Configuring Siemens HMI Audit Trail and Operator Activity

Overview: Operator Activity Logging on Siemens HMI Systems

Recording operator activity on an HMI is a baseline requirement in any regulated production environment (pharmaceuticals, food and beverage, medical devices, water treatment, and most ISO 9001 audited plants). Siemens addresses this requirement in TIA Portal with the Audit Trail functionality, which is part of the optional GMP (Good Manufacturing Practice) feature set in WinCC Comfort, WinCC Advanced, WinCC Professional, and Unified Comfort Panels.

The Audit Trail writes cryptographically protected, tamper-evident records of every logged action performed at runtime. Typical entries include user logon/logoff, recipe selection, setpoint changes, operator acknowledgment of messages, screen changes triggered by the operator, and any value change made through HMI tags. Records are signed with a checksum that the WinCC viewer validates when the log is re-opened; this protects the file from post-event editing.

Hardware and Software Compatibility Matrix

For the exact list of devices that accept the GMP/Audit option, see the Siemens application example "GMP-compliant configuration with WinCC Comfort/Advanced in TIA Portal". Always cross-check against the current TIA Portal release notes for the firmware/runtime build installed on the device, because a Comfort Panel that was last commissioned with V15.1 may require a firmware update before V18 Audit options are selectable.

Licensing the Audit Trail Option

Audit Trail is delivered as a chargeable runtime option that must be transferred to every HMI device individually. Order data for the most common entries:

• 6AV2107-0HA00-0BB0 – WinCC Audit option for Comfort Panels and Unified Comfort Panels (single device, transfer license).
• 6AV2107-0HA00-0BH0 – WinCC Audit option for RT Advanced (single device).
• 6AV2107-0HA00-0BG0 – WinCC Audit option for RT Professional (single device).

Transfer the license to the panel using the Automation License Manager (ALM) before commissioning. Without the license present in the panel's license key storage, the Audit option is dimmed in the runtime settings and the project will compile with a warning "GMP-compliant logging cannot be activated." The license is bound to the SD card or internal CFast of the panel, not to the project file. Replacing the storage medium requires transferring the license again.

Prerequisites Before Configuration

1. Installed and licensed TIA Portal (V16, V17, V18, or V19 at the time of writing) with the matching WinCC Comfort/Advanced or Unified component.
2. Target HMI device from the Comfort or Unified family. A Basic Panel must be physically replaced or a different logging strategy adopted.
3. Project with configured HMI tags, screens, and a working User Administration table (this is mandatory – the Audit Trail records which user performed each action).
4. Read/write access to the storage medium where the log will reside. SD card class 10 or better, or an SMB share with a static service account.
5. Plant-side time synchronization (NTP or PLC clock) so log timestamps are comparable across devices.

Step-by-Step: Enabling the Audit Trail in TIA Portal

1. Activate GMP-compliant Runtime

In the project tree, right-click the HMI device and select Properties > Runtime Settings > GMP. Tick "GMP-compliant configuration". This flag forces TIA Portal to verify, on every compile, that the project complies with the GMP rules: all screens used at runtime must be referenced from the navigation, all tags used in screens must be declared, and any dynamic referencing through indirect addressing must be replaced with absolute tag names.

2. Configure User Administration

Open HMI Tags > User Administration (WinCC Comfort/Advanced) or Security > Users and Roles (Unified). Create at least one group, e.g. OPERATOR, and assign individual user accounts. Each user must have a unique logon name and password; group passwords are not permitted in GMP mode. Password policy is enforced: minimum length 8, complexity optional, password aging configurable under Properties > Password aging (default 90 days, recommended 60 days for FDA 21 CFR Part 11 environments).

3. Enable the Audit Trail in Runtime Settings

Navigate to Runtime Settings > Audit Trail and tick "Enable Audit Trail". The following parameters become editable:

4. Tag-Level Auditing

For each tag whose writes must be logged, open the tag properties, switch to the Audit Trail tab, and tick "Log value changes". Only writes that originate from the HMI (operator input, script, recipe transfer) are logged; PLC-originated writes are not. This is intentional and avoids flooding the log with high-frequency process data.

5. Compile and Download

Compile the HMI station. TIA Portal will warn if any tag used in a screen is missing the Audit flag and the GMP project option is enabled. Resolve each warning, then download the project to the panel (full download recommended after a project structure change). The Audit license must already be present on the panel, otherwise the runtime starts in a degraded mode where the Audit folder is created but no entries are written, and an alarm 231001 "GMP option not licensed" is raised in the message view.

Reading the Audit Log

The audit files are stored with the extension *.audit. They are not plain CSV; the format is a binary container with a header signature and per-entry HMAC signatures. To read them, use one of:

• WinCC Viewer / Audit Viewer – installed alongside WinCC Comfort/Advanced. Filters by user, time range, event class, tag, and screen.
• Audit Trail Viewer (TIA Portal > Tools > Audit Trail Viewer) – V17+ viewer that can also export the filtered result to PDF or CSV for long-term archiving.
• Programmatic export – on Unified Panels, the Audit files can be opened through the HMIRuntime.AuditTrail JavaScript API for custom export to a network archive.

Each record contains the following fields:

Timestamp | UserName | GroupName | EventClass | ObjectName | OldValue | NewValue | Comment | Checksum

Tampering with the file invalidates the checksum chain. The viewer flags the file as "Invalid signature" and lists the index of the first corrupted record. This is the property that makes the log acceptable as evidence during an FDA inspection.

Storage Sizing and Retention

Each typical event (user logon, value change, alarm ack) is 120–200 bytes. A medium-sized cell with 5 operators, 80 audited tags, and ~500 alarm acknowledgments per shift generates approximately 1.5 MB per 8-hour shift. With the default 4 MB file and 2 backups, you retain roughly 5 shifts (2.5 days) on-device. For longer retention:

• Use a network share on a Windows server with SMB signing enabled and a service account that the HMI uses for logon.
• Schedule a daily copy from the SD card to a historian (WinCC Historian, SQL Server, or simply a file share) using a Windows task that runs robocopy.
• For Unified Panels, configure the parameter AuditRemoteServerPath to write directly to the archive share.

Working With a KTP700 Basic: The Hard Limitation

If the target device is a KTP700 Basic (or any other Basic Panel), Audit Trail is not available in the firmware, and the option does not appear in the Runtime Settings. Three pragmatic paths exist:

Path A – Replace the Panel

Replace the KTP700 Basic with a KTP700 Comfort (6AV2124-1GC01-0AX0) or a Unified Comfort MTP700. The Comfort variant uses the same cutout (198 × 140 mm) and the same HMI tag configuration, so the screen layout typically ports across with a recompile. Add a Comfort Audit license and follow the steps above.

Path B – Manual Logging Through Data Logs

On a Basic Panel you can use Data Logs in combination with Scheduled Tasks and Functions to build a lightweight activity log. The result is not signed and not tamper-evident, but it meets the requirements of many non-regulated plants (ISO 9001 light, internal traceability).

1. Create a Data Log named OperatorActivity with columns: Timestamp (Date/Time), User (String), Action (String), ValueOld (String), ValueNew (String).
2. Create a function LogOperatorAction that takes the action and old/new values as parameters, reads the current user with GetUserName, and appends a row to the data log.
3. Wire the function call to the Change event of every input field that must be audited (tag properties > Events > Value change).
4. Add a "Logoff" button that triggers LogOperatorAction("LOGOFF", "", "").

Export the CSV at end of shift via the built-in Data Log viewer or by copying the file from \Storage Card SD\Logs\ using the panel's web server (RTSP/HTTP, enabled in Runtime Settings > Web Server).

Path C – Push the Log to the PLC

For a more robust chain of custody, mirror each operator action into a DB on the S7 PLC and let the SCADA layer archive it. This is the only path that gives you signed, time-stamped records without upgrading the HMI. A practical implementation:

• Define a tag structure in TIA Portal: AuditDB (array of DTL + String[32] + Real + Real + Bool) sized to the expected number of events per shift.
• On input change, call a script that packs the timestamp, user, action, and values into the array and sets a AuditTrigger bool.
• In the PLC, on rising edge of AuditTrigger, copy the array to a data block with a cyclic archive pointer and forward it to the historian (WinCC Professional, Ignition, or a custom OPC UA server).

Verification Procedure

1. Download the configured project to the HMI and start runtime.
2. Log on as a user from the operator group. Confirm that the message view shows no 231001 "GMP option not licensed" alarm.
3. Change a tagged value from a screen input field. Log off. Open the Audit Viewer and verify the entry is present with the correct user name, old value, new value, and timestamp.
4. Acknowledge an active alarm. Verify the acknowledgment is logged with the alarm number and user name.
5. Open the file with a hex editor and confirm the header signature SIEMENS AUDIT V2 (Comfort) or SIEMENS AUDIT V3 (Unified) is present.
6. Modify one byte with the hex editor, re-open in the viewer, and confirm the file is flagged as invalid. This proves the integrity check works.

Troubleshooting Matrix

Integration With PLC Time and NTP

Audit timestamps are read from the panel's local clock. If the panel is not synchronized, the Audit log cannot be correlated with PLC events or historian records. For PLC-driven systems, use the S7-1500 RD_SYS_T to push the time to the HMI through a scheduled task. For plant-wide consistency, configure the panel as an NTP client under Runtime Settings > Time > NTP and provide at least two NTP servers. The Audit Viewer displays a warning if the panel clock drifted more than 5 seconds during a session.

Security Notes for Regulated Environments

• Enable automatic logoff after a configurable idle period (default 5 minutes; recommended 2 minutes for cleanrooms).
• Disable the panel's USB maintenance port at runtime, or restrict it to authenticated admin users.
• Store the Audit files on a write-once medium (WORM NAS) for the duration of the retention period, typically 7 years for FDA 21 CFR Part 11, 5 years for EU GMP Annex 11.
• Configure the panel to log failed logon attempts; the default threshold is 3 attempts before a 60-second lockout. Increase the lockout to 300 seconds for pharmaceutical lines.
• Restrict the WinCC Engineering Station user accounts; the Audit license itself is a controlled artifact and must appear in the site's license inventory.

FAQ