EOS SCADA Authorization Levels

EOS SCADA software provides four different authorization levels to restrict the operations that users can perform:

  1. Monitor
  2. Operation
  3. Engineering
  4. Superuser

Authorization levels can be considered as a hierarchical structure in which higher levels include the permissions of lower levels. A user with a higher authorization level can perform the operations available to users at lower levels, as well as additional operations assigned to their own authorization level.

The same authorization levels can also be assigned to user control objects that send commands from SCADA screens. This ensures that a specific command can only be issued by an operator with the required authorization level.

1. Monitor Authorization

The Monitor level is the basic authorization level for personnel who primarily use the SCADA system to monitor the status of the facility.

A user at this level can use the SCADA Runtime software to open screens and monitor the operating status of the facility.

The user can also open the Status screen, which displays device connections and the general health status of the system.

Basic usage: A user with Monitor authorization can monitor the facility's SCADA screens and system status, but cannot perform higher-level operation or engineering tasks.

2. Operation Authorization

Operation authorization is used to monitor the facility's daily operational activities and access the required operational data.

A user with Operation authorization can perform all operations available at the Monitor level, as well as the following operations:

  • Open the data window and view the general status of data in list form.
  • Open the graph window and view trend curves of collected data.
  • Export data to files in formats such as CSV, GIF, and JPEG.
  • Edit live graph features.
  • Create new live graphs.
  • Access alarm and event records.

Therefore, the Operation level is suitable for users who monitor the facility's daily operations and need to analyze operational data.

3. Engineering Authorization

Engineering authorization is used when the SCADA system needs to be configured and technically managed.

A user with Engineering authorization can perform all functions available at the Monitor and Operation levels, as well as more comprehensive operations related to SCADA project and system configuration.

  • Modify project and general settings.
  • Add local databases.
  • Modify the device list.
  • Add new devices.
  • Refresh the entire project after making changes.

Refreshing the project reloads the configuration in a manner equivalent to closing and restarting the software.

Authorization principle: Engineering authorization should be assigned to users who require more comprehensive SCADA configuration capabilities beyond normal facility operation activities.

4. Superuser Authorization

Superuser is the highest authorization level defined in the EOS SCADA system.

A user at this level can perform all configuration and management operations available in the SCADA system. This includes defining new personnel and creating or modifying existing authorizations.

  • Perform all Monitor operations.
  • Perform all Operation operations.
  • Perform Engineering operations.
  • Define new personnel.
  • Create new authorizations.
  • Edit existing authorizations.
  • Close one project and start another project.

⚠️ CAUTION

Superuser authorization allows comprehensive changes to the entire SCADA system and should therefore only be assigned to authorized personnel who require these capabilities.

Assigning Authorization to User Controls

The EOS SCADA authorization system is not limited to determining the user's system login level. The same authorization levels can also be assigned to user controls that send commands from SCADA screens.

For example, if the Engineering authorization level is assigned to a button, the user must have at least the corresponding authorization level to send a command to the system through that button.

Example: If the authorization level of a user control is set to Engineering, only a user with Engineering or higher authorization can send the associated command through that control.

This structure is an important control mechanism that enhances operational safety, particularly by ensuring that commands sent to critical devices can only be executed by personnel with the appropriate authorization.

Accessing the Human Resources Menu

To define authorizations, click the HUMAN RESOURCES menu item in the SCADA Tree Menu Bar on the left side of the SCADA Editor using the left mouse button.

EOS SCADA Editor general workspace layout

The HUMAN RESOURCES menu contains two different submenus:

  1. OPERATOR LIST
  2. AUTHORIZATIONS

The OPERATOR LIST section is used to define personnel, while the AUTHORIZATIONS section is used to assign login and access permissions to these users.

Using the Authorizations Menu

Right-clicking the AUTHORIZATIONS submenu item opens the Authorization Menu.

EOS SCADA Editor general workspace layout

The following operations can be performed on authorization records using this menu:

  • Add authorization
  • Copy authorization
  • Cut authorization
  • Paste authorization
  • Delete authorization
  • Sort authorizations

The information belonging to a newly added or existing authorization record can be modified through the Settings Table on the right side of the screen.

Authorization Settings

When an authorization record is selected, its properties can be edited through the Settings Table on the right side.

The basic properties available for authorizations are described below.

Property Name Property Description Default / Options
AuthorizedUser Authorized user name -
AuthorizationType Determines which authorization method the user will use to log in to the system. None
Password
USBDongle
PasswordAndUSBDongle
Password Password information. -
PasswordAuthorizationLevel Authorization level to be used when logging in with a password. None
Monitor
Operation
Engineering
Superuser
USBDonglePasscode USB Dongle password. -
USBDongleAuthorizationLevel Authorization level to be used when logging in with a USB Dongle. None
Monitor
Operation
Engineering
Superuser
DateLimit Date limit for the authorization validity period. -

Authorization Types

EOS SCADA software supports three different authorization methods for users to log in to the system:

  1. Password
  2. USB Key
  3. Both Password and USB Key

The authorization type selected for a user determines the authentication method used when logging in to the SCADA Runtime software.

Password Authorization

When the Password authorization method is selected, the user must enter their username and password when logging in to the SCADA Runtime software.

The information entered by the user is matched against the defined authorization record to determine the user's authorization level.

USB Key Authorization

When the USB Key authorization method is selected, inserting the USB Flash Drive whose specific hardware characteristics have been registered in the SCADA authorization table into the SCADA computer is sufficient for login.

Once the USB Flash Drive matches the authorization record, the authorization level defined for the user is applied.

Purpose: The USB Key method provides an alternative login mechanism that requires the user to physically possess authorized hardware.

Password and USB Key Authorization

When Both Password and USB Key is selected, two different login methods can be defined for the user.

The user can log in to the SCADA system using a username and password, or by inserting the USB Flash Drive whose specific hardware characteristics have been registered in the authorization table into the SCADA computer.

One important feature of this method is that independent authorization levels can be defined for the password and USB Flash Drive login methods.

Example

A user can be assigned Monitor authorization when logging in with a password and Operation authorization when logging in with a USB Flash Drive.

Thus, the same personnel can access the SCADA system with different authorization levels depending on the login method used.

Dual Login Feature

EOS SCADA software supports the dual login feature.

This feature allows two operators to log in to the SCADA software simultaneously. Operators can log in to the system using either passwords or USB Flash Drive methods.

NOTE

The dual login feature allows multiple operators to access the same SCADA Runtime environment through the authorization mechanism.

Adding a Time Limit to an Authorization

EOS SCADA software also allows a time limit to be added to authorizations.

When a date limit is defined for an authorization record, the corresponding authorization automatically expires when the specified date is reached.

This feature allows the authorization of users who need temporary system access to be automatically terminated later without requiring manual removal.

Usage example: A temporary authorization can be created for personnel who will work on the SCADA system for a specific period, and the validity period of this authorization can be limited using the DateLimit property.

EOS SCADA Editor Authorization Entry Panel

The EOS SCADA Editor provides a dedicated Authorization Entry Panel to make it easier to create new authorization definitions and to edit existing authorizations more efficiently.

EOS SCADA Editor general workspace layout

To access this panel, the user must double-click the AUTHORIZATIONS submenu item using the right mouse button.

Existing authorization information can be edited using the authorization table displayed in the panel. New authorizations can be created using the entry tools located at the top of the panel.

Creating a New Authorization

The following steps should be performed sequentially to create a new authorization through the Authorization Entry Panel.

  1. Select the user to be authorized.
    The user to whom authorization will be assigned must first be defined in the OPERATOR LIST.
  2. Specify the Authorization Type.
    Select the method the user will use to log in to the system.
  3. Select the Authorization Levels.
    Specify the authorization levels to be used for password and USB Flash Drive login methods.
  4. Enter the password.
    If password-based login is to be used, define the required password information for the user.
  5. Select the USB Flash Drive.
    If USB Flash Drive login is to be used, insert the corresponding Flash Drive into the computer. The connected Flash Drive will be displayed in the relevant window of the panel.
  6. Click the CREATE AND ADD button.
    Create the authorization record using the selected settings and add it to the system.

After the authorization has been created, the record can be viewed in the authorization table, and the required modifications can be made through the relevant settings fields.

Recommended Authorization Approach

When defining authorizations in SCADA systems, it is recommended that users be given only the level of authorization required to perform their assigned tasks.

  1. Monitor authorization should be used for personnel who only need to monitor facility data.
  2. Operation authorization should be assigned to personnel responsible for performing daily operational activities.
  3. Engineering authorization should be used for technical personnel responsible for project, device, and system configuration.
  4. Superuser authorization should be assigned to the limited number of users who need to manage the entire system.

This approach helps ensure more controlled use of the SCADA system by limiting users' access to critical operations outside the scope of their assigned duties.

Security and Authorization Warnings

⚠️ CAUTION

Users should not be assigned higher authorization than necessary. In particular, the Engineering and Superuser levels should be used in a controlled manner because they provide access to operations that can affect the configuration and overall operation of the SCADA system.

Authorization levels assigned to user controls that send commands should also be configured consistently with user authorizations. This ensures that critical commands can only be issued by users with the required authorization.

For temporary users, the DateLimit property may be used whenever possible so that the authorization automatically expires at the specified date.

Summary

In EOS SCADA systems, assigning the appropriate authorization level to each user is as important as defining personnel in the system.

EOS SCADA software provides four authorization levels: Monitor, Operation, Engineering, and Superuser. These levels are used to determine the SCADA operations that users are permitted to perform.

In addition to user authorizations, the same levels can be assigned to user controls that send commands to the system. This ensures that specific commands can only be executed by operators with the appropriate authorization.

EOS SCADA software also supports authorization methods based on Password, USB Key, and Both Password and USB Key, and allows separate authorization levels to be assigned to password and USB login methods.

The dual login and time-limited authorization features also provide more flexible management of user access.

After all authorization operations have been completed, the changes must be saved to the database.

← Back to Previous Content