Standardizing Custom ESD Actions Using the PCS 7 APL Button Object

To prevent security vulnerabilities where unauthorized operators can bypass graphic button restrictions and trigger Emergency Shutdown (ESD) or high-risk actions via group displays or tag browsers, replace raw WinCC buttons with the standardized PCS 7 Advanced Process Library (APL) Button object (@APL_Button) or an OpDi01 technological block. Raw WinCC buttons lack unified security tokens. By contrast, the APL Button object binds directly to controller authorization parameters (Op_Level / OS_Perm) and evaluates WinCC User Administrator permissions within the technological block runtime. This guarantees consistent authorization enforcement, two-step execution, and audit-compliant operator logging across process graphics, faceplates, and system browsers.

Vulnerabilities of Raw Graphic Buttons for Critical Plant Actions

In industrial process safety, high-consequence operational commands—such as Emergency Shutdown (ESD) resets, deluge valve initiations, or critical interlock overrides—demand rigorous access control and tamper-proof audit logging. A common engineering flaw in PCS 7 WinCC projects is implementing these commands using raw Windows buttons or generic WinCC graphic objects configured with C or VBS scripts.

While an engineer may assign a custom authorization level (such as Level 10 'ESD Tag') to the button's properties in Graphics Designer, this protection exists solely on that specific picture. If an operator accesses the tag through alternative operational paths—such as the Measuring Point Browser, Alarm Group Displays, or the PCS 7 Tag Search—the custom graphic restriction is completely bypassed. Standard faceplate scripts evaluate standard permissions (Level 5 or Level 6), allowing unauthorized operators to fire the command.

The APL Button Architecture and Technological Security Binding

The PCS 7 APL Style Guide (Section: Displaying and operating binary values) establishes the standardized method for implementing dedicated operational pushbuttons using the APL Button object (@APL_Button) or the OpDi01 (Digital Operator Input) technological block:

Controller-Enforced Permissions: The command authorization level is configured inside the S7-400 CPU using the block's Op_Level parameter (or OS_Perm bits), ensuring the controller itself validates authority.
Universal Faceplate and Graphic Alignment: The APL Button references the technological block's authorization word. Whether clicked from an overview graphic, a dedicated faceplate, or a system diagnostic browser, the exact same authorization level is enforced.
Auditable Operator Logging (Bedienmeldung): Every actuation automatically logs an operator input message in WinCC Alarm Logging with operator username, workstation name, tag name, and exact millisecond timestamp.

Functional Comparison Matrix: Raw WinCC Button vs APL Button vs OpDi01

The following table compares approaches for implementing high-risk operator commands:

Operational FeatureRaw WinCC Graphic ButtonAPL Button Object (@APL_Button)Technological Block OpDi01Authorization EnforcementLocal Graphic Only (Easily bypassed)Unified across Graphic & FaceplateController & Faceplate EnforcedMeasuring Point Browser SecurityBypassed (Evaluates Level 5/6)Enforced 100%Enforced 100%Audit Trail (Bedienmeldung)Requires custom C/VBS scriptingAutomated standard PCS 7 messageAutomated standard PCS 7 messageTwo-Step ConfirmationCustom coding requiredNative APL OK-confirmation supportNative APL OK-confirmation supportInterlock & Permissive DisplayNoneDisplays lock / permissive statusDisplays lock / permissive status

Step-by-Step Configuration of the APL Button Object

To implement a secure ESD action conforming to the PCS 7 APL Style Guide:

Instantiate OpDi01 Block in CFC:
- In the target CFC chart, insert an OpDi01 (FB1865) block from the APL library.
- Assign a technological name (e.g., ESD_Reset_Cmd).
- Set the parameter Op_Level to the desired authorization level (e.g., 10 for custom ESD Authorization, or 6 for Higher Process Controlling).
- Interconnect the block output Out to the safety reset or controller shutdown logic.
Assign User Authorization in WinCC User Administrator:
- In WinCC Explorer, open User Administrator.
- Select the authorization level (Level 10) and assign the descriptive name ESD Authorization.
- Grant this authorization strictly to authorized safety engineers or shift supervisors; ensure standard operator profiles have this level unchecked.
Insert the APL Button in Graphics Designer:
- Open the process graphic in Graphics Designer.
- Open the APL template picture @PCS7TypicalsAPLV8.pdl (or V9).
- Copy the standardized APL Button object into your process screen.
- In the object properties, link the tag prefix or interconnect the Tag property to the OpDi01 instance.
Compile AS and OS:
- Compile CFC charts and execute an OS Compile (Changes Only) to register the tags and alarm messages.

Verification

Verify comprehensive access control:
1. Log into WinCC Runtime with a standard Operator user account (lacking Level 10).
2. Click the APL Button on the process screen; confirm that the command does not execute and displays a disabled/greyed-out state.
3. Open the Measuring Point Browser, locate ESD_Reset_Cmd, and open the faceplate. Confirm that the command button inside the faceplate is also strictly disabled.
4. Log in as an authorized Supervisor (possessing Level 10). Confirm that the button unlocks on both the graphic and faceplate.
5. Execute the command and verify that a formatted Operator Input Message is recorded in WinCC Alarm Logging.

Limitations and Operational Precautions

Style Guide Compliance: Always follow the styling recommendations in the PCS 7 APL Style Guide regarding button colors, fonts, and confirmation steps to maintain HMI consistency across the plant.
Safety System Separation: Software ESD buttons implemented in basic PCS 7 must never replace hardwired emergency stop pushbuttons required by functional safety standards (IEC 61508 / IEC 62061).
User Logout Timeouts: Ensure WinCC client workstations enforce an automatic user logout timeout (e.g., 10 minutes) to prevent unauthorized personnel from utilizing an abandoned supervisor session.

Engineer FAQ

Where do I find the APL Button object in WinCC Graphics Designer?

Standard APL button objects are located in the template pictures @PCS7TypicalsAPLV8.pdl or @PCS7TypicalsAPLV9.pdl under the button/operation typicals section.

Can an APL Button enforce two-step confirmation (clicking OK)?

Yes. The APL Button inherits the system setting from @APLCommandExecutionSteps, requiring the operator to click the button and confirm with OK before the command transmits.

Why is OpDi01 preferred over raw internal WinCC tags?

OpDi01 resides in the controller, meaning interlocks, feedback signals, operator logging, and authorization are evaluated in the safe PLC environment rather than unmanaged HMI scripts.