C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Restricting Operator Access to Interlock Interfaces on CEMAT Drive Faceplates

Restricting Operator Access to Interlock Interfaces on CEMAT Drive Faceplates

To block or restrict operator access to interlock interfaces (such as ESVG or EBVG) from the diagnostic view of a CEMAT drive faceplate (C_DRV_1D), configure the instance-specific authorization attributes on the drive's block icon and enforce WinCC User Administrator privileges. In WinCC Graphics Designer, open the block icon's Object Properties, navigate to Miscellaneous, and set HigherProcesscontrolling_backup (or Processcontrolling_backup) to an elevated authorization level that standard operators do not possess. Alternatively, interlock jump navigation can be suppressed by modifying the CFC parameterization to disconnect dynamic faceplate references or by hiding specific diagnostic buttons within the CEMAT screen configuration.

Table of Contents

Executive Summary

In heavy industrial environments operating under Siemens CEMAT, operational integrity often requires restricting plant operators from accessing, viewing, or overriding sensitive interlock logic. Standard CEMAT drive faceplates (C_DRV_1D) expose diagnostic buttons—such as ESVG (Start Interlock General) and EBVG (Operating Interlock General)—that allow users to jump directly to subordinate interlock faceplates (C_INTER5 or C_INTERL). When process safety or plant governance mandates that standard control room operators cannot open these interlock diagnostic screens, automation engineers must implement systematic access control. This guide presents the configuration methodologies available in CEMAT and WinCC to restrict interlock access through WinCC User Administrator privileges, block icon attribute overrides, and CFC block parameterization.

Architecture and Fundamental Mechanics

Security Architecture for CEMAT Diagnostics

CEMAT utilizes a multi-tiered security model combining WinCC User Administrator privilege levels with instance-specific block icon attributes.

+-------------------------------------------------------------------------+
|                        WinCC User Administrator                         |
|                                                                         |
|   [Standard Operator Group]            [Shift Supervisor / Engineer]    |
|   - Level 5: Process controlling       - Level 5: Process controlling   |
|   - Level 6: DISABLED                  - Level 6: Higher controlling    |
+-------------------------------------------------------------------------+
                                    |
                                    v
+-------------------------------------------------------------------------+
|                       WinCC Graphics Designer                           |
|               Drive Block Icon (@PCS7Typicals_Cemat.pdl)                |
|                                                                         |
|   Property Group: 'Miscellaneous'                                       |
|   - Processcontrolling_backup       = 5  (Standard drive commands)      |
|   - HigherProcesscontrolling_backup = 6  (Interlock & Diagnostic Jumps) |
+-------------------------------------------------------------------------+
                                    |
                                    v
+-------------------------------------------------------------------------+
|                Runtime Action: Operator clicks 'ESVG'                   |
|                                                                         |
|   Script evaluates logged-in user against HigherProcesscontrolling:     |
|   - If User has Level 6  ==> Opens @PG_C_INTER5.pdl                     |
|   - If User lacks Level 6 ==> Operation BLOCKED (Access Denied Dialog)  |
+-------------------------------------------------------------------------+

When an operator clicks an interlock target in @PG_C_DRV_1D_DIAG.pdl, the underlying C-action calls CematCheckAuthorization(). This function evaluates whether the active user token possesses the numeric privilege level stored in HigherProcesscontrolling_backup. By elevating this attribute value or revoking the corresponding level from operator user accounts, engineers enforce security without altering the underlying PLC safety logic.

Step-by-Step Implementation Procedure

Step 1: Define Authorization Roles in WinCC User Administrator

  1. In WinCC Explorer, open User Administrator.
  2. Review your configured user roles:
    - Operators: Assign Authorization Level 5 (Process controlling) but uncheck Authorization Level 6 (Higher process controlling).
    - Supervisors / Maintenance Engineers: Assign both Authorization Level 5 and Authorization Level 6.
  3. Save and close User Administrator.

Step 2: Configure Block Icon Instance-Specific Authorization Attributes

  1. In WinCC Graphics Designer, open the process graphic containing the motor block icon (e.g., Plant_Area_A.pdl), or edit the prototype in @PCS7Typicals_Cemat.pdl if applying globally.
  2. Select the C_DRV_1D block icon and open Object Properties.
  3. In the left tree, select the Miscellaneous property container.
  4. Locate the attribute HigherProcesscontrolling_backup.
  5. Set this attribute to 6 (or a dedicated custom authorization level, such as 110 for Process Safety Engineering).
  6. Ensure Processcontrolling_backup remains set to 5 so standard operators can still start and stop the drive normally.
  7. Save and close the picture.

Step 3: Global Suppression via Faceplate Configuration (Alternative Method)

  1. If plant standards require permanently hiding interlock buttons from all users on a specific station (e.g., local field panel OS clients):
  2. Open @PG_C_DRV_1D_DIAG.pdl in Graphics Designer.
  3. Select the interlock button object (e.g., btn_ESVG).
  4. Under Properties > Miscellaneous > Visible, configure a dynamic script or tag connection linked to client workstation identity or user role, setting visibility to FALSE for unauthorized client types.
  5. Save the modified screen.

Step 4: CFC Parameterization to Restrict Remote Faceplate Interconnections

  1. In CFC, open the chart containing the C_DRV_1D block.
  2. If an interlock is purely hardwired or managed internally and should not be exposed to the HMI:
  3. Interconnect the interlock logic into the drive's protective input, but configure the CEMAT message mask parameter to suppress operator diagnostic drill-down.
  4. Perform a Changes Only compilation of the CFC chart and OS.

Verification

  1. Operator Account Test: Log into WinCC Runtime with a standard Operator account (Level 5 only). Open the C_DRV_1D faceplate, navigate to the Diagnostics page, and click the ESVG button. Verify that the click is ignored or displays an 'Insufficient Authorization' message, and the C_INTER5 faceplate does not appear.
  2. Supervisor Account Test: Log in with an Engineer or Supervisor account possessing Level 6. Click ESVG on the same faceplate and confirm that the C_INTER5 interlock faceplate opens with full diagnostic details.
  3. Audit Trail Verification: Check the WinCC Alarm Logging / Operation Messages window to ensure unauthorized attempts are logged if operation message logging is enabled.

Limitations and Operational Precautions

  1. Emergency Maintenance Access: Completely disabling interlock diagnostic navigation can slow down fault-finding during unscheduled plant shutdowns. Ensure maintenance personnel have designated high-privilege credentials available.
  2. Screen Overwrites during Updates: Modifying @PG_C_DRV_1D_DIAG.pdl directly will be overwritten if the OS Project Editor is executed. Use block icon properties or project-specific faceplate variants to preserve settings.

Engineer FAQ

How do I block access to C_INTER5 without modifying scripts?

Assign Authorization Level 6 to HigherProcesscontrolling_backup on the drive block icon and revoke Authorization Level 6 from the operator group in WinCC User Administrator.

Can standard operators still start and stop the motor?

Yes. Start, stop, and manual commands require only Processcontrolling_backup (Level 5), which remains enabled for operators.

What is the difference between Level 5 and Level 6 in WinCC?

Level 5 is 'Process controlling' (routine operator actions), while Level 6 is 'Higher process controlling' (tuning, interlocking inspection, and setpoint limits).

Can I assign a custom authorization level above 16?

Yes, WinCC allows defining custom user rights from 17 up to 999 in User Administrator and referencing them in CEMAT backup attributes.

Will changing block icon attributes require a full OS compile?

No, block icon property modifications in Graphics Designer take effect immediately upon saving the PDL and reopening it in Runtime.

How can I hide the button completely instead of disabling clicks?

Set the button's 'Visible' property to evaluate user authorization using a dynamic C or VBS script on picture load.

Does this setting affect the PLC logic execution?

No, PLC interlock logic in the AS continues to execute deterministically regardless of HMI authorization settings.

Can I apply this restriction to all drives at once?

Yes, by modifying the template block icon in @PCS7Typicals_Cemat.pdl and running Plant Hierarchy > Create/Update Block Icons.

Where do I find the CEMAT user authorization documentation?

Refer to the CEMAT Engineering Manual, Chapter 'OS Engineering - Instance Specific Authorizations'.

What happens if an unauthorized user attempts to open the interlock?

The faceplate script evaluates the authorization failure and suppresses the call to open the subordinate window.

Technical References

Related Articles

Related Tags

  • CEMAT
  • C_INTER5
  • C_DRV_1D
  • User Administrator
  • Security
  • HigherProcesscontrolling_backup
  • Faceplate Access Control
20 respuestas