Resolving PCS7_Asset_CheckPermission COM Error: WinCC Tag Area Assignment and TAGTABLEReadVarEx Dependencies

In SIMATIC PCS 7, the error 'Error: Unknown COM Error' thrown by the faceplate script function PCS7_Asset_CheckPermission occurs when a technological structure tag created manually in WinCC lacks required plant hierarchy metadata. The underlying C-API call TAGTABLEReadVarEx queries the WinCC Data Manager for the tag's Area (Anlage) attribute, User Administrator group rights, and server prefix. If a structure tag is created manually ('zu Fuß') instead of being generated via AS-OS compilation, these properties are unassigned (NULL). Setting the Area property on the structure tag in WinCC Tag Management resolves the COM exception.

Role of PCS7_Asset_CheckPermission in APL and Asset Management Faceplates

SIMATIC PCS 7 provides fine-grained operator security. When an operator clicks a block icon to open a faceplate or attempts an operational action (such as changing a setpoint, switching operating modes, or acknowledging an alarm), the faceplate script calls security functions such as PCS7_CheckPermission or PCS7_Asset_CheckPermission.

These functions verify whether the currently logged-in user possesses the required authorization level (e.g. Level 5 'Process Controlling' or Level 6 'Higher Process Controlling') specifically within the Plant Area (Anlage) where the technological block is located. In standard installations, this linkage is configured automatically by the Plant Hierarchy and AS-OS compilation engine.

Underlying Mechanics of TAGTABLEReadVarEx and WinCC Data Manager

Internally, PCS7_Asset_CheckPermission calls the low-level WinCC Data Manager API:
TAGTABLEReadVarEx(szServer, TagName, Typ, MAX_DM_TYPE_NAME + 1, Anlage, MST_STRLEN_PLANTS + 1, &Err).

This API function performs three operations:
1. Connects to the local or remote WinCC Data Manager (CCDataMgr.exe) across COM/DCOM.
2. Queries the internal tag table for the tag name passed by the faceplate tag prefix (lpszTagPrefix).
3. Reads the tag's associated metadata, notably the Anlage (Area) string and server name.

If the API receives a valid tag handle but the metadata records for Area or User Rights return an uninitialized NULL pointer, the COM marshaller catches an access violation and throws Error: Unknown COM Error into the WinCC script diagnostic log.

Root Causes: Manually Created Structure Tags and Missing Plant Area Attributes

When third-party PLCs, package units (PU), or non-PCS 7 controllers are integrated into WinCC, engineers frequently create the WinCC Structure Types and Structure Tags manually by hand ('zu Fuß') in Tag Management:

Omission of the Area Property: Manually created tags default to an empty Area string. Unlike tags compiled from CFC charts—which inherit the Plant Hierarchy folder name—manual tags have no automated area association.
Missing Standard Internal Tags: PCS 7 scripts expect internal tags such as @CurrentUser, @CurrentUserName, and @LocalMachineName. If these system variables are inaccessible or corrupt, permission evaluation halts.
Tag Prefix Mismatches: If the picture window's TagPrefix does not match the exact structure tag name, TAGTABLEReadVarEx fails to locate the record.

Configuring Area Authorization and User Rights in WinCC Explorer

To resolve permission evaluation for manually created tags:

Open WinCC Tag Management on the Engineering Station.
Locate the manually created structure tag instance.
Open the tag's properties. In the Area (German: Bereich / Anlage) field, assign the exact technological plant area name matching the Picture Tree Manager hierarchy (e.g., PU_Plant_Area).
Open WinCC User Administrator. Select the operator user group, open the Areas tab, and assign the corresponding authorization levels (e.g., Level 5 and Level 6) to the newly created area.

Tag Property Requirements for Faceplate Script Validation Matrix

The following table compares tag metadata requirements between AS-OS compiled tags and manually instantiated tags:

Tag PropertyAS-OS Compiled TagManually Created TagScript DependencyConsequence if MissingTag Name & PrefixAuto-generated from CFCManually typed in Tag MgmtFaceplate picture window linkFaceplate opens with blank valuesArea (Anlage)Derived from Plant HierarchyMust be manually typedTAGTABLEReadVarEx queryThrows 'Unknown COM Error'Server PrefixBound to OS Server packageMust match server data nameCross-client tag resolutionClient displays disconnected tagsWinCC Message IDGenerated via Message ConfigMust be linked in Alarm LoggingAlarm banner acknowledgmentAlarm buttons remain disabledUser AuthorizationsLinked via Area permissionsRequires explicit Area mappingPCS7_CheckPermissionOperator command buttons grayed out

Step-by-Step Remediation of Unknown COM Error in Faceplate Scripts

Execute the following steps to eliminate the COM error and restore faceplate permissions:

Identify the Faulty Tag: Open WinCC Diagnostics viewer (apdiag.exe) or inspect WinCC_Sys_01.log. Note the tag prefix generating the error.
Assign Plant Area: In WinCC Tag Management, select the structure tag. In the properties grid, populate the Area field with the valid area name.
Update User Administrator: Open WinCC User Administrator. Verify that the configured Plant Area exists in the Area list and that active users have the necessary authorization levels (Level 5 for operation, Level 6 for higher control).
Synchronize Picture Tree: Open Picture Tree Manager. Re-save the picture hierarchy so internal area tables rebuild.
Re-download or Refresh OS: If running on an OS Server/Client, download changes. In WinCC Runtime, reopen the faceplate and verify normal operation.

Verification

Confirm resolution through these diagnostic procedures:

Faceplate Permission Test: Open the package unit faceplate in WinCC Runtime. Verify that buttons are no longer locked or throwing script errors.
Check APDIAG Output: Run apdiag.exe and open the Output Window. Click the faceplate command buttons. Verify zero COM exceptions.
User Switch Verification: Log in as a user without Area authorization. Confirm the faceplate correctly displays disabled buttons without throwing COM errors.
Log File Audit: Confirm no new entries appear in C:\Program Files (x86)\Siemens\WinCC\Diagnostics\.

Limitations and Operational Precautions

Observe the following safeguards:

Plant Hierarchy Consistency: Do not assign arbitrary area names to tags that are not represented in the WinCC Picture Tree Manager, as this can break area-based alarm filtering.
Commercial Accuracy Disclaimer: Software order numbers (MLFBs), package structures, and hardware capacity prerequisites vary across PCS 7 versions and hardware platforms. System integrators must confirm exact software entitlements and licensing requirements against the official Siemens Catalog CA 01 and obtain an authorized Siemens distributor quotation prior to purchasing.