WinCC Alarm on User Login: Scheduler and Script Configuration

WinCC Alarm on User Login: Scheduler and Script Configuration

User authentication events on a Siemens HMI must be auditable in regulated plants (FDA 21 CFR Part 11, EU GMP Annex 11, IEC 62443). The native WinCC alarm subsystem can capture logon, logoff, and user change events without an external SIEM, provided the project is configured to surface system events through the alarm view and to forward user identity into the alarm text. This reference documents three engineering-proven methods that work on WinCC Flexible 2008 SP5, WinCC Comfort/Advanced V15.1 through V20, and WinCC Professional V17 through V20.

1. Overview and Use Cases

The default runtime behaviour in WinCC Flexible and TIA Portal WinCC does not generate a customer-visible alarm when a user logs in or out. The Scheduler subsystem exposes a discrete Change User trigger that fires whenever the active operator session switches (including logoff-to-logon, logon-to-logoff, and user-to-user). The trigger can be wired to the built-in TraceUserChange function, which writes a system event into the active alarm log, or to a VB script that lifts the username into an HMI tag for inclusion in custom alarm text.

Typical applications:

• 21 CFR Part 11 audit trail of operator sessions on a PanelView-equivalent Comfort Panel.
• Forensic reconstruction of who acknowledged which alarm during an incident.
• Auto-logout alarms triggered when an idle session is forcibly terminated.
• Privileged-account tracking (admin, maintenance, service) on shared operator stations.

2. Prerequisites

3. Alarm Architecture on WinCC Comfort/Advanced/Professional

Alarms in WinCC are managed by the Alarm Logging subsystem, which produces two streams:

1. Alarm events — discrete messages (Discrete Alarms, Analog Alarms, System Events) shown in the Alarm Control on screen.
2. Alarm logs — chronological records persisted to a backed-up segment or database.

Per the official Siemens documentation, "An alarm log is used to record project alarms. Alarm logs are created by the system. For example, after an error has occurred, or a limit was exceeded in Runtime." See Basics on alarm logging (RT Professional) for the architecture overview that applies to all TIA Portal WinCC variants.

System events are pre-defined message numbers in the range 1000 – 1399. The relevant IDs for user tracking are:

4. Method 1 — Scheduler + TraceUserChange (No Script)

This is the lowest-friction path. No VBScript is required, and the alarm will appear in any Alarm View that is configured to show system events.

4.1 Step-by-step configuration

1. In the TIA project tree, right-click the HMI device → Properties → Runtime settings → Scheduler.
2. Click Add new task; name it UserChanged.
3. Set the Trigger to Event: Change User.
4. In the Function list, add the system function TraceUserChange.
5. Compile and download the project. No tag or script needs to be created.
6. On the HMI screen containing the Alarm View, open the Alarm Control properties and tick System Events → Show.

4.2 What happens at runtime

When the operator presses Logon on the user administration dialog and authentication succeeds, the active session switches from (none) to alice. The Scheduler fires TraceUserChange, which writes a system event carrying both the previous and the new username into the alarm buffer. The Alarm Control appends a row:

| Time            | State  | Class  | Event                                    |
|-----------------|--------|--------|------------------------------------------|
| 2025-08-12 14:02| I      | System | User changed from (none) to alice         |

5. Method 2 — VBScript + Scheduler + GetUserName + SetBit

Use this method when you need a custom alarm number, a different alarm class (e.g. Warning instead of System), or the username embedded in a customer-specific alarm text that also includes tag values, recipe names, or shift IDs.

5.1 Required tags

5.2 VBScript: OnUserChange

Create the script under HMI device → Scripts → VB scripts. The function GetUserName returns the active user, and SetBit drives a tag that is bound to a custom discrete alarm.

' OnUserChange.vbs - executed by Scheduler on Change User event
Option Explicit

Sub OnUserChange()
    Dim sCurrent, sLast

    ' Read previous user from internal tag (default "")
    sLast = SmartTags("LastUser")

    ' GetUserName returns the user that is now active after the switch
    sCurrent = GetUserName()

    ' Persist into HMI tags
    SmartTags("CurrentUser") = sCurrent
    SmartTags("LastUser")    = sLast
    SmartTags("LastUser")    = sCurrent   ' overwrite after reading

    ' Decide direction: empty LastUser <> sLast means a fresh logon
    If sLast = "" And sCurrent <> "" Then
        SmartTags("UserLoginEvent")  = True    ' rising edge -> alarm comes in
        SmartTags("UserLogoutEvent") = False
    ElseIf sCurrent = "" And sLast <> "" Then
        SmartTags("UserLoginEvent")  = False
        SmartTags("UserLogoutEvent") = True    ' rising edge -> alarm comes in
    Else
        SmartTags("UserLoginEvent")  = True    ' user-to-user swap
        SmartTags("UserLogoutEvent") = False
    End If
End Sub

5.3 Bind the tags to discrete alarms

1. Open HMI device → Alarm Logging → Discrete alarms.
2. Create alarm ALM_USER_LOGIN (class Warning) triggered on UserLoginEvent == TRUE with acknowledgement.
3. Create alarm ALM_USER_LOGOUT (class Information) triggered on UserLogoutEvent == TRUE without acknowledgement.
4. In the alarm text field, insert the CurrentUser tag as a process value placeholder: Operator %s@100%s signed in → renders as Operator alice@100\station1 signed in.

5.4 Wire the script to the Scheduler

1. Open Scheduler and add a task named ScriptUserChange.
2. Trigger: Change User.
3. Function list: add VB Script → OnUserChange.
4. Compile, download, test.

6. Method 3 — Polling Script (Fallback for Older Versions)

If the runtime is WinCC Flexible 2008 SP2 or earlier where the Change User trigger is not reliable, a periodic VB script can poll the active username every 5 seconds and detect transitions.

' PollUser.vbs - executed every 5s by Scheduler
Sub PollUser()
    Dim sNow, sPrev
    sNow  = GetUserName()
    sPrev = SmartTags("CurrentUser")

    If sNow <> sPrev Then
        If sPrev = "" And sNow <> "" Then
            SmartTags("UserLoginEvent") = True
        ElseIf sPrev <> "" And sNow = "" Then
            SmartTags("UserLogoutEvent") = True
        Else
            SmartTags("UserLoginEvent") = True   ' user-to-user swap
        End If
    Else
        ' Clear rising edges so the same event does not re-fire
        SmartTags("UserLoginEvent")  = False
        SmartTags("UserLogoutEvent") = False
    End If

    SmartTags("CurrentUser") = sNow
End Sub

Schedule this script under Scheduler → Add task → Trigger: Periodic 5 s. Use a polling interval of 5–10 s to balance CPU load against event latency. Avoid intervals < 2 s on Comfort Panels — the VBScript engine is single-threaded and will starve the alarm subsystem if overloaded.

7. Including Username in Alarm Text

Process value fields are added by dragging tags from the project tree into the alarm text editor at the cursor. The placeholder syntax is:

Operator <%CurrentUser%> signed in at <%DateTime%>

For multi-tag messages, concatenate manually with the literal '@' separator. Example: User <%CurrentUser%> on station <%StationID%> logged out. The runtime replaces the placeholders when the alarm is raised. Placeholders are evaluated on the alarm raise event, not on acknowledge — so the username captured is the one at the moment of the event, which is correct for audit purposes.

8. Persisting the Alarm to a Log File or Database

For 21 CFR Part 11 / Annex 11 compliance, alarms must be persisted in a tamper-evident log. Configure a log target under Alarm Logging → Logs:

Per Siemens documentation, alarm logs are created by the system and segment rotation is automatic. Always enable Backup on power failure for the log segment to satisfy Annex 11 §12 traceability.

9. SIMATIC Logon Integration

When the HMI participates in a domain-based authentication scheme via SIMATIC Logon, the runtime calls into the central logon service instead of the local user administration. Two changes are required:

1. Under HMI device → Security → User administration, set the authentication mode to SIMATIC Logon and point to the SIMATIC Logon server (default port 16389/TCP).
2. Add the SIMATIC Logon role group mapping on the runtime side so that WinCC user groups still translate correctly (e.g. domain group DOMAIN\Operators → WinCC group Operator).

The Scheduler triggers still fire on user change, and GetUserName returns the fully qualified logon name (e.g. DOMAIN\alice). Truncate or map this in your VB script if the alarm log column is sized for 24 characters. A common pattern is:

Dim sFull, sShort
sFull  = GetUserName()
If InStr(sFull, "\") > 0 Then
    sShort = Mid(sFull, InStr(sFull, "\") + 1)
Else
    sShort = sFull
End If
SmartTags("CurrentUser") = sShort

10. Verification and Commissioning

1. Compile check. TIA Portal → HMI device → Compile → Software (rebuild all). Errors in the VB script appear in the Inspector under Compile output.
2. Simulation. Start RT simulation on the engineering PC. Trigger Logon → Logoff → Logon as different user. Watch the Alarm Control row count increase by one for each transition.
3. Tag inspection. Use a temporary text I/O field on the screen bound to CurrentUser; verify the value updates within 200 ms of logon.
4. Log file inspection. After the simulation, open the CSV log file and confirm three rows for three transitions. Spot-check timestamp, username, and event class.
5. Networked test. On a real Panel, push the project via TIA Portal → Online → HMI device maintenance → Download and repeat the logon transitions from the touchscreen.
6. Soak test. Leave the panel idle overnight; confirm no spurious logon events fire and no memory leak in the alarm buffer (top out at the configured Size of alarm buffer parameter).

11. Troubleshooting Matrix

12. Field-Proven Engineering Notes

• Avoid heavy scripts in the Scheduler. The Scheduler runs on the same thread as the alarm dispatcher. A long-running script (e.g. file I/O, database query) will delay alarm appearance by seconds. Offload heavy work to a queued task or an external service.
• Edge-trigger, do not level-trigger. Configure the discrete alarm to fire on the rising edge of UserLoginEvent; level-triggered alarms will re-fire every polling cycle.
• Use the alarm acknowledge model that matches your SOP. Some plants require all logon events to be acknowledged by a supervisor; others are pure audit. Configure the alarm class accordingly.
• Localise the alarm text. Use TIA Portal multilingual support: provide English, German, French, and Chinese variants. The placeholder <%CurrentUser%> is language-neutral.
• Test with SIMATIC Logon offline. When testing on a desk, point SIMATIC Logon at a local copy of the role database rather than the production DC, otherwise the panel will lock out operators when the link breaks.
• Document the alarm number in the SOP. Operators should know that ALM_USER_LOGIN is informational and does not require acknowledgement unless the site SOP says otherwise.

13. Quick-Reference Configuration Map

14. Frequently Asked Questions