Industrial IT. 800xA - System 800xA for DCI System Version 4.1. Configuration

Industrial IT 800xA - System 800xA for DCI System Version 4.1 Configuration

Industrial IT 800xA - System 800xA for DCI System Version 4.1 Configuration

NOTICE The information in this document is subject to change without notice and should not be construed as a commitment by ABB. ABB assumes no responsibility for any errors that may appear in this document. In no event shall ABB be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, nor shall ABB be liable for incidental or consequential damages arising from use of any software or hardware described in this document. This document and parts thereof must not be reproduced or copied without written permission from ABB, and the contents thereof must not be imparted to a third party nor used for any unauthorized purpose. The software or hardware described in this document is furnished under a license and may be used, copied, or disclosed only in accordance with the terms of such license. This product meets the requirements specified in EMC Directive 89/336/EEC and in Low Voltage Directive 72/23/EEC. Copyright 2003-2005 by ABB. All rights reserved. Release: May 2005 Document number: 3BUA000135R4101 TRADEMARKS All rights to trademarks reside to their respective owners.

TABLE OF CONTENTS About This Book General...7 Intended User...7 Document Conventions...7 Use of Warning, Caution, Information, and Tip Icons...8 Terminology...9 Applicable Specifications...10 Industrial IT Certification...10 Related Documentation...10 Section 1 - Introduction Product Overview...13 Functional Description...13 DCI Connect Documentation...14 Section 2 - Composer CTK Introduction...15 Description...15 Creating a DCU Tag List...16 DCU Manager...19 Node Addressing and Network Status Display...21 Network Device Assignment...22 DCU Resident Configuration...24 DCU Support Services...25 3BUA000135R4101 5

Table of Contents Section 3 - Network Services Introduction...27 DCU Connectivity...27 Conductor NT/UX Synchronization...28 Time Synchronization of DCU...28 Service Startup...28 List of Required DCI Network Services...28 Section 4 - Control Object Type Definition Introduction...31 Standard DCU Module Types...31 CIO Module Types...32 Object Types Structure...32 CCAs...33 Data Type Conversion...33 Array Handling...36 Object Type Definition for Symphony DCI OPC Control Network...36 Aspects...36 Section 5 - Security Introduction...37 DCI Security Operation...38 Aspect Integrator Platform Security...38 DCI System Level Security...39 CTK Security...42 Section 6 - Backup And Restore Introduction...43 Access...43 Function...44 Section 7 - Configure Users and Security Introduction...45 INDEX 6 3BUA000135R4101

About This Book General Use this section as a guide to the conventions and terminology used throughout this book. Intended User System engineers and technicians should read this instruction before configuring 800xA for DCI in the 800xA System. Document Conventions The following conventions are used for the presentation of material: The words in names of screen elements (for example, the title in the title bar of a window, the label for a field of a dialog box) are initially capitalized. Capital letters are used for the name of a keyboard key if it is labeled on the keyboard. For example, press the ENTER key. Lowercase letters are used for the name of a keyboard key that is not labeled on the keyboard. For example, the space bar, comma key, and so on. Press CTRL+C indicates that you must hold down the CTRL key while pressing the C key (to copy a selected object in this case). Press ESC E C indicates that you press and release each key in sequence (to copy a selected object in this case). The names of push and toggle buttons are boldfaced. For example, click OK. 3BUA000135R4101 7

Use of Warning, Caution, Information, and Tip Icons About This Book The names of menus and menu items are boldfaced. For example, the File menu. The following convention is used for menu operations: MenuName > MenuItem > CascadedMenuItem. For example: select File > New > Type. The Start menu name always refers to the Start menu on the Windows Task Bar. System prompts/messages are shown in the Courier font, and user responses/input are in the boldfaced Courier font. For example, if you enter a value out of range, the following message is displayed: Entered value is not valid. The value must be 0 to 30. You may be told to enter the string TIC132 in a field. The string is shown as follows in the procedure: TIC132 Variables are shown using lowercase letters. sequence name Use of Warning, Caution, Information, and Tip Icons This publication includes Warning, Caution, and Information where appropriate to point out safety related or other important information. It also includes Tip to point out useful hints to the reader. The corresponding symbols should be interpreted as follows: Electrical warning icon indicates the presence of a hazard which could result in electrical shock. Warning icon indicates the presence of a hazard which could result in personal injury. Caution icon indicates important information or warning related to the concept discussed in the text. It might indicate the presence of a hazard which could result in corruption of software or damage to equipment/property. 8 3BUA000135R4101

About This Book Terminology Information icon alerts the reader to pertinent facts and conditions. Terminology Tip icon indicates advice on, for example, how to design your project or how to use a certain function Although Warning hazards are related to personal injury, and Caution hazards are associated with equipment or property damage, it should be understood that operation of damaged equipment could, under certain operational conditions, result in degraded process performance leading to personal injury or death. Therefore, comply fully with all Warning and Caution notices. The following is a list of terms associated with 800xA DCI that you should be familiar with. The list contains terms and abbreviations that are unique to ABB or have a usage or definition that is different from standard industry usage. Table 1. Terminology Term/Acronym AE Aspect CCL CCTK CTK Conductor Alarm/Event Description A representation of a facet of a real world entity that is represented by an Aspect Object. An aspect defines a piece of information and a set of functions to create, access, and manipulate the information. Controlware Command Language Programming language used to create Controlware phase logic executed by the DCU. Composer CTK. Configuration Toolkit. Refers to Conductor NT or Conductor UX products. These are Symphony console applications with interfaces to multiple ABB systems. 3BUA000135R4101 9

Applicable Specifications About This Book Table 1. Terminology (Continued) Term/Acronym Controlware DA DCU GDBA Symphony/DCI based control logic utilizing softwiring between function modules. Data Access Description Distributed Control Unit (Symphony DCI Controller). Symphony DCI Global Database Access Applicable Specifications This product meets the requirements specified in EMC Directive 89/336/EEC and in Low Voltage Directive 72/23/EEC. Industrial IT Certification This product meets the requirements as being Industrial IT compliant. Related Documentation The following is a listing of documentation related to DCI Connect. Table 2. Related Documentation Category Title Description Software Operator Workplace HSI Object Dialogs and Icons Style Guide (HSI Style Guide) 3BSE019320 Hardware Controlware II Version 5.0 Module Reference WFPEEUI270003?? 10 3BUA000135R4101

About This Book Related Documentation Table 2. Related Documentation (Continued) Category Title Description DCI System Six Composer CTK (Version 5.1) User s Guide WFPEEUI210004?? Distributed Control Unit Conductor NT (Version 5.0) Configuration Conductor NT (Version 5.0) Operation Conductor NT (Version 5.0) DCI System Six Operation/Configuration WFPEEUI210002?? WBPEEUI340013?? WBPEEUI340012?? WBPEEUI340016?? 3BUA000135R4101 11

Related Documentation About This Book 12 3BUA000135R4101

Section 1 Introduction Product Overview The 800xA for DCI software product integrates the Symphony Distributed Control Unit (DCU) controllers with the 800xA System. This integration with the 800xA System provides one operation and configuration view of the system. Connectivity to the DCU hardware is accomplished through a dedicated OPC Server that is included with 800xA for DCI. Composer CTK is a software package that provides an integrated set of configuration tools in a graphical user environment for building DCU control strategies. The CTK is required to co-exist on the network with the 800xA for DCI to handle the configuration of DCU controllers and establish and maintain devices on the DCI control network. Composer CTK existed as a product prior to the development of the 800xA for DCI software. This instruction describes the features of Composer CTK version 5.1 that have been added to accommodate 800xA for DCI. It is intended to be used as an addendum to the Composer CTK Version 5.1 User s Guide. This instruction describes the configuration steps related to 800xA for DCI as part of the 800xA System. 800xA communicates with the DCI controllers via the ABB ECCP Dual Ethernet ECCP Controller or through third party single Ethernet controller cards. Workstations with ECCP boards support redundant control network connections to the DCU controllers. Functional Description The 800xA System allows monitoring and control of process variables from the DCU such as flow rate, temperature, and pressure according to a control configuration that the engineer or technician defines. A DCU is a controller and its 3BUA000135R4101 13

DCI Connect Documentation Section 1 Introduction input/output (I/O) devices connected for communication on the Control Network (Cnet) to System 800xA via the 800xA for DCI software. DCI Connect Documentation There are two instructions that pertain to the DCI Connect software: 800xA for DCI System Version 4.1 - Operation - Provides operational details for the features and functions of the DCI Connect software. 800xA for DCI System Version 4.1 - Release Notes- Provides data not included in any of the released DCI Connect product instructions which contain helpful information. 14 3BUA000135R4101

Section 2 Composer CTK Introduction Description Composer CTK is the tool that makes editing DCI tag object instance definitions possible. Once they are edited, these changes can be exported from Composer CTK and then imported into the 800xA system using the DCI Tag Importer. Refer to the 800xA for DCI Operation instruction for more information on importing DCI tags. The DCI Tag Importer aspect of the 800xA for DCI software requires a list of tag names and other module information so that it can create tag objects corresponding to DCU databases. The 800xA tag list is an XML file that contains the following information: Name - Name of the DCU module. Type - ASCII name of DCU Module Type. FIX - Numeric value indicating the Function of the designated module type. Description - Description entered by the user of the module (LEG atom). Project - Name of the CTK project to which the module has been assigned. When used for online controllers, the Project Name is blank. Controller - Name of the controller to which the module has been assigned. If the module was taken from a CTK project and was not assigned to a controller, the string UNASSIGNED will be used. Area - Area (number) to which the module has been assigned. 3BUA000135R4101 15

Creating a DCU Tag List Section 2 Composer CTK Creating a DCU Tag List The 800xA tag list is created in Composer CTK. From the main Composer CTK window, select File > Export > 800xA Tag List as shown in Figure 1. When 800xA Tag List is selected, the 800xA Tag List Export window appears (Figure 2). Figure 1. Export Tag List TC05627A Figure 2. Selected Tags To Export TC05628A 16 3BUA000135R4101

Section 2 Composer CTK Creating a DCU Tag List The Tag List Information tab shows the selected Tag List file (if any) and provides a Browse button to specify the location and name of the Tag List file to be generated. The default folder for Tag List files is 800xATagLists located in the <installation_path>\ctk file path. Use the Browse button to change the path as desired. The Tag List Information tab also shows the complete list of selected tags for all projects and controllers in a multi column list box. Items in the list box can be selected and a dialog menu (right click) can be used to remove the selected item(s) from the list. Figure 2 shows the number of tags currently selected. When the 800xA Tag List Export window first appears, the Destination File box is empty. If an existing file is selected in the Tag List Information tab, the tag lists are updated to reflect the data from the file. If any tag selections have been made prior to selecting a new destination file name, the user will be notified that the current selections will be lost if OK is selected. The Tag Selection tab presents a tree view, containing all projects, online controllers, and CIO database names, as well as two lists showing all of the tags for the currently selected tree item as shown in Figure 3. Figure 3. Selected Tree Item TC05629A 3BUA000135R4101 17

Creating a DCU Tag List Section 2 Composer CTK The tags are listed as Available Tags or Selected Tags as shown in Figure 4. Figure 4. Tag Selection TC05630A The default project name is selected when the window is first selected. When a project name is selected in the tree view, a list of all tags in the project appear in the list boxes. When the project is expanded, the tree view shows all module types for which at least one tag exists in the project. If one of the module types is selected, the list boxes show only the tags of the specified type. Tags can be moved between the lists by using the appropriate buttons. The double arrow button moves the entire list in the direction indicated. The single arrow button moves only selected item(s). Right click over a tag name in one of the list boxes to display module information such as Module Type, FIX, Legend, and AREA. When an online controller name is selected in the tree view, a list of all tags in the controller appear in the list boxes. When the project is expanded, the tree view shows all module types for which at least one tag exists. The CIO Databases group is shown if CTK can locate any CIO Database files (dumped by DCU Manager on page 19). The CIO Database file names are shown if CIO Databases is expanded. When a CIO Database is selected, a list of all tags in the Database file appear in the 18 3BUA000135R4101

Section 2 Composer CTK DCU Manager DCU Manager list boxes. When a CIO Database is expanded, a list of available CIO Module Types is shown. The same tag name may exist in different projects and/or online DCUs. However, duplicate tags cannot exist in the 800xA Tag List file. If the user selects a tag from a project or controller when it already exists in the complete list (in the Tag List Information tab), an error is issued stating that the tag must be removed from the list before adding it from another source (project or controller). From the Tag List Information tab, the source project or node of a tag can be viewed by right clicking it. Various DCU related features (previously found only in Conductor NT) are integrated into Composer CTK. Utilities such as Network Device Assignment, Status Display, File Operations, DCU operations, etc. are organized under the DCU Manager. The DCU Manager is accessed by selecting Tools > DCU Manager in Composer CTK as shown in Figure 5. A tool icon is also available on the main CTK toolbar. Figure 5. DCU Manager TC05631A 3BUA000135R4101 19

DCU Manager Section 2 Composer CTK The DCU Manager consists of a tree view containing a root named Devices and all available online DCU nodes and information that is related to the selected tree item as shown in Figure 6. Figure 6. DCU Status TC05632A When the Devices root item is selected in the left pane, a summary of all available nodes is shown in the right pane containing the device name, type, IP address and Ethernet address. Various operations are available on items in the tree view. A Menu of available operations is displayed by right clicking over the desired tree item. 20 3BUA000135R4101

Section 2 Composer CTK Node Addressing and Network Status Display Node Addressing and Network Status Display When a DCU node is selected in the tree view, Node information is displayed including the following items: Network Information. DCU identification. IP Address. Ethernet Address. DCU Mode. DCU Status. Software and firmware revision numbers. Database download information. When a DCU node is expanded in the tree view, the type of board in each used slot of the DCU frame is displayed. When one of these slot items is selected in the tree, the I/O board status is shown in the right pane. The I/O board status includes the following information: Auto/Suspend switch position. Board status (run, fault, etc.). Primary or backup. Backup ready status. Communication status. IOB tag name. Operations are available on DCU node items in the tree view. A menu of available operations is displayed by right clicking over the desired DCU node. The following operations have been defined: File Management: Download and Updump operations. Program downloads including IOB, PSB, and CIO/DIO. Database files including ALD, PBA, and CIO/DIO. DCU Resident Configuration (ANSI Terminal type configuration menus). DCU Resident Services (ANSI Terminal type service menus). CCL editing. DCU operations. Backup operations. Get Database Copy. Get Program Load. 3BUA000135R4101 21

Network Device Assignment Section 2 Composer CTK Go To Offline Mode. Do Switchover. Primary operations. Do hot start. Get program load. Do warm start. Do cold start. Go to offline mode. Enable fault response mode. Disable fault response mode. Network Device Assignment Right click the Devices item in the tree view and then select Network Device Assignment. When selected, the Network Device Assignment window appears (Figure 7). Entries in the device table can be added, deleted, or edited using the buttons provided. To edit an entry, select the device name and select the Edit button. The Edit Device Properties window appears. The basic properties for editing are the Device Name, Device Type, IP address, Physical address, and an indication of whether the device is present on the network. Depending on the Device Type selected, there may be a Device Settings button available to configure additional device dependant items. Validation of Device Properties occur when the Edit dialog is closed by selecting OK. To create a new entry, select the Add button and then proceed in the manner as described for Edit. 22 3BUA000135R4101

Section 2 Composer CTK Network Device Assignment TC05633A Figure 7. Network Device Assignment 3BUA000135R4101 23

DCU Resident Configuration Section 2 Composer CTK DCU Resident Configuration Right click on a DCU Node item to configure the DCU Resident Configuration (Figure 8). Figure 8. DCU Resident Configuration TC05634A When selected, a dialog appears in which DCU Resident Configuration menus are available. Only keyboard input is accepted in this dialog. For example, type LT on the keyboard to recall the Serial Port Login Table. 24 3BUA000135R4101

Section 2 Composer CTK DCU Support Services DCU Support Services Right click on a DCU Node item to configure the DCU Resident Services (Figure 9). Figure 9. DCU Resident Services TC05635A When selected, a dialog appears in which DCU Resident Configuration menus are available. Only keyboard input is accepted in this dialog. For example, type LEG on the keyboard to recall the Legend Verification. 3BUA000135R4101 25

DCU Support Services Section 2 Composer CTK 26 3BUA000135R4101

Section 3 Network Services Introduction DCU Connectivity A subset of the current Conductor NT Network Services are used in 800xA for DCI. These services provide connectivity to the DCU as well as synchronization with Conductor NT/UX and other vital services, such as DCU licensing and loading. The DCU has several interfaces for accessing (reading and writing) its internal data. The most prominent one is Symphony DCI Global Database Access (GDBA). Other interfaces are used much less often and are not used at all for process data. The Conductor NT Network Services have built-in support for all of the interfaces as shown in Table 3. Table 3. Data Access Interfaces From DCU Interface Name Type of Data Global Database Access GDBA Process Data System Operations SysOps DCU internal board information and status. Node Introduction NodeIntro Node and network connection status Alarm/Event Messaging Event Service DCU Alarm and events Other Interfaces Various 3BUA000135R4101 27

Conductor NT/UX Synchronization Section 3 Network Services Conductor NT/UX Synchronization It is necessary for the DCI connectivity tasks to interoperate with Conductor NT and Conductor UX consoles. The DCI connectivity tasks are responsible for maintaining and establishing such tables as the Network Device Assignment table. It is also necessary to synchronize the DCU database images between Conductor NT/UX and the DCI connectivity server. This will require running the Conductor NT dirsync.exe task at certain times. Refer to the Conductor NT Version 5.0 Operation instruction for more information. Time Synchronization of DCU Service Startup The DCI connectivity server performs time synchronization to the Symphony DCI nodes. The time synchronization is performed by the TSYNCD DAEMON. The time synchronizer is responsible for synchronizing time with the DCU, Composer CTK, and Conductor NT/UX nodes on the same network. The startup sequencing of the DCI network services is controlled by a task similar to Conductor NT NWKSER service. List of Required DCI Network Services The following table (Table 4) lists the network Services for DCI. Table 4. Conductor Services For DCI Conductor Service Number Service Name Description 10 N_MSG_SRVC Message server 11 N_MESSAGE_SRVC Service for message broadcast 12 N_TAB_SRVC Global tables service 28 3BUA000135R4101

Section 3 Network Services List of Required DCI Network Services Table 4. Conductor Services For DCI (Continued) Conductor Service Number Service Name Description 14 N_TAB_SRVC Event subsystem - Alarm server 16 N_DCU_ALARM_UPDAT E_SRVC DCU Event subsystem - Update server 17 N_DDB_SRVC Display database server 19 N_XDC_ALARM_UPDAT E_SRVC XDC event subsystem - Update server 21 N_TABI_SRVC Internal global tables 22 N_EVENT_EVTMSG_SR VC Event subsystem - Message server 23 N_FSN_SRVC File sync service 25 N_EVTBIT_SRVC Event bit service 32 N_DBASER_SRVC DBA access box server 33 N_LICENSE_SRVC Software license server 39 N_ALM_RELAY_SRVC External alarm relay service 56 N_MBIT_SRVC Event bit update messages 59 N_LOCAL_LIC_SRVC Local license counter service 60 N_TABIS_SRVC Table sync service 61 N_CLIENT_INFO_SRVC Client information request service 62 N_SYS_TAB_SRVC Global tables - system wide 3BUA000135R4101 29

List of Required DCI Network Services Section 3 Network Services Table 4. Conductor Services For DCI (Continued) Conductor Service Number Service Name Description 63 N_SYS_TABI_SRVC Internal global tables - system wide 64 N_SYS_TABIS_SRVC Table sync service - system wide 30 3BUA000135R4101

Section 4 Control Object Type Definition Introduction 800xA for DCI uses Object Types to provide a connection to and control of the DCU Controlware modules from the 800xA System. Each DCU module type has a corresponding Aspect Object Type. Module types with multiple Functions (FIXs) have an Object Type for each FIX. The CIO module types (AIO, AIOB, etc.) also have corresponding Object Types. The following functions are automatically provided by 800xA for DCI: Creation of all required Object Types and related Object Type Groups for DCU Controlware modules in the Object Type Structure. Creation of all Control Connection Aspect properties for each Object Type Creation of a DCI OPC Control Network Object Type. This Network Object Type includes the DCI Tag Importer. Refer to the 800xA for DCI Operation instruction for more information on the Tag Importer. Creation of required Aspect System Objects (ASOs) for the DCI Object Types. Standard DCU Module Types An Object Type has been defined for each of the supported module types in DCI. Each module type corresponds to an Object Type as shown in the Object Types structure. A Control Connection Aspect (CCA) exists for each Object Type. The properties included in the Object Types are all those that have DBA access for the given module type and FIX. 3BUA000135R4101 31

CIO Module Types Section 4 Control Object Type Definition CIO Module Types An Object Type should be defined for each of the following CIO module types: AIO. AIOB. DIOB. XCON. XMSG. These module types correspond to Object Types as shown in Object Types Structure on page 32. Object Types Structure The Object Types Structure in the Plant Explorer Workplace is where the Object Types are created. The Symphony DCI Controlware Modules Object Type Group resides under the Control System Object Type Group. 32 3BUA000135R4101

Section 4 Control Object Type Definition CCAs CCAs Each Symphony DCI Module Object Type has an OPC CCA. The CCA lists all of the DBA accessible atoms as properties of the Aspect. Figure 10 shows a sample CCA Property View for an ANI FIX 0 Object Type. TC05642A Figure 10. Property View of the Control Connection Aspect Data Type Conversion The Data Types assigned to the properties of the CCA are derived from the Data Types stored in the Composer CTK project databases. The Composer CTK data types are derived from the types stored in the DCUs ALD format. The ALD types are in turn derived from the DCUs Data Dictionary Data Types. 3BUA000135R4101 33

Data Type Conversion Section 4 Control Object Type Definition Table 5 and Table 6 show the conversion from DCU Data Dictionary Data types to the CCA property Data Types. Table 5. Data Types 1 DCU Data Dictionary Type UD BI TI UT CO US LO FL DO TX ST B8 B16 B32 TO SY MD PT GD CD Composer CTK Data Dictionary Type NULL BOOL INT:1 UINT:1 UNT:2 UINT:2 INT:4 FLOAT:4 FLOAT:8 TEXT TEXT BITS BITS BITS TM TM PTR NULL GD CD 34 3BUA000135R4101

Section 4 Control Object Type Definition Data Type Conversion Table 5. Data Types 1 (Continued) DCU Data Dictionary Type SU DP BA MP BB XD BIA Composer CTK Data Dictionary Type TEXT NULL BOOL MP BOOL PTR BITS Table 6. Data Types 2 Composer CTK Data Dictionary Type TEXT INT:1 INT:2 INT:4 UINT:1 UINT:2 UINT:4 FLOAT:4 FLOAT:8 PTR BOOL PPA Variant Type VT_BSTR VT_I1 VT_I2 VT_I4 VT_UI1 VT_UI2 VT_UI4 VT_R4 VT_R8 VT_BSTR VT_BOOL 3BUA000135R4101 35

Array Handling Section 4 Control Object Type Definition Table 6. Data Types 2 (Continued) Composer CTK Data Dictionary Type BITS:1 BITS:2 BITS:4 GD CD TM MP BIT TG NULL DYN PPA Variant Type VT_UI1 VT_UI2 VT_UI4 VT_BSTR VT_BSTR VT_DATE VT_BSTR VT_BOOL VT_BSTR VT_EMPTY VT_EMPTY Array Handling Some Symphony DCI Controlware atoms are defined as arrays. These atoms appear in the CCA with a data type of either VT_BSTR VT_ARRAY or VT_VARIANT VT_ARRAY. Object Type Definition for Symphony DCI OPC Control Network This Object Type is a specialization of the Generic OPC Server Network Object Type. Aspects DCI Tag Importer - this is the Uploader of the tags. Refer to the 800xA for DCI Operation instruction for more information. 36 3BUA000135R4101

Section 5 Security Introduction GDBA write security is a function of the controller. GDBA write security is maintained on an Area basis and an access level. There are up to 255 areas in a DCI installation, and there are nine access levels as defined in Table 7. Table 7. Symphony DCI Access Levels Level Operator 1 Trust 1 (low) Operator 2 2 Operator 3 3 Engineer 1 4 Engineer 2 5 Engineer 3 6 Supervisor 1 7 Supervisor 2 8 Supervisor 3 9 (high) Operator Level 1 is considered the lowest and least trusted level, while Supervisor Level 3 is the highest and most trusted level. Each level is a superset of the preceding level in terms of allowed access and trust. Beyond that, the actual implementation and use of the access levels is user designed and user specific. 3BUA000135R4101 37

DCI Security Operation Section 5 Security Areas and access levels are fundamental to DCI security and must be preserved. Refer to the Controlware II Version 5.0 Module Reference instruction for information and detail concerning the dynamics of security in the DCU. DCI Security Operation Each user login is assigned one of the nine access levels in Table 7 and anywhere from 1 to all 255 areas. The assignments are made when the user login is configured and may be modified by the customer when the need arises. Each GDBA writable atom in each DCU module has an assignable write access level from Table 7. Access level assignment is a function of the DCU Data Dictionary. Also, each individual DCU module is assigned to a specific area as defined by the AREA atom. However, areas are dynamic and may be changed as part of the security for a control algorithm. Each individual atom write request is checked to see if the AREA of the atom is set in the area mask, and if the access level of the atom matches that in the transaction. Only those that match are permitted. If any write request does not match, the overall transaction status is marked as containing errors, and the individual write request is marked as failed due to a security violation. It is left to the originating application to deal with the transaction status. In the case of a display, such as a point or graphic display, an error indication pops up with a text message describing why the transaction failed. Symphony DCI users have the flexibility to design the security within these parameters and that it is vital to preserve the current functionality. The console does not have the ability to predict or track the dynamics of AREA manipulation as performed by ControlwareII. Security control must still be done within the DCU. Aspect Integrator Platform Security 800xA System security is an adjunct to Windows 2000 security and is achieved by association with Windows 2000 groups. The initial installation of 800xA System creates five Windows groups automatically, which are intended to provide levels of 38 3BUA000135R4101

Section 5 Security DCI System Level Security security and trust. The five groups and their intended usage are shown in Table 8 (refer to the 800xA Security instruction for more information). Table 8. Industrial IT Windows 2000 User Groups 800xA Group Recommended Usage DCI Approximation IndustrialITAdmin Configure Admin. Structure. None. IndustrialITUser Read. Operator 1. IndustrialITOperator Read and operate. Operator 2. IndustrialITApplicationEngineer IndustrialITSystemEngineer Read, Operate, Configure, and Tune permission. Read, Administrate, Security Configure, and Configure permission. Operator 3 to Engineer 3. Supervisor1 to Supervisor 3. NOTE: All users must be added to the IndustrialITUser group. DCI System Level Security The Conductor NT Security table is configurable from Composer CTK to provide access to the table on systems without Conductor NT. Select Security > DCI System Level Security as shown in Figure 11. Figure 11. CTK Security TC05639A 3BUA000135R4101 39

DCI System Level Security Section 5 Security When this item is selected, Figure 12 appears. TC05640A Figure 12. System Level Security An existing user can be edited by selecting a user name in the list and then selecting the Edit button. A new user can be added by selecting the Add button. A user can be deleted by selecting the desired user, then selecting the Delete button. The Default user name cannot be deleted. System Security is activated selecting the Activate Security button. When selected, security is activated, the button label changes to Deactivate Security, and the button remains depressed. To deactivate security, select the Deactivate Security button; this causes the security checking to be deactivated and the button label to change to Activate Security. The Area Access table of different area names is configured by selecting the Area Names button. The configured names for the 255 DCI Areas are changed in the resulting window. 40 3BUA000135R4101

Section 5 Security DCI System Level Security When a new user is added, or when an existing user is edited, Figure 13 appears. Figure 13. New User Addition TC05641A The User Name must be unique. The list of access levels are the same as shown by Conductor NT: Operator Level 1. Operator Level 2. Operator Level 3. Engineer Level 1. Engineer Level 2. Engineer Level 3. Supervisor Level 1. Supervisor Level 2. Supervisor Level 3. The Area Access list shows all 255 area names as specified in the Area Names global table. The desired area names can be selected using this list. Areas that have been selected are highlighted in the list. 3BUA000135R4101 41

CTK Security Section 5 Security CTK Security Some of the Composer CTK version 5.1 features are restricted by access rights that are associated with the CTK login. The following table (Table 9) shows the access rights required to use each CTK feature: CTK Feature Administrative Rights DCU resident configuration Table 9. CTK Security Online Configuration Rights Read/write DCU resident service Read/write File download (Send To DCU button) File upload (Get From DCU button) Database Transfer Rights Upload/download Upload/download DCI System Security Administrative 42 3BUA000135R4101

Section 6 Backup And Restore Introduction Run the Backup option after creating a database for the first time. Run the Backup option before doing an upgrade or making significant changes to the system configuration. Run the Restore option when the system becomes corrupt or after an upgrade takes place. Access This feature is accessed through File > Backup in Composer CTK only (Figure 14). TC05679A Figure 14. Backup Access 3BUA000135R4101 43

Function Section 6 Backup And Restore Function Many of the files and internal tables used in version 5.1 Composer CTK are handled by the Backup/Restore tool to prevent accidental loss of configuration data. Three new options are available in the Library Components list as shown in Figure 15. TC05680A Figure 15. Library Components The 800xA Taglist Files are XML files created by the 800xA Tag List Export Tool. These are files saved to the default path recommended by the Tag List tool. If files are saved in any folder other than the specified default folder, they will not be saved in the backup file. The DCU Manager Upload/Download Files are all those files listed in the DCU File Operations window (ALD Database Files, CCL Files, etc.). The DCI System Configuration Tables include the Network Device Assignment table and the security tables for Users and Area Names. 44 3BUA000135R4101

Section 7 Configure Users and Security Introduction Refer to the 800xA System Security - Users Guide instruction for more detailed information. Configure the Users and Security using the following steps: 1. Assign Microsoft users. 2. Assign Security Settings in the Administrative Structure > Domains > <computer name > System Domain according to the 800xA System documentation and assign the Security Settings. 3. Use the Configuration Wizard to associate 800xA System groups to Microsoft groups. 4. Use the Configuration Wizard to assign users to the groups in the user structure (Operator to Operators group). 3BUA000135R4101 45

Introduction Section 7 Configure Users and Security 46 3BUA000135R4101

C Composer CTK 15 Creating a DCU tag list 16 DCU manager 19 CTK Security 39 Terminology 9 T INDEX D DCI documentation 14 Related documentation 10 Document conventions 7 F Functional description 13 H Harmony OPC server Users and security 45 Network services 27 N O Object types structure 32 Product overview 13 P Security 37 Structure Object types 32 Symphony OPC server configuration 45 S 3BUA000135R4101 47

Index 48 3BUA000135R4101

3BUA000135R4101 Printed in U.S.A. May 2005 Copyright 2003-2005 by ABB. All Rights Reserved Registered Trademark of ABB. Trademark of ABB. http://www.abb.com Automation Technology Products Wickliffe, Ohio, USA www.abb.com/controlsystems Automation Technology Products Västerås, Sweden www.abb.com/controlsystems Automation Technology Products Mannheim, Germany www.abb.de/controlsystems