WinCC VBScript Operator Input Validation and Command Gating

1. Separate HMI validation from PLC command authorization

An HMI can check whether a value looks reasonable and explain why a button is unavailable. It cannot be the only layer preventing an unsafe command. Treat every HMI write as an external request that the PLC must validate.

2. Validate numeric operator input before writing a tag

Read the proposed input, confirm it is numeric, convert it explicitly and reject values outside the approved engineering range.

Function ValidateSetpoint(ByVal proposedValue, ByVal lowLimit, ByVal highLimit)
    ValidateSetpoint = False
    If Not IsNumeric(proposedValue) Then Exit Function

    Dim value
    value = CDbl(proposedValue)
    If value < CDbl(lowLimit) Or value > CDbl(highLimit) Then Exit Function

    ValidateSetpoint = True
End Function

Display the engineering unit and permitted range next to the entry field. Do not silently clamp an operator value unless the approved functional specification explicitly requires it.

3. Write only after validation and confirmation

Sub WriteApprovedSetpoint(ByVal proposedValue)
    If Not ValidateSetpoint(proposedValue, 0, 100) Then
        HMIRuntime.Trace "Setpoint rejected: invalid range" & vbCrLf
        Exit Sub
    End If

    If MsgBox("Apply setpoint " & CStr(proposedValue) & " %?", _
              vbQuestion + vbYesNo, "Confirm setpoint") = vbYes Then
        HMIRuntime.Tags("HMI_Setpoint_Request").Write CDbl(proposedValue)
        HMIRuntime.Trace "Setpoint request submitted" & vbCrLf
    End If
End Sub

Confirmation is most useful for consequential or infrequent actions. Avoid interrupting routine operation with unnecessary dialogs.

4. Gate an HMI command from displayed operating state

A button may be disabled when the displayed machine mode or readiness state is unsuitable. This gives immediate feedback but remains separate from PLC acceptance.

Function CanRequestStart()
    Dim modeValue, readyValue
    modeValue = HMIRuntime.Tags("Machine_Mode").Read
    readyValue = HMIRuntime.Tags("Machine_Ready").Read

    CanRequestStart = (modeValue = 2 And readyValue = 1)
End Function

Use explicit state values or documented constants. Avoid unexplained numeric values in production libraries.

5. Apply user authorization correctly

Configure permissions in WinCC User Administration and use the supported authorization dynamic or object-model method for the installed release. Test authorized, unauthorized, expired-session and logged-out states.

• Show why the action is unavailable.
• Log consequential command requests with user and timestamp where required.
• Never treat a hidden button as a security boundary.

6. Use request and acknowledgment tags

For important commands, use a PLC handshake instead of assuming that a successful HMI write means the action occurred.

1. WinCC writes a command request and optional request identifier.
2. The PLC validates mode, permissives and interlocks.
3. The PLC accepts or rejects the request.
4. WinCC displays acknowledgment, rejection reason or timeout.

7. Test invalid, stale and unavailable states

8. Commissioning checklist

• Document every command tag, unit, range and data type.
• Confirm the PLC validates every HMI request independently.
• Test boundary values, invalid text, communication loss and user-role changes.
• Confirm scripts do not issue repeated writes from cyclic triggers.
• Record approved behavior in the functional specification and backup.