActionSpecific area faceplates lockedReturns 0 (Access Denied)Works if Global selectedTrailing/leading space in Picture Tree area stringRemove whitespace in Plant Hierarchy; recompile OSAll areas locked for userReturns 0 across plantFails globallyUser group lacks Level 5/6 authorizationGrant Level 5/6 in WinCC User AdministratorPicture navigation blockedAccess denied bannerWorks if Global selectedArea name mismatch between PDL and Picture TreeReassign picture to area in Picture Tree ManagerIntermittent authorization lossFlips 1 -> 0 on client switchWorks on serverWeb Client or OS Client time/token desyncSynchronize terminal bus clocks and log off/on

[!NOTE]
Commercial Accuracy Notice: Configuring area-specific user permissions and role-based access control is a standard human-machine > interface engineering task in SIMATIC PCS 7 (6ES7658-2CX58-0YH5). Utilizing User Administrator and area security filters > consumes no additional licenses or Process Objects.

Verification

Confirm that area-specific permissions function reliably:

User Login Test: Log in to an OS Client workstation using an operator account assigned strictly to the corrected area.
Faceplate Control Test: Open a motor or valve faceplate located in that process area. Confirm that the manual operation buttons (Start, Stop, Open, Close) are fully active and responsive (not grayed out).
Cross-Area Security Enforcement: Attempt to open a faceplate in a process area where the operator lacks rights. Confirm that the faceplate controls remain locked, proving that area segregation is strictly enforced.

Limitations and Operational Precautions

Adhere to these operational best practices for area security:

Standardize Naming Conventions: Enforce strict plant hierarchy naming rules (e.g. alphanumeric characters and underscores only; no trailing spaces or special symbols).
Avoid Manual Picture Tree Edits: Always configure hierarchy and area assignments in the ES Plant Hierarchy. Manually editing Picture Tree Manager directly on the OS will be overwritten on the next OS compile.
Redundant Server Synchronization: When updating User Administrator permissions, ensure the project is downloaded from the ES so that both redundant OS servers maintain identical user security databases.

Engineer FAQ

Why did global authorization work, but area-specific authorization failed?

Global authorization grants permission unconditionally across all areas. Area-specific authorization executes an exact string comparison between the user's assigned area and the picture's area name; an accidental space breaks the string match.

What does function PCS7_UpdatePermission_V6 do?

It is an internal Basic Process Control C-script function that queries whether the currently logged-in user possesses the required authorization level for the specific plant area hosting the invoking screen.

Where can I see the exact area strings registered in WinCC?

Open WinCC Explorer and launch the Component List Editor or Picture Tree Manager. The registered area strings are displayed in the hierarchy tree.