Troubleshooting Fail-Safe Operator Acknowledgment (SWC_QOS) Faceplate Failures in S7 F-Systems

When clicking the fail-safe acknowledgment icon ('SWC_QOS') fails to open the faceplate in a client-server PCS 7 environment while mouse hover animation operates normally, the failure is caused by missing WinCC user authorization levels, client-server script component absence, or an unmatched 'IDENT' connection parameter. In S7 F-Systems, opening safety faceplates strictly requires Authorization 1100 ('Fail-safe operation') in WinCC User Administrator, identical F-Faceplate software installation across all OS Clients, and unique authorization IDs generated between the AS safety program and the OS Project Editor.

Executive Summary

In SIMATIC PCS 7 (V8.0 through V9.1) systems operating safety-instrumented functions with S7 F-Systems (V6.2 through V6.4), fail-safe operator interactions—such as fault reintegration and safety parameter adjustments—are governed by the Safe Workplace Control (SWC) architecture using block SWC_QOS and related F-faceplates. A perplexing commissioning issue occurs when the SWC_QOS block icon animates on mouse-hover, but left-clicking fails to launch the faceplate on an OS Client workstation (even though OS simulation on an engineering laptop functions). This article explains the multi-tier safety authorization architecture, the role of the IDENT parameter, and the steps to restore fail-safe faceplate operation.

Architecture and Fundamental Mechanics

Architectural Mechanics of Safe Workplace Control (SWC) Faceplates:

Multi-Tier Safety Validation Architecture:
Standard PCS 7 faceplates (e.g. MotL, VlvL) require only standard operator authorizations: Authorization 5 ('Process controlling') or Authorization 6 ('Higher process controlling').
Fail-safe faceplates governed by S7 F-Systems enforce stringent safety integrity standards (SIL 3 / IEC 61508):
1. Dedicated Safety Authorization: In WinCC User Administrator, the logged-on Windows/WinCC operator must possess Authorization 1100: Fail-safe operation (Sicherheitsbedienung). If this authorization is absent, the C-script behind the mouse-click silently aborts without displaying an error dialog.
2. Two-Operator Transaction Principle (Initiator / Confirmer): The SWC architecture supports 1-operator or 2-operator authentication. If configured for dual authorization, the interface requires independent logon credentials to initiate and confirm.
The IDENT Parameter and Connection ID:
The safety program uses the SWC_QOS block to exchange encrypted cryptographic tokens with the OS faceplate.
The input parameter IDENT on SWC_QOS must contain a unique numerical or textual identifier. During OS compilation, the OS Project Editor links this IDENT to the corresponding WinCC internal tag structure.
If IDENT is duplicated across charts or left unassigned, the WinCC faceplate loader cannot resolve the unique target instance and refuses to open.
Client/Server Software Package Deployment:
On an engineering laptop in 'OS Simulation' mode, all optional packages are installed locally in a single workspace.
In a production Client/Server architecture, the SIMATIC S7 F-Systems Faceplates software package must be installed explicitly on the Engineering Station, both OS Servers, and all OS Clients.
If client workstations lack the F-faceplate script runtime libraries (F_*.pdl and S7FSys*.dll), mouse clicks fail silently.

Step-by-Step Implementation Procedure

Step-by-Step Procedure to Diagnose and Enable Fail-Safe Faceplates:

Verify F-Faceplate Package Installation on All OS Clients:
- On each OS Client workstation, open Windows Installed Apps / Control Panel.
- Confirm that SIMATIC S7 F-Systems Faceplates (matching the F-Systems version, e.g. V6.2 or V6.4) is installed.
- If missing, run the Siemens F-Systems Faceplate installer on every client machine.
Configure WinCC User Authorizations:
- Open WinCC Explorer on the Engineering Station (or OS Server).
- Open User Administrator.
- In the authorization list, locate or create Authorization 1100: Fail-safe operation.
- Assign Authorization 1100 to the designated operator groups and active users.
- Ensure Authorizations 5 (Process controlling) and 6 (Higher process controlling) are also assigned.
Verify IDENT and Interconnections on SWC_QOS in CFC:
- Open the safety CFC chart containing SWC_QOS.
- Check parameter IDENT: Ensure it contains a unique integer value (e.g. 1, 2, 3) that is not shared with any other SWC block in the multiproject.
- Confirm that the block has the system attribute S7_m_c := 'true' and is compiled into the OS.
Run OS Project Editor and Compile OS:
- In SIMATIC Manager, select Options -> 'Compile OS'.
- In the target WinCC project, open OS Project Editor -> click OK to ensure F-faceplate picture layouts (@PG_SWC_...pdl) are updated in the project GraCS folder.
Download OS Client Project and Test:
- Download the updated WinCC projects to OS Servers and OS Clients.
- Log on with a user possessing Authorization 1100.
- Click the fail-safe acknowledgment icon; verify the faceplate opens.

Verification

Verification Procedure:
1. Faceplate Launch Check: In WinCC Runtime on the OS Client, left-click the SWC_QOS block icon. Confirm the Safe Workplace Control faceplate opens promptly.
2. Safety Action Execution: Initiate a fail-safe acknowledgment from the faceplate. Confirm that the confirmation dialog prompts for verification, accepts the user signature, and successfully resets the AS fail-safe trip condition.
3. APDFAD Diagnostics Check: If any issues persist, inspect the WinCC diagnostic file (C:\Program Files (x86)\Siemens\WinCC\Diagnostics\WinCC_Sys_01.log) for script execution errors.

Limitations and Operational Precautions

Operational Precautions and Safety Engineering Guidelines:
- Authorization Exclusivity: Never grant Authorization 1100 to generic or unauthenticated user accounts. Only certified safety operators should hold rights to execute fail-safe acknowledgments.
- Two-Operator Integrity: If plant operating rules require dual authorization (4-eyes principle), configure the faceplate properties for two-operator verification.
- Ident Uniqueness: Duplicate IDENT assignments in safety logic will corrupt faceplate routing, potentially directing acknowledgments to the wrong safety loop.

Engineer FAQ

Why did the SWC_QOS faceplate open in OS Simulation but fail on the real OS Client?

OS Simulation on an engineering PC has all F-faceplate packages installed and runs with default bypass permissions. Real OS Clients require explicit installation of S7 F-Systems Faceplates and Authorization 1100 in WinCC User Administrator.

What WinCC authorization number is required for fail-safe operations?

Authorization 1100 ('Fail-safe operation') is required for fail-safe operations in S7 F-Systems.

What is the purpose of the IDENT parameter on SWC_QOS?

IDENT provides a unique identifier linking the AS safety block to the corresponding OS faceplate tag structure.

Can standard process operators acknowledge safety trips?

Only operators assigned Authorization 1100 in WinCC User Administrator can execute fail-safe acknowledgments through SWC faceplates.

What happens if S7 F-Systems Faceplates are not installed on an OS Client?

The block icon will display on screen, but clicking it will fail silently because the required script libraries and .pdl faceplate files do not exist on the client.