WinCC V7.5 Operator Authority Between Two RT Stations on One PLC

1. Problem Definition and Operating Modes

The classic WinCC V7.x multi-station configuration problem: two operator PCs (PC_A and PC_B) in physically separate locations, each running WinCC V7.5 SP1 Runtime, must share a single S7 PLC (in this case STEP 7 V5.6). The two RT stations cannot both write to the PLC simultaneously, because writes from one station will silently overwrite the other without conflict resolution. The required behavior is therefore exclusive operator authority with a passive monitor fallback:

• Exactly one station holds write/operator authority at any moment.
• The other station receives all live process values, but every input field, button, and slider is disabled.
• Authority can be transferred (hand-over) from the active station to the passive station, never both at once.

WinCC V7.5 does not have a built-in "operator authority arbiter" object. The capability has to be engineered from a small combination of system tags, external process tags, a VBScript routine, and WinCC user administration. The approach documented in Siemens Entry ID 109749508 – Library of Basic Processes (LBP V2.4) is the canonical Siemens reference for this pattern.

2. Prerequisites

The computer name is the most important configuration item on each RT: WinCC exposes it through the internal system tag @LocalMachineName. Both station names must be unique and known to the project.

3. Architecture Choice: Standalone RT vs. WinCC Server/Client

WinCC V7.5 supports two relevant multi-station topologies:

The standalone RT approach is the one described in the field report and is the most common when the two PCs were added to an existing single-PLC installation. The server/client approach is recommended for new installations because WinCC V7.5 already serializes tag updates through the server process, which removes the risk of two clients writing the same PLC bit within the same scan. The script-based authority check, however, is still required for UI-button enablement.

4. The @LocalMachineName System Tag

WinCC V7.5 exposes a fixed internal tag that returns the Windows computer name of the RT host. It is read-only and cannot be modified from a script. It is updated once at RT startup and whenever WinCC detects a computer-name change.

• Tag name: @LocalMachineName
• Type: Text tag, 16 characters (Windows NETBIOS limit)
• Update: At RT start
• Scope: Available on every WinCC RT station that runs the project

To use it in a script, reference it as HMIRuntime.Tags("@LocalMachineName").Read. Typical return values: PC_STATION_01 or PC_STATION_02 — exactly what is required to discriminate between the two operator stations.

5. External Tag Configuration for the Authority Token

The arbitration state is stored in a single byte external tag in the WinCC project. Because the tag is declared external, it is also accessible on both RTs and on the PLC side, which is essential for cross-station visibility.

If you want the authority to be visible in the PLC (e.g., to enable an OperatorEnable output that the HMI checks before accepting a write), point the external tag to a real PLC address. Otherwise, leave the tag local and the arbitration is purely a WinCC-side construct.

6. VBScript Implementation of the Authority Check

The arbitration logic is implemented as a WinCC VBScript function that runs on a 1-second scheduler. It compares the local computer name against the StationInCharge tag, and writes the result to a project-wide internal boolean tag HasAuthority.

' WinCC V7.5 SP1 - AuthorityCheck.bas
' Place in Global Script > Actions > Project-wide functions
' Trigger: cyclic 1 s

Dim sPC, nStationID, nInCharge, bHasAuth

' 1. Read local machine name
sPC = HMIRuntime.Tags("@LocalMachineName").Read

' 2. Extract trailing two characters and convert to integer
nStationID = CInt(Right(sPC, 2))

' 3. Read the authority token
nInCharge = HMIRuntime.Tags("StationInCharge").Read

' 4. Compare
If nStationID = nInCharge Then
    bHasAuth = True
Else
    bHasAuth = False
End If

' 5. Publish result
HMIRuntime.Tags("HasAuthority").Write bHasAuth

' 6. Optional: log hand-over events
If bHasAuth And (nStationID <> HMIRuntime.Tags("LastKnownAuthority").Read) Then
    HMIRuntime.Trace "Authority acquired by station " & nStationID & " at " & Now
    HMIRuntime.Tags("LastKnownAuthority").Write nStationID
End If

Project tags referenced:

7. Library of Basic Processes (LBP) Reference Approach

Siemens documents a more complete solution in the Library of Basic Processes application example, Entry ID 109749508, file 109749508_LBP_V2.4_Operation_DOC_en.pdf. The LBP example provides a ready-to-use WinCC faceplate that encapsulates exactly the operator-authority model discussed here:

• An @LocalMachineName comparison module
• Pre-built operator-hand-over faceplate with user-rights escalation
• Integration with the standard WinCC user administrator
• C and VBScript source for the state machine

To use the LBP approach, download the project from the Siemens Support entry, copy the faceplates into your own project, and replace the placeholder tag names with the project-specific StationInCharge. This saves roughly 4–6 hours of engineering versus building the script from scratch.

8. Binding the Authority Result to Operator Controls

There are two complementary ways to disable controls when a station does not hold authority.

8.1 Dynamic Property via Tag Connection

On every input object (I/O field, button, slider), open Properties > Output/Input > Enable and bind it to the internal tag HasAuthority:

1. Right-click the I/O field → Properties.
2. Select the Miscellaneous tab (or the property matching your object).
3. For Operator Control Enable (or Enable), click the small button to the right and select Tag.
4. Pick HasAuthority, type BOOL, no inversion.
5. Apply. The control now goes gray automatically when the local station loses authority.

8.2 WinCC User Administration Layer

For an extra layer of security, restrict the authorizing user group on the picture as well. The User Administrator is configured in the WinCC Explorer under User Administrator. Create:

On each picture or button, set the Authorization property in addition to the Enable property. The control is therefore disabled when HasAuthority = FALSE and a second time when the current user does not have authorization 100/999.

9. Hand-Over Procedure

Authority is transferred via a faceplate that the supervisor opens. The simplest implementation is a password-protected button on each station that writes the new station ID to StationInCharge:

' Hand-over button, on-click event
' The supervisor authenticates with a password before this runs
Dim sTarget
sTarget = HMIRuntime.Selection.Items(0).Name  ' or a hard-coded value
HMIRuntime.Tags("StationInCharge").Write sTarget
' Force re-evaluation of HasAuthority on the next 1 s tick

A second design is to have a single "Request Authority" button on each station. The first press sets a request bit; the other station has 30 seconds to acknowledge before authority is forcibly taken. This requires both a request tag and an acknowledge tag, but prevents accidental pre-emption.

10. PLC-Side Acceptance Bit (Recommended Hardening)

WinCC-side checks are defeated by direct AS-OS connections, archive jobs, or wrong scripts. For a hard lockout, mirror the authority token in the PLC and have the safety-relevant blocks check it:

// STEP 7 V5.6 - SCL example
// DB100, byte 0: authority token (0=none, 1=ST01, 2=ST02)
// DB100, byte 1: local station ID (set per RT, e.g. 1 for PC_STATION_01)

IF DB100.DBB0 = DB100.DBB1 THEN
    "OperatorEnable" := TRUE;
ELSE
    "OperatorEnable" := FALSE;
END_IF;

Any FB that performs a write from the HMI is then prefixed with IF "OperatorEnable" THEN ... END_IF;. This is the equivalent of an interlock on the HMI side and is the pattern documented in the LBP example.

11. Commissioning and Verification

1. Deploy the same WinCC project to both RT PCs, confirm RT starts cleanly. Check that @LocalMachineName returns the expected value (Diagnostics → Tag Simulation, or a small debug I/O field).
2. Open WinCC Tag Management on the ES, expand Internal Tags. @LocalMachineName must appear; if not, the RT is not running the correct project.
3. Trigger the cyclic authority script. Watch the value of HasAuthority in the GraphicsRuntime diagnostics. With StationInCharge = 1, only PC_STATION_01 should show HasAuthority = TRUE.
4. Click a write-enabled button on PC_A while authority is on PC_B. The button must be grayed out and the click should produce no write to the PLC (verify with STEP 7 VAT online monitor).
5. Perform a hand-over from supervisor login. StationInCharge changes, the other station's buttons become enabled within one 1-second tick, and the former authority station goes read-only.
6. Reboot one RT PC while the other holds authority. The authority token survives, and the rebooting station should re-evaluate @LocalMachineName and re-enter read-only mode within 30 seconds of RT start.
7. Force a write to DB100.DBB0 from STEP 7 to a value not equal to either station ID. Both stations must enter read-only mode.

12. Troubleshooting Matrix

13. Step 7 V5.6 Integration Notes

Because the PLC is programmed with STEP 7 V5.6 (not TIA Portal), the AS-OS connection is set up in SIMATIC Manager → Options → OS → Station Configuration Wizard or directly inside the WinCC project. Key items:

• The WinCC tag prefix (default ::) must match on both RT stations, or the script's HMIRuntime.Tags calls will fail with a "Tag not found" error.
• If you use a SIMATIC NET OPC server instead of direct AS-OS, the external tag points to the OPC item, not a DB address. In that case, the StationInCharge is "opaque" to the PLC and is not enforced — add a parallel PLC-side mechanism.
• The PC station connection name (e.g. S7ONLINE) must be identical on both RT stations for the script to behave the same way.

14. Operational Considerations and Safety Caveats

Other operational points:

• Authority is not tied to which operator is logged in; it is tied to which PC is active. A second operator logging into the non-authority station will still be unable to write.
• When the authority-holding station loses its PLC connection, the authority token remains "stuck" with that station ID. Implement a 30-second watchdog in the PLC that resets the token if no write is received from the authority station within the timeout.
• If the network between the two RTs and the PLC is unreliable, the external tag can show stale values. Always enable the WinCC connection diagnostic alarm to alert the operator.

15. Extending the Pattern

The same pattern scales to 3–8 operator stations with the following adjustments:

• Use a WORD (16-bit) for StationInCharge instead of BYTE.
• Replace the trailing-two-character extraction with a lookup table in the script that maps @LocalMachineName → numeric station ID.
• For larger fleets, consider promoting the pattern to a WinCC Server with clients, where the server already serializes tag updates. The @LocalMachineName check is still required for UI enablement, but the data layer is no longer a race condition.

Frequently Asked Questions