Adopting the following security best practices should be considered when using this application.

Transcription

1 Overview This Field Agent* configuration Tool is used to build an installable configuration bundle for a Field Agent* that is factory fresh and enrolled with your Edge Manager. NOTE: This utility does not merge existing machine adapter configurations already in your Field Agent* with the configuration you create with this utility. The prior configuration will be over written. Manually editing the set of files needed to configure the machine adapters to publish data from a logic controller through the Field Agent* to the Predix Cloud is a complex and error prone process. This utility is designed to allow the user to focus on the relevant data needed to configure the I/O and takes care of building a valid syntax set of configuration files in a bundle that can then easily be installed on the Field Agent*. Wherever possible, default values for configuring parameter values will be filled in automatically. It is still the user's responsibility to confirm the values are correct for their configuration. Security Recommendations Adopting the following security best practices should be considered when using this application. Care must be taken when connecting computers, on which this application runs, to a wide area network including but not limited to a corporate network or the Internet at large. The network segmentation and firewall rules at each network interface must be carefully considered to reduce the allowed traffic to the bare minimum needed for operation. Access rules customized to the site s specific needs must be used to access other devices from outside the local control networks. Care must be taken to control, limit, and monitor all access, using, for example, virtual private networks (VPN) or Demilitarized Zone (DMZ) architectures. If a computer is being used in a manner that does not require wide area network access, it is strongly recommended that the computer not be connected to any wide area network to reduce attack surface. Harden system configurations by enabling/using the available security features, and by disabling unnecessary ports, services, functionality, and network file shares. Apply the latest GE product security updates, SIMs, and other recommendations. Apply the latest operating system security patches to all computers. Use anti-virus software on all computers and keep the associated anti-virus signatures up-todate. Use whitelisting software on all computers and keep the whitelist up-to-date. Usage Notes Generally, using this utility entails either opening an existing project, or starting a new project and then following a workflow by passing through the dialog tabs from left to right, filling in the relevant properties. Setup Tab Start by defining the project on the Setup tab and filling in all relevant fields.

2 DEVICE INFORMATION This information section defines configurations for the targeted Field Agent* machine. DEVICE ID This is an optional field. You may wish to use the same value here as defined for the Field Agent* in the Edge Manager. CONFIGURATION VERSION This is an optional field. It is a user-defined value to track the configuration tool s project version. DEVICE MODEL Selection of the Field Agent* model will change capabilities defined in later tabs. PREDIX VERSION You can find the Predix Machine Version of your Field Agent* by browsing its web console and then selecting the OSGi Bundles menu. Scan down the list of installed bundles looking for the one prefixed with "Predix Machine" and look at its version. This is the version of the Predix Machine installed in the Field Agent*. Note that earlier versions of the Field Agents* do not have this Bundles plugin enabled by default, so the Bundles menu option will not be available. It is recommended that you download the latest Application Bundle available for your Field Agent* from the GE Support web site to enable the latest features. PROTOCOL Once the Device Model and the Predix Version have been selected, the available machine adapter protocols are enabled for the above selections. By selecting a protocol, the protocol tab and package tab will be added next to the Setup tab. If there are protocols already selected when changing the Device Model and Predix Version, the unsupported protocol will be removed from the Tab list and the unsupported protocol will be disabled from the protocol list. 2

3 DATA RIVER SETTING The current configuration tool supports only the Web Socket River for the Hoover Spillway Destination. TIME SERIES ZONE ID Time series zone id is the instance id of the time series service that the Field Agent* signs up for in Edge Manager. 3

4 WEB SOCKET URL For Field Agents* used inside the GE Intranet, an alternate Web Socket River URL may be needed: wss://gateway-predix-data-services.run.asv-pr.ice.predix.io/v1/stream/messages Default Web Socket River URL for Field Agents* enrolled on the US West Edge Manager will need to use: wss://gateway-predix-data-services.run.aws-usw02-pr.ice.predix.io/v1/stream/messages If you are still using your Field Agent* on the US East Edge Manager, then the URL is: wss://gateway-predix-data-services.run.asv-pr-pub.ice.predix.io/v1/stream/messages To reset the URL to the default value, delete the contents of this property, save your project, and then open it again. The values of these fields are specified by the Predix application that will be used with the Field Agent*. Use the values as provided with the application. OPC UA Tab User can either follow the three steps (OPC UA Servers, Subscriptions, Tags) by clicking or use the navigation button to configure OPC UA protocol. or 4

5 OPC UA Servers AREA NAME This is a user-defined identity of this OPC UA Data Source CONNECTION SETTINGS Each OPC UA Server requires a name and a connection setting including the server name or ip address, port number and the server resource path. These fields are used to form a valid OPC UA end point URL in the format like opc.tcp:// :4840/myopcuaserver. SECURITY SETTINGS The OPC UA server s username and password can be configured also when the security mode of the OPC UA server is NONE. More servers can be added by clicking the delete icon. button. Existing servers can be removed by clicking OPC UA Subscriptions GENERAL Each OPC UA Subscription requires a name and one OPC UA Server associated with it. A description is optional. PREFIX User can define prefix to be added to tags belonging to this subscription to make their tag name distinguishable in the time series database in the cloud. PUBLISH INTERVAL The OPC UA Machine Adapter subscription has two types of communication patterns with the OPC UA server. Both patterns are described as following: Subscribe: The OPC UA adapter registers monitored nodes to the OPC UA server. Based on the Data Change Filter and interval configured in the subscription or in the node, the OPC UA server will push the data change to the adapter. Pull: The OPC UA adapter pulls data from the OPC UA server regularly based on the interval of the subscription, regardless whether the data is changed on the server. The Data Change Filter is not applicable in this pattern. The default pattern is Subscribe. The publish interval of the subscription is in milliseconds. TIMESTAMP To specify which of the time stamps should be included in the data packet sent to the spillway subscribing to this node, choose one of the following values in the TIMESTAMP selection. Adapter: Use the time stamp at the machine adapter (The computer running Predix Machine) 5

6 Server: Use the time stamp at the OPC UA server. (The computer running the OPC UA server serving the data.) NOTE: If the Server time stamp is requested but is not found in the data received, the Source time stamp is used. Source: Use the time stamp at the data source. (The device where the data originates) NOTE: If the Source time stamp is requested but is not found in the data received, the Server time stamp is used. DATA FILTER TRIGGER The trigger value is used to filter data that triggers a data change notification. There are three types of changes that triggers a notification message. Valid values are: Status: The status of the value StatusValue: The value or status of the value. StatusValueTimestamp: The source time stamp, value, or status of the value. DEADBANDTYPE Deadband is a permitted range for value changes that will not trigger a data change notification. Deadband can be applied as a filter when subscribing to Variables and is used to keep noisy signals from updating the Client unnecessarily. Valid values for deadband types are: None: No deadband is specified. Absolute: Contains the absolute change in a numeric data value that triggers a notification to be generated. Triggers a value change if abs (last value - new value) > DeadbandValue. Percent: The percentage of the Range. Only applied to variables having a range property. Triggers a value if the value changed more than the percentage of the configured value range. DEADBAND VALUE Specifies the values for the deadband types. More subscriptions can be added by clicking the by clicking delete icon. button. Existing subscriptions can be removed OPC UA Tags Tags and their properties are shown in a data table. Users can search or select Table filters and define their own filters to show only interested tags. The Actions options allows users to selected which columns to display. Export CSV will export all tags into a csv formatted file. This csv formatted file can be used as the template to add more tags and use Import CSV to import the changed file back into the configuration tool. Also, by selecting tags, there is an action, Delete Selected, to delete multiple tags at once. 6

7 The newly added tag can be edited by clicking on the edit icon on the right side of each row of the table. Users can edit most columns except subscription, server, and prefix. Once a subscription is selected, its corresponding server and prefix (if Ignored Prefix is not selected and a value exists in the subscription) will automatically be populated. The tag NodeId supports four OPC UA node identifier types: String, Numeric, GUID (without the curly braces) or Opaque (base 64 encoded opaque data). The data filter columns (TRIGGER, DEADBAND TYPE, DEADBAND VALUE) has the same meaning as the subscription data filter. The default value for TRIGGER and DEADBANDTYPE is Inherit and that means the tag is going to use whatever data filtering define in its subscription. NOTE: The user can override the subscription value per tag by selecting the desired value within the tag column. More tags can be added by clicking the button Add Tag or Delete Tag after clicking the row action icon EtherNet/IP TM Tab EtherNet/IP protocol is available within Predix machine 17 and above.. Tags can also be added or deleted by choosing at the very right of each tag row. User can either follow the three steps (EtherNet/IP Servers, Subscriptions, Tags) by clicking or use the navigation button to configure EtherNet/IP protocol. or EtherNet/IP Servers DATA SOURCE/SERVER NAME This is a user-defined identity of this EtherNet/IP Data Source. CONNECTION SETTINGS Each EtherNet/IP server requires a name and a connection setting including the server name or ip address, port number. The available EtherNet/IP protocols are CIP and PCCC. More servers can be added by clicking the delete icon. button. Existing servers can be removed by clicking EtherNet/IP Subscriptions GENERAL Each EtherNet/IP subscription requires a name and one EtherNet/IP server associated with it. A description is optional. 7

8 PREFIX User can define prefix to be added to tags belonging to this subscription to make their tag name distinguishable in the time series database in the cloud. PUBLISH OPTIONS User can define the publish interval of the subscription in milliseconds, seconds, minutes or hours. User can define the minutes/hours to delay before data starts transferring by select User defined for Start Point Type and specifies the number or minutes/hours. More subscriptions can be added by clicking the by clicking delete icon. button. Existing subscriptions can be removed EtherNet/IP Tags Tags and their properties are shown in a data table. Users can search or select Table filters and define their own filters to show only interested tags. The Actions options allows users to selected which columns to display. Export CSV will export all tags into a csv formatted file. This csv formatted file can be used as the template to add more tags and use Import CSV to import the changed file back into the configuration tool. Also, by selecting tags, there is an action, Delete Selected, to delete multiple tags at once. The newly added tag can be edited by clicking on the edit icon on the right side of each row of the table. Users can edit most columns except subscription, server, and prefix. Once a subscription is selected, its corresponding server and prefix (if Ignored Prefix is not selected and a value exists in the subscription) will automatically be populated. The data filter columns have the same meaning as the subscription data filter. More tags can be added by clicking the button Add Tag or Delete Tag after clicking the row action icon. Tags can also be added or deleted by choosing at the very right of each tag row. Package Tab Package tab contains summaries of all previous tabs for user to review. Package button is used to create configuration bundles. If there are invalid data fields, user get a warning notification at the top of the package tab. Once all fields are filled in with valid data, the Package button will generate the data files and zip them into a bundle needed to configure the Field Agent*. The generated bundle is stored in the same folder as your project is saved, and uses the same base name for the file with the file extension ZIP. 8

9 Open your web browser to your Edge Manager, upload the bundle you just generated to the Edge Manager Repository, and then schedule and deploy the configuration to the related device. General Validate Once all information is entered in each tab, a status of either Valid or Invalid shows to indicating valid data or missing/invalid data. Fields with invalid value are usually highlighted with comments indicating the error. Most fields have a tooltip when the user hover their mouse over the field or click on the information icon next to the field to get more detailed information about these fields and their expected valid values. NOTE: Filling a field in with valid syntax data, but an incorrect value, can still generate a configuration that is a non-functional yet valid format. It is the responsibility of the user to fill in the data with the correct values. Menus File New, Open, Save, Save As Use these menus to start a new configuration project, open an existing project, save a project, or save the current project with a new name. The default folder for saved projects is your Documents folder. If you change to a different folder when you save your project, then that folder becomes the new default folder. If a newly opened project is marked as changed ('*' after the name in the title bar), then this indicates that the project was modified since opened. Preferences Preferences item allows a user to set settings. Current available setting are language and load from recent project file. 9

10 Edit Undo, Redo, Cut, Copy, Paste, Delete, Select All Use these menus to edit the editable fields. Select All will select all text fields within the current active page. View Actual Size, Zoom In, Zoom Out, Toggle Full Screen Use these menus items to change the display size of the configuration tool. Window Minimize, Close Use these menus to minimize or close (exit) the configuration tool. Help Release Notes, Documentation, About Release Notes item displays a window with the release notes for all available version. Documentation item displays a window containing a user guide for the application and the About item displays the application versions. * Trademark of the General Electric Company or its subsidiaries. All other brands or names are property of their respective holders. Copyright 2018 GE Power. All rights reserved. 10