Set an HMI recipe screen read only for operators

Can you make an HMI recipe screen uneditable for operators?

Yes: the recipe setup in the panel's programming software carries an access selection with three modes. The panel enforces the mode on the screen where it is set, so a second screen can hold the same recipe book with editing locked for operators.

The access selection sits inside the recipe setup, next to the recipe book it governs. Two screens can therefore present the same book with different rights, and both enforce their own setting. That is the whole mechanism this page uses.

Three shortcuts come up on every job, and none of them produces an uneditable screen:

• A project password on its own. A password controls who opens a protected function. The recipe fields keep their edit rights for anyone who passes it, and passwords on a shop floor get misplaced or forgotten.
• A hidden navigation button. Taking the button off the operator menu hides the screen; anyone who reaches it still finds full edit rights. Hiding is a second layer, added after the access mode is set.
• One shared screen. A screen carries one access selection. If it allows edit, every user of that screen edits. The split needs two screens, or the panel's per-user security on top.

What do the three recipe access modes allow?

Read only allows viewing with entry and download both blocked; read and download adds loading a record to the PLC; read, edit and download allows everything, so it belongs on the engineering screen alone.

Some software versions word the third option as read, edit and load. Read the exact names in the recipe dialog of your version before you set them, and note on the project which screen carries which mode.

Choose by what operators do at changeover: if they load records to the PLC, read and download; if they only look at values, read only.

What do you need before you lock the recipe screen?

You need the project open in the panel's programming software, the recipe book already defined with its records, a list of every operator-visible screen, and a copy of the project saved without passwords, labeled with the date.

• The recipe book and its records. Operators pick the record from the record dropdown on the recipe view, so confirm the records they need are saved in the book.
• Tag limits on the values engineers edit. The HMI tag table takes a low and high limit per tag; a documented setup carries an unsigned integer tag limited low 20, high 100, so an out-of-range entry is rejected at the tag even where editing is allowed.
• The password-free project copy. If you use the password feature at all, this copy is the recovery path, kept off the shared network and labeled with its date.
• The download path from the programming software to the panel, checked working before you change anything.

How do you set up the operator and engineering screens?

Place the same recipe book on two screens and set the access selection separately on each one: read and download for the operator screen, read, edit and download for the engineering screen, then download the project and test both screens.

1. Build the operator screen and place the recipe view on it, bound to the recipe book. Operators select the record with the record dropdown on the view.
2. Open the recipe setup for that view and set the access selection: read and download when operators load records to the PLC, read only when the screen only displays values.
3. Build the engineering screen, place the same recipe book on it, and set read, edit and download. Some versions word this option read, edit and load.
4. Set the low and high limits on each tag the engineering screen can change, so a mistyped value is caught at the tag.
5. Sweep navigation: no operator-visible screen may carry a button, gesture or screen-change event aimed at the engineering screen.
6. Download the project to the panel and run the checks in the next section before the line runs again. If that download crawls, fix it first: see Fix an HMI panel project download that takes 2 minutes.

If operators also need to store current PLC values as a new record and the screen has no save button on it, that is a separate recipe action on the same book: see Save operator recipes from an HMI with no save button.

How do you keep the engineering screen out of operator reach?

Remove every path first: no button, gesture or screen-change event on any operator-visible screen may target the engineering screen. Where tampering is a real risk, add the panel's user security so the engineering screen asks for a login.

A screen operators cannot find stays unvisited on an honest floor; that is the first layer, and plenty of panels run that way for years. The second layer is authentication. The panel's user security gates screens by login, and that is the control to use where a recipe change carries consequences. Screen-level access control has its own setup: see HMI screen access control for a protected operator view. If the login has to be entered on a panel with no touch input, the entry method changes: see Password entry on an HMI panel with no touch screen.

This design puts the lock in the access selection and treats the password as optional, because passwords on the floor get misplaced or forgotten. Where records fall under data-integrity regulations, the two layers map onto the requirements: the access selection restricts who can change a value, and user security with change logging attributes each change to a named user.

How do you prove the operator screen is locked?

Run three checks on the panel before the line runs: touch every recipe field on the operator screen and confirm each one rejects entry, run one download and confirm the PLC registers hold the record, and walk every operator screen and confirm none reaches the engineering screen.

1. Field entry. Attempt entry in every field on the operator screen, one attempt per field. Every field must reject.
2. Download. With read and download set, run one download and compare the values in the PLC registers against the record. With read only set, confirm no download control functions.
3. Navigation sweep. Walk every operator-visible screen and try every button and event; none may land on the engineering screen.
4. Engineering screen. Open it, edit one value, download, confirm the PLC took the change, then restore the original values.

Repeat the pass after every project download to the panel. The access selections travel inside the project, so a fresh download re-imposes them, and the sweep catches any screen added since the last pass.

What does a worked example look like on a 12-field recipe book?

A bagging line with 12 parameters per record and 6 saved records needs 60 discrete checks, about 20 minutes at the panel: 12 rejected entry attempts, 12 register comparisons after one download, and 36 navigation paths swept across 9 operator screens.

The line runs one recipe book: 12 parameters per record, seal temperature and fill weight among them, and 6 saved records. The engineer builds the operator screen in read and download and an engineering screen in read, edit and download, reachable from no operator screen.

The verification pass, at about 20 seconds per action:

Operators can load any of the 6 records to the PLC and cannot change a value; all 6 records stay engineer-owned. After the next project revision the pass repeats. If the revision touched only two screens, the field check runs on those and the navigation sweep covers any new screen, which cuts the pass to a few minutes.

Recommendation: set the operator recipe screen to read and download when operators load records to the PLC, and to read only when they only view values. Keep read, edit and download on one engineering screen that no operator navigation path reaches, set low and high limits on the tags behind it, keep a password-free project copy labeled with its date, and repeat the three checks after every project download to the panel.

Questions