Configuration Instruction

Size: px

Start display at page:

Download "Configuration Instruction"

Isaac Mills
5 years ago
Views:

1 Configuration Instruction SIMATIC PCS 7 SIMATIC IT Integration PCS 7 / SIMATIC IT Integration Pack V6.1 SIMATIC software in a domain

2 Warranty, liability and support NOTE The application examples are not binding and do not claim to be complete regarding the circuits shown, equipping and any eventuality. The application examples do not represent customer-specific solutions. They are only intended to pro-vide support for typical applications. You are responsible in ensuring that the de-scribed products are correctly used. These application examples do not relieve you of the responsibility in safely and professionally using, installing, operating and servicing equipment. When using these application examples, you recognize that Siemens cannot be made liable for any damage/claims beyond the liability clause described. We reserve the right to make changes to these application examples at any time without prior notice. If there are any deviations between the recommendations provided in these application examples and other Siemens publications - e.g. Catalogs - then the contents of the other documents have priority. Warranty, liability and support We do not accept any liability for the information contained in this document. Any claims against us - based on whatever legal reason - resulting from the use of the examples, information, programs, engineering and performance data etc., described in this application example shall be excluded. Such an exclusion shall not apply in the case of mandatory liability, e.g. under the German Product Liability Act ( Produkthaftungsgesetz ), in case of intent, gross negligence, or injury of life, body or health, guarantee for the quality of a product, fraudulent concealment of a deficiency or breach of a condition which goes to the root of the contract ( wesentliche Vertragspflichten ). However, claims arising from a breach of a condition which goes to the root of the contract shall be limited to the foreseeable damage which is intrinsic to the contract, unless caused by intent or gross negligence or based on mandatory liability for injury of life, body or health The above provisions does not imply a change in the burden of proof to your detriment. Copyright 2006 Siemens A&D. It is not permissible to transfer or copy these application examples or excerpts of them without first having prior authorization from Siemens A&D in writing. For questions about this document please use the following address: mailto:online-support.automation@siemens.com V /32

3 Table of Content Table of Content Table of Content Introduction Test environment Equipment for the Windows active directory domain Installed software Before you start Installing the domain Maintain your domain Adding computers to the domain Running SIMATIC software as Administrator or Power User SIMATIC Shell SIMATIC and security settings in Windows In general SIMATIC PCS 7 OS Servers SIMATIC BATCH Servers SIMATIC IT computers SIMATIC PCS 7 ES and SIMATIC PCS 7 Clients Known problems with Power Users Open points while working as a Power user DCOM and domain policy settings for the SIMATIC BATCH Faceplates in case of working with a Power User Windows login and SIMATIC Logon References Abbreviations V /32

4 Introduction 1 Introduction This is an example of how to set up a running domain with SIMATIC software. It might not meet your preferences or policies but it gives you an overview of what to do. In case you need special settings you might apply them as needed for your environment but you should test that after special settings e.g. policies the software is still running. 1.1 Test environment The following schema shows in an overview the test environment which is used to set up the domain: Figure 1-1: Schema of the Windows active directory domain computers A private IP address band is used with fixed IP addresses. V /32

5 Introduction Equipment for the Windows active directory domain 2 Windows active directory domain controllers (DNS, WINS) 2 SIMATIC PCS 7 OS Servers (redundant) 2 SIMATIC BATCH Servers (redundant) 1 SIMATIC PCS 7 Engineering System (ES) 2 SIMATIC PCS 7 OS Clients with SIMATIC BATCH 1 SIMATIC IT Production suite 1 SIMATIC IT Historian and SIMATIC PCS 7 OS Client 1 SIMATIC IT Report/ CAB engineering 1 SIMATIC IT components software 1 SIMATIC PLC CPU 417 with a CP Installed software Operating System Table 1-1 Station Server Client Installation Windows 2003 MUI (Multilanguage User Interface) with SP1 Internet Explorer V6.1 SP1 Image software Windows XP SP2 Image software SIMATIC software SIMATIC software and its required software components (e.g. message queuing, SQL Server,...) are installed as needed. The installed software for SIMATIC PCS 7 and SIMATIC IT are the released integration packages. Table 1-2 Product SIMATIC PCS 7 SIMATIC IT Version Process Control System PCS 7 Toolset V6.1 incl. SP1 PCS 7 / SIMATIC IT Integration Pack V6.1 incl. HF2 (Part 1) (Updates for PCS 7 V6.1 SP1) SIMATIC IT Production Suite 6.1 SP1 SIMATIC IT Historian 6.1 SP1 PCS 7 / SIMATIC IT Integration Pack V6.1 incl. HF2 (Part 2) (Updates for SIMATIC IT V6.1 SP1) V /32

6 Introduction 1.2 Before you start The planning of a domain is a very important task. Which and how many computers do you need? Make sure you have drawings of your environment. Name your computers and the domain name according good manufacturing practice. Will you use a standalone domain or a domain which is part of your company domain? Will you have a domain in an isle or is your domain located in the company domain? Who are the responsible persons/ departments for installing and maintaining your domain? Do you have administrative rights on the domain or not? Is a domain necessary for you - or might a workgroup be enough? Usage of a redundant power supply or not? Backup strategies for the domain controllers? V /32

7 Installing the domain 2 Installing the domain In a SIMATIC domain environment you need the following services running: DNS WINS It depends on your needs if you want to use a DHCP Server or other domain specific servers running. In addition install the domain according your needs. 2.1 Maintain your domain NOTE Make sure you control in a frequent way your domain controllers. Check and clear (after saving) the event logs in a frequent way. Check the event logs of the computers in the domain frequently. Think over a recovery plan if your computers have a hardware failure. Create a backup plan for your software projects. You should make sure that only authorized personal will have access to the domain controllers. There is a lot of planning which must be done for maintaining your domain. V /32

8 Installing the domain 2.2 Adding computers to the domain While adding your computers to your domain there are two possibilities: SIMATIC software is already installed We added computers to the domain which had already a running SIMATIC software in a workgroup area. After adding the computers to the domain make sure you can logon to the domain by first using the domain administrator account and check the event viewer. As we do not want to run our computers logged in with an administrator account we added in our domain a user account named WindowsLogin. This account will have local Power User rights on every computer to run the SIMATIC software (see Chapter 2.3). Proceed with the hints mentioned in chapter 3 for getting the system again up in a running state. SIMATIC software is not already installed After adding the computers to the domain make sure you can connect to the domain. Check the event viewer and make sure everything is ok. Add if you do not want to run the computers with an administrator account a domain user in the computer as Power User (see chapter 2.3). To install the SIMATIC software on a computer logon to the domain using an administrator account and install the SIMATIC software which is needed for this computer. Proceed with the hints mentioned in Chapter 3 for getting the system again up in a running state. V /32

9 Installing the domain 2.3 Running SIMATIC software as Administrator or Power User Windows rights The minimum Windows rights you need to run SIMATIC software is to be a Power User. For installing software you need Windows administrator rights. We recommend for the PCS 7 software the usage of a Power user for the Windows login while for the SIMATIC IT we recommend an Administrator login (see Chapter 4.1). You can either add every login which needs Power User rights on every computer by hand or use the advantage of a domain with the group management. Group management in a domain One possibility is to create an Organizational Unit (OrgUnitWindows) in which you put a domain local group (ADLocalPowerUsers). In this group you add your Power Users you want to logon to the computers e.g. a login called WindowsLogin. You then use this group to grant permissions on the local computers as a local power user. NOTE In our test environment we are using several organizational units (OU) to organize the groups and users for the Windows 2003 domain. Our OU are called OrgUnitxy where the xy is the abbreviation for the SIMATIC software used (e.g. SB stands for SIMATIC BATCH). As you might see in the knowledge management document SIMATIC logon inside SIMATIC we are using several different logins for the different SIMATIC software. This is the reason why we are using several organizational units. V /32

10 Installing the domain Table 2-1 Step Activity Screenshot 1. Create an Organizational Unit in the Domain. 2. Move the existing user WindowsLogin into this group. V /32

11 Installing the domain Step Activity Screenshot 3. Create a domain local security group in the organizational unit. 4. Add the user WindowsLogin to the ADLocalPowerUsers group. V /32

12 Installing the domain Step Activity Screenshot Added group membership V /32

13 Installing the domain Step Activity Screenshot Windows organizational unit with the windows group and the user 5. On every member computer in the domain add the new created ADLocal- PowerUsers group to the local Power Users group. See Figure 2-1 below the table. V /32

Installing the domain Figure 2-1: User rights assignment on every computer in the domain NOTE To install software you need administrative rights.

14 Installing the domain Figure 2-1: User rights assignment on every computer in the domain NOTE To install software you need administrative rights. Make sure you start the installation of new software only when you are logged in as administrator. Also make sure after the installation to login once more as the administrator with which you installed the software as very often registry settings will be written after you restarted your computer. V /32

Step Activity Screenshot 1. You can open the SIMATIC shell over the windows explorer.

15 Installing the domain 2.4 SIMATIC Shell Table 2-2 The "Simatic Shell" dialog is a component of SIMATIC OS and serves for central maintenance and diagnosis of all computers tied into your clientserver system. Step Activity Screenshot 1. You can open the SIMATIC shell over the windows explorer. Inside the SIMATIC Shell you must see all your computers where either SIMATIC OS or SIMATIC Batch Base is installed, as these software bring the ACE configuration files for the SIMATIC Shell with them. 2. If you have more than one network cards in your system, you should check over SIMATIC Shell > Settings and choose in the Terminal bus selection dialog the correct network card for the terminal bus. Mark the right card and click OK. 3. If you have more than one network card make also sure that you check in the Network Connections, under Advanced > Advanced Settings, that the terminal bus connection is the first one in the register Adapters and Binders. If this is not the case use the buttons to move the right network card in the first position. For the process bus you should V /32

16 Installing the domain Step Activity Screenshot uncheck the setting: File and Printer sharing and Client for Microsoft networks. V /32

17 SIMATIC and security settings in Windows SIMATIC and security settings in Windows In general Windows shares for folders and files In a Microsoft Windows 2003 environment exists for folders the sharing and security tabs and for a file the security tab in the properties of the folder or the file. You can also access these tabs of right mouse click Sharing and Security or right mouse click on Properties. Figure 3-1: Tab sharing for the folder sbdata on a SIMATIC BATCH Server V /32

SIMATIC and security settings in Windows 2003 Figure 3-2: Tab security for a folder on a SIMATIC BATCH Server NOTE Depending what is entered in these tabs, a

18 SIMATIC and security settings in Windows 2003 Figure 3-2: Tab security for a folder on a SIMATIC BATCH Server NOTE Depending what is entered in these tabs, a user which is logged in or wants to access a share, a file or a folder from a remote computer will have access to these folders/ files or not. V /32

SIMATIC and security settings in Windows 2003 Windows user rights assignment In addition there exists in the Computer Management a list of Local Users and Groups with Users and Groups.

19 SIMATIC and security settings in Windows 2003 Windows user rights assignment In addition there exists in the Computer Management a list of Local Users and Groups with Users and Groups. Administrators or a software while installing (with administrator rights) are able to add there local groups or users. Figure 3-3: Local users and groups in the Windows computer management As an example: The SIMATIC BATCH software adds here a group called SIMATIC BATCH, while the SIMATIC WinCC Software adds groups named SIMATIC HMI. V /32

SIMATIC and security settings in Windows 2003 3.

20 SIMATIC and security settings in Windows SIMATIC PCS 7 OS Servers After logging into a SIMATIC PCS 7 OS Server as a Power User and starting the SIMATIC PCS 7 OS Server project you will receive a failure message. To solve this you have to add your Power User or the group where the user is in to the local Windows group: SIMATIC HMI. Figure 3-4: Adding the power user to the SIMATIC HMI group After this - the failure message while starting SIMATIC PCS 7 OS Server will not be shown anymore. V /32

21 SIMATIC and security settings in Windows SIMATIC BATCH Servers Before you log in with the Power User login and starting of the SIMATIC BATCH Servers you have to add your power user or better your power user group to the SIMATIC BATCH group and grant rights to the folders and files of SIMATIC BATCH. Figure 3-5: SIMATIC BATCH group You might have a warning from the launch coordinator while starting the first time as power user. As you probably have no SIMATIC PCS 7 OS software installed on your BATCH Server in your distributed environment this message is ok. V /32

SIMATIC and security settings in Windows 2003 Figure 3-6: Message after starting SIMATIC BATCH as power user You have to give the local Power Users the rights to access

22 SIMATIC and security settings in Windows 2003 Figure 3-6: Message after starting SIMATIC BATCH as power user You have to give the local Power Users the rights to access the shares and the folders in order to get your SIMATIC BATCH system running. Figure 3-7: Add rights for the folder BATCH for the ADLocalPowerUsers group V /32

23 SIMATIC and security settings in Windows SIMATIC IT computers NOTE As there are several possibilities we show here that it is also possible to add not only the Windows group but also directly a user login (e.g. the prior used WindowsLogin) if you are sure that you will only have ONE power user to add. We recommend for the usage of SIMATIC IT software the login with Administrator rights (see chapter 4.1). In order to run the SIMATIC IT computers as a power user you have to have full access to the share CONF and the folder and files located under ICUBESYS (installation path of SIMATIC IT software). Figure 3-8: Folders and files in the path ICUBESYS After you grant the Power User these rights you are again able to run your SIMATIC IT system. Proceed as follows: V /32

24 SIMATIC and security settings in Windows 2003 Table 3-1 Step Activity Screenshot 1. Grant access to the power user WindowsLogin for the folder SIT and its subfolders. 2. Share the folder CONF by adding the WindowsLogin user and giving the permissions. V /32

25 SIMATIC and security settings in Windows 2003 Step Activity Screenshot 3.5 SIMATIC PCS 7 ES and SIMATIC PCS 7 Clients The already mentioned settings for the files, folders and shares apply also to the SIMATIC PCS 7 Engineering System and the SIMATIC PCS 7 Clients. V /32

26 Known problems with Power Users 4 Known problems with Power Users 4.1 Open points while working as a Power user While trying to run the SIMATIC software as Power User the following known problems exists. SIMATIC IT It is recommended to run the SIMATIC IT computers with the Administrator login with which you installed the software as even if you get the system up and running as a power user several parts of the software need the Administrator right e.g. "Download-Objects" from PM to the BPM or while working with DIS. SIMATIC PCS 7 The working with SIMATIC BATCH faceplates on a SIMATIC OS Client as a power user is not working without special DCOM and policy settings in Windows. You need to have Administrator rights to see inside the Unit faceplates the phases without any special settings. The download of the SIMATIC OS project shows OK while downloading to the SIMATIC OS Server but the SIMATIC BATCH faceplate folder EDS in the SIMATIC BATCH share (C:\Program Files\Siemens\Batch\sbdata\EDS) can not be loaded if the user has no rights on the shares and folders on the SIMATIC OS Server computer. Microsoft SQL While running as a power user it is not possible to look at the SQL instance as the user has not been granted the rights. The solution for that is either a new server registration or granting access with the power user login inside SQL. NOTE If you have problems while running as a power user test it with administrative rights. If it works try to figure out if this is a known issue or if the right configuration for the folder/ share is not correct. Make sure to test your project in a test environment before going to the production environment. V /32

27 Known problems with Power Users 4.2 DCOM and domain policy settings for the SIMATIC BATCH Faceplates in case of working with a Power User You have to add special settings for your domain policy and to the DCOM settings to have a display of the phases inside the UNIT Faceplate on a SIMATIC BATCH Client. The domain policy you have to set is needed if you are working the software together with the SIMATIC Logon software. In the release notes you have a hint. Also in the readme of the software of SIMATIC Logon you will find a small hint. NOTE Settings in the domain policy If you are using SIMATIC Logon in a domain you have to add in the User rights assignment the policy "Access this computer from the network" the group "Authenticated Users. Figure 4-1: Policy setting inside the domain V /32

Known problems with Power Users Table 4-1 On the SIMATIC OS Servers you have to change the

computer correct displayed. Therefore on the SIMATIC OS type: Step Activity Screenshot 1.

A window named Component Services is started which provides access to the DCOM settings.. 2.

28 Known problems with Power Users Table 4-1 On the SIMATIC OS Servers you have to change the DCOM settings for the access rights in order to get the SIMATIC BATCH Faceplates on the Client computer correct displayed. Therefore on the SIMATIC OS type: Step Activity Screenshot 1. Start the dcomcnfg over START > RUN > dcomcnfg. A window named Component Services is started which provides access to the DCOM settings.. 2. Click with the right mouse button on My computer and choose Properties. There you have to change to the register Default Properties. V /32

After this change you have to go back to register COM security, where you have to manage the launch permissions.

29 Known problems with Power Users Step Activity Screenshot 3. Change the Default Authentication Level inside the Default Distributed COM Communications Properties to None. 4. After this change you have to go back to register COM security, where you have to manage the launch permissions. By default you will see that only Administrators have full rights of launching permissions. After allowing Everyone the launch permission the SIMATIC BATCH Faceplates are displayed even if you are logged on as power user. V /32

30 Windows login and SIMATIC Logon 5 Windows login and SIMATIC Logon After you started your computer with a Windows login (with Power User or Administrator rights) you can start your SIMATIC application. If you installed SIMATIC Logon on your computer you will use SIMATIC Logon to run your SIMATIC applications. The login used in SIMATIC Logon can be a different login then the Windows login. For detailed info on the SIMATIC Logon please refer to the knowledge management document SIMATIC Logon in a domain. V /32

31 References 6 References The following documents help files and FAQ where used in setting up the test environment. Security Handbook German English Helpfiles C:\Program Files\SIEMENS\Documentation\English V /32

32 Abbreviations 7 Abbreviations Abbreviations used in this manual: Table 7-1 Abbreviation AD BPM CAB CP DB DCOM DHCP DIS DNS ES FAQ HF HMI IP MUI OS OU PLC SIT SQL SP WINS Complete name Active Directory Business Process Modeler Client Application Builder Communication Processor Data Base Distributed Component Object Model Dynamic Host Configuration Protocol Data Integration Service Domain Name Service Engineering System Frequent Asked Question Hot Fix Human Machine Interface Internet Protocol Multilanguage User Interface Operator Station Organizational Unit Programmable Logical Unit SIMATIC IT Structured Query Language Service Pack Windows Internet Naming Service V /32

Configuration Instruction

Configuration Instruction SIMATIC PCS 7 SIMATIC IT Integration PCS 7 / SIMATIC IT Integration Pack V6.1 Time Synchronization Warranty, liability and support Time Synchronization 24639647 Note The application