Configuration Instruction

Transcription

1 Configuration Instruction SIMATIC PCS 7 SIMATIC IT Integration PCS 7 / SIMATIC IT Integration Pack 2007 Electronic Signature in SIMATIC PCS 7 and SIMATIC IT Historian

2 Warranty, liability and support NOTE The application examples are not binding and do not claim to be complete regarding the circuits shown, equipping and any eventuality. The application examples do not represent customer-specific solutions. They are only intended to provide support for typical applications. You are responsible in ensuring that the de-scribed products are correctly used. These application examples do not relieve you of the responsibility in safely and professionally using, installing, operating and servicing equipment. When using these application examples, you recognize that Siemens cannot be made liable for any damage/claims beyond the liability clause described. We reserve the right to make changes to these application examples at any time without prior notice. If there are any deviations between the recommendations provided in these application examples and other Siemens publications - e.g. Catalogs - then the contents of the other documents have priority. Warranty, liability and support We do not accept any liability for the information contained in this document. Any claims against us - based on whatever legal reason - resulting from the use of the examples, information, programs, engineering and performance data etc., described in this application example shall be excluded. Such an exclusion shall not apply in the case of mandatory liability, e.g. under the German Product Liability Act ( Produkthaftungsgesetz ), in case of intent, gross negligence, or injury of life, body or health, guarantee for the quality of a product, fraudulent concealment of a deficiency or breach of a condition which goes to the root of the contract ( wesentliche Vertragspflichten ). However, claims arising from a breach of a condition which goes to the root of the contract shall be limited to the foreseeable damage which is intrinsic to the contract, unless caused by intent or gross negligence or based on mandatory liability for injury of life, body or health The above provisions does not imply a change in the burden of proof to your detriment. Copyright 2008 Siemens A&D. It is not permissible to transfer or copy these application examples or excerpts of them without first having prior authorization from Siemens A&D in writing. For questions about this document please use the following address: mailto:online-support.automation@siemens.com V /90

3 Table of Contents Table of Contents 1 Introduction In general Test environment Equipment for the Windows active directory domain Installed software... 6 Operating system... 6 SIMATIC software ESIG - Electronic Signature SIMATIC Electronic Signature inside SIMATIC PCS SIMATIC Operator Station SIMATIC Engineering Station SIMATIC BATCH How to create new roles for SIMATIC BATCH? Electronic signatures for releasing/ revoking a library/ master recipe/ formula Electronic signature inside a master recipe Some explanations to the ESIG inside a master recipe SIMATIC Electronic Signature inside SIMATIC IT SIMATIC Management Console SIMATIC Plant Performance Analyzer (PPA) Creating a new scenario The six possible scenarios for the PPA SIMATIC Historian Data Display (HDD) SIMATIC Compliance Services and viewer The Compliance Service server Compliance Service configuration Creating the CS Database with the help of the system SIMATIC Batch inside the CS viewer SIMATIC PPA inside the CS viewer SIMATIC HDD inside the CS viewer Filtering inside the CS viewer Using Profiles inside the CS viewer Report Manager and Compliance Service Configuring the Administration tool of the Report Manager Using the standard report for the Compliance Service Creating reports from scratch Failure Message FRM References Abbreviations V /90

4 Introduction 1 Introduction 1.1 In general General information, to the topic of how to set up a running domain, can be found in the knowledge management document SIMATIC software in a domain. Here just an overview from the environment which is used to give the information to the topic Electronic SIGnature in SIMATIC PCS 7 and SIMATIC IT 1.2 Test environment The following scheme shows the Windows active directory domain computers: Figure 1-1 Scheme of the Windows active directory domain computers A private IP address band is used with fixed IP addresses. V /90

5 Introduction Equipment for the Windows active directory domain 2 Windows active directory domain controllers (DNS, WINS) 2 SIMATIC PCS 7 OS Servers (redundant) 2 SIMATIC BATCH Servers (redundant) 1 SIMATIC PCS 7 Engineering System (ES) 2 SIMATIC PCS 7 OS Multiclient + SIMATIC BATCH Client 1 SIMATIC IT Production Modeler 1 SIMATIC IT Historian + PPA DB 1 SIMATIC IT Report Manager/ CAB engineering 1 SIMATIC IT components software + SITMesDB 1 SIMATIC AS CPU 417 with a CP V /90

6 Introduction Installed software Operating system The used operating systems for the domain computers can be found in the following table. Table 1-1 Server Client Station Domain Controller Installation Windows 2003 MUI (Multilanguage User Interface) with SP2 Internet Explorer V6.0 SP2 ( ) Image software Windows XP SP2 Image software Windows 2003 MUI (Multilanguage User Interface) with SP2 Internet Explorer V6.0 SP2 ( ) SIMATIC software SIMATIC software and its required software packages (e.g. message queuing, SQL Server 2005 with SPx,...) are installed as needed. The installed software for SIMATIC PCS 7 and SIMATIC IT is the released Integration Pack 2007 on top of the released SIMATIC Versions. Table 1-2 Product SIMATIC PCS 7 SIMATIC IT V7.0 SP1 Version Microsoft SQL 2005 SP1 HF PCS 7 / SIMATIC IT Integration Pack 2007 Part1 Updates SIMATIC PCS 7 V6.3 SP1 Microsoft SQL 2005 SP2 PCS 7 / SIMATIC IT Integration Pack 2007 Part2 Updates SIMATIC IT SIMATIC IT Report Manager HF1 A detailed list of the installed SIMATIC software can be found in the attachment A of the document SIMATIC software in a domain. NOTE To connect the SIMATIC IT Report Manager to the Database of the Compliance Service database - Hotfix 1 for the Report Manager is mandatory. V /90

7 2 ESIG - Electronic Signature On the Wikipedia webpage ( you can find currently several ways to define the word electronic signature. The most important one in the SIMATIC PCS 7 SIMATIC IT field is the description for the FDA 21 CFR, article 11. Food and Drug Administration 21 CFR Sec definitions (5) Digital signature means an electronic signature based upon cryptographic methods of originator authentication, computed by using a set of rules and a set of parameters such that the identity of the signer and the integrity of the data can be verified. (7) Electronic signature means a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual's handwritten signature. NOTE Please refer also to the SIMATIC knowledge management document SIMATIC Logon inside SIMATIC as SIMATIC Logon is mandatory for the usage of the SIMATIC Electronic SIGnature software package. 2.1 SIMATIC Electronic Signature inside SIMATIC PCS 7 NOTE SIMATIC Logon Service must be installed in order to use Electronic Signature. Electronic Signatures SIMATIC Electronic Signature is the SIMATIC Logon component that can be used to create an electronic signature. An electronic signature is a verification created and archived to fulfill a requirement such as important or critical operator input in an automation system. These verifications contain information about an operation, for example: Name of the person or persons responsible for performing the operation Date and time of the operation to be performed Significance of the signatures (an authorization, for example) Author V /90

8 Basic principle of operation If an electronic signature is required for an operation, configure the appropriate requirement in the corresponding application. SIMATIC Electronic Signature requests the information on the configured operations, checks it and transfers it to the calling application for storage. The requested operation is released only when all necessary signatures have been entered for the operation. Electronic signatures made with Electronic Signature fulfill the following requirements: Electronic signatures are unique: They consist of a user name and password. If the information for several or different users are requested, they are prompted to enter their user name and password. Once entered, electronic signatures cannot be reused ("copied"). Once entered, electronic signatures cannot be reassigned to another person. The electronic signature contains the following: Name of the person signing Date and time of the signature Name of the operator station Comments (optional) During configuration, the administrator can make settings so that the object is released only after one or more signatures have been entered (4-eyes principle). It is also possible to define certain rules that must be adhered to, for example: Different user roles (see section "SIMATIC LOGON") That signatures must be entered in a fixed order Opening SIMATIC Electronic Signature The SIMATIC Electronic Signature dialog box is displayed by the application with a specific call. How you activate the application-specific call for SIMATIC Electronic Signature is described in the documentation of the relevant application. V /90

9 NOTE In the folder from SIMATIC Logon C:\Documents and Settings\All Users\Documents\Siemens\SIMATICLogon\developmentkit is a document called SL_ProgrammingGuide.pdf which explains the development steps to connect 3 rd party programs to SL. The actual version contains also an example. Some explanations of this document can be found in the SIMATIC Logon inside SIMATIC document. While there only the most general hints according the usage of the SIMATIC Logon with the SIMATIC Electronic Signature are made in this document is shown how to create new Roles and new users for each application as this is slightly different depending where the SIMATIC Logon software package with ESIG is used SIMATIC Operator Station NOTE The feature ESIG is not supported in SIMATIC OS there is only the usage of SIMATIC Logon enabled. SIMATIC WinCC is a powerful HMI system for use with Microsoft operation systems. HMI stands for "Human Machine Interface", i.e. the interface between the person (the operator) and the machine (the process). Figure 2-1 Information from the SIMATIC OS according to SIMATIC Logon and ESIG V /90

10 For the usage of the SIMATIC Logon software inside SIMATIC OS please see the knowledge management document SIMATIC Logon inside SIMATIC. There are the steps described which are needed to set up SIMATIC OS with the SIMATIC Logon which is the basic for the ESIG in SIMATIC PCS SIMATIC Engineering Station NOTE The feature ESIG is not supported in SIMATIC ES there is only the usage of SIMATIC Logon enabled. The software Electronic SIGnature is not merged to the product SIMATIC Engineering Station (like in SIMATIC OS). Only the usage of SIMATIC Logon is enabled. It is also possible to make sure that only authored persons can make changes to the system (e.g. compile and download of the CFC) with a system based protection. This is done in the HWconfig of the system directly on the properties of the CPU in the register protection. Figure 2-2 The settings for the protection inside SIMATIC ES Protection Level Here you can select one of three protection levels to protect the CPU from unauthorized access. V /90

11 Figure 2-3 Possibilities in the Protection register Default setting (protection level 1; no password set): Depending on the CPU, this protection level has different names: For standard CPUs with a keyswitch, protection level 1 is called "Keyswitch setting". The keyswitch setting (mode selector switch) on the CPU determines the protection level: Keyswitch in RUN-P or STOP setting: no restrictions Keyswitch in RUN setting: only read access permitted However, you can bypass the keyswitch protection by entering a password. On standard CPUs whose operating mode switch is not a key switch but a RUN-STOP switch this protection level is called "No protection". You cannot set a password here. For F-CPUs or H-CPUs, protection level 1 is called "Access protection for F-CPU or keyswitch setting". In the default setting, no safety program can be downloaded to the CPU. You can download safety blocks to the CPU only after assigning a password and selecting the "CPU contains safety program" option. If you set a password protection level: Authorized users have read and write access, irrespective of the key switch position and of the set protection level. V /90

12 Once you entered the Level 3 (Write-/read protection) and entered a password for the level of protection.. Figure 2-4 Write/ read protection you are requested while compiling/ downloading to enter the password. Figure 2-5 Message when the SIMATIC ES system is protected NOTE The maximal password length for the Write-/read protection is 8 signs. V /90

13 2.1.3 SIMATIC BATCH In the beginning of working with SIMATIC Electronic Signature inside SIMATIC BATCH you have to assign (pre-)defined roles to users/ groups from your environment. This can either be users or groups from a domain environment (like in our case), local users/ groups from a computer or users/ groups from a log on computer in a workgroup (please refer to the knowledge management document SIMATIC Logon in a domain ). To assign the (pre-)defined roles to a user or group you have to start the SIMATIC BATCH control center (BCC) with a user login which belongs to the special group LOGON_ADMINISTRATOR (see SIMATIC Logon inside SIMATIC ). Only a user which is member of this group has the right to open the Roles management. inside the BCC like in the following picture. Figure 2-6 Roles management in SIMATIC BATCH V /90

14 The SIMATIC Logon Role Management tool window, where you can assign the users/ groups to the roles, will be opened. Figure 2-7 SIMATIC Logon Role Management tool used by SIMATIC BATCH In the upper window on the left side you can see the seven predefined roles which exist in SIMATIC BATCH: Super user Factory manager Shift manager Operator Process engineer Automation engineer Emergency operator On the right side you see the assigned user or group. Here as an example the group SBsuperusers is assigned to the role Super user. NOTE It is only possible to assign one user or one group to a role not several users or groups.. In the lower window you can see on the left side the domain (ADCGOA) and the local computer (Client03) from which you can assign the users/ groups to the roles in the upper window. V /90

15 How to create new roles for SIMATIC BATCH? NOTE It is possible to create new roles if the predefined roles do not fit into your project needs. When you want to create a new role you can do this with a right mouse click on the Roles in the upper window and then you can choose to create a new role. Figure 2-8 Configuring a new role You have to give the new role a Role name and if you want you can write a short description for this new role. Figure 2-9 Configuring a new role V /90

16 With a right mouse click on the Groups and users of the new created role you can (with the help of the Edit ) assign a new user/ group to the role. Figure 2-10 Configuring a new role Here as an example the user New.User from the domain is assigned to the NewRole. Instead of the Edit it is also possible to use a drag and drop from the lower to the upper window to assign a user/ group to a role. Figure 2-11 Configuring a new role V /90

17 Figure 2-12 Configuring a new role NOTE It is possible to export the settings from the role assignment to a file. Simply use "FILE > EXPORT" and you can save the settings to a file called SL_MyApplication_MyProject.xml or a text file to assist you in your documentation of your plant settings. The name of the file can be chosen free. This is an example of how the text file looks like. All roles Super user, Factory manager, Shift manager, Operator, Process engineer, Automation engineer, Emergency operator, NewRole,This is an example of how to create a new role! Roles: Super user,,group: ADCGOA\SBsuperusers, Roles: Factory manager,,group: ADCGOA\SBfactorys, Roles: Shift manager,,group: ADCGOA\SBshifts, V /90

18 Roles: Operator,,Group: ADCGOA\SBoperators, Roles: Process engineer,,group: ADCGOA\SBengineers, Roles: Automation engineer,,group: ADCGOA\SBautos, Roles: Emergency operator,,group: ADCGOA\SBemergencys, Roles: NewRole,This is an example of how to create a new role!,user: ADCGOA\New.User,D_New.User - For SIMATIC LOGON in a domain Back in the BCC you can open the permission management. Figure 2-13 Permission management inside SIMATIC BATCH The Open permission management is available no matter what user rights you have. If you are in the role of a Super user you have the possibility to change the settings for the permission management. If you are the member of another group you have only the possibility to view the settings for the permission management. The role to which you belong is indicated inside this window through a little green arrow in the register Individual permissions and Computers and Units. In the permission management you will find in the register Individual permissions a list of all roles with the rights in SIMATIC BATCH. For the V /90

19 new created role for example you have to define the individual rights. If you mark the line All functions you can easily assign all rights to the specific group. With the Batches, Formulas, General, Import/Export, Libraries, Materials, Process cell, Recipe Editor and Recipes you can assign specific rights to the role for these specific topics. Figure 2-14 Permission management inside SIMATIC BATCH - register Individual permissions V /90

20 In the register Computers and units you can assign for each computer in the plant which roles have access to this individual computers. As standard setting only the role Super user has rights on the different computers in the environment. If you want to have that also other roles have access on these computers you have to mark the appropriate role in this register for each computer. Figure 2-15 Permission management inside SIMATIC BATCH register Computers and units CAUTION The register Computers and Units is something which is often forgotten to adapt if you create new roles or add new computers in the environment. Without assigning here the correct settings you might have no rights on these computers or with these users. V /90

21 When you change a setting for a role or for a computer this is logged into the Change Log register. Figure 2-16 Permission management inside SIMATIC BATCH register Change Log V /90

22 Electronic signatures for releasing/ revoking a library/ master recipe/ formula In the Project settings inside the BCC exists a register called Electronic signatures. There you can define if an electronic signature is used in order to manage the release/ revoke of libraries, master recipes and formulas. You start this window from the BBC with: Options > Settings > Project settings Figure 2-17 ESIG for Libraries, Master Recipes and Formulas V /90

23 Here you have to go to the register Electronic signatures. Figure 2-18 ESIG for Libraries, Master Recipes and Formulas If you want to assign an electronic signature to a specific action, you have to mark the action and press the button "Edit ".Then you can choose from the existing roles which roles are needed to release/ revoke a library, master recipe or a formula. Figure 2-19 Configuring ESIG for Libraries, Master Recipes and Formulas V /90

24 This is an example of the usage of an ESIG for releasing a master recipe. Figure 2-20 Configuring ESIG in a master recipe After you configured and activated the ESIG in the appropriate place you will have to sign with an ESIG if you perform the action which is shown in the ESIG. V /90

25 If you release now a master recipe you have to sign to get this action done. Figure 2-21 Using ESIG for releasing a master recipe V /90

26 The name of the role indicated in the window shows which role has to sign for this action. In this example you have to sign as a member of the Super user role. Figure 2-22 Using ESIG for releasing a master recipe If you sign with a wrong user name, a wrong password or a user which is not a member of the role Super user, you will receive a message. The following message is shown when using an unknown user/ password. Figure 2-23 Using ESIG for releasing a master recipe V /90

27 Figure 2-24 Using ESIG for releasing a master recipe If you sign with a user which is not member of the Super user role you have the following warning message. Figure 2-25 Using ESIG for releasing a master recipe Signing with a correct user enables the action. You can acknowledge this action or cancel the signature procedure if you want to. Figure 2-26 Using ESIG for releasing a master recipe V /90

28 Figure 2-27 Using ESIG for releasing a master recipe This is the master recipe after the ESIG. Figure 2-28 Using ESIG for releasing a master recipe V /90

29 If you cancel the procedure you will receive a hint that this action leads to a lost signature. Here it is up to you if you agree and cancel the action or if you perform the action. Figure 2-29 Using ESIG for releasing a master recipe If you want to sign not only with one but with several roles you have to configure this inside the settings of the specific ESIG. Figure 2-30 Using ESIG for releasing a master recipe If you configured two roles to sign for an action you have to sign two times with the corresponding users/ groups. NOTE While configuring the ESIG you can choose the option Sequence. If you have chosen to sign in Sequence you have to follow the sequence which is visualized. V /90

30 Figure 2-31 Using ESIG for releasing a master recipe Figure 2-32 Using ESIG for releasing a master recipe V /90

31 Electronic signature inside a master recipe As an example we create a new recipe to show how this feature is working in general. Figure 2-33 Creating new Master recipe The register ESIG of the Master recipe is the important one for this use case as you define here the ESIG for the SIMATIC BATCH. Figure 2-34 Creating new Master recipe register ESIG V /90

32 NOTE This register is important. Here you define the electronic signatures for the master recipe. With these ESIGs you perform the status control of a running batch. The register "ESIG" is in the standard setting not activated. You have to configure the Electronic Signatures to your needs while configuring/ creating the master recipe. You activate the ESIG register with the check box Activate and the button "New". Figure 2-35 Configuring ESIG in a master recipe upper part of the register ESIG As you can see in the upper part of the window there are five actions possible: Change batch parameters Comments for batch Close batch Archive batch Rename batch For each of these actions you can define one or several roles which are needed. You can activate each of this actions individual by marking the Active check mark. V /90

33 In the lower part you see actions From to To which are the well known SIMATIC BATCH states: held planned released blocked running paused after step aborted stopped canceled Figure 2-36 The lower part of the register ESIG The possibilities for To are depending from the chosen From. Only possible state changes can be chosen. As an example for the released are only possible to choose: canceled blocked running The configuration of the roles is the same like already seen by the Master recipes and formulas. V /90

34 The following picture shows in an overview the possible batch status changes of SIMATIC BATCH. Figure 2-37 Possible status changes of SIMATIC BATCH V /90

35 If you configure an action do not forget to activate the ESIG via the Active checkbox. Figure 2-38 Configuring ESIG in a master recipe Some explanations to the ESIG inside a master recipe NOTE These are some explanations. For further info please refer to the online help. Action: Displays all the actions relating to the object that can be signed. The display is refreshed when you click the "New" button. Active: Here, you select the actions that you want to have signatures for. Time: Enter the time within which all the necessary signatures must be entered after the action. If the time expires (when the batch is at least released), a message to this effect is displayed in the message window of the PCS 7 OS. V /90

36 Sequence: Here, you select the actions for which the signatures must be entered in a specific order per action (assuming that more than one signature is required per action). All at once: The "All at once" option is always active for conditions (cannot be deactivated). This means that if more than one signature is required for a condition, all signatures must be provided at the same time, i.e. provided in an open "Sign" dialog. Roles: By clicking on this column, you open the "Configure roles" dialog to select the user roles for which the substitute will enter the signatures. From: Indicates the start status, for which the ESIG is needed, e.g. running To: Indicates the possible status, for which the ESIG is needed, e.g. when you are coming from running it is not possible to go direct in the status of CLOSED. 2.2 SIMATIC Electronic Signature inside SIMATIC IT NOTE NOTE Please refer to the knowledge management SIMATIC Logon inside SIMATIC where you can find in detail how the import of the users/ groups from the domain is working. In the actual version of SIMATIC IT (V6.3SP1HF2) you have to have a domain with groups and users in order to use the SIMATIC LOGON SIMATIC Management Console You can logon to the SIMATIC management console either by using the SIMATIC Logon or the build in user manager. For the usage of SIMATIC Logon you have to enable SIMATIC Logon inside SIMATIC IT. V /90

37 2.2.2 SIMATIC Plant Performance Analyzer (PPA) NOTE A detailed description How to install a new PPA database is described in the knowledge management document Data exchange in between PCS 7 and SIMATIC IT Historian The most important part for a new database which is using the ESIG function is the part where you choose the Electronic Signature Assignment. Figure 2-39 Electronic Signature Assignment of the PPA It is possible to have an ESIG in PPA for the following operations: Life Cycle Management Approve Configuration Delete Configuration V /90

38 Run/Stop Run Server Stop Server Project Management Project Modify Project Delete NOTE The scenarios can be browsed with the buttons "...", in case this scenarios have been defined prior in the User Management. It is also possible to browse for the scenarios after the creation of the database in case you have not created them upfront. Creating a new scenario Here as an example the creation of a new scenario. You start the User manager over the management console: "Tools > User Manager" There you have to change the view to the Scenario view. With "File > New > Scenario" you can create a new scenario. Figure 2-40 Creating a new scenario in the user manager You have to give the new scenario a name and if you like you can add a description. V /90

39 Here we create a new scenario to demonstrate the configuration, therefore we name the scenario 10NewScenario Figure 2-41 Creating a new scenario in the user manager V /90

40 Figure 2-42 Creating a new scenario in the user manager You have to assign a user which is allowed to sign for this particular scenario as an example the user superuser from the domain ADCGOA. NOTE In the SIMATIC Logon Import Tool where you enable/ disable the usage of SIMATIC Logon you have to choose also the User Validation type. If you want to use users from a domain (SIMATIC Logon needed) you have to check here the Windows Domain User Validation. V /90

41 Figure 2-43 Creating a new scenario in the user manager The six possible scenarios for the PPA There are six possible scenarios for the PPA and we created different ones for this example. The naming is according to the function of the scenario PPA. 01ApproveConfig 02DeleteConfig 03RunServer 04StopServer 05ProjectModify 06ProjectDelete V /90

42 Figure 2-44 The six defined scenarios for the PPA These created Scenarios were applied to the Database while creating the DB. Figure 2-45 The six defined scenarios for the PPA And when one of these actions is made you have to sign for this action, e.g. start of the configuration brings up this signing box. V /90

43 Figure 2-46 The signing of an ESIG request from PPA CAUTION NOTE While signing with a user it is not enough to type the name of the user you have to provide the whole username <domainname\username> - in our case ADCGOA\superuser. The results of this action can be seen in the SIMATIC Compliance Service Viewer. This application is explained later in this document SIMATIC Historian Data Display (HDD) To use ESIG inside the HDD you have to enter in your configuration some specific settings. At first you have to create a new configuration with e.g. a RTDS class with several Tags defined. While configuring the tags you have to choose the settings for the Audit Trail support. You can use the following three settings for the AT support: None Audit Trail AT with Electronic Signature Therefore we created three tags in the RTDS class Tag1_noAT_noESIG Tag2_AT_noESIG V /90

44 Tag3_AT_ESIG Figure 2-47 Creating a new tag inside a new configuration At the end you have a class with three configured tags. Figure 2-48 Creating a new tag inside a new configuration V /90

45 Now we have to approve this configuration. As we configured an ESIG for approving the configuration, you have to sign for this. Figure 2-49 Approving the new configuration with the new crated tags And as we choose Effective from next start you have to restart your PPA application in order to get the new values. After these steps we are ready to go to the HDD and start there a new Standard Trend with the help of the configuration wizard. In the wizard you have to make settings for: Source selection (PDA, PPA, WinCC Tag Logging, Calculated Tag) we choose PPA PPA project (in case you have more than one) Archive type (Online - Custom) Item selection Time span management Aggregate function Properties/ Settings And the wizard is ready to run after the Chart configuration The Item selection is the important one here as we choose now the three prior defined tags. V /90

46 As the chart is now running, we can have an automatic update for the tags. The tags we choose are values from our Reactor02. When we run a batch with SIMATIC BATCH with settings for the Reactor02 we see that the values are changing. After the batch ended and you stopped the automatic update it is now possible to change the values over the modify possibility for the tags which have enabled Audit Trail (AT) in our case Tag2_AT_noESIG Tag3_AT_ESIG Figure 2-50 Running the configuration wizard inside HDD You change the value for this tags with a right mouse click on a sample and choosing the Modify Sample option. V /90

47 Figure 2-51 Modifying a sample The Modify Sample dialog looks like that. Figure 2-52 Modifying a sample V /90

48 In case we have projected an ESIG (what we did on Tag3-AT-ESIG), you are prompted to sign in a box called ES request. Here you have to provide a user which is a member of the chosen scenario. Figure 2-53 Modifying a sample V /90

49 Figure 2-54 Modifying a sample As one result you see that after the value change the green curve (Tag3- AT-ESIG) is now different. In the Quality information on the right side you see also that the value was changed from GOOD to UNCERTAIN. The signing of the ESIG is tracked in the Compliance Service Database. NOTE The results of this action can be made visible in the SIMATIC Compliance Service Viewer which reads data out the Compliance Service database. This topic is explained in the next chapter. 2.3 SIMATIC Compliance Services and viewer SIMATIC IT Compliance Service is a tool that allows SIMATIC IT users to manage the following functionality: Full traceability of modifications applied to GMP (Good Manufacturing Practice) relevant data by means of an Audit Trail service. Electronic Signature management V /90

50 NOTE Inside the SIMATIC Compliance Services/ viewer the SIMATIC ESIG signatures you made prior in the other system parts like PPA, HDD, are directly displayed. So the Compliance Service Viewer is the place to go when you want to look up signatures you made before for SIMATIC IT. In addition it also imports the SIMATIC BATCH comments and ESIG signatures. Background Features The Compliance Service's functionality enhances SIMATIC IT products with new features oriented to applications in regulated industry, where the adherence to FDA standards is a must. The functionality developed in these services is oriented to reach compliancy with 21 CFR 11 recommendations. Significant events are, for example, the login and log-out operation of a user and the start operation of an order. The Compliance Service allows you to: generate Audit Trail records of operations performed on application's data. request the Electronic Signature as validation of operations subjected to the Audit Trail Service. request the Electronic Signature even if the operation is not subjected to the Audit Trail Service. visualize the stored Audit Trail records. Audit trail Service This service provides functionality to components in order to create Audit trail records and store them in a secure repository. SIMATIC IT components will use a unique repository. The service provides also functionality to extract AT records from the DB according to user-defined filtering criteria. Electronic Signature Service This service provides a functionality which allows components to approve activities carried out on the MES system via SIMATIC IT components by: authorizing specific operations (e.g. adding and modifying archived samples). For more information, see documentation for SIMATIC IT Historian. controlling the life cycles of Product Production Rules and Materials in SIMATIC IT PDefM and SIMATIC IT Material Manager respectively. For V /90

51 more information, see SIMATIC IT Product Definition Manager and SIMATIC IT Material Manager online help. having operations carried out by custom applications approved via the COM interface. See SIMATIC IT Compliance Service COM Interface. Each component is able to request that an electronic signature scenario be applied for the approval of specific activities. Approval is requested through the appearance of pop-up forms which vary according to predefined criteria. Activities requiring approval are displayed and the users whose approval/disapproval is required must then input their User ID and Password. Signatures Provided they are properly handled, UserIDs and Passwords are equivalent to full handwritten signatures (as stated in the 21 CFR 11 document). Traced records The Electronic Signature Service can be associated to an Audit Trail record. If it is the Audit Trail record links to the records generated by the Electronic Signature Service. Electronic signature data and corresponding Audit Trail records are archived only if the approval process is completes successfully. Only for this event the electronic record change is trailed The Compliance Service server The Compliance Service server is an executable, running only on one computer of a logical network and performing the following operations: It manages the requests to store Audit and Trail, Electronic Signature and Logbook records coming from all the running applications/ components. It manages the requests to read stored data. It manages the request to put data offline. Prerequisite The service requires SIMATIC IT Services installed. The Compliance Service Server has to be started every time you restart the system in order to enable the Compliance Service functions. V /90

52 You can do this over the management console Server > Compliance Service Server. Figure 2-55 Configuration of the Compliance Services Another possibility is to put this Compliance Service Server in the auto start list of the system. This is the preferred way as you cannot forget to start this service after restarting the system. Start from the management console: Configuration > System and switch to the tab Start-Up to configure the automated Start-up of the Compliance Service Server. Figure 2-56 Configuration of the Compliance Services V /90

53 2.3.2 Compliance Service configuration Before you can use the Compliance Service in his full function you have to configure it. You can do this by opening the Compliance Service Configuration from the management console: Configuration > Compliance Service Configuration Figure 2-57 Configuration of the Compliance Services V /90

54 This opens the configuration window. You see the already existing configurations. In our case we are using a Database called Compliance with an alias name called ComplianceAlias. Figure 2-58 Configuration of the Compliance Services As you can see there is a possibility to enable the CS with a checkmark Enable Compliance Service. V /90

55 With the button "Properties" you can have a look at the settings of an already existing database. Figure 2-59 Configuration of the Compliance Services NOTE The CS database can be created with the help of the system while configuring it. Creating the CS Database with the help of the system While configuring the CS database system it is possible to direct create the CS database described in the following pictures. In the Compliance Service Configuration area use the "Add" button to create a new CS database. V /90

56 Provide the correct SQL Server Name, user Name and Password. Figure 2-60 Creating the CS database with the help of the system V /90

57 In the empty field Database: type in a name for the new database, e.g. AddNewComplianceDB. Provide the Alias Name, the User Name and the password. Figure 2-61 Creating the CS database with the help of the system Click "Finish" to create the Database. V /90

58 After the database has been created you see in the Compliance Service Configuration window the newly created database. Figure 2-62 Creating the CS database with the help of the system Mark the new database and with the button "Set Default" you can make the newly created database as actual DB. The actual DB has in the Alias row a green arrow. NOTE It is only possible to have one database active. In general it does not make sense to have here more then one database. V /90

59 2.3.3 SIMATIC Batch inside the CS viewer Inside PPA you have to Import the data from BPM to have the comments from a batch inside the CS viewer. Figure 2-63 Configuration of the PPA database for working with batch in the CS viewer If you run then a batch with SIMATIC BATCH you can see later in the CS viewer the inserted comments. You can start the CS viewer from the management console: Client > Compliance Service Viewer Figure 2-64 Staring of the CS Viewer V /90

60 Figure 2-65 Compliance Service Viewer NOTE Data which is coming from SIMATIC BATCH is displayed green in the CS viewer. All other displayed data from PPA, HDD.. will be displayed without color. CAUTION The data is available inside the CS viewer only if the batch is CLOSED in SIMATIC BATCH. The values of not closed batches are not displayed in the CS viewer. In the CS viewer exists a which you can use to change the display options of the CS viewer. You have e.g. the possibility to show only data which is coming from SIMATIC BATCH in the display when you search for a specific ApplicationID which refers to SIMATIC BATCH. V /90

61 Figure 2-66 Filter for SIMATIC BATCH data Figure 2-67 Compliane service viewer with filter Simatic BatchSystem NOTE The ApplicationID you can search for in the CS viewer for entries coming from the SIMATIC BATCH system is Simatic BatchSystem. V /90

62 2.3.4 SIMATIC PPA inside the CS viewer The PPA Electronic Signatures actions are written to the CS viewer. There is no coloring of the entries like in BATCH. Figure 2-68 Filter for PPA entries in the CS viewer Figure 2-69 Compliance Service Viewer PPA NOTE The ApplicationID you can search for in the CS viewer for entries from the PPA is Admin. In case you have a canceled ESIG the ApplicationID to search for is PPA ADMIN.. Figure 2-70 View of canceled ESIGs from the PPA inside the CS viewer V /90

63 2.3.5 SIMATIC HDD inside the CS viewer The HDD Electronic Signatures actions are written to the CS viewer. There is no coloring of the entries like in BATCH. Figure 2-71 Compliance Service Viewer HDD NOTE The ApplicationID you can search for in the CS viewer for entries from the HDD is S_Pdd#10# SITHIST. This contains the computer name so in other systems this name looks most likely different. In case you have a canceled ESIG the ApplicationID to search for is HDD Appl.Server. Figure 2-72 Filter for HDD entries in the CS viewer Figure 2-73 Filtered for HDD entries in the CS viewer Figure 2-74 Filter for canceled HDD entries in the CS viewer V /90

64 2.3.6 Filtering inside the CS viewer A very good possibility to find entries inside the CS viewer is the filtering. You can open the Set Filter dialog with the Button marked in red. Figure 2-75 Compliance Service Viewer Set Filter Like seen in the chapters before, with the filtering for an ApplicationID and the field OP %LIKE%, you can very easily create CS views with the relevant data. Figure 2-76 Compliance Service Viewer Set Filter As you can see in the Set Filter dialog, it is also possible to filter for a time frame "From.To", which gives you also in a very comfortable way the information, you are interested in. V /90

65 NOTE If you use instead the %LIKE% expression in the field OP the expression!=, the entered field text will be filtered out. The possible field OPs are: Figure 2-77 Possible Field OPs For the order by, the following possibilities exist: Figure 2-78 Order by possibilities V /90

66 2.3.7 Using Profiles inside the CS viewer After you have applied a custom filter to the CS viewer you might want to reuse this filter at a later time. For this case you can save the view as a profile, with a name which is self explaining: File > Save Profile Figure 2-79 Using Profiles in the CS viewer After having done this for your custom filters you can reload your filters with File > Load Profile V /90

67 Figure 2-80 Using Profiles in the CS viewer NOTE It makes sense to save after the first start of the CS viewer the loaded profile as "Standard" profile BEFORE applying the first custom filters. In that way no matter what you filter out, you can go back to the standard setting. 2.4 Report Manager and Compliance Service If you want to use the Report Manager for creating reports based on the Compliance Service you have to configure the Report Manager to do this. The needed steps are explained in the next chapters. NOTE Like mentioned in the first part of the paper to be able to use this function in Report Manager you have to have the HF1 from RM installed. Another setting which has to be made inside the PPA Administration Tool for the Report Manager is the creation of the Report Manager view. V /90

68 Figure 2-81 Creation of the Report Manager view inside PPA Configuring the Administration tool of the Report Manager Start the Report Manager Administration Tool All Programs > SIMATIC > SIMATIC IT > Components > Report Manager (RM) > Report Manager Console Figure 2-82 Starting the Report manage Administration Tool In the Administration Tool you have to create a new production connection (Repository) to the SQL database of the Compliance Service. We have already two Production Connections configured one to Historian (PPA_PPA) and one to the Production suite (SITMESDB_PS). V /90

69 Figure 2-83 Creation of a new Production Connection Figure 2-84 Creation of a new Production Connection V /90

70 After having chosen the connection type you have to provide a project name which you simply type into the free field (we have chosen the name Compliance). In the Component you have to choose with the drop down menu one of the four possible connections (in this case Compliance Services). Provide the User name and the password choose the server from which you want to add the information and choose the database (which is the name of the Database). The connection parameters look in our case like that: Figure 2-85 Creation of a new Production Connection After having created the new Repository you have to install the Standard Reports from this Repository to the Report Manager server. Use a right mouse click on the new created product connection > "Install Standard Reports" V /90

71 Figure 2-86 Installing the Standard Reports After the reports have been installed there is a message which indicates that this task is done. Figure 2-87 Installing the Standard Reports V /90

72 The standard path for this installation is the path to My Documents which is in our case called MyDocs. There exists a folder My Business Objects Documents with a subfolder userdocs. There the Standard reports will be installed. Figure 2-88 Installing the Standard Reports Using the standard report for the Compliance Service To use the predefined reports you have to open the report manger. You can do this in the management console Client > Report Manager Figure 2-89 Using the standard report After having provided a correct login the following page is shown. In the welcome screen cancel the welcome screen with the button "Cancel". V /90

73 Figure 2-90 Using the standard report This opens you an empty Report Manager view. Figure 2-91 Using the standard report V /90

74 With the File > Open command you can open the predefined reports. There exists only one for the CS which is named CS OverviewReport.rep. Figure 2-92 Using the standard report As this is the standard report it cannot contain the actual values from your plant. Therefore you have to refresh the data with the button "Refresh Data". Figure 2-93 Using the standard report V /90

75 Provide the time range you desire for the display of the report. Figure 2-94 Using the standard report After having applied the time range the Enter or Select Value window opens. Here you can, with the button "Values, show the complete List of Values of AT Action for the Select Action or List of Values of atusc.signature Username for the Select User query. Figure 2-95 Using the standard report V /90

76 Hit in the List of Values of AT Action the button "Refresh". Figure 2-96 Using the standard report Here you can choose the query you want to apply. Do this for the Select Action and Select User query. If you want to have the complete report for the CS use the "%" which is a placeholder. This gives you every available value for the selected timeframe. Figure 2-97 Using the standard report Hit in the Enter or Select Values Box the "OK" button and the Standard report will be displayed. V /90

77 Figure 2-98 Using the standard report After having customized the Standard Report you can save the report with File > Save As. Figure 2-99 Using the standard report V /90

78 The reports can be saved on either folder in the network. Several report formats can be applied, e.g. *.rtf, *.pdf, *.xls and then be distributed via or a shared folder on the network. Figure Using the standard report V /90

79 2.4.3 Creating reports from scratch To create a customized report you have to open the Report Manger. You can do this from the management console Client > Report Manager After having provided a correct login the following page is shown. In the welcome screen use the button "Begin >" to create a customized report. Figure Creating a customized report V /90

80 Choose Universe and push the button "Next >". Figure Creating a customized report V /90

81 Choose the Compliance_CS Universe and push the button "Finish". Figure Creating a customized report V /90

82 This is the query panel which opens after your settings Figure Creating a customized report V /90

83 From here you can move from the Classes and Objects side (on the left) via drag and drop the desired data to the result objects window frame (on the right). Figure Creating a customized report With right mouse click on an object you can apply a simple condition e.g. for the AT Action opens the Apply Simple Condition a window called List of Values of AT Action. Choose here the desired one e.g. Run PPA. Figure Creating a customized report V /90

84 After having applied the simple condition it looks as follows. Figure Creating a customized report Run the query and the following report will be generated. Also this report can now be saved with a customized name and we have created our customized report. Figure Creating a customized report V /90

85 2.4.4 Failure Message FRM0024 If you experience the following failure message No macro with this name. Cannot execute macro. (FRM0024) you have forgotten to import the Macro in the "Report Manager > Tools > Add-Ins". Figure Macro message Figure Import the macro from the path displayed V /90

86 This information can be found in the RMtrouble.pdf file from the Report Manager. Figure Failure description from the RMTrouble.pdf V /90

87 This macro is responsible to display the Select Time Range dialog. Figure The macro opens this dialog V /90