Resolving WinCC User Limit Issues on KTP600 and Basic Panels

Overview of WinCC User Administration in TIA Portal

WinCC user administration within TIA Portal provides a layered security model for SIMATIC HMI panels, consisting of users, user groups, and authorizations. The model allows operators to be granted granular permissions for screen navigation, value modification, recipe handling, and audit-relevant actions. However, the user administration runtime on each HMI panel family has different published performance limits, and exceeding them produces both functional degradation (login latency, group synchronization failures) and administrative restrictions (inability to add additional users via the engineering interface).

When designing a project around a SIMATIC Basic Panel such as the KTP600, KTP1000, or TP1500 Basic, engineers frequently discover that the 50-user ceiling enforced by WinCC is incompatible with the operator headcount of a production line. This article documents the tested and released limits for Basic Panels, the behaviour when those limits are exceeded, and the recommended migration path through Comfort Panels and SIMATIC Logon.

User Administration Object Model

WinCC user administration on a runtime HMI panel contains three distinct objects, each with its own size limit:

The 50-user ceiling is enforced by the WinCC Configuration Studio and by the runtime project files. The limit is derived from performance testing and is documented as a released limit rather than a hard memory limit. Engineers who attempt to bypass the limit by editing exported project files can encounter inconsistencies between the engineering view and the panel runtime after compilation.

KTP600 and Basic Panel Limits (TIA Portal V11 to V18)

The Basic Panel generation — including KTP400, KTP600, KTP1000, and TP1500 Basic — uses the WinCC RT Advanced runtime. Within this runtime the published limits for user administration are:

• 50 users (combined across all user groups)
• 50 user groups
• 32 authorizations
• 100-character maximum length on user names and passwords
• 8-character minimum password length with configurable complexity rules

Field testing has shown that approximately 100 sub-users can be assigned to a single user group before project transfers fail with a consistency error referencing the user administration table. This is not a published specification; it is the empirical threshold observed when the runtime user database exceeds the allocated memory block on the Basic Panel filesystem.

Why 50 Users Is a Performance Limit, Not a Hard Boundary

The 50-user limit is tested and released to guarantee specific login and authentication response times on the WinCC RT Advanced runtime. The authentication flow on a Basic Panel is implemented entirely in panel-resident firmware — there is no central authentication service. When a user attempts to log in, the panel:

1. Hashes the supplied password using the panel-resident hash algorithm (SHA-256 in firmware V14+; SHA-1 in earlier V11/V12 builds).
2. Iterates the local user database to locate the matching identity.
3. Evaluates the user's group membership against the requested authorization.
4. Returns the access decision to the runtime screen handler.

With more than 50 entries, the sequential scan latency on the panel's lower-tier processor (ARM9-class in KTP600, Cortex-A8 in TP1500 Basic) begins to exceed 1 second, which violates the runtime's interactive response budget. With 100+ users, login latency can reach 3–5 seconds, and the user administration dialog can time out during group synchronization at project startup.

Migration Path: Comfort Panel and SIMATIC Logon

For installations that require 100, 500, or 1000+ operator identities, the recommended architecture is to migrate from a Basic Panel to a Comfort Panel (TP700 Comfort, TP900 Comfort, TP1200 Comfort, TP1500 Comfort, TP1900 Comfort, TP2200 Comfort) and deploy SIMATIC Logon as a central authentication service.

Comfort Panel Advantages for User Administration

• Higher-performance processor (Cortex-A8 / A9 class) supports user databases up to 2,000 entries with sub-second login latency.
• Supports Active Directory integration through SIMATIC Logon.
• Supports TLS-encrypted password storage (AES-256 in firmware V15+).
• Provides a centralized user management dialog that scales to enterprise headcount.

SIMATIC Logon Architecture

SIMATIC Logon is a Windows service that authenticates HMI panel users against a central user store. The typical topology is:

SIMATIC Logon Configuration Steps

1. Install SIMATIC Logon on a Windows Server (2016/2019/2022) within the production network. The installer is provided on the TIA Portal installation media or downloaded from the Siemens Industry Online Support portal.
2. Open the Comfort Panel project in TIA Portal, navigate to Runtime settings > User administration, and enable SIMATIC Logon.
3. Configure the SIMATIC Logon server address (IPv4 address or DNS hostname) and the connection port (default 1630/TCP).
4. Import or synchronize the Active Directory groups that should be granted HMI access.
5. Assign Comfort Panel local authorizations (32 maximum, unchanged) to the imported AD groups.
6. Compile and download the project to the Comfort Panel.
7. Verify authentication by logging in with a domain credential on the panel.

Configuration Parameters and Tags

The following internal tags are exposed by the WinCC runtime for user administration monitoring and can be evaluated in HMI scripts or via the PLC interface:

These tags can be polled by the PLC to enforce procedural interlocks based on operator identity. The recommended scan rate is 100 ms, aligned with the HMI tag update cycle.

Compatibility Matrix Across TIA Portal Versions

Licensing Considerations

TIA Portal and WinCC require a valid License Key for engineering and runtime. The licensing model for user administration depends on the installed edition:

• STEP 7 Basic — Basic Panel configuration only (KTP/TP Basic).
• STEP 7 Professional — Comfort Panel and WinCC RT Advanced/Professional configuration.
• WinCC RT Advanced — Runtime license for Comfort Panel projects.
• SIMATIC Logon — Separate license key, installed on the Windows host running the Logon service.

Refer to the official licensing documentation for STEP 7 and WinCC under TIA Portal for the current key-to-edition mapping and to verify which License Key covers SIMATIC Logon within your maintenance contract.

Troubleshooting Matrix

Verification Procedure

1. Open the Comfort Panel runtime and confirm the login dialog appears with the SIMATIC Logon branding.
2. Log in with three test accounts from different Active Directory groups.
3. Verify that each user receives the correct authorization level via the @CurrentUserLevel tag, polled from the PLC.
4. Trigger a forced logout (@UserLogout = 1) and confirm the session is terminated within 500 ms.
5. Reboot the panel and confirm the SIMATIC Logon session is restored without manual re-authentication (within the configured timeout).
6. Inspect the SIMATIC Logon audit log on the server to confirm each login event is recorded with timestamp, user identity, and panel IP address.

Field-Proven Caveats

• The 50-user limit applies per panel, not per project. A single TIA Portal project compiled to two Comfort Panels can have 50 users on each panel independently.
• If you must remain on a KTP600 due to hardware constraints (panel cutout, supply voltage, ATEX zone), an external authentication gateway — for example, an industrial PC running a custom OPC UA server with its own user store — can front-end the panel. This is an architectural workaround, not a Siemens-supported configuration.
• SIMATIC Logon V1.x is not compatible with Comfort Panel firmware V17+. Always upgrade the Logon service and the panel firmware together.
• If the project is opened in a newer TIA Portal version (e.g., V18) but the Comfort Panel firmware is older (e.g., V14), some Logon features will be silently dropped during compilation. Match the panel firmware and engineering tool version.

Summary Recommendation

For deployments with fewer than 50 operators on a single panel, retain the KTP600 / Basic Panel configuration and apply the released limits without workaround. For deployments approaching or exceeding 50 operators, the only supported path to 1,000+ accounts is the Comfort Panel + SIMATIC Logon architecture. Any attempt to bypass the 50-user ceiling on Basic Panels by editing project files or by exploiting firmware bugs will produce performance degradation, login failures, and audit gaps.