Configuring PCS7 OS Operator Event Logging and Audit Trail

Configuring PCS7 OS Operator Event Logging and Audit Trail

Capturing who logged in, which operator performed which action, and which process values were modified is a regulatory, operational, and forensic requirement on any SIMATIC PCS7 plant. Every faceplate in the standard PCS7 APL (Advanced Process Library) and the older PCS7 Library writes operator actions into the WinCC message system automatically; the engineer's job is to wire this stream into the archive, the alarm view, the audit trail, and the long-term storage. This reference shows how to enable operator action recording, add user-defined operator input messages, log user-change events, and verify the audit chain end-to-end on a WinCC Runtime / PCS7 OS station.

1. Overview of Operator Event Logging in PCS7

PCS7 OS is built on SIMATIC WinCC, and WinCC ships with three message subsystems that engineers routinely confuse:

• Alarm Logging – the runtime message engine that receives, classifies, colors, acknowledges, and archives process and operator messages.
• User Administrator – the central user / group / authorization database that backs every login and every faceplate write-protection check.
• Audit (GMP / FDA-eligible) – an optional, signed logbook module that is invoked when the project is configured for electronic signature workflows. Audit is layered on top of Alarm Logging and does not replace it.

For the typical "who changed what and when" requirement, Alarm Logging is sufficient. The user-change event is published by the User Administrator; the operator-input event is published by the APL block; both messages are formatted by the message configuration and written to the message archive.

2. Architecture and Data Flow

Operator event data flows through the following chain on a PCS7 OS:

1. User logs on at the OS client – the User Administrator validates credentials against the local SIMATIC Logon or the central Windows domain.
2. User opens a faceplate and writes a setpoint – the APL block (e.g., CTRL_PID, VALVE_ANA, MOT_SPEED) detects the operator write and raises an operator-input message in the message system.
3. WinCC Alarm Logging formats the message with timestamp, user name, computer name, area, priority, and the dynamic field values (old value, new value, limit, etc.).
4. The formatted message is forwarded to the Alarm Logging runtime view and, in parallel, written to the message archive (circular or sequence archive).
5. On redundant OS servers, the message is replicated to the standby server via the WinCC redundancy sync.

The end-of-line storage is a pair of *.alg / *.udl files on the archive path, a SQL Server CC_AlgExp* database, or both, depending on the archive configuration you select in WinCC Explorer.

3. Prerequisites

Verify the WinCC/PCS7 build before proceeding. Open the WinCC Explorer and check Help > About. Mismatched ES and OS versions are the single most common reason that operator-input messages appear in the engineering but not in the runtime.

4. Enabling Operator Action Recording in the PCS7 Library Blocks

Every standard APL block exposes an input MSG_LOCK and an attribute column OperatorControlMessage. The OperatorControlMessage attribute decides whether the block raises a message when an operator writes a value.

1. Open the PCS7 OS picture tree in WinCC Explorer or, on the ES, open the master data library.
2. Right-click the block (e.g., CTRL_PID) in the CFC/SFC and select Object properties > Attributes > Operator control messages.
3. Set OperatorControlMessage = 1 (the default for APL blocks; verify it has not been overwritten by a project standard).
4. Compile the OS, then download the OS server. The compile step generates the message configuration *.mcf and merges the new message classes into Alarm Logging.

The default PCS7 message classes used for operator actions are:

5. Logging User Change (Logon / Logoff) Events

User-change events are the cornerstone of the operator audit trail. PCS7 OS subscribes to SIMATIC Logon and forwards a structured message every time a user logs on, logs off, locks the workstation, or unlocks it. The TIA Portal documentation for the equivalent TraceUserChange function on Basic / Comfort Panels and WinCC Runtime Advanced / Professional is published at the official Siemens documentation portal and applies, with the same logic, on PCS7 OS:

Example: Logging the logon and logoff events (Basic Panels, Comfort Panels, RT Advanced, RT Professional).

On a PCS7 OS station the procedure is as follows.

1. Open WinCC Explorer > Computer > Properties > Parameter on the OS server and verify the SIMATIC Logon service is referenced. The service is started by the WinCC runtime as soon as the OS is started.
2. Open SIMATIC Logon > User Administrator on the OS server and confirm the user groups and the associated WinCC authorization levels (e.g., Operator, Foreman, Process control engineer).
3. In WinCC Explorer, open Alarm Logging > Message classes and add or enable the message class System, User change. PCS7 installs the class by default; if it is missing, import it from the PCS7 master message configuration.
4. Open Alarm Logging > Messages and verify the four built-in messages are present:

   Message number (default)	Text	Trigger
   100200	@100%1@ logged on at @100%2@	Successful logon
   100201	@100%1@ logged off at @100%2@	Logoff
   100202	Workstation locked by @100%1@	Lock (screen saver / manual)
   100203	Workstation unlocked by @100%1@	Unlock

5. Compile and download the OS. The runtime will raise the corresponding user-change message every time a SIMATIC Logon event is published.

For panels and WinCC Runtime Advanced / Professional the equivalent TIA Portal function is configured under User administration > Events > TraceUserChange; the same fields – User, Logon time, Logoff time, Reason – are available.

6. Generating User-Defined Operator Input Messages

If you operate a tag that is not part of the PCS7 APL, or you want to capture a custom event such as a recipe selection, a batch phase transition, or a manual override, you generate a user-defined operator input message from the WinCC message system or from a C / VBS script.

6.1 Static configuration in Alarm Logging

1. In WinCC Explorer, open Alarm Logging and add a new message class User-defined operator.
2. Add a message text that includes the dynamic process value fields, for example:

   @1%s@ has changed recipe @2%s@ from @3%s@ to @4%s@ at @5%t@

3. Bind the message to a WinCC tag or to a script that calls the message DLL / OCX at runtime. A common pattern is to use a binary trigger tag, e.g., Recipe_Acknowledge, and raise the message on a rising edge:

' VBScript in a WinCC picture, fired on a button click
Dim userName, oldVal, newVal, ts
userName = HMIRuntime.ScopeTags("@CurrentUser").Value
oldVal    = HMIRuntime.Tags("RecipeName").Read
newVal    = HMIRuntime.Tags("RecipeSelected").Read
ts        = Now

' Raise operator-input message (text ID 100210 is project-specific)
HMIRuntime.Trace "Operator input: " & userName & " changed recipe from " _
                & oldVal & " to " & newVal & " at " & ts, _
                "UserMsg", 1, 1, 0

6.2 Dynamic message via the C / ODK API

For high-frequency or transactional events use the WinCC ODK DM_API:

// C / ODK style pseudo-call
DM_VAR_TEXT_STRUCT s;
s.msgNumber = 100210;
s.szText1   = userName;
s.szText2   = oldVal;
s.szText3   = newVal;
MSRTGetMsgTextCS(&s);
DM_SendOperatorMessage(0, 100210, s.szMsgText, 0, NULL);

6.3 Recommended message-class layout

7. Configuring the Message Archive

Operator events are worthless if they are not persisted. Configure the archive before commissioning.

1. In WinCC Explorer right-click Alarm Logging and choose Archive Configuration.
2. Select the archive type:
   • Sequence archive (circular) – the default; configurable size (1 MB to 4 GB per segment) and segment count (1 – 100).
   • Process-controlled archive – external switch (e.g., batch end) decides when a new segment is started.
3. Map a network share with adequate free space; budget at least 5 GB per year per OS server for a mid-size plant with operator messages enabled.
4. Enable Long-term archive export (segmented *.csv or SQL CC_AlgExp*) for regulatory retention. The export service runs as a Windows scheduled task on the OS server.
5. On redundant OS servers, the standby server must have the same archive path; messages are queued if the standby is offline.

8. Display and Reporting

Operator events can be inspected at runtime through three standard PCS7 controls:

• WinCC Alarm Control (online) – select the message class Operator - * in the filter, optionally filter by user, time range, or area.
• WinCC User Archive Control – for long-term queries; can be linked to MS Excel or to a third-party BI tool via ODBC.
• WinCC IndustrialDataBridge / OPC UA Historical Access – streams archived messages to a historian such as SIMATIC PCS 7 Historian or any OPC UA HDA client.

For 21 CFR Part 11 / EU GMP Annex 11 environments enable the optional Audit component in PCS7: it adds a cryptographic signature to every operator message and a tamper-evident export. Refer to the SIMATIC PCS7 Process Control System – Configuration Manual and the WinCC Audit Option documentation for the exact configuration steps.

9. Verification Procedure

Run the following checklist on the OS after every change to confirm that operator events are recorded.

1. Start the WinCC Runtime on the OS server.
2. Open the WinCC Alarm Control in the project and apply a filter for the operator message classes.
3. Log on as a known user (e.g., op_foreman); confirm a user-change message appears within 1 s with the correct user name and computer name.
4. Open an APL faceplate, change a setpoint, and confirm that a process operator-input message is raised containing the old and new value.
5. Force a custom user-defined operator input message (button click) and confirm it appears with the configured text and timestamp.
6. Stop the runtime, restart it, and confirm the archived messages are still listed in the long-term archive control.
7. Export a *.csv from the archive segment and verify the column mapping:

   Column	Content	Example
   Date / Time	Local OS time, ISO 8601	2025-02-14 09:31:07.123
   Milliseconds	0 – 999	123
   MsgNo	Message number	100210
   State	Came In / Went Out / Ack	Came In
   User	SIMATIC Logon user	op_foreman
   Computer	OS host name	OS-SRV-01
   Text	Resolved dynamic text	op_foreman changed recipe from A to B

10. Troubleshooting Matrix

11. Field-Proven Notes

• Operator-input messages are written before the value is sent to the AS. If the AS rejects the value (bad quality, area conflict) the message is still recorded with the original value. Combine the operator message with a process-value-quality message if you need a full bidirectional trace.
• For 21 CFR Part 11 deployments always enable WinCC Audit and a 4-eyes principle on critical setpoint writes. The 4-eyes check is a property of the WinCC authorization, not of the message system.
• Do not put the message archive on a deduplicated storage layer that does not honour NTFS file system change notifications. Some enterprise backup agents can keep the *.alg file open and stall the runtime.
• On multi-language projects the message text is resolved in the operator's display language at the moment the message is raised, not when it is read back. Plan localization accordingly.

12. Related Standards and References

• SIMATIC PCS 7 – Operator Station (OS) configuration manual: Siemens Industry Online Support.
• SIMATIC WinCC V7.5 / V8.0 Alarm Logging manual: Siemens Industry Online Support.
• TIA Portal – Configuring user administration – Example: Logging the logon and logoff events: Example: Logging the logon and logoff events.
• SIMATIC Logon – Installation and administration manual: Siemens Industry Online Support.
• 21 CFR Part 11, FDA Guidance for Industry – Electronic Records; Electronic Signatures. EU GMP Annex 11 – Computerised Systems.