Create user groups in the User administration editor, assign an authorisation to each group, then attach that authorisation to the screen objects it protects. Set logoff time so an unattended panel does not stay logged in, configure runtime start behaviour and screensaver, and take a full backup of the panel image and project before handover.
- Protect by group and authorisation, never by hard-coded passwords inside scripts or screens.
- An automatic logoff time is what actually enforces security on a shop floor panel.
- A backup you have never restored is not a backup; test the restore before the machine ships.
User Groups and Authorisations
Open the User administration editor. It has two parts: users, who are individual people, and groups, which carry the actual rights. Rights are always assigned to groups, and users inherit them by membership.
| Group | Typical authorisation | Can do |
|---|---|---|
| Operator | Operate | Start, stop, acknowledge alarms, view screens |
| Setter | Adjust | Change setpoints, load recipes, jog in manual |
| Maintenance | Service | Force outputs, view diagnostics, reset counters |
| Engineering | Administer | User management, runtime settings, backup |
Four groups cover most machines. Resist the temptation to create a group per person; a leaver then means editing rights rather than deleting a user.
Password policy
Set a minimum password length and an expiry period in the runtime settings if the site requires it. Set logout time per group as well, so a maintenance login does not stay active for the rest of the shift after the engineer walks away.
Never build a password into a script or a comparison against a fixed string in a screen. It cannot be changed without the engineering software, and it will end up written on the panel enclosure.
Protecting Screen Objects and Commands
An authorisation only does something once it is attached to an object. Every button, I/O field and symbolic field has a Security section in its properties where an authorisation is selected.
Decide what to protect based on consequence rather than habit:
- Always protect: manual jog commands, output forcing, counter resets, recipe editing, user management, parameter screens.
- Usually protect: setpoint entry, mode change to manual, alarm suppression.
- Rarely protect: screen navigation, alarm acknowledgement, viewing trends and reports.
Protecting navigation is a common mistake. An operator who cannot even look at a diagnostic screen calls maintenance for information they could have read themselves.
The Enable and Visibility animations can also react to the logged-in group, so a protected button appears greyed out rather than prompting for a login the operator will never pass. Combine this with the mode gating from HMI buttons, lamps and mode selection.
Learn panel security and handover in class
Practical Siemens HMI sessions covering users, runtime configuration, backup and commissioning documentation.
Runtime Settings That Matter on Site
Runtime settings decide how the panel behaves when nobody is configuring it. Open the Runtime settings of the HMI device and work through each page.
| Setting | Why it matters |
|---|---|
| Start screen | The screen shown at power-up; make it the overview, not a diagnostic page |
| Screensaver and backlight | Extends display life; keep the backlight timeout longer than a normal task |
| Logoff time | Automatic logout after inactivity; the real enforcement of user rights |
| Alarm settings | Buffer size and overflow behaviour for the alarm history |
| Language settings | Runtime language and the languages available for switching |
| Transfer settings | Whether remote transfer is allowed during runtime; disable on production panels |
| Screen keyboard | Layout and behaviour of the on-screen keypad |
Leaving remote transfer enabled on a live production panel is a common finding in plant audits. Disable it and re-enable only when a download is planned.
Panel Backup, Restore and Handover
A panel will eventually fail, and the machine will be down while somebody looks for the project file. Prepare for it before handover.
What to back up
- The complete TIA Portal project archive, including the PLC program and HMI.
- A panel image backup taken with ProSave or the backup function in the panel control panel.
- Recipe data records and user administration data, which live on the panel and are not in the project.
- The runtime licence information for panels that require it.
Restore test
Restore the backup onto a spare panel or the same panel after a reset, and confirm the machine runs. This is the step almost everyone skips, and it is the only one that proves the backup is usable.
Handover documentation
Record the panel IP address and PROFINET name, the user groups and their rights, the storage medium used for logs and recipes, where the backup is stored, and the date of the last successful restore test. Add it to the machine file alongside the PLC documentation described in Siemens PLC troubleshooting.
Hands-On Lab: Secure a Panel and Take a Tested Backup
Hands-on- TIA Portal with WinCC Comfort and a panel or panel simulation
- An existing project with manual controls and a setpoint screen
- A storage medium for the backup
- Estimated time: 40 minutes
Create groups and authorisations
Add Operator, Setter, Maintenance and Engineering groups, each with its own authorisation.
Protect the right objects
Attach authorisations to jog buttons, setpoint fields, counter reset and user management, leaving navigation open.
Set logoff and runtime options
Configure a five minute logoff time, set the start screen and disable remote transfer.
Take the backup
Archive the TIA Portal project and take a panel image backup to the storage medium.
Restore and verify
Restore the backup and confirm screens, users and recipes are intact.
Rights are assigned by group, protected objects refuse an operator login, automatic logoff works, and a restore has been tested rather than assumed.
Frequently asked questions
Should rights be assigned to users or to groups?
To groups. Users inherit rights through membership, so adding or removing a person never means editing the protection on individual screen objects.
What is a sensible automatic logoff time?
Around five minutes of inactivity for elevated groups. Without it, a maintenance login stays active long after the engineer has left the machine.
Is the TIA Portal project enough as a backup?
No. Recipe records, user administration data and panel settings live on the panel itself. Take a panel image backup as well as the project archive.
Should remote transfer stay enabled on a production panel?
No. Disable it during normal operation and enable it only when a planned download is taking place.