TP 170B Password Lockout: Fixing Insufficient Authorisation Error

Problem Summary

The SIMATIC TP 170B Color HMI (MLFB 6AV6 545-0BA15-2AX0 and related variants) intermittently refuses to accept any username/password combination, even when the credentials match the project configuration. After a power cycle the panel behaves normally until the next event triggers the symptom. The runtime displays the system message "You have insufficient authorisation" in the user-view area. The same symptom can affect OP 170B, TP 170A, and TP 170B monochrome panels running the same WinCC Flexible image family.

This is not a hardware fault and not a corruption of the password table itself. It is the deliberate, expected behaviour of the WinCC Flexible user administration block when the failed-login counter has reached the configured limit. Operators perceive it as a "bug" because no obvious cause is shown on the screen and a simple restart temporarily clears the state.

Affected Hardware and Software

The lockout is implemented inside the WinCC Flexible runtime image; the counter value, limit, and persistence rules are all defined by the project (Project » User Administration » Properties). The behaviour is not modified by the bus, by the PLC program, or by the operator touching the screen.

Root Cause Analysis

WinCC Flexible stores two values per user account: a hash of the password and a failed-login counter. The runtime increments the counter on every wrong password and on every login attempt against a non-existent user. When the counter reaches the configured threshold (default = 3 for most TP/OP 170B project templates), the user record is marked as locked and any further authentication attempt returns the system message 1700.020001 "You have insufficient authorisation" (text ID varies slightly by language).

Two rules determine whether a restart clears the lockout:

1. Non-retentive counter (default for TP/OP 170B): the counter is held only in the volatile copy of the user database in RAM. A power cycle / restart clears it, giving the operator three new tries. This is the behaviour the original poster observed.
2. Retentive counter (often used on MP 277, MP 377, WinCE panels): the lock state is written to the internal flash-backed user database. A restart does not reset it; only a project redownload or a manual re-import of the user list clears the block.

Confirm which rule is in effect before promising the maintenance crew a "restart fix". In TP 170B / OP 170B projects the default is rule 1, but a custom project that explicitly enables Retentive user administration under User Administration » Properties » Runtime behaves like rule 2.

Diagnostic Flow

Diagnostic Steps

1. Open the panel's Alarm View (or, in the project, the discrete alarm history). Look for events of class System with text containing Logon, Password, or the localised equivalent of insufficient authorisation. A burst of three such entries within minutes is a fingerprint of the lockout.
2. Export the alarm log via ProSave / WinCC Flexible to a USB stick or via the project backup. The *.log file from the panel contains the timestamps of all failed attempts.
3. On the engineering station, open the WinCC Flexible project. Right-click User Administration » Properties » Runtime. Note:
   • Number of login attempts (default 3)
   • Retentive user administration (checkbox)
   • Log failed logins (must be enabled to see the events in step 1)
4. Determine which rule the project uses (volatile or retentive) and proceed to the matching solution below.

Solution 1 — Power-Cycle / Restart (Volatile Counter)

If the project has Retentive user administration disabled (default for TP/OP 170B), the failed-login counter is held in RAM only. A clean restart returns the account to a clean state with three fresh attempts.

1. Disconnect the 24 V supply to the panel for at least 10 s. A warm reset through the control panel is acceptable, but a hard power cycle is more reliable for clearing volatile security state.
2. Restore supply and wait for the project to start (typical TP 170B boot time 25-40 s from cold).
3. Try the original credentials with the operator present. Have the operator watch the touch screen to confirm each character lands in the password field.
4. If the login still fails, capture the alarm log immediately and treat the problem as Solution 2 (retentive lockout).

Solution 2 — Full Project Redownload (Retentive Counter)

When the project uses Retentive user administration, the locked state is stored in the panel's internal flash and survives a power cycle. The only reliable field remedy is to re-transfer the project. The project file must contain a clean user list (no locked entries).

1. On the engineering station, open the WinCC Flexible project. Go to Project » User Administration » Users. For every user verify that the Locked attribute is unchecked, or use the Reset locked users action available in WinCC Flexible 2005 SP1 and later.
2. Save the project and compile.
3. Transfer the project to the panel using one of:
   • WinCC Flexible » Transfer » Project via MPI/PROFIBUS, or
   • ProSave » Restore from a panel backup image, or
   • For TP 170B without a programming port on the PLC side, the serial RS-232 transfer on the back of the panel.
4. After the redownload, the runtime starts with a clean user database. Log in with a known account to confirm.

Solution 3 — Import / Export User Administration

WinCC Flexible exposes a maintenance feature: the Import users and Export users functions. These work on the .csv user list that ships with the project. Importing a clean list while the runtime is online replaces the locked accounts in the panel's user database. The feature is documented in the SIOS entry 24182683 and is supported on TP/OP 170B targets.

1. On the engineering station, Project » User Administration » Export. This creates a UTF-16 users.csv file containing every user, password hash, group, and lock state.
2. Open the CSV in a text editor that supports UTF-16. For each user set the Locked column to 0. Save.
3. Transfer the modified users.csv to the panel (ProSave » File transfer, or the UserView import button if a temporary user with rights is still logged in).
4. Trigger Import users on the panel. The runtime replaces the in-memory user DB and the locked users are unlocked.

Solution 4 — Hidden Maintenance Page

The TP/OP 170B firmware exposes a hidden system page set that contains the raw User Administration applet. It is reached through a key sequence on the control panel. This is described in the SIOS entry 24141925 and only works on panels whose project permits scripts and which were built with WinCC Flexible 2005 or later.

1. Open the control panel (Start » Settings » Control Panel) on the panel.
2. Tap the empty area in the top-right corner of the OP Properties dialog five times within 3 s.
3. The Start Center » Settings » User Administration page opens. From here you can Export the current user list, Import a known-good list, or Reset all passwords to factory (function depends on image version).
4. Import the previously exported users.csv with the lock bits cleared. Confirm with Apply. The runtime commits the change immediately.

Hardening After the Recovery

Once the panel is back in service, harden the user administration so the symptom is harder to trigger.

Operational Protection Without WinCC Flexible Security

Where regulatory or process reasons prevent the operator from exporting the user list, the discussion thread describes a useful pattern: hide a maintenance button behind a hardcoded key sequence that the operator does not know. The panel's script interpreter can be used to require, for example, a long-press in a non-visible area plus a numeric key sequence before showing the User Administration applet. This is engineering overhead, but it is the only field-proven way to keep the panel manageable without giving the operator a way to alter the security database.

Verification

1. Power-cycle the panel and confirm it boots to the project start screen within 45 s.
2. Log in with a known user. Confirm the UserView shows the correct group.
3. Deliberately enter the wrong password three times. Confirm the runtime now shows "You have insufficient authorisation".
4. Power-cycle. Confirm the lockout is cleared (volatile case) or remains (retentive case), as expected from the project configuration.
5. Apply the matching solution and re-verify a successful login.

When to Escalate

Escalate to Siemens Technical Support (SR / 8 6 4 4 4 7 7 7 7) when:

• The lockout occurs on a brand-new panel that has never accepted a login.
• The project was compiled with WinCC Flexible newer than the panel image; the runtime rejects the project before user administration is reachable.
• ProSave cannot establish a connection (MPI address conflict, RS-232 cable wiring on TP 170B uses a 9-pin SUB-D with pin 2-3 crossed, not a standard null-modem).

Reference Documentation

For deeper background consult the following official Siemens resources:

• SIOS entry 24456183 — "How do you configure the user administration in WinCC flexible?"
• SIOS entry 24141925 — "How do you access the hidden system pages in WinCC Flexible 2005?"
• SIOS entry 24182683 — "How do you import / export users in WinCC Flexible?"
• SIMATIC HMI WinCC Flexible Manual Collection (entry 18796024 on SIOS) for the user-administration model and the Locked attribute semantics

Frequently Asked Questions