Restricting Concurrent User Logins to a Single OS Station in SIMATIC PCS 7 WinCC

To restrict a specific user account so that it can only be logged into one SIMATIC PCS 7 WinCC OS station at any given time, implement a centralized session-tracking mechanism using WinCC internal tags on the OS Server coordinated by Global Script or Active Directory workstation logon restrictions. Standard WinCC and SIMATIC Logon do not natively block concurrent multi-station logins because authentication tokens operate independently per client. By monitoring the '@CurrentUser' system tag via an event script on each client and registering the active station name in an OS Server tag table, an automatic logout via 'PASSExitUser()' can be triggered if the user is already active on another machine.

Executive Summary

In regulated industrial environments and pharmaceutical plants operating under strict electronic record standards, operational compliance often mandates that privileged user accounts (such as 'Calibration', 'MaintenanceLead', or 'QualityAuditor') may only be active on a single operator station simultaneously. While SIMATIC Logon verifies user credentials against central Active Directory or local databases, it does not intrinsically limit concurrent user sessions across distributed OS Clients. This article details two robust engineering approaches: a native WinCC script-based session registration mechanism using server-side internal tags, and an enterprise Active Directory Group Policy approach restricting accounts to designated workstation hostnames.

Architectural and System Mechanics

SIMATIC WinCC OS Clients interact with user authentication through specific internal system variables and APIs:

@CurrentUser: A text tag containing the username of the operator currently logged into the local client runtime.
@LocalMachineName: A text tag containing the Windows NetBIOS hostname of the local station.
PASSExitUser(): A WinCC C-API function that immediately terminates the active operator session, reverting the client to default viewing rights.

Architectural Session Tracking Flow:
1. When an operator logs in, @CurrentUser changes from empty/default to the username.
2. A client-side script detects the tag change and reads a centralized Server tag (or queries an SQL table) that stores the active client hostname associated with that username.
3. If the server tag indicates the user is already active on Station B, the script displays a blocking dialog on Station A and executes PASSExitUser().
4. When the user logs out normally, the script clears the server registration tag.

Step-by-Step Engineering and Implementation Procedure

Step 1: Create Centralized Session Tracking Tags on the OS Server

In WinCC Explorer on the OS Server (or ES), open Tag Management.
Under Internal Tags, create a 16-bit text tag (string) named SESS_<Username>_Host for each privileged account requiring concurrency control (e.g., SESS_Calibration_Host).
Set the tag update cycle to 'Upon Change' with project-wide server scope.

Step 2: Implement Client Login Detection Script in WinCC Global Script

In Global Script (C-Editor or VBS-Editor), create an action triggered on changes to the system tag @CurrentUser:

#include "apdefap.h"
void CheckSingleLogin(char* lpszTagName)
{
    char szUser[64];
    char szLocalHost[64];
    char szServerHost[64];
    char szTrackTag[128];

    GetTagCharWait("@CurrentUser", szUser, sizeof(szUser));
    GetTagCharWait("@LocalMachineName", szLocalHost, sizeof(szLocalHost));

    // Apply restriction specifically to target accounts
    if (strcmp(szUser, "Calibration") == 0)
    {
        sprintf(szTrackTag, "OSServerPrefix::SESS_%s_Host", szUser);
        GetTagCharWait(szTrackTag, szServerHost, sizeof(szServerHost));

        if (strlen(szServerHost) > 0 && strcmp(szServerHost, szLocalHost) != 0)
        {
            // User is already active on another workstation
            MessageBox(NULL, "User is already logged in on another station!", "Access Denied", MB_ICONSTOP);
            PASSExitUser();
        }
        else
        {
            // Register current station
            SetTagCharWait(szTrackTag, szLocalHost);
        }
    }
}

Step 3: Implement Logout Deregistration Script

Ensure that when @CurrentUser transitions to empty (""), the script clears the server tag SESS_Calibration_Host to allow future logins from any authorized terminal.

Step 4: Alternative Active Directory Workstation Restriction

If IT policy allows, open Active Directory Users and Computers, locate the user account properties, select the 'Account' tab, click 'Log On To...', and specify the exact computer names where this user is permitted to authenticate.

Verification

Verify concurrency restriction:
1. On OS Client 1, log in with account 'Calibration'. Confirm that @CurrentUser updates and SESS_Calibration_Host reflects Client 1's hostname.
2. Move to OS Client 2 and attempt to log in with account 'Calibration'.
3. Verify that Client 2 displays an 'Access Denied' message and immediately invokes PASSExitUser(), returning Client 2 to logged-out state.
4. Log out from Client 1; confirm SESS_Calibration_Host clears. Verify Client 2 can now successfully log in.

Limitations and Operational Precautions

Operational precautions:
- If an OS Client machine experiences a sudden power failure or network disconnect without a clean logout, the registration tag on the server may remain locked until manually cleared by an administrator or cleared by a watchdog timeout.
- In systems utilizing multiple OS Servers, ensure session tags reside on a designated master server or synchronize via server-to-server messaging.
- Ensure emergency administrative accounts are exempt from single-session restrictions to maintain operational continuity during plant upsets.

Engineer FAQ

Q: Does SIMATIC Logon provide a native check-box for single session enforcement?

A: No. SIMATIC Logon authenticates against Windows security providers, which inherently permit concurrent network logins unless restricted via scripts or Group Policy.

Q: What happens if a client crashes while the user is logged in?

A: The session tag on the server may retain the hostname. Implementing a 15-minute inactivity watchdog or an administrative 'Force Session Reset' button clears stale sessions.

Q: Can this restriction be applied to all operator accounts simultaneously?

A: Yes, by generalizing the script to use a dynamic tag naming convention SESS_ + szUser + _Host for any authenticated user.

Q: Does `PASSExitUser()` disconnect WinCC runtime?

A: No. PASSExitUser() only logs out the current operator and resets WinCC permissions to default guest/unauthorized mode without closing runtime.

Q: Can PCS 7 APL block `OpSrv` enforce this at the AS level?

A: APL OpSrv and OSStation blocks enforce station authorization for specific equipment, but do not prevent a Windows user from opening multiple client sessions.

Technical References

Related Tags

SIMATIC Logon, Concurrent Login, WinCC Scripting, @CurrentUser, PASSExitUser

20 respuestas

Restricting Concurrent User Logins to a Single OS Station in SIMATIC PCS 7 WinCC