Configuring WinCC Button Password Protection Across V7 and TIA

Overview: Three Approaches to Password-Protected HMI Buttons

Accidental presses on critical HMI buttons (Reset, Delete Recipe, Force, Override, Clear Alarm Log, Manual Mode toggle) are among the top causes of unplanned downtime on packaged lines, water utilities, and skid-mounted process units. The HMI is the operator's primary surface, so guarding those buttons at the HMI layer is a legitimate engineering choice that does not require modifying PLC logic. Siemens WinCC offers three independent mechanisms to gate a button behind a credential, and they can be combined.

Choosing between these is not a stylistic decision; it is a security decision. A shared "abcd" string on an internal tag is suitable for a brownfield retrofit where the audit team will never review HMI logs. A bound operator account under SIMATIC Logon with a per-tag Operator event in the audit trail is required by most ISA-99/IEC 62443 zone-conduit audits on pharmaceutical or Tier-1 automotive lines.

Prerequisites and Planning

Before writing any C script or configuring users, decide three things on paper:

1. What is the blast radius? A Reset of a counter is recoverable; a Force of a motor starter or a Clear of the alarm archive is not. Tag the buttons by risk class: R1 (cosmetic), R2 (loss of recipe), R3 (loss of production state), R4 (safety or regulatory). Only R3+ should require a credential; R1 should rely on the popup guard only.
2. Who must be able to perform the action? Map an Authorization name (e.g., Process.Reset, Maintenance.Force) before you start clicking in the User Administration dialog. Renaming an authorization later breaks every screen that references it because the string is stored in the picture, not as a symbol.
3. How long is the session valid? WinCC V7's Logoff time field (under User Administration > Properties) defaults to 30 minutes; WinCC Unified supports per-client idle timeouts in the project settings. Decide whether the operator stays logged in for the shift or must re-authenticate per button.

Method 1 — WinCC V7 C Script on Operator-Control Enable

This is the original mechanism and is still the fastest path on a brownfield V7.x system that does not use User Administration. It does not require any project license beyond the base WinCC RT.

Step 1: Create the internal password tag

1. Open the Tag Management editor.
2. Right-click and select Add new tag.
3. Set Name to a project-specific value, for example Tag_Password_Reset. Do not reuse a tag name from another screen; the C script uses a string literal and a typo is silent.
4. Set Data type to Text tag, 8-bit character set with length 16. Do not use Text tag, 16-bit character set unless your panel firmware is Unicode-only; older Runtime versions return garbage from GetTagChar on a 16-bit tag without a leading BOM check.
5. Under Properties > Limits/Reports, leave the start value empty so the field reads blank at runtime rather than "0".

Step 2: Add the password input I/O field

1. From the Standard palette, drop an I/O Field on the screen.
2. Configure the Output/Input property to point to the tag created in Step 1.
3. Set Data format to String; tick Password input (the eye icon) so the field renders dots instead of plaintext at runtime.
4. Place a static text label "Maintenance Password" above the field; do not embed the label in the field itself, because touch recalibration on 4:3 panels can clip trailing characters.

Step 3: Bind the C script to the button

Select the Reset button. In the Properties pane, right-click Operator-Control Enable (German: Bedienbarkeit) and choose C action. Paste the following script. Adjust the literal password and tag name to match your project.

#include "apdefap.h"
BOOL _main(char* lpszPictureName, char* lpszObjectName, char* lpszPropertyName)
{
    /* Read current password entry. GetTagChar returns the runtime
       value of a text tag as a char* terminated by '\0'. */
    char* szPwd = GetTagChar("Tag_Password_Reset");

    /* Constant-time compare is not required because the input field
       is local and the attacker has no oracle. Use strcmp. */
    if (szPwd != NULL && strcmp(szPwd, "R3set!2025") == 0)
    {
        /* Return value 1 = property TRUE = button enabled. */
        return 1;
    }
    else
    {
        return 0;
    }
}

Step 4: Clear the field after use

On the same Reset button, add an event on Mouse click > Press (left):

#include "apdefap.h"
void _main(char* lpszPictureName, char* lpszObjectName, char* lpszPropertyName)
{
    /* Wipe credential from memory immediately after the action. */
    SetTagChar("Tag_Password_Reset", "");
}

Without this line, the button remains enabled for the rest of the picture-open session because the script's return value only re-evaluates when its trigger fires. A second operator walking up to the same panel within the trigger interval can re-press Reset without re-entering the password.

Method 2 — TIA Portal User Administration with Authorizations

The script-based guard is a soft deterrent. The proper mechanism in WinCC RT Professional (TIA Portal) is the User Administration editor combined with per-button Authorization strings. Every user belongs to a group, every group owns a fixed set of authorizations, and a button's Authorization property is a semicolon-separated list of authorization names.

Step 1: Define authorizations in the User Administration editor

1. In the TIA Portal project tree, expand Runtime settings > User administration.
2. Open the Authorizations tab.
3. Click Add and enter an authorization name. Use a dotted namespace so a search/replace cannot accidentally rename a sibling right: Process.Reset, Process.Force, Maintenance.ClearArchive. Authorization names are case-sensitive on the runtime side.
4. Each authorization row exposes a configurable Authorization number (0–999). Set them with gaps (10, 20, 30) so a future authorization can be inserted without renumbering the existing range.

Step 2: Create the user group and assign the authorization

1. Switch to the User groups tab.
2. Add a group (e.g., Maintenance) and tick the Process.Reset checkbox in the authorization matrix.
3. Add a sibling group Operator with no Process.* authorizations; operators see the button but it renders grayed out.

Step 3: Add individual users

1. Switch to the Users tab.
2. Add a user, set a password (minimum 8 characters; TIA Portal rejects shorter passwords on the Password field at compile time when the policy is enabled).
3. Assign the user to the Maintenance group.
4. Set Logoff time to 600 seconds for a typical shift handoff policy, or 0 for shift-persistent login.

Step 4: Bind the authorization to the button

1. Select the Reset button in the HMI screen.
2. In Properties > Miscellaneous, find Authorization.
3. Type Process.Reset. Multiple authorizations can be combined with semicolons: Process.Reset; Maintenance.ClearArchive — the user must have all of them to operate the button.
4. Compile and download the HMI station.

At runtime, an unauthenticated user sees the button greyed out. A logged-in user without the authorization also sees it greyed out. A user in the Maintenance group sees the button live, and the action is recorded in the WinCC alarm/audit log with the username.

Method 3 — WinCC Unified User Management

WinCC Unified (TIA Portal V17 and later, Unified Comfort Panels V18+) uses a different security model with two authentication surfaces:

• UMC (User Management Component) for local user administration, used for the HMI runtime.
• WinCC Unified Certificate Manager for the certificate authority that secures the Unified Runtime HTTPS channel and the OpenSSL-based user authentication tokens.

The certificate authority itself is protected with a CA password. As documented in the TIA Portal V21 update notes for WinCC Unified Certificate Manager, the CA password is requested on the first start of the runtime and on every certificate renewal. Losing the CA password requires regenerating the entire Unified PC's certificate trust chain — there is no recovery path.

Step 1: Configure UMC users

1. In the TIA Portal project tree, select the Unified PC or Unified Comfort Panel.
2. Open Runtime settings > User management.
3. Create a role (e.g., Maintenance) and tick the function rights relevant to the reset button (typically Operate plus the specific control rights for the screen).
4. Add a user, assign the role, set a password with the project's password policy (default policy: minimum 8 chars, 1 digit, 1 special).

Step 2: Use the function right on the button

Unified buttons expose a Function right property in the Properties pane under Security. Select the Maintenance role from the dropdown. The button renders disabled when the active session lacks the right.

Step 3: Configure the Certificate Manager

1. On the Unified PC, launch WinCC Unified Certificate Manager from the start menu.
2. Create a Certificate Authority; you will be prompted for the CA password. Use a 16+ character passphrase and store it in the site password vault, not on the engineering workstation.
3. Issue device certificates for each Unified client and Unified Panel. The CA password is required to sign each certificate.

Method 4 — Confirmation Popup as a Secondary Guard

Even with a credential check, a mis-tap on a touch panel with a stuck operator glove is realistic. Layer a popup on top of every R3+ action:

1. Create a separate picture (e.g., POP_ConfirmReset.pdl) containing two buttons: Confirm and Cancel.
2. On the Reset button's Click event, call OpenPictureInPopup (WinCC V7) or the equivalent Unified JavaScript UI.OpenPopup().
3. The popup's Confirm button performs the actual reset and closes itself; Cancel just closes.

Forcing both the popup and the credential is the configuration used on most skid packages in regulated industries. The popup costs nothing, the credential makes the popup less annoying because only authorized staff ever see it.

Comparison Matrix: V7 Script vs TIA User Administration vs Unified

End-to-End Walkthrough: Password-Protecting a Reset Counter Button

This walkthrough ties the previous sections together on a WinCC RT Professional V17 project.

1. Identify the tag. Reset clears the counter at PLC address DB100.DBD0. The HMI tag is HMI_Counter_Reject, type DInt.
2. Define the authorization. In TIA > Runtime settings > User administration > Authorizations, add Quality.Reset with number 50.
3. Create the group. Add group Quality Lead, tick Quality.Reset.
4. Create the user. Add user jdoe, password Qwerty!2025, assign to Quality Lead, logoff time 900 s.
5. Bind the authorization. Select the Reset button. In Properties > Miscellaneous > Authorization, enter Quality.Reset.
6. Add the popup guard. In Events > Click, add a OpenPopup function call to POP_ConfirmReset.
7. Compile and download the HMI station.
8. Test: Log in as operator (no group) — button greyed. Log out. Log in as jdoe — button live. Click — popup opens. Confirm — counter resets to 0 and popup closes.

Verification and Commissioning

Acceptance testing should cover four scenarios:

Capture screenshots of each scenario for the site's Factory Acceptance Test (FAT) report. On WinCC Unified, additionally verify the audit log entry shows the username and the timestamp in ISO-8601 UTC; this is the artifact the audit team will request.

Troubleshooting Matrix

Security Best Practices and Hardening

1. Never hard-code the password as a literal in a production C script. Use the User Administration database. The script method is a maintenance bypass for a brownfield scenario, not a permanent solution.
2. Use a 12-character minimum for any password that gates an R4 action. WinCC V7 will accept "abcd" because the field is free-form; there is no built-in complexity check. Enforce complexity externally with a documented policy.
3. Wipe the password field after the action (see Method 1, Step 4) so the credential does not linger in HMI memory.
4. Separate the credential surface. On a multi-screen project, do not reuse TagPassword for both Reset and Force; an attacker who reads the V7 project offline can find every guarded action. Use unique tag names per action.
5. Configure logoff time aggressively. Default 30 minutes is too long for an unattended panel in a public corridor; 5 minutes is the typical pharmaceutical-floor default.
6. Audit the audit log. A configured-but-never-reviewed audit log is a worse failure mode than no audit log because it gives a false sense of compliance.
7. Disable the diagnostic channel in production. WinCC RT Professional exposes a diagnostic viewer that, when logged in as Administrator, can read the project source and the User Administration database. Restrict the Administrator role to engineering accounts only.

FAQ