Restricting PID Parameter Tuning in SIMATIC PCS 7 APL Faceplates - Operator Authorization Levels and User Administrator

To prevent plant operators from modifying PID controller tuning parameters (such as Gain, TI, and TD) in SIMATIC PCS 7 Advanced Process Library (APL) faceplates while preserving their ability to adjust normal operating values (Setpoint SP and Manual Output MV), engineers must configure operator authorization levels. In PCS 7 APL, parameter inputs possess an internal authorization attribute (typically configured as Level 2 'Higher process controlling' or Level 3 'Advanced process controlling'). In WinCC User Administrator, the operator user group must be assigned Authorization Level 5 ('Process controlling') but denied Authorization Level 6 ('Higher process controlling'). Additionally, the CFC block input OS_Perm can be parameterized to explicitly lock parameter modifications at the controller level.

APL Faceplate Security Architecture and Authorization Levels

In industrial facilities, protecting PID control loops from unauthorized adjustments is vital for process safety and stability. While operators need routine access to switch operating modes (Manual vs Automatic) and enter target setpoints (SP_LiOp / SP), critical tuning parameters (Gain, TI integration time, TD derivative time) must be restricted to process control engineers.

The SIMATIC PCS 7 Advanced Process Library (APL) implements a multi-tier security model directly within the faceplate views (PIDConL, PIDConS, PIDConR). Each input field on the faceplate binds its editable state to a specific operator permission level defined in the WinCC User Administrator. If the logged-in Windows or WinCC user lacks the required authorization bit, the faceplate renders the parameter field in read-only mode (grayed out) with an invisible or disabled input button.

Configuring Authorization Levels in WinCC User Administrator

In WinCC Explorer, the User Administrator tool establishes authorization levels that map directly to APL faceplate functionalities:

Authorization Level IDStandard APL DesignationDefault Permitted OperationsTarget User GroupAuthorization 5Process controllingChange Setpoint (SP), Change Manual Output (MV), Toggle Auto/ManualOperators, Field TechniciansAuthorization 6Higher process controllingChange Alarm Limits (High/Low warnings), Reset InterlocksShift Supervisors, Lead OperatorsAuthorization 11Advanced process controllingModify Controller Parameters (Gain, TI, TD), DeadbandControl Engineers, System Administrators

To lock PID tuning for operators:

Open WinCC Explorer -> User Administrator.
Select the Operators group.
Ensure the checkbox for Authorization 5 (Process controlling) is Checked.
Ensure the checkboxes for Authorization 6 (Higher process controlling) and Authorization 11 (Advanced process controlling) are Unchecked.
Assign user accounts to their respective groups and save the configuration.

Restricting Parameter Modifications via CFC Block Properties and OS_Perm

In addition to WinCC user permissions, engineers can enforce parameter restrictions within the CFC chart using the OS_Perm (Operator Permissions) structured input or block property attributes:

The OS_Perm Bitmask: The PIDConL block features structured inputs OS_Perm and OS1Perm that evaluate bit-level operator permissions directly inside the AS program. For instance, setting OS_Perm.Bit21 = 0 revokes operator permission to modify the controller gain (Gain), disabling the input field regardless of WinCC login rights.
Block Property Authorization Levels: In the CFC editor, double-click the PID block to open block properties. Navigate to the I/O Properties tab. Locate the tuning parameters (Gain, TI, TD). In the Operator Authorization column, adjust the required level from 1 to 2 or 3. Recompile the OS so that AS-OS Engineering compiles the updated permission mask into the WinCC tag database.

Verification

Execute the following tests to verify that PID tuning parameters are securely locked:

Operator Login Validation: In WinCC Runtime, log in with a standard operator account (possessing only Authorization 5).
Setpoint Modification Test: Open the PID faceplate. Verify that the Setpoint (SP) input field allows clicking and value modification.
Parameter View Lockdown Test: Switch to the Parameter view of the PID faceplate. Verify that the Gain, TI, and TD fields are visually grayed out and clicking on them does not open the numeric input pad.
Engineer Override Test: Log in with an Engineering account (possessing Authorization 11). Open the Parameter view and confirm that the fields become active and editable.

Limitations and Operational Precautions

When restricting operator permissions, observe these operational considerations:

SIMATIC Logon Integration: If the plant utilizes SIMATIC Logon with Microsoft Active Directory, user group memberships are managed via Windows domain groups. Ensure Active Directory groups map precisely to WinCC authorization numbers.
Multi-Client Consistency: User administrator changes made on an OS Server must be propagated to OS Clients by downloading the server project or ensuring SIMATIC Logon centralizes user validation across all terminal stations.
Bypass Prevention: Do not hardcode internal parameters into custom PDL graphics. Rely exclusively on standard APL scripts to prevent bypassing user authorization checks.

Engineer FAQ

Can an operator still acknowledge alarms if Authorization 6 is disabled?

Yes. Alarm acknowledgment is governed by Authorization 5 (Process controlling) or standard WinCC alarm permissions, allowing operators to silence and acknowledge process alerts without modifying tuning gains.

Why are tuning parameters still editable after removing Authorization 6?

Check the Op_Level property of the Gain pin in CFC. If the block pin was historically set to Authorization 1 (Process controlling), it must be updated to Authorization 2 or 3 in CFC and recompiled to the OS.

What is the difference between OS_Perm and WinCC User Administrator?

OS_Perm enforces permissions within the PLC automation logic (AS), preventing modifications even from custom scripts or third-party OPC clients. WinCC User Administrator enforces permissions at the HMI graphical interface level.