OT: Survey type question

This is just a survey type of question regarding SCADA type applications. Just looking for some feedback on how some of the other posters on this site would handle this situation.

Company I work for is implementing a SCADA system. First design criteria asked for a data collection box at each machine location. If a valid employee was not entered into the box at the machine location it would lock out the functionality of the machine. Pretty straight forward. However there are many approaches to this assignments section and I am wondering which is considered and used most frequently. FYI there would be a total of upto 99 machine locations each requiring upto 3 employees, in most cases it is either one or possibly two employees per assignment.

Anyway one option would be to have loaded into the PLC a file of sorts that would contain valid employee numbers. When the person scans or enters their information it would validate against this table. If the information was valid it would unlock the machine and allow operation.

Another option is within the SCADA software have a screen that shows all the selected machine locations, has the employee selections along side and then a list of available name. As a person is assinged there name is removed from the available list.

I am sure there are other avenues here which is why like I said I would like feed back. Our second shift supervisors like the first option on this list becaue they think it is to complicated to go thru all the assignements. Our first shift supervisors like the way in which assignments are done but still think it is a little more complex than it needs to be. The MGMT (owner) like the idea of the second option because it give control to the supervisors. So how can one please all and come up with a solution that works for everyone? Well one way is by posting the question here and seeing what others have done and what feed back and insight they can provide.

Currently our system is setup like I said more toward the second option. But is this the best option? Thanks and have a great day.

I'd use login account related privileges based on the network domain personally, and do the privilege evaluation via group policies at the HMI/SCADA level.

Failing that, I'd use a back-end database as a look-up for individual privilege levels.

Building them into PLC's is really one of the worst choices I could think of.

Hi

I implemented barcode readers into our scada system so that people have to log on to the production machinery , and different people have different priveleges.

Most of our production guys dont have netywork user accounts but have an ID card with a barcode.

if it is a scada system then the best way would be an sql database holding the employee info & level access, assume they log in with password or fob/barcode then it is easy to keep one database managed with updates like new employees or remove them on termination.
We have a number of IFIX scada systems & all log/fetch data from a server which hold the databases for recipe download & storing batch detail & alarms.
I'm thinking of adding the above rather than having to keep adding new users to the IFIX on each machine.

Parky, so what I take it you are doing is when the Production personell arrive at the machine they do a login type of function. The data is then sent back to the SQL server where there is some routine or other software running that compares the numbers and provides a level access, if their number is valid and they have the proper access credentials it allows them to operate the piece of equipment. Would this be a correct analogy of what you have?

If so what are you using within SQL to check the information entered at the PLC level with the level access/account information table in the SQL table?

Thanks and have a great day.

parky said:

if it is a scada system then the best way would be an sql database holding the employee info & level access, assume they log in with password or fob/barcode then it is easy to keep one database managed with updates like new employees or remove them on termination.
We have a number of IFIX scada systems & all log/fetch data from a server which hold the databases for recipe download & storing batch detail & alarms.
I'm thinking of adding the above rather than having to keep adding new users to the IFIX on each machine.

Click to expand...

Hi

The barcode data on my machines is stored on change to an SQL database, which is linked to the payroll. Locally on the machine it displays the employee number and privelege, but this data is logged away so for any given date/time/machine it is possible to relate it to individuals via payroll.

The SQL server is just a pc with a database, the scada fetches the data (names & passwords) & then the scada compares the level access & sets the appropriate code in the level access word in the plc & the scada (in actual fact the scada runs an sql statement to compare the values on one system).

mrtweaver said:

Company I work for is implementing a SCADA system. First design criteria asked for a data collection box at each machine location. If a valid employee was not entered into the box at the machine location it would lock out the functionality of the machine. Pretty straight forward. However there are many approaches to this assignments section and I am wondering which is considered and used most frequently. FYI there would be a total of up to 99 machine locations each requiring up to 3 employees, in most cases it is either one or possibly two employees per assignment.

Click to expand...

I bolded the highlights... Is this a continuous process, does each machine have to work on its own?

99 machines would take forever to log in, using separate data logins. A central scheme on your SCADA would be better, logging in all employees per shift, with access to each machine.

Is management paranoid? lol.

It is very possible about paranoya (sp?) But anyway the supervisor has a schedule it is on this schedule they assign the employees. Once they have done so the data is sent directly to each PLC on the production floor. Then when the employees arrive they check the schedule goto that location press the proper buttons and login to that work center. if they are not scheduled there it does not allow them to log in and it locks the machine out from running. So the supervisor has to spend the time going thru and doing the assignments and this is done on a daily basis. But one such question that came up at a recent meeting was why not just validate the employee against a table, save the supervisor time in the morning. This is possible but a bit beyond my understanding at this time. This is why I was looking for any and all alternatives to see what migth work better and be very efficient and easy. Hope this clears things up. Have a great day.

tomalbright said:

I bolded the highlights... Is this a continuous process, does each machine have to work on its own?

99 machines would take forever to log in, using separate data logins. A central scheme on your SCADA would be better, logging in all employees per shift, with access to each machine.

Is management paranoid? lol.

Click to expand...

... we used to call that "making a job" for someone...

It sounds a lot more complicated than it should be. make-work make-work. Lock out invalid "stupid" employees from doing a no-no on disallowed equipment.

What is meant by "Once they have done so the data is sent directly to each PLC on the production floor." ?

Can you explain what the job/process is?

It's difficult to understand how the employees work are all employees allowed to work on all machines?
Is this to stop unauthorised people running machines at any time or just when they are allocated to a machine?
If all employees run the macines but each employee can only run certain machines then the tables would contain the folowing:
Employee, password, machines
i.e. if joe bloggs could operate machines 1,10,14,21,22 then the tables would be populated with his name, password & the list of machines permitted.
When logging on to say machine 21, the sql would query the name, password & if the machine number was in the records. regardless of one or more scada's
i.e. if 90 plc's talk to one scada then I could see a bottleneck in checking but it's possible that 99 employees records could be downloaded to each plc (memory available)once a day say during none production times or even only when a change to employees is made & downloaded & stored in the plc's.
if all operators could use all machines then only the user name & password would be required, the database could also log when the operator logged on, how long logged on for & a wealth of info.
We have a system that downloads recipes, stores batch codes, ingredients added, time, temperature date for graphs, alarms & compares that the recipe is not out of date (all recipes contain an end of use date)operator codes, CIP data all that can be accessed with a reporting tool. this is for 21 vessels all working independantly, however there are a lot of pokes to the database so slows it a little.
the database is over 9gb (would be bigger but we archive it regulary to reduce the query time).

Well let me first add the disclaimer that it is a job and it pays the bills. After I have said that then I can tell you the type of factory it is because most people once you say the type of work this factory does, well youll get the idea one I tell you. I work for a bulk mail mailing house. I know I know the good stuff that ends up in the circular file of a lot of peoples homes. Anyway now to clear up what I said:

Supervisor logs into the scada system. Click on the button for EDIT assignments. While they are editing assignments they are changing the data in an SQL table. Once they have changed the assignements to meet the days production goals the data is automatically saved. So now you have an SQL table which contains the daily assignments. On the same screen where you have the EDIT button there is also a PROGRAM/LOAD button. There is also another table in SQL, this table is connected thru the OPC server to each and every production floor piece of equipment. As data is changed in this second table it directly affects the data at the machine level. This table is also keyed off of machinelocation field which correlates to each machine on the floor from 1 to 99. So if the values in row 1 which is machine location 1 is changed it affect machine one and so on. Anyway once the program/load button is pressed the data from the edit table is sent to the program table and hence is loaded into every box. So it takes the supervisor some time to set the daily events up but once they do the rest of the login goes quite rapidly. Because all an employee needs to do is look where they are assigned, goto that machine location, and press the proper button and if the system accepts it they are loged in and the machine is put in a ready state.

Hope this clears up your question.

tomalbright said:

... we used to call that "making a job" for someone...

It sounds a lot more complicated than it should be. make-work make-work. Lock out invalid "stupid" employees from doing a no-no on disallowed equipment.

What is meant by "Once they have done so the data is sent directly to each PLC on the production floor." ?

Can you explain what the job/process is?

Click to expand...

As it stands right now, and this is subject to change, we have one table with a list of employees. If the employee is on that list then they are allowed to log in. If they are not on the list then they are not. But I do know from some of the meeting I have been to that there may come about a level(degree) type system where level one people can run this type of machine, level 2 can run what level one can plus these, level 3 contains both levels 2 and 1 but also these machines, and so on. This information is still in the developement stages so I dont know if they are going to go thru with it or not but as of right now it is simply here is a scanned badge number, is this number in the Employee table, if yes the allow operation of the machine.

There will be upto a total of 99 machines online and each machine will be able to handle upto 4 personell. Our employee database however is quite large, just in production persons alone, now these would be the ones that run the machines, I think there is close to 400. Each number that is given to an employee is 8 digits in length and if things keep going the way they are they may change this to 10 digits, again it is being talked about so I am keeping an open mind. Now take this employee table and add in stock clerk, production monitors, QC, Mechanics, and Material Handlers now you talk close to 600 names. So you can see how this would take up a large segment of PLC memory. Maybe someone might know the answer to this, are there any PLC units that have a flash card built on and they can access the flash card in the same way a PC might. This way you would not have to load in the entire database you could do a compare rigth to flash card. Or go against the SQL table as some have suggested here on this site. Dont know which would be better.

parky said:

It's difficult to understand how the employees work are all employees allowed to work on all machines?
Is this to stop unauthorised people running machines at any time or just when they are allocated to a machine?
If all employees run the macines but each employee can only run certain machines then the tables would contain the folowing:
Employee, password, machines
i.e. if joe bloggs could operate machines 1,10,14,21,22 then the tables would be populated with his name, password & the list of machines permitted.
When logging on to say machine 21, the sql would query the name, password & if the machine number was in the records. regardless of one or more scada's
i.e. if 90 plc's talk to one scada then I could see a bottleneck in checking but it's possible that 99 employees records could be downloaded to each plc (memory available)once a day say during none production times or even only when a change to employees is made & downloaded & stored in the plc's.
if all operators could use all machines then only the user name & password would be required, the database could also log when the operator logged on, how long logged on for & a wealth of info.
We have a system that downloads recipes, stores batch codes, ingredients added, time, temperature date for graphs, alarms & compares that the recipe is not out of date (all recipes contain an end of use date)operator codes, CIP data all that can be accessed with a reporting tool. this is for 21 vessels all working independantly, however there are a lot of pokes to the database so slows it a little.
the database is over 9gb (would be bigger but we archive it regulary to reduce the query time).

Click to expand...