Create groups and users in the WinCC User Administrator with the authorisation levels each role needs and an automatic logout, set the Authorization property on every operable object, enable operator input messages for an audit trail, and let the PLC (ladder or SCL) release critical functions only when the authorised WinCC request and a physical key switch agree.
- Authorise objects, not people: groups carry the levels.
- Audit every value change and command.
- The PLC enforces critical rights – request AND key.
The WinCC User Administrator
The User Administrator holds groups, users and numbered authorisation levels. Objects in Graphics Designer reference a level; a user can operate the object only if their group has it. Automatic logout, password rules and, with SIMATIC Logon, central Windows accounts complete the picture.
Lab Flow: From Key Switch to a Secured WinCC Station
Every lesson in the Softwell PLC lab manual series follows the same six stages and the same address rule, so the code you write here plugs straight into the HMI lessons.
Stage 1Field Wiring and PLC Tag
| PLC tag | Address | Type | Device / comment |
|---|---|---|---|
S70_KeyMaint | %I9.6 | Bool | Maintenance key switch, 1 = MAINT |
Stage 2Input Mapping into DB_IO
// FC_InputMapping "DB_IO".S70_KeyMaint := "S70_KeyMaint";
Stage 3PLC Logic in Ladder and SCL
The same logic in SCL – use whichever your plant standard prefers; both write the same DB members that WinCC reads:
// FC_AccessControl – SCL equivalent
"DB_Access".Maint_Enable := "DB_IO".S70_KeyMaint AND "DB_Access".Maint_Req AND NOT "DB_Alarm".Any_Fault;
"T_ReqAlive"(IN := "DB_Access".Maint_Req, PT := T#10M); // request expires after 10 min
IF "T_ReqAlive".Q OR NOT "DB_IO".S70_KeyMaint THEN
"DB_Access".Maint_Req := FALSE; // never rely on WinCC alone
END_IF;
// The PLC enforces the right; WinCC only asks for it.
"DB_Manual".Jog_Allowed := "DB_Access".Maint_Enable;Stage 4Link PLC Tags to WinCC
In Tag Management add the SIMATIC S7-1200, S7-1500 Channel, create a connection with the CPU IP address, then use AS Symbols to load the PLC symbols and drag the DB members you need into a tag group. The DB members must have Accessible from HMI ticked in TIA Portal. Names and menus can differ slightly between WinCC versions.
| WinCC tag | Data type | Connection / address | Used by |
|---|---|---|---|
DB_Access_Maint_Req | Binary | symbolic | Button with level 1001 Maintenance |
DB_Access_Maint_Enable | Binary | symbolic | Maintenance panel visibility |
Stage 5User Administrator, Object Authorisation and Audit
| Group | Authorisation levels | Auto logout |
|---|---|---|
| Operators | Value input, process controlling, change screen, acknowledge alarms | 10 min |
| Maintenance | Operators + 1001 Maintenance (custom level) | 5 min |
| Administrators | All, including user administration | 5 min |
| # | Object | Properties | Tag / event |
|---|---|---|---|
| ① | Login / Logout buttons | Login dialog via a short C or VB action, or the configured hotkey | – |
| ② | Command buttons and I/O fields | Miscellaneous → Authorization; Operator-Input Message enabled | Process tags |
| ③ | Button Request maintenance | Authorization 1001 Maintenance | DB_Access_Maint_Req |
| ④ | Maintenance group | Display dynamic on Maint_Enable | DB_Access_Maint_Enable |
| ⑤ | AlarmControl (operator messages) | Filter on operator input messages for the audit view | Alarm Logging |
The panel version with backup is in HMI user administration and backup.
Stage 6Perform and Test: Login, Authorisation Levels and Audit Trail
Log in as different users and see which objects their authorisation levels unlock. Request maintenance with and without the key switch, wait for the automatic logout, and read the operator-input audit trail. Passwords are for this simulation only.
Troubleshooting
| Symptom | Likely cause | First check |
|---|---|---|
| Everyone can operate a button | No Authorization on the object | Object properties |
| Maintenance enabled without key | Release only in WinCC | PLC rung must include the key |
| No record of a change | Operator input message not enabled | Object property |
| User stays logged in | No automatic logout | User Administrator settings |
Hands-On Lab: Secure a WinCC Station and Prove the Audit Trail
Hands-on- TIA Portal and WinCC Explorer V8.1
- Estimated time: 75 minutes
Wire and declare the key switch
Declare S70_KeyMaint.
Map into DB_IO
Copy the key switch in FC_InputMapping.
Write the release in ladder and SCL
Maint_Enable from key, WinCC request and no fault; request timeout.
Load the tags into WinCC
Load DB_Access members.
Configure User Administrator and objects
Groups, users, levels, auto logout; Authorization on objects; operator input messages; login/logout buttons.
Test every role
Log in as each user, request maintenance with and without the key, check the audit trail and the auto logout.
Each role can do exactly what its levels allow, every change is recorded, and maintenance mode is impossible without the physical key.
Frequently asked questions
What are authorisation levels in the WinCC User Administrator?
Numbered rights such as user administration, value input, process controlling or acknowledging alarms. Groups get a set of levels, users belong to groups, and each screen object references the level it needs.
How do I protect a button or an I/O field?
Set its Authorization property to the required level. Without that level the object cannot be operated; add an Operator-Control Enable dynamic if it should also look disabled.
How do I get an audit trail of operator actions?
Enable operator input messages on the objects that change values or send commands, so Alarm Logging records who changed what and when, and archive those messages.
What is SIMATIC Logon?
An option that uses Windows or domain users for WinCC log-in, giving central password rules, account lock-out and an audit of log-ins across stations.
Why combine a WinCC right with a key switch in the PLC?
A password can be shared and WinCC is not the only client of the PLC. The PLC enforces maintenance mode only when the authorised request and the physical key agree.
Should the PLC logic be ladder or SCL?
The release is a three-contact rung, ideal for ladder; the request timeout is equally short in SCL. Both are shown.