Resolving WinCC User Authorization Failures When Opening SFC Faceplates in PCS 7

Resolving WinCC User Authorization Failures When Opening SFC Faceplates in PCS 7

When WinCC Runtime prevents standard 'Operator' users from opening SFC faceplates while allowing 'Engineer' users access, the restriction is caused by insufficient user authorization levels configured in WinCC User Administrator or SIMATIC Logon. Opening and operating SFC Visualization controls requires authorization level 5 ('Process controlling') for basic faceplate opening and parameter viewing, or level 6 ('Higher process controlling') for sequence start and control commands. To resolve the failure, open WinCC User Administrator on the Engineering Station, select the user group mapped to Operators, enable authorization levels 5 and 6 (or specific SFC Visualization authorizations), and re-download the OS project to all runtime stations.

Table of Contents

• Executive Summary
• Architecture and Fundamental Mechanics
• Step-by-Step Implementation Procedure
• Verification
• Limitations and Operational Precautions
• Engineer FAQ
• Technical References
• Related Articles
• Related Tags

Executive Summary

Role-based access control is a fundamental safety requirement in distributed control systems to prevent unauthorized manipulation of automated phase execution. In SIMATIC PCS 7 environments integrating SIMATIC Logon and WinCC User Administrator, commissioning teams frequently encounter scenarios where supervisory or engineering accounts can view and manipulate SFC faceplates normally, but plant operators cannot open the faceplates at all. When clicking an SFC block icon, the system remains unresponsive or displays an authorization error. This discrepancy stems from missing WinCC authorization rights assigned to the Windows user group representing operators. This article explains the authorization hierarchy governing SFC Visualization, identifies the mandatory permission levels, and details the alignment procedure across SIMATIC Logon and WinCC.

Architecture and Fundamental Mechanics

WinCC User Administrator Architecture, SIMATIC Logon Integration, and SFC Visualization Permissions:

• Security Model Architecture:
• SIMATIC PCS 7 relies on SIMATIC Logon as the central authentication authority, mapping Windows Active Directory (or local Windows) user groups to WinCC User Administrator permission groups.

• When an operator logs onto a WinCC Client, SIMATIC Logon validates credentials and assigns the user the authorization levels configured for their mapped group in the WinCC project.

• SFC Visualization Authorization Levels:

• Standard PCS 7 graphics utilize predefined authorization levels:

  • Level 5 (Process controlling): Grants permission to open standard faceplates, acknowledge alarms, and view operational values.
  • Level 6 (Higher process controlling): Grants permission to start, stop, pause, resume, or abort SFC sequences, and alter technological setpoints in Manual mode.
  • Level 1100+ (SFC Visualization Specific): Certain PCS 7 releases feature dedicated authorization categories for 'SFC Visualization: Display' (read-only observation of step chains) and 'SFC Visualization: Operation' (command execution).

• The Mechanism of the Opening Failure:

• The script attached to the SFC block icon (@pcs7_sfc_type_icon.pdl or @sfc_symbol.pdl) evaluates the operator's effective rights using the C-function PASSCheckLevelPermission(). If the logged-in user lacks Level 5 (or the custom level assigned to the picture window), the function returns FALSE and aborts the popup call (SSMOpenTopField()), leaving the operator unable to open the faceplate.

Step-by-Step Implementation Procedure

1. Inspect Current Group Authorizations in WinCC User Administrator:
   * Open the OS project in WinCC Explorer on the Engineering Station.
   * Double-click User Administrator in the project navigation tree.
   * In the navigation tree, locate the Groups folder.
   * Select the group corresponding to plant operators (e.g. Operators or Operating Personnel).

2. Assign Mandatory Authorization Levels:
   * In the right-hand authorization matrix, ensure the following rights are checked for the operator group:

   • Authorization 5: Process controlling (Mandatory to open the faceplate).
   • Authorization 6: Higher process controlling (If operators are permitted to start/stop sequences or change modes).
   • Authorization 1100 (or SFC: Display): Check any specific SFC rights present in the project.

3. Verify SIMATIC Logon Group Mapping:
   * In WinCC User Administrator, click SIMATIC Logon Configuration.
   * Verify that the Windows group (e.g. DOMAIN\PCS7_Operators) is correctly mapped to the WinCC Operators group.
   * Ensure that the logged-in Windows user account is an active member of that Windows security group.

4. Verify Picture Window Calling Permissions:
   * Open Graphics Designer and check the properties of the SFC block icon.
   * Verify that the property Authorization under Miscellaneous is set to 5 (Process controlling) and has not been inadvertently assigned to 6 or an administrative engineering level.

5. Save, Compile, and Download to Target OS:
   * Close User Administrator and save the WinCC project.
   * In SIMATIC Manager, perform an OS Changes Download to the OS Server and OS Clients.
   * Log out and log back in as the 'Operator' user to refresh the authorization token.

Verification

1. Log into Windows and WinCC Runtime using the standard 'Operator' credentials.
2. Locate the SFC block icon on the process overview screen.
3. Left-click the block icon; confirm that the SFC Type / SFC instance faceplate opens immediately without authorization prompts.
4. Verify that sequence status, active step, and elapsed times are visible.
5. Attempt an operator action permitted under Level 5/6 (e.g. selecting Manual mode) to confirm proper execution.

Limitations and Operational Precautions

Changes made to WinCC User Administrator on the ES do not take effect on runtime clients until an OS download is completed. If using Windows Active Directory groups via SIMATIC Logon, group membership changes require the Windows user to log off and log on again to renew their Kerberos security token.

Engineer FAQ

Which WinCC authorization level is required to open an SFC faceplate?

Authorization Level 5 ('Process controlling') is standardly required to open and view the faceplate.

Which authorization level is required to start or abort an SFC sequence?

Authorization Level 6 ('Higher process controlling') is required to issue control commands.

Why did the SFC faceplate open for the Engineer but not the Operator?

The Engineer group possessed Authorization Levels 5 and 6, whereas the Operator group lacked Authorization Level 5.

Do I need to compile the OS after modifying WinCC User Administrator?

No OS compilation is required, but an OS Download (Changes) to target OS Servers and Clients is necessary to distribute the database changes.

Can I assign custom authorization levels to specific SFCs?

Yes, in the SFC block icon properties in Graphics Designer, you can customize the 'Authorization' attribute to any level from 1 to 999.

Technical References

• SIMATIC PCS 7 SFC Visualization Manual
• SIMATIC PCS 7 WinCC User Administrator and SIMATIC Logon Guide
• SIMATIC Logon Administration Tool Manual

Related Articles

• Displaying and Configuring Timer Setpoints in PCS 7 SFC Type Faceplates
• Adopting Runtime Setpoints in SFC Types and Operating the TAKESP Control Pin in PCS 7
• Resolving WinCC OS Server Startup Hangs and Corrupted Alarm Logging Runtime Databases
• Configuring the Engineering Station (ES) PC Station and OS Project Structure in PCS 7

Related Tags

• SFC Visualization
• User Administrator
• SIMATIC Logon
• Authorization Level 5
• Process Controlling
• WinCC Runtime
• Faceplate Permissions
• PCS 7 Security