Logging User Actions in WinCC: Audit Trail and Operator Messages

Siemens WinCC HMI/SCADA systems routinely perform operator input, value changes, recipe selections, screen switches, and acknowledgments. Engineering teams that need to track who did what, when, and from which client typically require that information in the same SQL-based archive the process values use, so it can be queried, exported, and audited. WinCC provides three production-ready mechanisms for this: the licensed Audit Trail option, the user-defined operator message subsystem, and VBS / C action scripting with manual HMIRuntime.Trace / archive writes. This reference compares the three mechanisms, gives commissioning-grade configuration for each, and shows how the resulting records surface in the archive table.

1. Overview and Architectural Position

Every WinCC project is organized around three data flows: process values (tags, archives, trends), messages (bit-level, system, operator, and process messages routed through the Alarm Logging service), and user administration (SIMATIC Logon, internal user, or Windows domain accounts). A user action becomes auditable only at the boundary where one of those flows is intercepted.

Where a user action is captured determines what information is captured:

• Audit Trail records every change to configured variables and selected operator actions, signed with a checksum chain and stored in dbo.AUDIT_TC / dbo.AUDIT_TCV. It is the only mechanism that meets 21 CFR Part 11-style requirements and is tamper-evident.
• User-defined operator messages route through Alarm Logging and are stored in dbo.MSG alongside process and system messages. They are queryable through standard Alarm Control filtering.
• Scripts can call HMIRuntime.Trace, write to a user archive field, append to a text file, or insert directly into an archive tag. Maximum flexibility, no built-in integrity guarantees.

2. Prerequisites

• WinCC V7.4 SP1 or later (this article assumes V7.5 SP2 / V7.5 SP3) or TIA Portal WinCC Professional V17/V18 for the equivalent S7-1500 HMI panel. TIA Unified is not covered here because the archive schema is different (PouchDB / SQLite).
• A configured user administration: SIMATIC Logon, internal WinCC users, or a Windows domain group. Without resolvable user identity, all three mechanisms lose their value.
• SQL Server reachable from the WinCC server. The default instance is \WinCC with databases CC_<ProjectName>_R (runtime) and CC_<ProjectName>_A (archive).
• For Audit Trail: a valid WinCC Audit license (article 6AV6371-1DX07-4AX0 for V7.x base; expansion package 6AV6371-1DX07-4CX0 for the advanced option).
• Permissions: member of the SIMATIC HMI / WinCC Administrators group on the WinCC server, db_owner on the archive database for custom table writes.

Reference: WinCC V7.5 SP2 Manual (Siemens Support entry 109751755) and Siemens Support FAQ 24325381: Operator Messages in WinCC.

3. Method A: WinCC Audit Trail (Licensed)

WinCC Audit is a separate runtime component installed on the WinCC server. Once licensed, the configuration surface in WinCC Explorer gains an "Audit" editor tree node and an "Audit" column appears in the Tag Management and Alarm Logging properties.

3.1 Enabling the Editor

1. In WinCC Explorer, right-click the project node and choose Properties → Options. Confirm that the WinCC Audit option is licensed and active.
2. Open the new Audit editor. Three sub-nodes are visible: Configuration, Reports, and Viewer.
3. In Configuration → Settings, set:
   • Audit size of trace → number of records buffered in memory (default 1 000, raise to 10 000 for fast operator stations).
   • Audit retention → days to keep archive data before pruning; FDA-style projects require indefinite retention with archive backup policy.
   • Checksum algorithm → SHA-256 (V7.5 SP2 default; older builds use SHA-1, which is not acceptable for regulated environments).

3.2 Marking Tags and Messages for Auditing

3.3 What Gets Written

Audit records are stored in the archive database in two tables:

• dbo.AUDIT_TC — audit trail configuration changes (who enabled/disabled auditing, license status, project changes).
• dbo.AUDIT_TCV — variable value changes; primary columns are TC_TIME, TC_USER, TC_COMPUTER, TC_VAR, TC_OLDVAL, TC_NEWVAL, TC_HASH_PREV, TC_HASH.
• dbo.AUDIT_TCM — message-related audit events (acknowledgments, status changes).

3.4 Querying from the Archive Table

Although Audit Trail writes to its own dedicated tables rather than the process value archive, those tables are inside the same CC_<Project>_A database, so a single SQL query can join Audit data with process values:

-- All operator-driven setpoint changes in the last 24 h
SELECT  a.TC_TIME,
        a.TC_USER,
        a.TC_COMPUTER,
        a.TC_VAR,
        a.TC_OLDVAL,
        a.TC_NEWVAL,
        a.TC_HASH
FROM    dbo.AUDIT_TCV AS a
WHERE   a.TC_TIME > DATEADD(HOUR, -24, GETDATE())
  AND   a.TC_USER <> 'SYSTEM'
ORDER BY a.TC_TIME DESC;

-- Join audit and process archive for context
SELECT  v.TC_TIME   AS change_time,
        v.TC_USER,
        v.TC_NEWVAL AS new_setpoint,
        ar.PVVARIABLEW AS measured_value
FROM    dbo.AUDIT_TCV   AS v
INNER JOIN dbo.ARCHIVE   AS ar
        ON ar.PVARCHIVETIME BETWEEN v.TC_TIME AND DATEADD(SECOND, 60, v.TC_TIME)
WHERE   v.TC_VAR LIKE 'S7$Program/SETPOINT%';

Reference: WinCC V7.5 SP2 Audit Option Manual (Siemens Support entry 109769926).

4. Method B: User-Defined Operator Messages

Operator messages are the lightweight way to get user actions into the Alarm Logging archive. A user-defined operator message is a string formatted with up to 10 process values; it is dispatched the same way as a bit-level alarm and lands in dbo.MSG with full origin information.

4.1 Configuring the Message Class

1. In WinCC Explorer, open Alarm Logging → Message Classes. Right-click and add a new class USER_AUDIT with:
   • Type: Operator message
   • Archive: Long-term archive (otherwise messages are lost on archive swap)
   • Priority: 1 (audit messages should not be alarm-priority, otherwise the alarm control flashes on every entry)
2. Inside the new class, add an individual message with a default text containing the 10 process-value placeholders:
   Operator %1 changed %2 from %3 to %4 at %5

4.2 Triggering an Operator Message

Three trigger mechanisms are available; the choice depends on whether the action is a value change, a button press, or a periodic event.

4.3 Auto-Generated Operator Messages for IO Fields

For I/O fields this is the simplest path. In the Graphics Designer, open the I/O field properties and tick Operator messages → Generate with the format "%s changed <TagName> from %s to %s". Every operator-driven write then produces a structured operator message automatically, with the user identity, computer name, old value, and new value inserted by WinCC. No script is required.

4.4 Manual Operator Message via VBS

Use this when the action is a button press, recipe confirm, or any non-tag event.

' WinCC VBS - Button event: "Confirm Recipe"
Sub OnClick(ByVal Item)
    Dim sUser, sRecipe, sResult
    sUser   = HMIRuntime.Tags("@CurrentUser").Read
    sRecipe = HMIRuntime.Tags("RecipeName").Read
    sResult = HMIRuntime.Tags("ConfirmResult").Read

    ' 10 process-value slots supported
    HMIRuntime.AlarmLogging.CreateOperatorMessage _
        hmiMsgBox, _                  ' message class object
        "USER_AUDIT", _                ' message class name
        1, _                           ' message number
        sUser, sRecipe, sResult, _
        Now, HMIRuntime.ActiveScreen.Name
End Sub

4.5 Querying the Operator Message Archive

Operator messages land in dbo.MSG in the standard alarm archive. The relevant columns:

SELECT  MSGTIME, USERNAME, COMPUTERNAME, TEXT1, TEXT2, TEXT3, TEXT4
FROM    dbo.MSG
WHERE   CLASSNAME = 'USER_AUDIT'
  AND   MSGTIME > DATEADD(DAY, -7, GETDATE())
ORDER BY MSGTIME DESC;

Reference: Siemens Support FAQ 24325381: Operator Messages in WinCC.

5. Method C: Script-Based Action Logging

When Audit Trail is over-licensed and operator messages are not flexible enough, scripts give full control. The two main targets are user archives and external text/CSV logging. The trade-off is the loss of built-in tamper evidence.

5.1 Writing to a User Archive

User archives (dbo.UA#<ArchiveName>) are flexible SQL tables freely defined in WinCC Explorer with up to 500 columns. They are well suited for high-frequency, schema-fixed audit data.

' VBS - Tag change handler
Sub OnChange(ByVal Item)
    Dim oUA
    Set oUA = HMIRuntime.UserArchives.Item("UserActions")

    oUA.Connect
    oUA.InsertField "dtTime",   Now
    oUA.InsertField "sUser",    HMIRuntime.Tags("@CurrentUser").Read
    oUA.InsertField "sStation", HMIRuntime.Environment.ProcessHost
    oUA.InsertField "sScreen",  HMIRuntime.ActiveScreen.Name
    oUA.InsertField "sObject",  Item.Name
    oUA.InsertField "sTag",     Item.OutputValue
    oUA.InsertField "sOldVal",  Item.InputValue
    oUA.InsertField "sNewVal",  Item.OutputValue
    oUA.InsertField "sComment", ""

    oUA.Insert            ' one row committed
    oUA.Disconnect
End Sub

5.2 Appending to a CSV / TXT File

When a database is undesirable (e.g. small edge HMI without SQL), the simplest approach is a file append. Wrap it in a global VBS function:

' Module: LogAction.bas
Const LOG_PATH = "C:\WinCC_Audit\actions.csv"

Sub LogAction(sAction, sParam1, sParam2, sParam3)
    Dim fso, ts, sLine
    Set fso = CreateObject("Scripting.FileSystemObject")
    Set ts  = fso.OpenTextFile(LOG_PATH, 8, True)   ' 8 = ForAppending

    sLine = Format(Now, "yyyy-mm-dd hh:nn:ss") & ";" & _
            HMIRuntime.Environment.ProcessHost & ";" & _
            HMIRuntime.Tags("@CurrentUser").Read & ";" & _
            sAction & ";" & sParam1 & ";" & sParam2 & ";" & sParam3
    ts.WriteLine sLine
    ts.Close
End Sub

5.3 Calling HMIRuntime.Trace for Development

HMIRuntime.Trace writes to the WinCC diagnostic file WinCC_Sys_<Date>.log in C:\Program Files (x86)\Siemens\Automation\WinCC\Diagnostics. It is enabled in Computer → Properties → Graphics Runtime → Trace and is invaluable for development but should not be considered a long-term audit log because the file is rotated and not checksummed.

6. Method Comparison

7. Displaying the Audit in the WinCC Archive Table

The phrase “archive table” in WinCC can mean any of four artifacts:

1. Process value archive table — dbo.ARCHIVE with tag values. This is the table accessed through WinCC Online Trend Control and WinCC Online Table Control.
2. Alarm archive table — dbo.MSG, shown through the WinCC Alarm Control.
3. User archive — custom table shown through the WinCC User Archive Control.
4. Audit archive — dbo.AUDIT_TCV / dbo.AUDIT_TCM, shown through the WinCC Audit Viewer control.

To present a single screen with all user actions regardless of origin, use a single WinCC Alarm Control with a filter on the USER_AUDIT class and additionally include the Audit Viewer OCX on the same screen, or query both tables through a database connection and a custom ActiveX / WPF panel.

7.1 Alarm Control Filter for Operator Messages

1. Insert a WinCC Alarm Control on the screen.
2. Open the configuration dialog and add a Message Block for User Name, Computer Name, and the embedded Text1..Text4 columns.
3. Open Selection and apply a server-side filter:
   • Filter on Class = USER_AUDIT
   • Time range: last 24 h, 7 d, 30 d, or user-defined
4. Enable Acknowledgeable = No to keep the audit log from being acknowledged (which would itself generate another event).

7.2 Configuring a User Archive Table Control

For the script-based approach, drag a User Archive Table Control onto the screen, point it at the UserActions user archive, and define the columns to display. The control supports filter, sort, export to CSV, and a print button. This is the natural place to show the script-generated audit data.

8. Verification Procedure

1. On the WinCC server, start the runtime and log in as a configured user. In a second client, log in as a different user.
2. Trigger a controlled action: change a setpoint from each client. Record the time of the change to the second.
3. Open the Audit Viewer (if licensed) and confirm that two records appear with the correct user and computer names. Verify the hash chain validates (status bar reads "Audit trail valid").
4. Open the Alarm Control filtered on USER_AUDIT and confirm that the operator message is listed with the correct Text1..Text4 content.
5. For the script path, query the user archive table directly: SELECT * FROM dbo.UA#UserActions WHERE dtTime > <time-of-action> and verify one record per action with the correct user.
6. From a third station that is not logged in, repeat the same action and confirm that no user identity is captured (i.e. the audit log shows <unknown> or <No user>), validating that the user filter is working.

9. Troubleshooting Matrix

10. Security, Retention, and Performance Considerations

• User identity source. Use SIMATIC Logon rather than internal users when the plant has an Active Directory. The internal user table cannot be synchronized with the badge system, and operator accountability breaks the moment the same person is in two operator stations with two different local accounts.
• Storage sizing. A typical operator action audit record is 0.5–1 kB in AUDIT_TCV and 0.3–0.5 kB in MSG as an operator message. For a plant with 10 000 actions per day, plan 5–10 MB per day or 2–4 GB per year of audit data. Set archive backup accordingly.
• SQL maintenance. The audit database must be included in the same SQL maintenance plan as the rest of the archive (rebuild index weekly, statistics daily). Skipping this causes the audit query in the Alarm Control to slow down over months.
• Time synchronization. All WinCC servers, clients, and SIMATIC Logon servers should be synchronized to the same NTP source within 1 second. Audit times that drift make correlation impossible.
• Access control on the archive database. Grant db_datareader on the archive database to the engineering reporting account only. Never grant db_owner; that allows deletion of audit rows.
• Redundancy. For WinCC/PCS 7 redundant servers, audit data is replicated only if both archive databases are set to Redundant in the WinCC project. Verify the redundancy settings before commissioning.

11. Frequently Asked Questions