Installation Guide

AVEVA™ Plant SCADA 2020 R2
Installation and Configuration Guide

July 2021
Legal Information
DISCLAIMER
AVEVA Group Plc makes no representations or warranties with respect to this manual and, to the maximum extent permitted by law,
expressly limits its liability for breach of any warranty that may be implied to the replacement of this manual with another. Further,
AVEVA Group Plc reserves the right to revise this publication at any time without incurring an obligation to notify any person of the
revision.
COPYRIGHT
© July 2021 AVEVA Group Plc. All rights reserved.
The Example Project is provided to you for the purpose of illustrating how the SCADA software 2020 R2 could be used in an oper-
ational environment ("the Purpose"). AVEVA grants you a royalty free, non exclusive, non transferable license to use the example pro-
ject installed with your SCADA software version 2020 R2 (“the Example Project”) for the Purpose only.
The Example Project is provided by AVEVA as part of the SCADA software version 2020 R2 on an "as is" basis and AVEVA does not
guarantee the reliability, serviceability or function of the Example Project.
Should you modify the Example Project, you bear the risk of any use of such modified Example Project.
AVEVA gives no express warranties, guarantees or conditions and to the extent permitted under applicable laws, AVEVA disclaims
all implied warranties, including any implied warranties of merchantability, fitness for a particular purpose or non-infringement of
third parties’ intellectual property rights.
AVEVA shall not be liable for any direct, indirect or consequential damages or costs of any type arising out of any action taken by
you or others related to the Example Project.
No part of this documentation shall be reproduced, stored in a retrieval system, or transmitted by any means, electronic, mechanical,
photocopying, recording, or otherwise, without the prior written permission of AVEVA. No liability is assumed with respect to the
use of the information contained herein. Although precaution has been taken in the preparation of this documentation, AVEVA
assumes no responsibility for errors or omissions. The information in this documentation is subject to change without notice and does
not represent a commitment on the part of AVEVA. The software described in this documentation is furnished under a license agree-
ment. This software may be used or copied only in accordance with the terms of such license agreement. ArchestrA, Aquis, Avantis,
Citect, Citect HMI, Citect SCADA, DYNSIM, eDNA, EYESIM, InBatch, InduSoft, InStep, IntelaTrac, InTouch, PIPEPHASE, PRiSM,
PRO/II, PROVISION, ROMeo, SIM4ME, SimCentral, SimSci, Skelta, SmartGlance, Spiral Software, Termis, WindowMaker, Win-
dowViewer, and Wonderware are trademarks of AVEVA and/or its subsidiaries. An extensive listing of AVEVA trademarks can be
found at: https://sw.aveva.com/legal. All other brands may be trademarks of their respective owners.
Publication date: July 2021
AVEVA Group plc
High Cross Madingley Road
Cambridge CB3 OHB. UK
https://www.aveva.com/
GENERAL INFORMATION
Some product names used in this manual are used for identification purposes only and may be trademarks of their respective com-
panies.
July 2021 edition for Plant SCADA Version 2020 R2.
Manual Revision Version 2020 R2.
PLEASE NOTE
Electrical equipment should be installed, operated, serviced, and maintained only by qualified personnel. No responsibility is
assumed by AVEVA Group Plc for any consequences arising out of the use of this material. © July 2021 AVEVA Group Plc. All
Rights Reserved.
Validity Note
The present documentation is intended for qualified technical personnel responsible for the implementation, operation and main-
tenance of the products described. It contains information necessary for the proper use of the products. However, those who wish to
make a more "advanced" use of our products may find it necessary to consult our nearest distributor in order to obtain additional
information.
The contents of this documentation are not contractual and in no way constitute an extension to, or restriction of, the contractual
warranty clauses.
For information on how to contact sales, customer training, and technical support see https://sw.aveva.com/contact.
Contents
Legal Information 1
Contents 3
Safety Information 7
Chapter 1: Install Plant SCADA 11

What Should I Install? 18
Chapter 2: Configurator 23
View the Configurator Messages List 25
Chapter 3: Install a Development Workstation 27

Development Workstation Installation Requirements 28
Development Workstation Installation Procedure 29
Use Configurator to Set Up a Development Workstation 31
Chapter 4: Set Up a System Management Server 33

Configure a System Management Server 34
Connect a Computer to a System Management Server 36
Enable Encryption 39
Configure a Runtime Computer for Encryption 41
Chapter 5: Install a Runtime Server 43

Runtime Server Installation Requirements 44
Runtime Server Installation Procedure 45
Use Configurator to Set Up a Runtime Server 47
3
Contents
Chapter 6: Install a Deployment Server 51

Deployment Server Installation Requirements 52
Deployment Server Installation Procedure 53
Configure a Deployment Server 54
Configure a Deployment Client 56
Configure a Runtime Computer for Deployment 58
Chapter 7: Install an Industrial Graphics Server 63

Industrial Graphics Server Functionality Limitations 64
Industrial Graphics Server Installation Requirements 65
Industrial Graphics Server Installation Procedure 66
Use Configurator to Set Up an Industrial Graphics Server 68
Confirm the Settings for an Industrial Graphics Server 69
Chapter 8: Install an OPC UA Server 73

OPC UA Server Installation Requirements 75
OPC UA Server Installation Procedure 76
Use Configurator to Set Up an OPC UA Server 78
Configure Client Certificates for an OPC UA Server 78
Confirm the Settings for an OPC UA Server 82
OPC UA Client Driver 83
Chapter 9: Install a Plant SCADA Web Server 85

Web Server Installation Requirements 86
Web Server Installation Procedure 89
Web Server/Client Configuration 90
The IIS Virtual Directory 91
Setting Up Security 92
Configuring Security Using IIS 93
Testing the Web Server Security Settings 97
Chapter 10: Install a Runtime-only Client 99

Runtime Only Client Installation Requirements 99
Runtime Only Client Installation Procedure 100
Use Configurator to Set Up a Runtime-only Client 102
Chapter 11: AVEVA™ Enterprise Licensing 105

Enterprise License Server Installation Requirements 107
Enterprise License Server Installation Procedure 108
Use Configurator to Set Up an Enterprise License Server 109
Chapter 12: Install Communication Drivers 111
4
Contents
Install Additional Communication Drivers 113
Chapter 13: Install OPC Factory Server 115
Chapter 14: Security Roles 117

Modifying the Members of a Security Role 120
Add the Required Users to the Runtime Users Role 123
Directory Security 123
Chapter 15: New Features in Plant SCADA 2020 R2 125
Chapter 16: Upgrading to Plant SCADA 2020 R2 129

Upgrade Method 129
Upgrade Path 130
Offline Upgrade 130
Migrate to Production 136
Troubleshooting Offline Upgrade 139
Online Upgrade 139
Pre-requisites for Online Upgrade 140
Upgrading from v2018 141
Upgrading from v2018 R2 142
Troubleshooting Online Upgrade 144
Migration Tool 146
Using the Migration Tool 146
Remove Obsolete Memory and Alarm Devices 149
Creation of Roles for Existing Users 151
Migrate Included Projects 152
Default Scale 153
Chapter 17: Uninstall or Change Components 155
Chapter 18: Manage Updates 157
5
Contents
6
Safety Information
Hazard categories and special symbols
The following symbols and special messages may appear in this manual or on the
product to warn of potential hazards or to call attention to information that clarifies or
simplifies a procedure.
Symbol Description
The addition of either symbol to a “Danger” or “Warning”

safety label indicates that an electrical hazard exists
or which will result in personal injury if the instructions are
not followed.
This is the safety alert symbol. It is used to alert you to

personal injury hazards. Obey all safety messages that
follow this symbol to avoid possible injury or death.
DANGER indicates an imminently hazardous situation, which, if not avoided, will result in death
or serious injury.
WARNING indicates a potentially hazardous situation, which, if not avoided, can result in death
or serious injury.
CAUTION indicates a potentially hazardous situation which, if not avoided, can result in minor or
moderate injury.
NOTICE
© July 2021 AVEVA Group Plc. All rights reserved. 7

Safety Information
NOTICE used without a safety alert symbol, indicates a potentially hazardous situation which, if
not avoided, can result in property or equipment damage.
Please Note
Electrical equipment should be installed, operated, serviced, and maintained only by
qualified personnel. No responsibility is assumed by AVEVA for any consequences
arising out of the use of this material.
Before You Begin

Plant SCADA is a Supervisory Control and Data Acquisition (SCADA) solution. It facil-
itates the creation of software to manage and monitor industrial systems and processes.
Due to Plant SCADA's central role in controlling systems and processes, you must
appropriately design, commission, and test your Plant SCADA project before imple-
menting it in an operational setting. Observe the following:
UNINTENDED EQUIPMENT OPERATION
Do not use Plant SCADA or other SCADA software as a replacement for PLC-based control pro-
grams. SCADA software is not designed for direct, high-speed system control.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
LOSS OF CONTROL
l The designer of any control scheme must consider the potential failure modes of control paths and,
for certain critical control functions, provide a means to achieve a safe state during and after a path
failure. Examples of critical control functions are emergency stop and overtravel stop, power out-
age and restart.
l Separate or redundant control paths must be provided for critical control functions.
l System control paths may include communication links. Consideration must be given to the implic-
ations of unanticipated transmission delays or failures of the link.
l Observe all accident prevention regulations and local safety guidelines. 1
l Each implementation of a control system created using Plant SCADA must be individually and thor-
oughly tested for proper operation before being placed into service.
damage.
8 © July 2021 AVEVA Group Plc. All rights reserved.

Safety Information
1. For additional information, refer to NEMA ICS 1.1 (latest edition) "Safety Guidelines
for the Application, Installation, and Maintenance of Solid State Control", and to NEMA
ICS 7.1 (latest edition) "Safety Standards for Construction and Guide for Selection,
Installation and Operation of Adjustable-Speed Drive Systems" or their equivalent gov-
erning your particular location.

Safety Information
10
Chapter 1: Install Plant SCADA
This guide provides instructions for installing AVEVA™ Plant SCADA.
The Plant SCADA installer initially requires you to specify the "role" a computer will
play within your control system. You can select from the three following options:
l Development Workstation — the computer will be used to build and test Plant
SCADA projects.
l Server — the computer will be responsible for running a Plant SCADA system. It
will perform tasks such as processing I/O device communications and managing
alarms and trends.
l Runtime-only Client — the computer will be a display client for monitoring and con-
trolling a system.
When you specify a role for a computer, a set of default components are automatically
selected for installation. If required, you can customize the list of default selections. For
example, if you select "Server", you can specify which type of server(s) you want to
install.
If you need help to determine the role for a computer, see What Should I Install?
Note: If you want your system to use secured features such as encryption or deploy-
ment, you should not install Plant SCADA on the computer that acts as the domain
controller within your Windows® domain.
If you are not familiar with Plant SCADA, this introductory chapter also provides
information you will need to know about the installation process and some specific
requirements. It includes:
l Licensing Tools
l Windows® User Groups and Security Roles
l Windows® Firewalls
l Communication Drivers
l OPC Factory Server
l Anti-virus Software Setup
l Maintaining System Currency
l Virtualization Host Support.

When installation is complete, a dialog will appear asking if you would like to launch
Configurator. This is a tool that is used to prepare a computer for its role within a Plant
SCADA system. For example, it can be used to manage the certificates required to
enable encrypted communications, or to map the local Windows® user groups to Plant
SCADA's security roles. For more details, see Configurator.
If you already have Plant SCADA installed, the Upgrading section of this guide
provides information to help you update to the latest version. It describes:
l Instructions for both online and offline upgrade methods
l Supported upgrade paths
l The Plant SCADA Migration Tool.
See Upgrading.
Note: Due to significant component organizational changes in this release, you need
to fully uninstall any existing versions of Plant SCADA and it's associated com-
ponents before you install Plant SCADA 2020 R2. You do not need to uninstall Plat-
form Common Services or ArchestrA Data Store.
Licensing Tools
Plant SCADA supports two different software licensing models:
l Sentinel Licensing
Sentinel Licensing uses physical USB keys that plug in to each computer in your
Plant SCADA system.
To use Sentinel Licensing, you need to install the Sentinel Driver (available via
the Core Components page of the installer).
l FLEXERA Softkey Licensing
The FLEXERA softkey solution stores license information on a FlexNet Enterprise
License Server. The Plant SCADA client process will retrieve licenses from this
server as required by the Plant SCADA system.
To activate and administer licenses, you need to install the Floating License Man-
ager (available via the Core Components page of the installer).
In both cases, Plant SCADA uses a Dynamic Point Count to determine if your system is
operating within the limitations of your license agreement. This process tallies the num-
ber of I/O device addresses being used by the runtime system.

Note: You can run Plant SCADA without a key in demonstration (demo) mode.
Demo mode lets you use every feature normally, but with runtime and I/O restric-
tions (15 minutes with a maximum of 50,000 real I/O, or 10 hours with a maximum
of one dynamic real I/O).
For more information, see the topic Licensing in the Plant SCADA documentation when
installation is complete.
Windows® User Groups and Security Roles

You can only perform certain operations within Plant SCADA's engineering and
runtime environments with relevant permissions. The Security Roles page in Con-
figurator allows you to grant these permissions to local and domain user groups.
Plant SCADA creates a set of security roles and local Windows user groups on a com-
puter during installation. By default the local Windows user groups are associated with
these security roles as members. Each role provides a different level of access to fea-
tures, applications and project resources. See Security Roles.
If you are installing Plant SCADA 2020 on a clean computer (one that has not hosted an
earlier version), the new security roles and local Windows user groups will be created
and mapped as follows:
Security Role Windows User Group Description
Members of this role can run

configuration tools (such as
Plant SCADA Studio or Com-
puter Setup Wizard) and
start the runtime display cli-
ent and server processes.
Configuration Users SCADA.ConfigUsers

Note: It is recommended
that members of this role
only start runtime for devel-
opment purposes and not
in a production system
environment.

the runtime display client and
Runtime Users SCADA.RuntimeUsers
make local CtAPI con-
nections.

Security Role Windows User Group Description

Plant SCADA as a server pro-
cess.
If you are not running Plant

SCADA as a service, add a
member to this role who
needs to run a Plant SCADA
Server Users SCADA.ServerUsers server (including a display cli-
ent with [CtAPI]Remote
enabled).
Note: If you are running

Plant SCADA as a service,
it is not recommended to
add members to this role.
If you choose to install Deployment Server components on a clean computer, additional

security roles and local Windows user groups will be created and mapped as follows:
Security Roles Windows User Group Description
Members of this role can add

or remove client computers
Deployment Admin-
SCADA.DeploymentAdmins to/from deployment server.
istrators
They can also perform upload
and deploy operations.
Members of this role can

Deployment Upload-
SCADA.DeploymentUploaders upload a new project version
ers
to the deployment server.
Members of this role can

deploy a new project to a con-
Deployment Users SCADA.DeploymentUsers
nected deployment client
computer.
If you choose to install an Industrial Graphics Server on a computer, additional security

roles and local Windows user groups will be created and mapped as follows:
Industrial Graphics Members of this role can con-

AIGUsers nect and authenticate with
Users
the Industrial Graphics

Server.
Note: Unlike the other secur-

ity roles, do not add indi-
vidual users. Instead, only
add domain groups to the
role to allow authorization in
a distributed system.
This security role is not in use

Industrial Graphics
AIGUsersRW for AVEVA Plant SCADA 2020
R/W Users
R2.
If you are upgrading Plant SCADA from an earlier version, equivalent user groups will
already exist on the computer. If the installer detects these existing groups, they will be
retained. Only security roles will be created and mapped to the existing local Windows
user groups.
Windows User Group Name
Security Role
Clean installation version Upgrade from earlier ver-
2020 sion
Configuration
SCADA.ConfigUsers Citect.Engineers
Users
Runtime Users SCADA.RuntimeUsers Citect.LocalUsers
Server Users SCADA.ServerUsers Citect.ServerUsers
Deployment Admin-
SCADA.DeploymentAdmins Asb.Deployment.AdminRole
istrators
Deployment
SCADA.DeploymentUploaders Asb.Deployment.UploadRole
Uploaders
Deployment Users SCADA.DeploymentUsers Asb.Deployment.DeployRole
Note: In an upgrade scenario, the Asb.Deployment.ReadRole user group is obsolete

and not associated with any security role.

If required, you can use Configurator to change the associated members with these
security roles (see Modifying the Members of a Security Role).
Windows Firewalls
Microsoft Windows® distinguishes between Public, Home and Work networks. Each net-
work has its own firewall profile, which allows you to configure different firewall rules
depending on the security requirements of your location. The Plant SCADA installers
can automatically modify the Windows firewall settings for the current active network
profile during installation. If you later change network settings, you will need to manu-
ally modify the firewall settings within Windows.
Note: Plant SCADA networking and redundancy needs the option "Plant SCADA
Runtime" to communicate through a Windows firewall. You will need to manually
add an application to the Windows firewall exception list for a particular network
profile.
Communication Drivers
Plant SCADA communicates with I/O devices such as PLCs, loop controllers, bar code
readers, scientific analyzers, remote terminal units (RTUs), and distributed control sys-
tems (DCS). This communication takes place with each device through the imple-
mentation of a communications driver.
The installation process allows you to select from a set of individual drivers that are spe-
cific to your system and its I/O devices. There are also certain drivers that are necessary
for Plant SCADA to function correctly. These will be installed automatically.
Note: With the release of Plant SCADA 2020 R2, a classification system for the driver
portfolio was introduced to indicate the level of ongoing maintenance that customers
can reasonably expect for each driver. In line with these classifications, the number
of drivers included by default with the Plant SCADA installation media has been
reduced to a set of ‘core’ drivers that have undergone recent updates. All other
drivers continue to be available for download from the Communication Drivers
page at the AVEVA Knowledge and Support Center located at https://soft-
waresupport.aveva.com/.
See Install Communication Drivers.

OPC Factory Server

The Plant SCADA installer allows you to install a copy of Schneider Electric's OPC Fact-
ory Server.
Based on the OPC protocol, OPC Factory Server enables Windows-based OPC client
applications to communicate with a range of Schneider Electric's PLCs.
Fore more information, see Install OPC Factory Server.
Anti-virus Software Setup

If a computer uses an anti-virus software product, you need to be aware of the fol-
lowing implications for a Plant SCADA installation.
SYSTEM PERFORMANCE DEGRADATION
The "on access" scan in anti-virus products can lock files used by Plant SCADA, usually having
the effect of slowing Plant SCADA down whilst it waits for the scan of that file to finish.
damage.
INOPERABLE SYSTEM OR LOSS OF DATA
In some extreme cases, anti-virus software may (incorrectly) detect certain patterns within data
files as being viruses. Depending on the anti-virus configuration, this may result in files being
relocated or deleted, resulting in data being lost or the system being inoperable.
Failure to follow these instructions can result in injury or equipment damage.
It is recommended that the following directories are excluded from scanning by any
anti-virus products:
l Program Files installation directory (including files and sub directories)
l Data and Logs directories
l Any alarm server archive paths.

The above exclusions are recommended for "on access" or "real time" scans that run con-
tinuously and scan each file that is read from or written to.
Maintaining System Currency

After you have completed the installation and configuration of Plant SCADA and
deployed it as your production system, it is recommended that you keep your software
up to date.
AVEVA will periodically publish software updates for Plant SCADA and advisories
relating to safety, security and functionality. These are available from the Product Hub
page of the AVEVA Knowledge & Support Center website at https://soft-
waresupport.aveva.com. We especially recommend that you nominate a person in your
organization to refer, and subscribe, to the RSS feeds for Safety and Security, as well as
the latest articles on the web site.
Virtualization Host Support

You can run components of your Plant SCADA system in a virtual environment. The fol-
lowing virtualization environments are supported:
l Microsoft Hyper-V: based on the version of Windows.
l VMware Workstation: basic virtualization without High Availability and Disaster
Recovery.
l VMware vSphere.
What Should I Install?

The Plant SCADA installer directs you through a set of pages that will help you determ-
ine which components you require on a computer. Before you begin this process, you
need to consider the questions below.
Note: If you are building a large system, it is important to carefully consider the
overall topology of the system. For example, a distributed architecture, server
redundancy, load sharing and clustered control scenarios can help to address your
process requirements and benefit the overall performance of a system. See the topic
Typical System Scenarios in the Plant SCADA documentation before you start to build
a complex system.

Will you use the computer to configure a Plant SCADA project?

To configure a Plant SCADA project, you need to use a development workstation. An
installation of a development workstation includes two fundamental sets of com-
ponents:
l Plant SCADA Studio — used to create and configure a project.
l Runtime components — used to run a project.
See Install a Development Workstation.
Do you want to use AVEVA™ Industrial Graphics?

AVEVA Industrial Graphics is a thin client solution for the delivery of HTML5 graphics
to desktop browsers and mobile devices. It provides a common graphics technology that
can be used across AVEVA's SCADA and HMI solutions.
Clients access AVEVA Industrial Graphics via an Industrial Graphics Server, a ded-
icated computer that authenticates client details and provides access to the graphical
and functional content.
If you want to use Industrial Graphics, you will need to set up an Industrial Graphics
Server. You will also need to configure a Deployment Server in your network to deploy
content to the Industrial Graphics Server.
An AVEVA Enterprise License Server also needs to be part of your network to provide
licenses for client access.
See Install an AVEVA Industrial Graphics Server.
Do you want Plant SCADA to act as a server for OPC UA client applications?
Setting up an OPC UA Server allows Plant SCADA's runtime system to function as a
server to OPC UA client applications. For more information, see Install an OPC UA
Server.
Does your system require encrypted communications?

Communications between Plant SCADA processes, computers and CtAPI can be encryp-
ted. This is required if:
l You need to use trusted communications for your runtime system computers.
l You want to connect an OPC UA server to your system.
l You want to connect an Industrial Graphics Server to your system.

To enable encryption, a System Management Server is required to manage the cer-

tificates used to support trusted communications. A System Management Server is set
up using a tool called Configurator (see Set Up a System Management Server).
Note: To use encrypted communication, your Plant SCADA servers need to be run-
ning as a service.
If you already have a System Management Server set up, you will need access to the cer-
tificate that will connect your new installation to the System Management Server. This
can be also be configured using Configurator. See Connect a Computer to the System
Management Server.
Do I need to run Plant SCADA as a service?

Plant SCADA can be run as a Windows™ service, allowing for unattended operation of
a system's servers.
To create an encrypted connection, your Plant SCADA servers need to be running as a

service. This is required when:
l You are running with encryption enabled. This includes running in mixed mode.
If you are using Plant SCADA's Deployment feature, you also need to run as a service
under the following circumstances:
l When a deployment client is configured on a computer and you want to push project
updates using "Force" mode.
l If you are using encrypted communications, and the current user on a deployment
client does not have required privileges.
To configure Runtime Manager to run as a service, see Configure a Runtime Computer
for Encryption.
Do you want to use Plant SCADA's Deployment feature?

Plant SCADA's Deployment functionality allows you to send runtime files to specific
computers in a Plant SCADA system. This simplifies the process of distributing project
changes across multiple computers.
If you want to use this feature, a Deployment Server is required. This is where you
store versions of a project for distribution. Specific components need to be installed for a
Deployment Server (and any Deployment Clients that connect to it).

See Install a Deployment Server.
Note: A Deployment Server uses encrypted communications, so you will need to

connect the host computer (and any connected clients) to an existing System Man-
agement Server.
Do you want to view Plant SCADA Runtime in a web browser?

A Plant SCADA Web Server allows you to display a runtime system using an ActiveX
component in Internet Explorer. It authenticates requests from web-based clients, dis-
tributes the required content from a Plant SCADA project, and enables access to the
runtime servers.
Add-on components need to be installed to set up a Plant SCADA Web Server. The
installation process also adds a virtual directory called "AVEVA Plant SCADA" to Win-
dows® IIS (Internet Information Services).
See Install a Plant SCADA Web Server.
Do you just need to install a runtime client?

If you are setting up a computer that will only operate as a runtime client, you have the
option to install just the Plant SCADA runtime components.
See Install a Runtime-only Client.
Note: If you want to install a standalone Plant SCADA system for training or eval-
uation purposes, install a Development Workstation (see Install a Development
Workstation).

22
Chapter 2: Configurator
Configurator is a tool you can use to prepare a computer for its role within a Plant
SCADA system.
When a Plant SCADA installation is complete, a dialog will appear asking if you would
like to launch Configurator. In most cases, you will require Configurator to complete the
setup of a computer.
To access Configurator at other times, go to the Windows® Start menu and locate
AVEVA | Configurator.
Configurator presents a set of pages that can be accessed via a directory to the left of the
interface.
For the AVEVA Enterprise Licensing Platform, the following page is included:
l AVEVA Enterprise License Server — used to configure an AVEVA Enterprise
License Server.
See Use Configurator to Set Up an Enterprise License Server.
For AVEVA Common Platform components, the following page is included:
l System Management Server — used to configure a System Management Server.
See Configure a System Management Server.
For an AVEVA Industrial Graphics Server, the following pages are included:

l Client Settings
l Authentication Settings
See Use Configurator to Set Up an Industrial Graphics Server for more inform-
ation.
For Plant SCADA, the following pages are included:
l Computer Setup — used to configure environment settings for a runtime computer,
including a server password and some deployment settings
See Use Configurator Setup a Runtime Server.
l Security Roles — used to map Plant SCADA Roles to Windows® user groups,
Domain Groups and Individual users.
See Security Roles.
l Encryption — used to encrypt communications between Plant SCADA processes,
computers and CTAPI applications.
See Enable Encryption.
l Deployment Server — used to set up a Deployment Server for the distribution of
Plant SCADA project versions.
See Configure a Deployment Server.
l Deployment Client — used to set up a Deployment Client.
See Configure a Deployment Client.
l OPC UA Client Driver — used to manage secure communications with OPC UA
devices connected to Plant SCADA via an external OPC UA server. This relates to an
installed driver, not Plant SCADA's OPC UA Server.
See OPC UA Client Driver.
l OPC UA Server — allows Plant SCADA's runtime system to function as a server to
third-party OPC UA client application.
See Use Configurator to Set Up an OPCUA Server.
The icons next to each page indicate the current status of the associated settings, accord-
ing to the following legend.

Each page includes the Configuration Messages panel to advise you of the outcome of
any adjustments you make. You can also View the Configurator Messages List.
View the Configurator Messages List

The Configurator Messages List allows you to view and export all of the Configurator's
current messages.
To view the Configurator Messages List:

l On a Configurator page, click the All Messages button.
The Messages List dialog box displays all current messages in a tabular format. Click on
a column heading to sort the table according to the column. Click again to toggle
between ascending or descending order.
To export the Configurator Messages List:

1. Click the Export to file button.
2. Use the Save As dialog to save the file.

26
Chapter 3: Install a Development Workstation
A development workstation uses configuration tools such as Plant SCADA Studio and
Graphics Builder to create a Plant SCADA project.
A project includes runtime content and configuration information. You need to dis-
tribute a copy of the project to each computer in a Plant SCADA runtime system.
When you chose to install a development workstation, the following components are
selected by default:
l Plant SCADA Studio
l Plant SCADA Runtime
l Plant SCADA Drivers
l Plant SCADA Deployment Server
l Plant SCADA Deployment Client
l Plant SCADA Industrial Graphics Server
l Software Update Tool
l Project DBF Add-In for Excel.
Two licensing options are also selected by default.
l Sentinel Driver
l Floating License Manager.
See Licensing Tools to determine your requirements.
If required, you can use the Customize the components that will be installed page to
modify the list of selected components.

See also
Development Workstation Installation Requirements

Development Workstation Installation Procedure
Use Configurator to Configure a Development Workstation
Development Workstation Installation Requirements

This topic describes the hardware and software requirements for a Plant SCADA devel-
opment workstation.
Note: Before you install Plant SCADA, it is recommended that you install the latest
updates from Microsoft® for your operating system and system software.
Hardware Requirements
The hardware requirements for a development workstation are as follows, based on the
size of the system you are configuring.
Compact Small Medium Large Huge

System System System System System
<1,500 pts <15,000 pts <50,000 pts <500,000 pts >500,000 pts
CPU
2000 2000 4250 4250 8000
PassMark®
Cores 2 2 4 4 4
RAM 8 GB 8 GB 8 GB 8 GB 8 GB
HDD 10 GB 20 GB 50 GB 50 GB 100 GB
DirectX 11 or DirectX 11 or DirectX 11 or DirectX 11 or DirectX 11 or

later with later with later with later with later with
WDDM 1.0 WDDM 1.0 WDDM 1.0 WDDM 1.0 WDDM 1.0
Graphics Driver. Driver. Driver. Driver. Driver.
128 MB of ded- 128 MB of ded- 128 MB of ded- 128 MB of ded- 128 MB of ded-
icated VRAM. icated VRAM. icated VRAM. icated VRAM. icated VRAM.
Screen
1920 x 1080 1920 x 1080 1920 x 1080 1920 x 1080 1920 x 1080
Resolution

Compact Small Medium Large Huge

System System System System System
<1,500 pts <15,000 pts <50,000 pts <500,000 pts >500,000 pts
Network 100 Mb 100 Mb 100 Mb 100 Mb 100 Mb
The suggested disk space requirements for the HDD is an estimate only and includes:
l A full Plant SCADA installation including optional components and documentation
l Project assets for the specified system size.
If the deployment feature is being used, the HDD needs to have the required space for
the number of configured project versions + 2. You should remove unused project ver-
sions periodically to reduce HDD usage.
An SSD is recommended for engineering machines for better performance. If a non-SSD

is used, select a minimum RPM of 7200.
Operating System Requirements

The following operating systems are supported (64-bit only):
l Windows® Server 2019
l Windows® 10 build 1803 or later
l Windows® 10 LTSC build 1607 or later
l Windows® Server 2012 R2
l Windows® 8.1.
Microsoft .NET Framework 4.8 is required. It will be installed by Plant SCADA if not
detected.
When .NET installation is complete, you may be prompted to restart your computer. If
this occurs, you should initiate a restart before you continue.
Note: The Project DBF Add-In for Excel will only work with a 32-bit version of
Excel. An Office 2016 version of Excel (or later) is required.
Development Workstation Installation Procedure

This table below describes the pages included in the Plant SCADA installer and the set-
tings required to install a development workstation.

Use the Back and Next buttons to navigate through the pages.
Installer Page Notes
Installation Documentation If required, view the available documents.
License Agreement Accept the terms of the License Agreement.
What is the role of this com-

Select Development Workstation.
puter?
By default, the following components are selected when you install a Devel-
opment Workstation.
l Plant SCADA Studio

l Plant SCADA Drivers
l Plant SCADA Deployment Server
Customize the default com- l Plant SCADA Industrial Graphics Server
ponents l Software Update Tool
l Project DBF Add-In for Excel
l Sentinel Driver
l Schneider Electric Floating License Manager
You can use this page to customize the list of selected components.
Note: The Project DBF Add-In for Excel will only work with a 32-bit version of
Excel. See the Operating System Requirements.
If the installer detects that the computer has Windows Firewall enabled, you
will be asked if you would like the installer to modify your settings.
Windows® Firewall
If you select Yes, Plant SCADA Runtime will be added to the list of authorized
programs.
This page identifies the destination folders for:
l The selected Plant SCADA program files.

l The Plant SCADA User and Data folders.
You can modify the folder locations by clicking the Change buttons and select-
Destination Folder
ing alternative locations.
Note: The installation folder and the 'User and Data' folder cannot be the
same, or a sub-directory of one another. You also cannot install in your Win-
dows user folder.
This page identifies the destination folder for any add-ons that you have selec-
Base Folder
ted (such as the Project DBF Add-in for Excel).

You can modify the folder locations by clicking the Change button.
This page lists the components that will be installed based on your selections.
Ready to Install the Program If required, use the Back button to make any modifications.
Click Install to start the installation process.
Use Configurator to Set Up a Development Workstation

When your Plant SCADA installation is complete, a dialog will appear asking if you
would like to launch Configurator.
The following descriptions of the Configurator's pages will help you determine which
settings you need to consider.
Computer Setup
The Computer Setup page allows you to specify three key settings for a Plant SCADA
computer.
l Server Authentication — specifies the password the Plant SCADA server processes
use to communicate with each other. If the computer will run a server process, you
will need to configure the server password.
l Project Run Path — instructs Runtime Manager to run the project currently selected
in Plant SCADA Studio, or a deployed project from the Deployment Server.
l Runtime Manager Configuration — allows you to run Runtime Manager as a ser-
vice, which may be required for a Deployment Client.
Security Roles
To manage the usage of Plant SCADA and restrict access to its sensitive components,
only users with relevant permissions can perform certain security-related operations.
Each security role has specific permissions to access different features, software applic-
ations and project resources. Using the Security Roles page in the Configurator, you can
assign the security roles to a user account or a group account. For more information, see
Security Roles.

Encryption
If your Plant SCADA system uses encrypted communications, you will have to enable
encryption for each new installation of Plant SCADA. This is achieved using Con-
figurator's Encryption page (see Enable Encryption).
As a prerequisite, the computer needs to be registered with a System Management

Server. This is achieved using Configurator's System Management Server page (see
below).
System Management Server

This page allows you to set up the computer as a System Management Server (see Con-
figure a System Management Server)
If your Plant SCADA system already has a System Management Server, you can use this
page to establish a trusted connection to it (see Connect a Computer to a System Man-
agement Server).
Additional Components
Some pages will appear in the Configurator if you chose to install additional com-
ponents. Use the links below for more information on how to configure these pages.
l Deployment Server — see Configure a Deployment Server.
l Deployment Client — see Configure a Deployment Client.
l OPC UA Server — see Use Configurator to Set Up an OPCUA Server.
l OPC UA Client Driver — see OPC UA Client Driver.
l Industrial Graphics Server — see Use Configurator to Set Up an Industrial Graphics
Server.

Chapter 4: Set Up a System Management Server
A System Management Server ensures Plant SCADA components only work on trusted
computers. It also enables support for end-to-end encryption (which is highly recom-
mended).
Only one of the computers in a Plant SCADA system can be set up as a System Man-
agement Server.
A System Management Server does not need to be on a dedicated computer. In a typical

Plant SCADA system that is also using deployment, it is recommended that the System
Management Server is on the same computer as the Deployment Server.
The components required to enable encryption are included with every installation of
Plant SCADA. You need to use Configurator to specify which computer in your system
will act as the System Management Server.
The certificates required to enable trusted communications can then be created on this
computer using Configurator. Alternatively, you can also use your own third party cer-
tificates if required.

All other computers in your system then use this certificate to acquire validation from
the System Management Server.
Configure a System Management Server

Plant SCADA needs post-installation configuration in order to use encrypted com-
munications via a System Management Server. Encryption is a requirement for com-
ponents such as a Deployment Server, an Industrial Graphics Server or an OPC UA
Server.
Only one of the machines in the network can be identified and configured as a System
Management Server.
You use Configurator to establish a trust relationship between one or more computers
running Plant SCADA and its services. This configuration creates a platform that can
support encrypted communication between these computers. It is achieved by con-
figuring a certificate on a common System Management Server that can then be used to
enable encrypted communications.
Certificates may be generated automatically on the System Management Server, or

provided by a system administrator or IT department (see Use Externally Provided Cer-
tificates for Encryption in the Plant SCADA documentation).
Note: To connect a computer to the System Management Server, the current user on
the connecting machine needs to be a member of either the “aaAdministrators” or
the “Administrators” group on the computer where the System Management Server
is installed.
To configure the System Management Server:

1. Start the Configurator.
2. In the left pane, select Common Platform | System Management Server.

The following page is displayed:

3. Select This machine is the System Management Server. Review the notes on the
screen before you start the configuration.
Note: The machine on which you want to install the System Management Server
needs to be configured to have a static IP address.
4. Click Configure.
Note: If you need to change the port used by a System Management Server see
the topic Advanced Configuration for a System Management Server in the Plant
SCADA documentation.
5. On successful configuration, the message “Device configuration completed” is dis-

played. The security code is displayed in the Configurator as shown below. To view
more information about the certificate, click Details.
If the configuration is unsuccessful, check the Log Viewer. You can access this by
typing the following in the Windows command prompt:
%PROGRAMFILES(X86)%\common files\archestra\aaLogviewer.exe
Alternatively, view the error messages in the System Management Console.
6. Click Close to exit the Configurator.
Note: After you have configured a System Management Server, it is recommended

that you either sign out or reboot the computer to ensure all settings are applied cor-
rectly.
Connect a Computer to a System Management Server

Computers running Plant SCADA need to connect to the System Management Server
to use encrypted communication enabled by a certificate.

Note: If you do not have a System Management Server configured, refer to the sec-
tion Configure a System Management Server for instructions. All AVEVA applications
need to be configured to trust each other to use encrypted communications.
To connect a computer to the System Management Server, you use the System Man-
agement Server page in Configurator. You can launch Configurator at the completion of
the installation procedure, or from the Windows™ Start menu.
To establish a connection, the current user on the remote computer needs to be a mem-
ber of either the “aaAdministrators” or the “Administrators” group on the machine
where the System Management Server is installed. If this is not the case, you will be
prompted to enter the credentials for a member of one of these groups.
To connect a computer to the System Management Server:

1. In the panel on the left side of the Configurator select Common Platform, System
Management Server.
2. Select the option Connect to an existing System Management Server.
3. In the field below, select the name of the System Management Server you want to
use from the drop-down list.
The Configurator uses SSDP (Simple Service Discovery Protocol) to detect a Sys-
tem Management Server on a remote computer. If SSDP has been blocked on your
network, nothing will appear in the drop-down list.
If the required computer name does not appear in the list, you can manually enter
a hostname or Fully Qualified Domain Name (FQDN) for the computer on which
the System Management Server is installed. Connecting via an FQDN will require
a connection to a domain server.
Note: The Configurator interface refers to "redundant SSO servers". This feature
is not supported by Plant SCADA, you cannot configure a computer as a redund-
ant SSO server.
4. Click Configure. The root certificate is downloaded, and the following message is dis-
played.

5. Review the message carefully before you click Yes. If you select No, the configuration
process will be canceled.
A dialog box may appear prompting you to log on to the System Management
Server. This will occur if the current user is not a member of either the “aaAd-
ministrators” or the “Administrators” group on the machine where the System
Management Server is installed. If this happens, enter the credentials for a mem-
ber of one of these groups and click OK.
The Configuration Messages area displays the steps in the configuration process
and the progress.
If the configuration is unsuccessful, view details of the error messages in the Sys-
tem Management Console. Alternatively, check the Log Viewer by typing the fol-
lowing in the Windows command prompt:
%PROGRAMFILES(X86)%\common files\archestra\aaLogviewer.exe
6. Click Close to exit the Configurator.
Note: After you have connected a computer to a System Management Server, it is

recommended that you either sign out or reboot the computer to ensure all settings
are applied correctly.

Once you have connected to a System Management Server, you can modify the con-
figuration settings by selecting Advanced. Refer to the topic Advanced Configuration for a
System Management Server for more information.
Note: If you need to connect a client computer that is not on the same domain as the
System Management Server (for example, it is part of a Workgroup), you need to
configure the Primary DNS Suffix on the client to identify the domain on which the
System Management Server resides. Refer to the Windows documentation for
instructions on how to specify a Primary DNS Suffix for a computer.
Enable Encryption
Communications between Plant SCADA processes, computers and CtAPI can be encryp-
ted in Plant SCADA 2020 R2.
To use encrypted communications, you need to have a System Management Server con-
figured. In addition, the Runtime Manager should be running as a service. If these pre-
requisites are not met, warning messages will be displayed.
To enable encryption:
1. Launch the Configurator after the installation, or from the Windows™ Start menu.
2. In the left pane, select Plant SCADA | Encryption.

The following page is displayed.
3. Firstly, check that the Encryption Prerequisites have been met. If a red cross appears
next to an item, you will need to make the required configuration changes before you
can enable encryption.
l To register the computer with the System Management Server, see Connect a
Computer to a System Management Server.

l To configure Runtime Manager to run as a service, see Configure a Runtime Com-
puter for Encryption.

4. Select Enable Encryption.

5. If you are performing an online upgrade to version Plant SCADA 2020 R2 or running
an older version of Citect SCADA, select Accept encrypted and non-encrypted con-
nections (mixed mode). Note that you can clear this option and configure your sys-
tem to use encryption after the upgrade process is complete.
The following table indicates the encryption mode that will align successfully
across server and client.
Encryption mode on server
Unencrypted Mixed Mode Encrypted
Communication Communication Communication

Unencrypted
OK OK unsuccessful
Encryption
mode on Mixed Mode
OK OK OK
client

Encrypted
unsuccessful OK OK
6. Click Configure. A message is displayed when encryption setup is completed.
Note: If you do not select Enable Encryption before you click Configure, the fol-
lowing message is displayed: "Encryption is currently disabled. It is recommended
that you enable encryption.".
Configure a Runtime Computer for Encryption

To prepare a computer for encryption, you need to confirm the following runtime envir-
onment settings.
These settings can be adjusted using the Configurator's Computer Setup page under
Plant SCADA. You can launch Configurator at the completion of the installation pro-
cedure, or go to the Windows® Start menu and locate AVEVA | Configurator.
Runtime Manager Configuration

This setting instructs Runtime Manager to run as a service. This is required under the
following circumstances:
l You are running with encryption enabled. This includes running in mixed mode.

To run Runtime Manager as a service:

1. In the panel on the left side of the Configurator, select Plant SCADA | Computer
Setup. The Computer Setup page appears. Navigate to the Runtime Manager Con-
figuration section of the dialog.
2. Select Run Runtime Manager as a Service.
Note: If you are using Deployment to run a project and do not select the Run
Runtime Manager as a Service option, you will need to manually start the Plant
SCADA Runtime Manager before deploying the project.
3. To apply your settings, click the Configure button.

Chapter 5: Install a Runtime Server
A Runtime Server is any computer that hosts a server process in support of the runtime
system. For example, a Runtime Server can perform one or more of the following func-
tions:
l Alarms server - evaluates the conditions that define an alarm
l Trends server - manages the accumulation and logging of trend information
l Reports server - generates configured reports
l I/O device server - manages communication with field devices.
The server processes that are hosted by a runtime server are not configured during the
installation process. These are defined in a project using in the Topology activity in
Plant SCADA Studio.
These processes can be installed on a single computer, or separated onto multiple com-
puters across a distributed system. See the topic Typical System Scenarios in the Plant
SCADA documentation for examples of how you can distribute server processes.
See also
Runtime Server Installation Requirements

Runtime Server Installation Procedure

Use Configurator to Set Up a Runtime Server
Runtime Server Installation Requirements

This topic describes the hardware and software requirements for a computer that will
act as a Runtime Server.
Before you install Plant SCADA, it is recommended that you install the latest updates
from Microsoft® for your operating system and system software.
The hardware requirements for a Runtime Server are as follows, based on the size of
your system.
Compact Small Medium Large

System System System System
<1,500 pts <15,000 pts <50,000 pts <200,000 pts

per server per server per server per server
CPU
2000 2000 4250 8000
PassMark®
Cores 2 2 4 8
RAM 8 GB 8 GB 8 GB 16 GB
HDD 10 GB 20 GB 50 GB 100 GB
DirectX 11 or later DirectX 11 or later DirectX 11 or later DirectX 11 or later

with WDDM 1.0 with WDDM 1.0 with WDDM 1.0 with WDDM 1.0
Driver. Driver. Driver. Driver.
Graphics
128 MB of ded- 128 MB of ded- 128 MB of ded- 128 MB of ded-
icated VRAM. icated VRAM. icated VRAM. icated VRAM.
Screen
1920 x 1080 1920 x 1080 1920 x 1080 1920 x 1080
Resolution
Network 100 Mb 100 Mb 100 Mb 100 Mb

Note: The recommendations above are for a single cluster and server only running
I/O, alarms, trends and reports. System resources for CPU and memory should be
increased when using clustering, or if there is high rate of change of data (I/O or
alarms).
The suggested disk space requirements for the HDD is an estimate only and includes:
l Runtime components.
l Compiled project.
l 20% of the I/O trending with a change on average every 10 seconds, 24 x 7 for 3
months.
l Alarm changes equal to the number of I/O changing per day.


l Windows® 8.1.
detected.
Runtime Server Installation Procedure

This section lists the pages displayed by the Plant SCADA installer and the settings
required for a Runtime Server. Use the Back and Next buttons to navigate through the
included pages.


Select Server.
puter?
Select Runtime Server.

Select the servers you want to
install
If required, you can also select other server types.
By default, the following components are selected when you install a Runtime
Server.

Customize the default com- l Plant SCADA Drivers
ponents
l Software Update Tool
l Sentinel Driver (see Licensing Tools).
You can use this page to customize the list of components selected for install-
ation.
This page lists the local Windows groups the installer will create to manage
security (see Windows User Groups and Security Roles).
Note: This page will only appear if you are installing Plant SCADA on a
clean computer (one that has not hosted an earlier version). If you are
upgrading from an earlier version, equivalent user groups will already exist
on the computer.
Local Windows™ Groups
If you want your current Windows user account to be included in the groups
that are being created, select Add the current Windows user to these
groups.
A dialog will let you know that the group membership changes will not occur
until after a restart.
Windows™ Firewall
programs.
Destination Folder This page identifies the destination folders for:


dows user folder.
This page identifies the destination folder for any additional components that
you have selected (such as the Project DBF Add-in for Excel).
Base Folder
Use Configurator to Set Up a Runtime Server

would like to launch Configurator. You can use the Configurator's Computer Setup
page to adjust the following runtime environment settings for a computer:
Server Authentication
A server process requires the configuration of a password. This allows servers to authen-
ticate and create trust with each other. If a computer will run a server process, you will
need to create a new password, or use the password that is already used by other server
computers in your Plant SCADA system.
To configure server authentication for a runtime computer:

1. Launch the Configurator after the installation, or from the Windows™ Start menu.
2. In the left pane, select Plant SCADA | Computer Setup.

3. If the computer will be used to host a Plant SCADA server process, you will need to
specify a password for server authentication. To do this, go to the Server Authentic-
ation section of the dialog.
4. Select the Configure Server Password check box.

5. Enter the required password and confirm it in the fields provided.
If the Password and Confirm Password fields already contain an entry, it means a
server password has already been configured on the local computer. If required,
you can enter a new password.
The password you use needs to match the password configured for the other
server processes included in your Plant SCADA system. This password can be set
on each computer using Configurator or the Setup Wizard.

Note: If you change the server password while the runtime system is active, it will
not disrupt any established connections as the password is only retrieved when
authentication needs to occur. However, it is recommended that you apply the new
password as soon as possible. To do this, you need to restart the runtime system.
Project Run Path

If the computer will receive project updates from a Deployment Server, you need to
indicate that you want to run the deployed project.
If you are not using deployment, you can use the default setting Run the project selec-
ted in Plant SCADA Studio.
To set the Project Run Path:

Setup. The Computer Setup page appears. Navigate to the Project Run Path section.
2. Select one of the following options to determine which project will be launched by
Runtime Manager:
l Run the project currently selected in Plant SCADA Studio — This is selected
by default and will run the project from Plant SCADA Studio.
l Run the project deployed from the Deployment Server — Select this option to
set up a computer for deployment. This option allows you to run the deployed
projects from the deployment server.
Note: If Plant SCADA Runtime is running as a service and the Project Run Path
option in the Configurator is changed to Run the project deployed from the
Deployment Server, you need to restart the Runtime Manager service for deploy-
ment to function correctly.


This setting instructs Runtime Manager to run as a service. This allow a project to be
deployed and run on a computer without having to change other settings.
You need to select Run Runtime Manager as a service under the following cir-
cumstances:
client may not have required privileges.
Note: The current user on a deployment client needs to be a member of Con-

figuration Users security role to run the deployment client (see Security Roles).
These settings can be made using the Configurator's Plant SCADA | Computer Setup
page. You can launch Configurator at the completion of the installation procedure, or go
to the Windows®Start menu and locate AVEVA | Configurator.


Chapter 6: Install a Deployment Server
A Deployment Server allows you to distribute projects (and any subsequent updates) to
the computers in your Plant SCADA system. It stores multiple "versions" of a project's
runtime files, allowing you to deploy a specific version to any computer that has been
configured as a deployment client.
Note: A Deployment Server uses encrypted communications, which means it

requires access to a System Management Server. Ideally the Deployment Server
should be installed on the same computer as the System Management Server. See Set
Up a System Management Server.
When using Industrial Graphics, a Deployment Server is required to deliver project ver-
sions to the Industrial Graphics Server.
See also
Deployment Server Installation Requirements

Deployment Server Installation Procedure

Configure a Deployment Server

Configure a Deployment Client
Deployment Server Installation Requirements

This section describes the hardware and software requirements for a computer that will
host a Deployment Server.
The hardware requirements for a Deployment Server are as follows:
Cores 4
Memory 8 GB
Size of project backed up, multiplied by the number of ver-

sions expected to be stored.
HDD
An SSD is recommended for better performance. If a non-
SSD is used, select a minimum RPM of 7200.
CPU PassMark® 4250
Network 1 GB

l Windows® 8.1.
detected.

Deployment Server Installation Procedure

This section lists the pages displayed by the Plant SCADA installer and the settings
required for a Deployment Server. Use the Back and Next buttons to navigate through
the included pages.

Select Server.
puter?
Select Deployment Server.

install
By default, the following components are selected when you install a Deploy-
ment Server.
Customize the default com-
ponents l Plant SCADA Deployment Server
on the computer.
groups.

Windows™ Firewall
programs.

Destination Folder
dows user folder.
Base Folder
Configure a Deployment Server

Deployment uses encrypted communications, which means you will require access to a
System Management Server (see Set Up a System Management Server).
To configure a deployment server you also need to have the deployment server com-
ponents installed. This is an option on the Customize the default components page of
the Plant SCADA installer (see Install a Deployment Server).
You can then use Configurator to configure a deployment server and set the deploy-
ment database password. Launch Configurator at the completion of the installation pro-
cedure, or from the Windows™ Start menu (Programs | AVEVA | Configurator).
On the Security Roles page under Plant SCADA, make sure that your user account is
assigned to the Deployment Administrator role, either directly or via an associated
domain group (see Security Roles).

To configure the deployment server (on a local computer):

1. In the panel on the left side of the Configurator, select Plant SCADA | Deployment
Server. The [START] page appears.
2. Select one of the following options:
l Configure the Deployment Server - this option is available when no deployment
server has been configured.
l Update the configuration of the current Deployment Server - this option is avail-
able once a deployment server has been configured. Select it to update the database
password and transfer speed for a deployment server; however you cannot update
the port number.
l Import configuration file from previous version of the Deployment Server - If you
have an earlier version of the deployment server configured, you can import the set-
tings. Browse for the following Configurator file in the provided field:
"SE.Asb.Deployment.Server.WindowsService.exe.config".
Note: The default location is “%PROGRAMDATA%\AVEVA Plant SCADA 2020

R2\Config”
After importing the Configurator file, you can continue using the deployment
database and file repository created previously in the current or earlier versions of
Plant SCADA.
3. Click Next. The SETTINGS page appears.
This page allows you to set the password used by the deployment database. It
also allows you to set the transfer rate to limit the network bandwidth used when
deploying a project.
4. Enter the Password for the database. Confirm the password.
Note: To change an existing database password you need to reconfigure the deploy-
ment server.
5. In the Transfer Speed (KB/s) field, enter a value between 0 and 2147483647 (0 being
unrestricted). The default is 10000 (KB/s). By limiting the transfer speed, you allow
other processes to use the remaining network bandwidth. This value may affect the
overall duration of a deployment operation. For example, if your project is 20MB
with a limit set to 1000 KB/s, the project will take approximately 20 seconds to trans-
fer.
Note: Settings may vary according to your network infrastructure.
6. Click the Next. The FINISH page appears.

If required, you can use the Previous button to make any changes to your settings
before you complete the configuration process.
7. Click Configure. The Configuration Messages panel will indicate if the deployment
server configuration is successful.
Note: If you change the computer name for the deployment server, it will cause a
loss of communications between the deployment server and all of the deployment
clients.
If there is any issue to perform deployment server activities, check that the NT Ser-
vice\CitectDeploymentServer virtual service account has read and write permissions for
the deployment server folder (%PROGRAMDATA%\AVEVA Plant SCADA 2020
R2\Deployment\Server).
Right click the Server folder, go to Properties | Security, and check that the permissions
are assigned correctly.
Configure a Deployment Client

Deployment uses encrypted communications, which means you will firstly need to con-
nect each deployment client to the System Management Server used by the deployment
server (see Connect a Computer to a System Management Server).
To configure a deployment client you use Configurator. This allows you to enter the
login credentials required to register the client.
Note: To configure a deployment client you need to have the deployment client com-
ponents installed. This is an option on the Customize the default components page
of the Plant SCADA installer.
Launch the Configurator at the completion of the installation procedure, or from the
Windows™ Start menu (Programs | AVEVA | Configurator).
On the Security Roles page under Plant SCADA, make sure that your user account is
assigned to the Deployment Administrator role, either directly or via an associated
domain group (see Security Roles).

Note: The current user on a deployment client needs to be assigned to the Runtime
Users role to run a deployment client. If this is not always possible, you can con-
figure Runtime Manager to run as a service (see Configure a Computer for Deploy-
ment).
To configure a deployment client (on a local computer):

1. In the panel on the left side of the Configurator, select Plant SCADA | Deployment
Server. The [START] page appears.
2. Select one of the following options:
l Configure the Deployment Client - This option is available when no deployment
client has been configured.

l Update the configuration of the current Deployment Client - This option is
available if a deployment client has been configured. The Deployment Client con-
figuration needs to be updated whenever there is change in the System Man-
agement Server configuration.
l Import configuration file from previous version of the Deployment Client - If
you have an earlier version of the deployment client configured (from Plant
SCADA 2016 or 2018), you can import the client settings. Browse for the following
Configurator file in the provided field:
"SE.Asb.Deployment.Node.WindowsService.exe.config".
Note: The default location is "%PROGRAMDATA%\AVEVA Plant SCADA 2020

R2\Config”
3. Click Next. The CONNECT page appears.

In the Deployment Server field, select the deployment server to which you would
like to connect. If the name does not appear in the list, type the Windows com-
puter name of the machine on which the System Management Server is installed.
To change the deployment server to which a deployment client is connected,
repeat the steps needed to configure a deployment client.
If the deployment client is also configured as a deployment server, the deploy-
ment client should only connect to the local deployment server.
4. Click Next. The AUTHORIZE page appears.
Enter the User Name and Password for the Windows user account that will be
used to register the client computer with the deployment server. The user account
you enter needs to be assigned to the Deployment Administrator role on the
deployment server (either directly or via an associated domain group). For more
information, see Security Roles.
5. Click Next. The SETTINGS page appears.

On the SETTINGS page, you can set the Unpack Rate, and specify the location
for the projects to be deployed.
l In the Unpack rate (KB/s) field, enter a value between 0 and 2147483647 (0 being
unrestricted). If you limit the unpack rate, your system will still be able to run
other processes. This value may affect the overall duration of a deployment oper-
ation.
l In the Deployed project location field, specify the folder path where the
deployed projects from the Deployment Server will be stored. The default location
is: %PROGRAMDATA%\AVEVA Plant SCADA 2020 R2\Deploy-
ment\Client\Projects. You can use the browse button to change the folder path.
6. Click Next. The FINISH page appears.
This page informs you that the Configurator is ready to send a request to the
deployment server for registration.
If required, you can use the Previous button to make any changes to your settings
before you initiate the registration process.
7. Click Configure.
If registration is successful, the configured client information will be stored on the
computer and a connection will be established. If registration is not successful,
you will be notified via the Configuration Messages panel.
If there is any issues with deployment client activities, check that the NT Ser-
vice\CitectDeploymentClient and NT Service\Citect Runtime Manager virtual service
accounts have read and write permissions for the deployment client folder
(%PROGRAMDATA%\AVEVA Plant SCADA 2020 R2\Deployment\Client).
Right click the Client folder, go to Properties | Security, and check that the permissions
are assigned correctly.
Configure a Runtime Computer for Deployment

To prepare a computer for deployment, you need to confirm the following runtime
environment settings.
These settings can be adjusted using the Configurator's Computer Setup page under
Plant SCADA. You can launch Configurator at the completion of the installation pro-
cedure, or go to the Windows® Start menu and locate AVEVA | Configurator.

Server Authentication
If the computer will be used to host a Plant SCADA server process, you will need to spe-
cify a password for server authentication. Server processes with mismatching server
passwords will not communicate with each other.
To configure server authentication:

Setup. The Computer Setup page appears. Navigate to the Server Authentication
section.
2. Select the Configure Server Password check box.

3. Enter the required password and confirm it in the fields provided.
If the Password and Confirm Password fields already contain an entry, it means a
server password has already been configured on the local computer. If required,
you can enter a new password.
The password you use needs to match the password configured for the other
server processes included in your Plant SCADA system. This password can be set
on each computer using Configurator or the Setup Wizard.
4. To apply your settings, click the Configure button .
Note: If you change the server password while the runtime system is active, it will
not disrupt any established connections as the password is only retrieved when
authentication needs to occur. However, it is recommended that you apply the new
password as soon as possible. To do this, need to restart the runtime system.
Project Run Path

This setting instructs Runtime Manager to run a deployed project from a specified dir-
ectory.


Runtime Manager:

This setting instructs Runtime Manager to run as a service. This allow a project to be
deployed and run on a computer without having to change other settings.
cumstances:
Note: The current user on a deployment client needs to be a member of the Con-



62
Chapter 7: Install an Industrial Graphics Server
An AVEVA™ Industrial Graphics Server distributes HTML5 graphics to desktop and

mobile browsers. It authenticates clients details and provides access to the graphical and
functional content created using the Plant SCADA Industrial Graphics Editor.
Note: With this release of Plant SCADA, the Industrial Graphics Server has a num-
ber of functionality limitations. For example, an Industrial Graphics Server is read-
only and does not support alarms. For a full list of limitations, see Industrial Graph-
ics Server Functionality Limitations.
When you choose to install an Industrial Graphics Server, the following components are
selected by default:
l Plant SCADA Deployment Client.
The Deployment Client is required as Plant SCADA's Deployment functionality is used
to deliver projects to the Industrial Graphics Server.

Note:
• For runtime operation, it is recommended that you install an Industrial Graphics
Server on a dedicated computer especially if it will be required to handle a large
number of client requests.
• If you would like to review an Industrial Graphics application locally during devel-
opment, you also need to have an Industrial Graphics Server installed locally on the
development workstation.
Licensing for AVEVA Industrial Graphics is managed using the AVEVA Enterprise
Licensing system, which means you may also need to install the Enterprise Licensing
Server and/or the Enterprise Licensing Manager. For more information, see AVEVA
Enterprise Licensing.
If required, you can display the Industrial Graphics Web Client locally on the Industrial
Graphics Server using the following address in a browser:
l https://localhost/aig
Be aware, however, that the connected System Management Server may be configured
to use a non-default port (see Advanced Configuration for a System Management
Server). This changes the port the AIG server uses to listen, which means you need to
include the current HTTPS Port setting in the address as follows:
l https://localhost:<HTTPS Port value>/aig
Note: If the Plant SCADA compiler determines that your SCADA system tag names
are not globally unique across all clusters, any tag subscriptions that do not specify a
specific cluster will be rejected by the Industrial Graphics Server. If this occurs, you
can use the parameter [General]EnforceTagGlobalUniqueness to diagnose which
tags are not globally unique.
See also
Industrial Graphics Server Installation Requirements

Industrial Graphics Server Installation Procedure
Use Configurator to Set Up an Industrial Graphics Server
Confirm the Settings for an Industrial Graphics Server
Industrial Graphics Server Functionality Limitations

With the release of Plant SCADA 2020 R2, the Industrial Graphics Server has the fol-
lowing functionality limitations:

l An Industrial Graphics Server is read-only.

l Alarms are not supported.
l Local variables cannot be referenced.
l Alarm Properties as Tags are not exposed.
l Quality tag extensions are represented as a numeric value. Only OPC quality should
be used for an Industrial Graphics application.
l Extended quality modes "Control Inhibit" and "Tag Override" are not available.
l Plant SCADA trends are not supported, however, instant trends via an I/O tag or
AVEVA™ Historian are available.
l Web widgets are not supported.
l Industrial Graphics cannot be imported/exported between Plant SCADA and other
AVEVA products.
l Native Plant SCADA graphics cannot be converted or imported into Industrial
Graphics applications.
l Redundant Industrial Graphics Servers are not supported.
Note: It is recommended that you review the list of supported graphical elements
and limitations before you start creating an Industrial Graphics application. See the
topic Supported Graphical Elements and Known Limitations in the AVEVA™ Industrial
Graphics section of the Plant SCADA documentation.
Industrial Graphics Server Installation Requirements

host an Industrial Graphics Server.
Note: It is recommended to install the Industrial Graphics Server on a dedicated

computer.
The hardware requirements for an Industrial Graphics Server are as follows:
l CPU PassMark®: > 5200 pts
l RAM: 16 GB
Each client session requires ~200 Mb of memory, depending upon graphics com-
plexity.

l HDD: 500 Mb and space for the project’s Industrial Graphics.

l Client connections: 10
Additional clients can be supported by increasing the number of CPU’s, CPU
speed, and Memory.
Note: The recommended requirements are suitable for a system with ten clients,
browsing pages with approximately 40 dashboard/charting components with ~250
I/O tags on the page. Pages may take a longer time to display on the first visit. The
display time depends on graphics and script complexity.

l Windows® 8.1.
detected.
Note: Licensing for AVEVA Industrial Graphics is managed using the AVEVA Enter-
prise Licensing system. If you do not have access to an existing Enterprise License
Server, you will need to include the AVEVA Enterprise License Manager and
AVEVA Enterprise License Server to your Plant SCADA installation. For more
information, see AVEVA Enterprise Licensing.
Industrial Graphics Server Installation Procedure

This section describes the pages displayed by the Plant SCADA installer and the settings
required for an Industrial Graphics Server. Use the Back and Next buttons to navigate
through the included pages.


Select Server.
puter?
Select Plant SCADA Industrial Graphics Server.

If required, you can also select other server types. However, It is recom-
install
mended that you install an Industrial Graphics Server on a dedicated com-
puter.
By default, the following components are selected when you install an Indus-
trial Graphics Server.

Licensing for AVEVA Industrial Graphics is managed using the AVEVA Enter-
prise Licensing system. If you do not have access to an existing Enterprise
ponents
License Server, you will need to include the following components in your
installation.
l AVEVA Enterprise License Manager

l AVEVA Enterprise License Server.
If an Enterprise License Server is already set up, you will still need the License
Manager to access it.
See AVEVA™ Enterprise Licensing.
on the computer.
groups.

Windows™ Firewall
programs.

Destination Folder
dows user folder.
Base Folder
Use Configurator to Set Up an Industrial Graphics Server

You can use Configurator to enable authentication for an Industrial Graphics Server.
You can also adjust the refresh rates for any connecting clients. These settings are avail-
able on the following pages within the Industrial Graphics Server branch of the Con-
figurator directory.
Authentication Settings
System Management Server
You need to connect a computer that hosts an Industrial Graphics Server to a System
Management Server (SMS). This will allow authentication and authorization requests to
be handled by the SMS's Identity Manager.

When connected, the System Management Server field will display the name of the
computer hosting the SMS.
If "not connected" is displayed, you will need to configure the connection to an SMS (see
Connect a Computer to a System Management Server).
Secure Gateway
If required, you can use a secure gateway to avoid directly exposing the Industrial
Graphics Server to client computers that are not a part of your SCADA system network.
To use a secure gateway, enter the Fully Qualified Domain Name for the computer that
hosts the secure gateway server you want to use. The computer you use should be loc-
ated in a DMZ.
For more information, see the topic Securing Industrial Graphics Web Client Access in the
Plant SCADA documentation.
Client Settings
The Client Settings page allows you to specify the following settings for clients that con-
nect to the Industrial Graphics Server.
Graphic Refresh Rate
Allows you to specify (in milliseconds) how regularly graphics are refreshed in a con-
nected Industrial Graphics Client. You can specify a Refresh Rate between 250 and
60000 milliseconds.
Alarm Refresh Rate
This feature is not supported by Industrial Graphics applications in this version of Plant
SCADA.
Note: Plant SCADA's Deployment functionality is used to deliver projects to the

Industrial Graphics Server. For this reason, you will need to use Configurator's
Deployment Client page to connect the Industrial Graphics Server to your system's
Deployment Server. See Configure a Deployment Client for further instructions.
Confirm the Settings for an Industrial Graphics Server

To confirm that an Industrial Graphics Server is ready for operation, you should check
that you have completed the following steps.

Connect all of your Plant SCADA computers to a System Management Server.

To connect a computer to a System Management Server, use the System Management
Server page in Configurator. See Connect a Computer to a System Management Server.
Configure the authentication settings.

The required settings are available on the Authentication Settings page within the
Industrial Graphics Server branch of Configurator. See Use Configurator to Set Up an
Industrial Graphics Server.
Set up deployment.
If your Industrial Graphics Server is running on a remote computer, set it up for deploy-
ment.
l Set up a deployment server in your system (see Configure a Deployment Server).
l Configure a deployment client on the Industrial Graphics Server so that it can receive
project versions from the deployment server (see Configure a Deployment Client).
Enable encryption.
An Industrial Graphics Server will only connect to your Plant SCADA servers over an
encrypted connection. You need to confirm the following:
1. Plant SCADA is configured to run with encryption enabled. This is achieved via the
Encryption page in Configurator (see Enable Encryption).
Running in mixed mode is acceptable as long the remaining prerequisites are also
met.
2. Runtime Manager needs to be configured to run as a service.
This is required to enable encryption. The required settings are available on Con-
figurator's Computer Setup page (see Configure a Runtime Computer for Encryp-
tion).
3. In your project settings, confirm the DNS Name field is configured for each entry in
the Computers activity. This is also required to enable encryption.
4. Run the Computer Setup Wizard and confirm on the Network Model page that net-
working is enabled. This is required even if you are running the Industrial Graphics
Server and the Plant SCADA servers on a single computer.

Set up user authentication.

The Industrial Graphics Server only supports authentication with Windows® users.
Plant SCADA users are not supported.
Authentication occurs in two places:

1. To establish a connection to the Industrial Graphics Server, a user must be a member
of a Windows group that is mapped to the “Industrial Graphics Users" security role
(see Security Roles).
2. The user must also be a member of a Windows group that is mapped to a valid Role
within your Plant SCADA project. See the topic Roles within the Runtime System Secur-
ity section of the Plant SCADA documentation.

72
Chapter 8: Install an OPC UA Server
An OPC UA Server allows Plant SCADA's runtime system to function as a server to

OPC UA client applications.
Note: In this release of Plant SCADA, the OPC UA Server has the following func-
tionality limitations:
• The server is read-only.
• The server supports DA only.
• Quality tag extensions are represented as a numeric value. Only the OPC quality is
exposed.
• Alarm Properties as Tags are not exposed.
• Extended quality modes "Control Inhibit" and "Tag Override" are not available.
• Redundant OPC UA servers are not supported.
Following installation, you can configure the OPC UA server via Configurator's OPC
UA Server plugin under Plant SCADA. This has four configuration options:
l Port number – the port number the OPC UA server will listen on.
l URL – the URL to use to connect to the OPC UA server (read only).
l Enable Encryption – This option allows encrypted communications between the
server and client.
l Allow Anonymous access – Checking this option allows anonymous users to con-
nect to the OPC UA server.

See Use Configurator to Set Up an OPC UA Server.
The OPC UA Server does not support OPC UA’s discovery feature, so to connect manu-
ally enter the URL of the OPC UA server (as shown in Configurator).
If the OPC UA Server is installed on a separate computer, you will need to configure a
deployment server and client to deploy the relevant project information to the OPC UA
server. Once the project files have been deployed, the OPC UA server will start using
the new configuration automatically.
For information on how to use certificates to enable encrypted communications between

a Plant SCADA OPC UA Server and an OPC UA client, see Configure Client Certificates
for an OPC UA Server.
UNINTENDED EQUIPMENT OPERATION
If you update the Equipment Name or Equipment Item for a variable tag and restart the I/O
Server, any OPC UA clients that are subscribed to this tag via its old equipment name may
show outdated values. After restarting the I/O Server, perform the rebrowse operation in the
OPC UA client and resubscribe to those variables tags.
damage.
Note: The OPC UA Server’s browse functionality will always retrieve a tag name
with the cluster prefix. However, if you manually subscribe to a Plant SCADA tag
using its tag name, the OPC UA Server may reject the subscription request if a
cluster is not explicitly defined. This will occur if the compiler determines that your
SCADA system tags are not globally unique across all clusters. If this occurs, you
can use the parameter [General]EnforceTagGlobalUniqueness to diagnose which
tags are not globally unique.
See also
OPC UA Server Installation Requirements

OPC UA Server Installation Procedure
Use Configurator to Set Up an OPC UA Server
Confirm the Settings for an OPC UA Server


host an OPC UA Server.
Note: It is recommended to install the OPC UA Server on a dedicated computer.
The hardware requirements for a OPC UA Server are as follows:
l CPU PassMark®: > 4000 pts
l RAM: 16 GB
l Changes per second: < 25,000
l Supported tags: < 100,000
l Maximum OPC UA clients in the system: < 10
Adding each OPC UA client to the connected OPC UA server increases the CPU
and memory usage on both the OPC UA server and the IO Server.
Note:
• Several systems with a large number of tags arranged in a flat architecture, or a
hierarchy with many child nodes, will significantly impact the browse performance
of a connected OPC UA client.
• Plant SCADA now includes a connectivity service that manages tag subscriptions
for the OPC UA Server and Industrial Graphics Server. This places an additional
load on your I/O servers, particularly if a subscribed tag also specifies a property or
extension. If this impacts I/O performance, you should consider distributing your
I/O servers across a number of computers. You can also disable support for prop-
erties and extensions with the parameter [IOServer-
]DisableConnectivityPropertiesAndExtensions.



l Windows® 8.1.
detected.
Note: The OPC UA Server does not support browse filtering by OPC UA Clients.
OPC UA Server Installation Procedure

required for an OPC UA Server. Use the Back and Next buttons to navigate through the
included pages.

Select Server.
puter?
Select Plant SCADA OPC UA Server.

install
By default, the following components are selected when you install an OPC UA
Server.
ponents l Plant SCADA OPC UA Server

on the computer.
groups.
Windows™ Firewall
programs.

Destination Folder
dows user folder.
Base Folder
See also



To set up an OPC UA Server, open Configurator and adjust the following settings on
the OPC UA Sever page under Plant SCADA.
Address Configuration
Enter the Port Number that you want to use for the OPC UA Server. The value you
enter will be reflected in the URL.
The URL field shows the address that is used to connect to the OPC UA Server. You can-
not edit this field.
This defaults to:
opc.tcp://<computer name>:48031/plantscada.
Encryption
Select the Enable encrypted communications to set the security policy to
Basic256Sha256 and the security mode to SignAndEncrypt.
Authentication
Select Allow anonymous connections if you want to allow users to connect anonym-
ously to the OPC UA Server.
If this option is not selected, a user will only be able to access the server if they are part
of a Windows group that is associated with one of the Security Roles defined in your
project. Plant SCADA users are not supported.
Configure Client Certificates for an OPC UA Server

You can use certificates to enable encrypted communications between a Plant SCADA
OPC UA Server and an OPC UA client. To achieve this, both computers require access
the following certificates:
l The "<Computer Name> ASB OPC UA Server" certificate from the OPC UA Server
l The client certificate from the OPC UA client.

Note: The information provided in this topic is intended for a scenario where SMS
certificates are used on computers contained within your SCADA system network. If
you want to deliver information across multiple domains or externally via the inter-
net, we recommend you seek professional advice on setting up an external web
server.
To complete this setup, you will need to perform the following steps:
Copy the OPC UA Server certificate to the OPC UA client

You initially need to export a copy of two certificates created by the SMS.
1. Open Windows™ Certificate Manager.
To do this, you can type "manage computer certificates" into the Windows Search
bar.
2. In the tree view, go to the Personal branch then select Certificates.
3. Locate the certificate named “<computer name> ASB OPC UA Server”.
4. Right-click on the certificate and select All Tasks, then Export. This will open the Cer-
tificate Export Wizard.
Depending on the type of certificates that your client application uses, you will
need to export the certificate as a CER file (if the client uses the Windows™ Cer-
tificate Store) or a DER file (if the client uses file-based certificates). These two
formats are the same, only the file extension is different.
5. Use the following settings to export the certificate.
l On the Export Private Key page, select No, do not export the private key.

l On the Export File Format page, select DER encoded binary X 509 (.CER) or
Base-64 encoded X.509 (.CER) (depending on the requirements of your client
application).
l On the File To Export page, enter a path and file name (for example, "c:\tem-
p\<machine name> OPC UA Server.cer").
6. When you reach the Finish page, review the settings and click Finish to export a
copy of the certificate.
Once the certificate has been exported, you may need to rename the file extension on the
certificate from “.cer” to “.der” (if the client uses file-based certificates).
Import the OPC UA Server Certificate on the Client Computer

OPC UA client applications will generally use one of the following mechanisms to man-
age certificates:
l Using the Windows™ Certificate Store
l Storing certificates in a specified folder (that is predefined by the OPC UA client
application).
Import a certificate into the Windows Certificate Store
Importing a certificate into the Windows Certificate Store requires administrator rights.
1. Copy the "<machine name> OPC UA Server.cer" file to an appropriate location on the
client computer.
2. Right click on the CER file and select Install Certificate. This will open the Cer-
tificate Import Wizard.
3. Use the following settings.
l Under Store Location, select Local Machine.
l On the Certificate Store page, select Personal.
4. When you reach the last page, review the settings and click Finish.
Import a certificate into a specified location
Copy the "<machine name> OPC UA Server.der" file to the folder that is used by your
OPC UA client application.
The table below includes the location of the certificate folder for some common OPC UA
clients.

OPC UA
Manufacturer Certificate Folder
Client
Datafeed
OPC UA Cli- Softing C:\ProgramData\Softing\OpcClient\pki\trusted\certs
ent
Unified Auto- C:\Users\Admin\AppData\Roaming\unifiedautomation

UaExpert
mation \uaexpert\PKI\trusted\certs
UA Client C:\Pro-
Unified Auto-
Getting gramData\unifiedautomation\UaSdkNetBundleEval
mation
Started \pkiclient\trusted\certs
C:\User-
Matrikon Matrikon s\Admin\Appdata\Local\Matrikon\OPCUAExplorer
\pki\DefaultApplicationGroup\trusted\certs
C:\ProgramData\Kepware\KEPServerEX\V6\UA\Client
KEPServer Kepware
Driver\cert
C:\ProgramData\Software Toolbox\TOP Server-

Top Server Software Toolbox
\V6\UA\Client Driver\cert
For more information, please refer to the documentation provided with your OPC
UA client application.
Configure the OPC UA client certificate on the OPC UA Server

The next step in this process is trust the OPC UA client certificate on the computer the
OPC UA Server is running on.
The easiest way to do this is to attempt to connect an OPC UA client to the server. As
the server will not trust the client certificate yet, the connection is expected to be unsuc-
cessful. However, after this happens, any OPC UA client certificates that are not
installed on the OPC UA Server computer will be put into the “Rejected Certificate”
folder on the OPC UA Server. By default, this is in the following folder:
C:\ProgramData\AVEVA\PCS\OPC UA Rejected Client Certificates\certs”
Accessing this folder requires administrator rights.

Import certificates from the Rejected Certificates folder

1. Browse to the rejected certificate folder.
2. Right click on the certificate for the OPC UA client that you want to trust and select
Install Certificate. This will open the Certificate Import Wizard.
3. Use the following settings.
l Under Store Location, select Local Machine.
l On the Certificate Store page, select Trusted People.
4. When you reach the last page, review the settings and click Finish.
Configure the OPC UA Server ports

OPC UA communicates via a single TCP port. This is specified in the Endpoint Con-
nection setting for the OPC UA Server.
This defaults to port 48031.
You will need to confirm that this port is not blocked by any firewall software installed
on your computer.
See Also
Enable Encryption
Confirm the Settings for an OPC UA Server

To confirm that an OPC UA Server is ready for operation, you should check that you
have completed the following steps.
Connect all of your Plant SCADA computers to a System Management Server.

To connect a computer to a System Management Server, use the System Management
Server page in Configurator. See Connect a Computer to a System Management Server.
Confirm the Configurator settings.

The required settings are available on the OPC UA Server page within the Plant
SCADA branch of Configurator. See Use Configurator to Set Up an OPC UA Server.
Set up deployment.
If your OPC UA Server is running on a remote computer, set it up for deployment.

l Set up a deployment server in your system (see Configure a Deployment Server).

l Configure a deployment client on the OPC UA Server so that it can receive project
versions from the deployment server (see Configure a Deployment Client).
Enable encryption.
An OPC UA Server will only connect to your Plant SCADA servers over an encrypted
connection. You need to confirm the following:
1. Plant SCADA is configured to run with encryption enabled. This is achieved via the
Encryption page in Configurator (see Enable Encryption).
Running in mixed mode is acceptable as long the remaining prerequisites are also
met.
2. Runtime Manager needs to be configured to run as a service.
This is required to enable encryption. The required settings are available on Con-
figurator's Computer Setup page (see Configure a Runtime Computer for Encryp-
tion).
3. In your project settings, confirm the DNS Name field is configured for each entry in
the Computers activity. This is required to enable encryption.
4. Run the Computer Setup Wizard and confirm on the Network Model page that net-
working is enabled. This is required even if you are running the Industrial Graphics
Server and the Plant SCADA servers on a single computer.
Set up user authentication.

If Enable Anonymous Access is disabled for the OPC UA Server, a user name and pass-
word will be required to connect to the OPC UA server. Only authentication with Win-
dows® users is supported, Plant SCADA users are not supported.
The user must also be a member of a Windows group that is mapped to a valid Role
within your Plant SCADA project. See the topic Roles within the Runtime System Security
section of the Plant SCADA documentation.
OPC UA Client Driver

The OPC UA Client Driver page appears under Plant SCADA in Configurator, when
the Plant SCADA OPCUA driver is installed. This is one of the communication drivers
that is installed with Plant SCADA by default (see Install Communication Drivers).

Note: The Configurator's OPC UA Client Driver page is used to manage secure
device communications via an external OPC UA server. It is not related to the Plant
SCADA OPC UA Server, which delivers runtime data to third-party OPC UA cli-
ents.
Plant SCADA's OPCUA driver supports the use of user credentials when connecting to
a device. It allows you to establish a secure connection between the driver and an
external OPC UA server using X509 client and server certificates. The driver needs
access to the server certificate and the server needs access to the driver's client cer-
tificate.
To support this, the OPC UA Client Driver page under Plant SCADA in Configurator
allows you to:
l Create security settings.
l Select the client certificate from the Windows® certificate store.
l Import the client certificate from a file into the Windows certificate store.
l Issue a Plant SCADA OPC UA client certificate, store it in the Windows certificate
store and export it to a file.
l Import the server certificate from the file into the Windows certificate store.
l Test connection to the OPC UA server.
For further instructions, see the topic Security Configuration in the OPCUA driver doc-
umentation. You can access the driver documentation via the Driver Reference Help
toolbar button in Plant SCADA Studio's Topology|I/O Devices view.

Chapter 9: Install a Plant SCADA Web Server
A Plant SCADA Web Server provides the server-side functionality of the system that
supports a Plant SCADA Web Client, a tool that allows you to view a live project within
a Web browser.
The Web Server supports the following functionality:

l It authenticates requests from a Web Client
l It delivers the graphical and functional content in a Plant SCADA project to the Web
Client
l It directs the Web Client to the location of the runtime servers.
This functionality is enabled when a Plant SCADA project is stored on the Web Server
as a "web client deployment". The Web Server can contain multiple web client deploy-
ments.
The Web server uses Microsoft's IIS to verify requests from client computers. It shares
the content required to view a project on a Web Client, and provides access to the client
to the runtime servers.
See also
Web Server Installation Requirements

Web Server Installation Procedure
Web Server/Client Configuration

Web Server Installation Requirements

This section describes the hardware and software requirements for hardware of a com-
puter that will host a Plant SCADA Web Server.
The hardware requirements for a Web Server are as follows:
Cores 2
Memory 8 GB
HDD 20 GB
CPU PassMark® 2000
Screen Resolution 1920 x 1080
Network 100 Mb
The suggested disk space requirement for the HDD is only an estimate. It takes into
account the required software and space for storing your project versions. You need to
ensure there is enough space to hold the number of versions of the project being served.

Note: Use an NTFS file system on the target drive for the Web Server software, oth-
erwise you will not have access to the necessary Windows™ security settings (that
is, the Folder Properties dialog will not have a Security tab). If you are currently
using a FAT/FAT32 system, convert the drive to NTFS before installing the Web
Server software.



l Windows® 8.1.
detected.
Internet Explorer Version 11.0 (or later) is required.
Note: For a Web Server, a Windows Server operating system is recommended.
Microsoft Internet Information Services (IIS)

For correct operation of the Web Server, you need to install Microsoft Internet Inform-
ation Services (IIS). The following table identifies the version of IIS required for each of
the supported operating systems.
Operating System IIS version
Windows Server 2019 10.0
Windows Server 2016 10.0
Windows 10 10.0
IIS includes a number of components that you can enable via the Programs page in Win-
dows' Control Panel. The Windows Features dialog box is displayed by selecting Turn
Windows Features on or off.

The following table lists the IIS components that are required for a Plant SCADA Web
Server installation.
IIS6 Management Compatibility

IIS6 Metabase and IIS6 Configuration com-
patibility
Web Management Tools
IIS Management Console
IIS Management Services
ASP
Application Development Features
ISAPI Extensions
Default Document
Directory Browsing
HTTP Errors
Common HTTP Features
HTTP Redirection
Static Content
WebDAV Publishing

Health and Diagnostics HTTP Logging
Performance Features Static Content Compression
Basic Authentication
Security Request Filtering
Windows Authentication
Web Server Installation Procedure

This section describes the pages displayed by the Plant SCADA installer and the setting
required for a Web Server. Use the Back and Next buttons to navigate through the
included pages.

Select Server.
puter?
Select Plant SCADA Web Server for IIS.

install
By default, only the following component is selected when you install a Web
Server.
l Plant SCADA Web Server for IIS
ponents
ation.
Local Windows™ Groups Note: This page will only appear if you are installing Plant SCADA on a
on the computer.

groups.
Windows™ Firewall
programs.

Destination Folder
dows user folder.
Base Folder
Web Server/Client Configuration

To display a live Plant SCADA project in an Internet browser, you need to publish the
content of the project pages and the current data these pages present using standard,
web-based communication protocols.

For the web server to function you need to create an exception in the Windows firewall
or any other third party firewall to allow TCP traffic to flow on port 80. Specifically, if
the machine hosting the web server is running Microsoft® Windows® operating system,
enable the World Wide Web Services (HTTP) option in the Windows inbound firewall.
Once you have installed Plant SCADA Web Server for IIS, you will find the following
directories under the following folder:
\Inetpub\wwwroot\PlantSCADA
l The base directory primarily hosts the administrative pages that are displayed by a
Web Server.
l The cgi-bin and images directories contain the content necessary to display these
pages.
l The client folder contains the client components (.cab files) that are delivered to a
remote computer to run a web deployment. Any subdirectories include the com-
ponents associated with a particular release (in this case, v2020 R2).
l The deploy folder includes the files associated with any web deployments (Plant
SCADA projects) configured on the Web Server.
l The #displayclientfolder (located in the Deploy folder) plays a key role in the Web
Server security, as the permissions defined for this folder determine the access rights
for each user.
l The locales folder contains the files necessary to support different languages for the
client interface. See “Implementing Multiple Language Support” in the Web Client
topic of the Plant SCADA online help.
See Also
The IIS Virtual Directory

Setting Up Security
Web Client User Account Types
Configuring Security Using IIS
The IIS Virtual Directory

The installation process also adds a virtual directory called PlantSCADA to Windows
IIS (Internet Information Services). This virtual directory establishes the Web Server as a
valid destination for client applications. However, it also plays a key role in managing
which users have access to the site.
You can view evidence of this virtual directory in Windows' Internet Information Ser-
vices (IIS) Manager. The PlantSCADA virtual directory is shown under the list of
default websites.

You can view the properties for the directory by selecting Properties from the right-click
menu.
The Virtual Directory inherits settings from the computer's default website, with the fol-
lowing exceptions:
l Directory Browsing is enabled
l Script Source Access is disabled
l The default document is set to default.htm only
l Anonymous access is disabled
l Integrated Authentication is disabled
l Basic Authentication is enabled.
These settings, including integrated authentication, anonymous access and SSL Encryp-
tion, can be customized by the local administrator. However, proper configuration
needs experience with IIS and an understanding of the implications of adjusting its set-
tings.
Setting Up Security
If you want to use a Web Server/Client for communications in your Plant SCADA sys-
tem there are configuration requirements for both the server and the client. The major
configuration needed is that of security on the server.
Security on the Web Server is based on the implementation of user accounts. In the case
of an IIS-based Web server, security is tightly integrated with Windows user authen-
tication. For information on setting security on each of these, refer to Configuring Secur-
ity Using IIS.
Web Client User Account Types

Both systems support the same three user account types on a Web Client.
Client type Description
User is permitted to remotely view, add, update and delete

Administrator
deployments.
User can view project pages and make adjustments to writable

Control Client
values.
View-only Client User can only view the project pages.

The Web Server tests the access rights for each user when they log in and then displays
or hides the appropriate buttons on the home page accordingly.
Note: Although the Web Client security architecture controls access to your projects
on the Web Server, the Plant SCADA system security (privilege/area settings) still
manages the control system, maintaining a primary level of security.
Configuring Security Using IIS

Setting up security on an IIS-based Web Server primarily involves creating three Win-
dows user groups, each representing one of the Web Client user account types. Indi-
vidual users can then be assigned to the relevant user group, and automatically inherit
appropriate access rights based on the Windows security settings defined for the group.
Note: To secure your system, the creation of Windows user groups to manage your
Web Server security is mandatory.
There are three things to consider:

l Client Type Access Rights
l Preparing the 'PlantSCADA' Folder
l Setting Access Rights for Client Accounts.
Client Type Access Rights

The following table defines the access rights that each type of user has to the Web
Server's installed directories, as defined by the properties for each.
In the table, read means Read & Execute, List Folder Contents and Read user per-
missions are allowed; read and write means Full Control is allowed, and access denied
means Full Control is denied.
Web Client Control View-only Client

Installed directory
Administrators Client Users Users
PlantSCADA read read read
PlantSCADA\ cgi-bin read read read
PlantSCADA\ client read read read

Web Client Control View-only Client

Installed directory
Administrators Client Users Users
PlantSCADA\ deploy read and write read read
PlantSCADA\ deploy \
read read access denied
#displayclient
PlantSCADA\ images read read read
For example, an administrator client needs to be able to read all the installed folders to
fully access the components of the home page. Additionally, they need write access to
the Deploy subdirectory to create new deployments.
By comparison, a View-only Client needs to be denied access to the #displayclient folder

to deny the ability to write back to a Plant SCADA project.
Therefore, when setting up security on the Web Server, your user accounts need to align
appropriately with the permissions outlined in the table above.
To implement the Web Server’s security strategy successfully, follow the procedure
below to configure your system, and simplify managing client accounts. The ongoing
management of your Web Server security then involves adding and removing indi-
vidual accounts as needed.
The installation and initial configuration of the Web Server needs to be performed by a
Windows user with local administrator permissions; that is, they need to be able to add
and edit Windows User accounts, and modify files and folders. This capability is needed
to set up Web Client user accounts and manage security settings.
It is important to understand the distinction between the role of the Windows Local
Administrator, and the Web Client’s Administrator users:
l Windows Administrator - configures security on the Web Server and sets up client
accounts.
l Web Client Administrator - an end user capable of modifying and managing pro-
jects deployed on the Web Server.
Create the client account user groups:
1. From the Computer Management tool, locate Local Users and Groups in the dir-
ectory tree. This is where the users and groups for the local machine are configured
and managed.
2. Right-click the Groups folder and select New Group. This displays the New Group
dialog.

3. In the Group Name, type Web Client Administrator (or something appropriate), and
describe the group's purpose.
4. Click Create.
The group you have just created will appear in the list of groups presented in the Com-
puter Management console. Repeat the steps above to create Control Client and View-
only Client user groups.
Note: The Web Client Administrator group needs to be added to the “Configuration
Users” role in the Configurator. This is necessary so the Web Server can obtain the
project files. See Security Roles.
To test your security settings, add at least one user to each group. See Testing the Web
Server Security Settings.
Preparing the 'PlantSCADA' Folder

You need to set the security settings for the PlantSCADA folder and its sub-directories,
as this will determine the access granted to each type of client account.
To prepare the PlantSCADA folder:

1. Log on to the Web Server computer as a Windows Administrator.
2. Launch Windows Explorer and browse to the PlantSCADA folder. The PlantSCADA
folder is located in the installation directory. By default, this is Inet-
pub\wwwroot\PlantSCADA on the web server computer.
3. Right-click the PlantSCADA folder and select Properties.
4. From the Properties dialog, select the Security tab to display the users currently con-
figured for the folder.
There will probably be several groups already defined in this folder. The two you
need to pay attention to are the Administrators group and the Everyone group.
l The Administrators group represents all the Windows users recognized by the
Web Server computer with Local Administrator rights. This group has Full Con-
trol permissions on the folder, facilitating the ability to adjust the Web Server
security settings. If this is the case, there should be no reason to modify this
group.
l The Everyone group represents all other users recognized by the local machine.
Give this group the following access to the PlantSCADA folder; allow Read &
Execute, List Folders Contents, and Read permissions. This provides local users
on the Web Server machine with the equivalent of Control Client permissions.

5. Add the three client account user groups you created in the previous procedure to
the PlantSCADA folder.
6. Confirm the security settings for the three newly created groups. Each has to have
the same access as the Everyone group: Read & Execute, List Folders Contents, and
Read permissions
7. All the subdirectories have to inherit the permissions set for the PlantSCADA folder.
To do this click the Advanced button on the Security tab of the properties dialog,
and select Replace permission entries on all child objects, then click OK.
This provides consistent security settings across all the installed directories. A Security
dialog might appear to alert you that this will “remove or reset explicitly defined per-
missions on child objects”. Click Yes to continue.
Setting Access Rights for Client Accounts

The three client account types supported by the Web Client are defined by the security
settings for each within the installed directories on the Web Server machine.
The differences, outlined in the table in Client Type Access Rights, need specific secur-
ity settings for the Administrator Client and View-only Client types. An Administrator
needs write access to the Deploy subdirectory, and the View-only Client needs to be
denied access to the #displayclient subdirectory.
To configure security setting for the Administrator Client group:

The Administrator Client needs full access to the Deploy subdirectory to enable the cre-
ation and modification of deployments.
1. Locate the Deploy subdirectory in the PlantSCADA folder. By default, this is
InetPub\wwwroot\PlantSCADA\Deploy.
2. Right-click the folder and select Properties to display the Deploy folder properties.
3. Click the Security tab and locate the Web Client Administrator group you created in
the list of users and groups.
4. Edit the permissions set for the group to Allow Full Control.
To configure the security settings for the View-only Client group:
The View-only Client needs to be denied access to the #displayclient subdirectory to
deny write changes being made to a deployed Plant SCADA project.
1. Locate the #displayclient subdirectory in the PlantSCADA folder. By default, this is
Inetpub\wwwroot\PlantSCADA\Deploy\#displayclient.
2. Right-click the folder and select Properties to display the folder properties.
3. Click the Security tab and locate the View-only Client group you created in the list
of users and groups.

4. Edit the permissions set for the group, and change to Deny Full Control
5. A Security dialog appears “Deny entries take priority over all Allow entries”. Click
Yes to continue.
Note: The Control Client group needs no additional configuration, as it uses the set-
tings outlined in Preparing the PlantSCADA folder.
Set security permissions accurately in order for the web server to operate correctly. If
you experience any problem with communicating from the web client check that the
security settings are correct for your installation.
Deleting a User Account

You can deny a user access to the Web Server by removing them from the groups that
have permissions set for the PlantSCADA folder.
However, if security is a concern, deny the user access to the PlantSCADA folder before
you delete the user. This avoids a situation where the operating system doesn't imme-
diately acknowledge that a user account has been deleted, creating a short period where
a deleted user can still log on.
To delete a user account:

1. Add the user as an individual to the PlantSCADA folder.
2. Set their access rights to Deny Full Control.
3. Remove the user from the groups that have permissions set for the PlantSCADA
folder.
With all access denied, they cannot do anything even if they gain access.
Testing the Web Server Security Settings

To test the security settings for your Web Server client groups:
1. Launch Internet Explorer on the Web Server machine.
2. Call up the Web Client home page by typing in the following address:
http://localhost/Plant SCADA
3. Log in to the home page using a user name and password that's been added to the
Administrator Client group.
If successful, the System Messages dialog will read “LOGINADMIN Admin (User-
Name) logged in”.

If the message starts with LOGINDC (for Control Client) or LOGINMC (for View-
only Client), there is a problem with your configuration. Confirm that you are
using the correct user name for the group you are testing. If the problem still
occurs, revisit the process in Setting up security using IIS to check that an error
hasn't been made.
4. Repeat this process with a Control Client and View-only Client user.

Chapter 10: Install a Runtime-only Client
You can use the Plant SCADA installer to set up a runtime-only client. This will create
dedicated runtime display client that does not include the components required to con-
figure a project.
See also
Runtime-only Client Requirements

Runtime-only Client Installation Procedure
Use Configurator to Set Up a Runtime-only Client
Runtime Only Client Installation Requirements

This section describes the hardware and software requirements for a Runtime Only Cli-
ent.
The hardware requirements for a Runtime Only Client are as follows.
CPU
2000
PassMark®
Cores 2
RAM 4 GB
HDD 10 GB
DirectX 11 or later with WDDM 1.0 Driver.

Graphics
128 MB of dedicated VRAM.
Screen
1920 x 1080
Resolution
Network 100 Mb

The complexity of your pages such as the number of graphical animations and Cicode
running in the background will impact your client CPU choice. It is recommended to
use a higher performing PC with high clock speed when building complex user inter-
faces.
As a guide, the following will require high clock speed to maintain a client CPU load of
less than 25% on a single core:
l HD user interface with 50 complex Genies
l UHD4K user interface with 100 complex Genies.
The suggested screen resolution supports lower and higher resolutions including 4K
UHD (3840 x 2160). However, 4K UHD will require a high clock speed CPU. A multi-
monitor client may also require a higher clock speed CPU and more memory.

l Windows® 8.1.
detected.
Runtime Only Client Installation Procedure

This section describes the pages displayed by the Plant SCADA installer and the setting
required for a Runtime Only Client. Use the Back and Next buttons to navigate through
the included pages.


Select Runtime Only Client.
puter?
By default, only the following component is selected when you install a Web
Server.

Customize the default com- l Plant SCADA Deployment Client
ponents l Software Update Tool
l Sentinel Driver (see Licensing Tools).
ation.
on the computer.
groups.
Windows™ Firewall
programs.

Destination Folder l The Plant SCADA User and Data folders.

dows user folder.
Base Folder
Use Configurator to Set Up a Runtime-only Client

would like to launch Configurator. For a runtime-only client, you can use the Con-
figurator's Computer Setup page under Plant SCADA to adjust the following runtime
environment settings for a computer.
Project Run Path

This setting allows you to specify whether or not the computer will receive project ver-
sions from a Deployment Server.

Runtime Manager:

If you intend to use Plant SCADA's Deployment feature to distribute project versions to
this client, you will need to use Configurator to connect the computer to a Deployment
Server. See Configure a Deployment Client.

The Runtime Manager can be configured to run as a Windows® service. This allow a
project to be deployed and run on a computer without having to change other settings.
cumstances:
Note: The current user on a deployment client needs to be a member of theCon-




Chapter 11: AVEVA™ Enterprise Licensing
The AVEVA Enterprise Licensing system is a common platform that allows you to man-
age AVEVA Enterprise Software product licenses. This licensing system is composed: of
a browser-based License Manager and a License Server that together allow you to share
and deliver licenses for your installed products.
The system was introduced to allow centralized license management, remove the need
for dongles, and increase license security by use of activated licenses. It supports flexible
topologies for any size system.
For Plant SCADA, the AVEVA Enterprise Licensing system is used to manage licenses
for clients connecting to the AVEVA Industrial Graphics Server.
The following describes the components of the AVEVA Enterprise Licensing system.
License Manager
The License Manager allows you to access and maintain licenses for certain AVEVA
Enterprise Software products in your different environments using its scalable, flexible
design features:
l Browser-based for scalability and ease of use; can be remotely accessed by any of the
supported web browsers.
l Light-weight, standalone software you can install on the same node as the License
Server computer, or on any other node based on your deployment needs.
l Manage one or multiple License Servers to best organize and manage the licenses in
your unique environment.
l Access details about your licenses, such as usage information, from the License Man-
ager interface.
License Server
License Server provides the functionality to acquire, store, maintain, and serve licenses
to your installed AVEVA Enterprise software.
l Licenses are hosted and maintained on the License Server.
l Securely serve any type of software applications being licensed, including Windows
browsers, tablets, and mobile devices.
l Provide current license usage information.

Activation Server
Activation server is a cloud-based Internet-accessible server to which the License Man-
ager connects for license activation. The License Manager connects to the AVEVA Activ-
ation Server in the Cloud only temporarily during the activation process.
Installed Products
Once the AVEVA Enterprise Software product is installed it relies on the licensing sys-
tem to enable its functionality. During product installation you decide from which
License Server you want the product to get its license.
l If a License Server is installed on the same computer as the product, it will use that
one as the default.
l If the product is installed on a different computer than the License Server, you can
point the product to License Server computer.
All the products installed on the same computer would point to the same License
Server.
Licensing Workflow
The following example of the licensing workflow assumes that both License Manager
and License Server are installed on the same computer, and that the computer can con-
nect to the Internet.
1. Purchase one or more AVEVA Enterprise Software products:
Along with your installation media or downloads, you will receive one or more
entitlement files containing license details.
2. Start License Manager:
It opens in a browser window and accesses the installed License Manager com-
ponents.
3. Select the License Server:
Use the License Manager to select an available server to host the licenses you
want to activate. You can also add a new license server.
4. Import the entitlement file:
Once you import the entitlement file, the License Manager displays the available
licenses.
The entitlement file contains information for specific product licenses that are
imported into the License Manager to activate purchased licenses. It is sent to you
in an email upon purchase of your product licenses. It is in a zipped .xml file
format.

5. Activate licenses:
License Manager connects to the AVEVA Enterprise Activation Server over the
Internet to activate the selected licenses on the License Server. The Activation
Server activates licenses on the License Server.
6. Manage your licenses:
Licenses are now available for their respective product to use. You can now:
l activate new licenses
l deactivate current licenses
l reserve and unreserve licenses.
7. Install and Configure the purchased products:

Install your purchased AVEVA Enterprise Software products following the indi-
vidual product installation instructions. The installed products, when running,
will acquire their licenses from the License Server and will release them when no
longer needed.
If an Industrial Graphics Server is running when a license becomes available, you will
need to perform a restart to allow it to acquire the license from the License Server.
To restart the Industrial Graphics Server:

1. Open the Windows™ Component Services console.
2. In the Services (Local) list, locate AVEVA Industrial Graphics Service.
3. Use the right-click menu to restart the service.
Note: For more detailed information see the Enterprise License Manager User Guide,
available from the AVEVA branch of the Windows Start menu.
See Also
Licensing for Industrial Graphics Applications in a Web Browser
Enterprise License Server Installation Requirements

This section describes the hardware and software requirements for a computer that will
host an AVEVA™ Enterprise License Server.
Before you install this component, it is recommended that you install the latest updates
The hardware requirements for a Enterprise License Server are as follows:

Cores 4
Memory 4 GB

Client operating system (x86 and x64):
l Windows® 8.1 Professional
Server operating system (x64 only):

detected.
Enterprise License Server Installation Procedure

required for an AVEVA™ Enterprise License Server. Use the Back and Next buttons to
navigate through the included pages.

Select Server.
puter?
Select AVEVA Enterprise License Server.

install
By default, the following components are selected when you install an Enter-
Customize the default com- prise License Server.
ponents
l AVEVA Enterprise License Manager
l AVEVA Enterprise License Server.

If you are going to connect the computer to a License Server on a remote com-
puter, you only need to install the License Manager.
security.
If you want your current Windows user account to be included in these

groups, select Add the current Windows user to these groups.
Windows™ Firewall
programs.

Destination Folder
dows user folder.
Base Folder
Use Configurator to Set Up an Enterprise License Server


To set up an Enterprise License Server, open Configurator and go to the AVEVA Enter-
prise License Server page located under AVEVA Enterprise Licensing Platform.
Note: Before running the Configurator, make sure that ports 55555 and 59200 are
open.
Primary Server Name

By default, the installation process identifies the local computer as the primary server
and enters the computer name as the Primary Server Name.
You can point to a different License Server on your network, if necessary.
Server Port
The default Server Port is 55555. You can specify a different port, if necessary.
Agent Port
The default Server Port is 59200. You can specify a different port, if necessary.
You can test your connection to the License Server by selecting Test Connection. Press
Configure to save all your changes.

Chapter 12: Install Communication Drivers
If you chose to install Plant SCADA Drivers, the communication drivers installation will
commence towards the end of the main product installation.
The available drivers will be extracted to a temporary folder, then the Select Drivers dia-
log will be displayed.
The Select Drivers dialog lists the drivers that are available for installation. There are
certain drivers that are necessary for Plant SCADA to function correctly. These are not
displayed in the list and will be installed automatically.
Note: With the release of Plant SCADA 2020 R2, a classification system for the driver
portfolio was introduced to indicate the level of ongoing maintenance that customers
can reasonably expect for each driver. In line with these classifications, the number
of drivers included by default with the Plant SCADA installation media has been
reduced to a set of ‘core’ drivers that have undergone recent updates. All other
drivers continue to be available for download from the Communication Drivers

page of the AVEVA Knowledge and Support Center located at https://soft-

waresupport.aveva.com/.
Select the drivers that you wish to install. Commonly used drivers are selected by
default. You can select every driver by clicking the Select All button. Then click the
Next button to display a confirmation list of the drivers that will be installed.
You will be advised if any drivers that are time limited or not supported by your oper-
ating system. If you see that any of the drivers in the list are subject to limitations, click
the Back button and deselect them from the previous dialog.
INCOMPATIBLE DRIVERS
Do not ignore alerts during driver installation. If you choose to ignore such alerts, the driver will
be installed but may operate incorrectly.
damage.

When you are satisfied that the correct drivers will be installed, click the Next button to
install the selected drivers.
If you want to install additional drivers at a later time, you can run the communications
driver installer from the user interface or the command line. For details see Install Addi-
tional Communication Drivers.
Install Additional Communication Drivers

You can install additional communications drivers at any time after you have installed
Plant SCADA.
To install additional drivers:

1. In the Plant SCADA installation media, locate the "setup.exe" file in the following loc-
ation:
AVEVA Plant SCADA\Plant SCADA\Drivers
Note: If you are using the Microsoft® Windows operating system and have User
Account Control (UAC) switched on, the UAC dialog will display when you
open the file. You will be required to supply administrator credentials if you are
not an administrator on the computer.
2. Run the "setup.exe" file.

3. Click Next and then accept the license agreement.
4. A Choose Destination dialog will display. Use this to specify the default folder in
which to install the drivers. You can accept the default location or change to another
folder using the Browse button.
The installation folder has to contain the citect32.exe file otherwise an alert mes-
sage will be generated. In other words, the location needs to have an existing
Plant SCADA installation in the specified location.
5. Click the Next button to display the Select Drivers dialog. Then continue with the
installation as described in Install Communication Drivers.

114
Chapter 13: Install OPC Factory Server
The Plant SCADA installer allows you to install a copy of Schneider Electric's OPC Fact-
ory Server v3.62.
Based on the OPC protocol, OPC Factory Server enables Windows-based OPC client
applications to communicate with the following Schneider Electric PLCs:
l TSX Compact
l Micro
l TSX Momentum
l TSX/PCX Premium
l Quantum
l M340
l TSX Series 7
l TSX S1000.
Note: You must install Plant SCADA before you install the OPC Factory Server to
allow the OFS Server to be licensed using the Plant SCADA license key. This will
allow the correct Part and Serial number combination to be registered during the
OFS Server installation.
To install OPC Factory Server, launch the Plant SCADA installer and select Schneider
Electric OPC Factory Server.

Follow the on screen instructions to complete installation. Details on the installation

options for OPC Factory Server can be found in the OPC Factory Server User Manual,
located in the following folder in Plant SCADA's installation media:
\Extras\OFS vx.xx\Documentation

Chapter 14: Security Roles
To restrict access to Plant SCADA's sensitive components, only users with relevant per-
missions can perform certain security-related operations. To help manage these per-
missions, Plant SCADA uses a set of security roles. Each role provides a different level
of access to features, applications and project resources.
The following security roles are used on all Plant SCADA computers.
Security Role Description
Members of this role can run con-

figuration tools (such as Plant SCADA
Studio or Computer Setup Wizard)
and start the runtime display client
and server processes.
Configuration Users
Note: It is recommended that mem-
bers of this role only start runtime for
development purposes and not in a
production system environment.
Members of this role can run the

runtime display client and make local
CtAPI connections.
Runtime Users Note: Any Windows® user account

that has to start runtime needs to
be assigned to this role. See Add
the Required Users to the Runtime
Users Role.
Members of this role can run Plant

SCADA as a server process.
If you are not running Plant SCADA as

a service, add a member to this role
who needs to run a Plant SCADA
server (including a display client with
Server Users
[CtAPI]Remote enabled).
Note: If you are running Plant

SCADA as a service, it is not recom-
mended to add members to this
role.

If you have installed deployment server components on a computer, additional three

Security Roles will exist.
Members of this role can add or

remove client computers to/from
Deployment Administrators
deployment server. They can also per-
form upload and deploy operations.
Members of this role can deploy a

Deployment Users new project to a connected deploy-
ment client computer.
Members of this role can upload a

Deployment Uploaders new project version to the deploy-
ment server.
If you have installed Industrial Graphics Server on a computer, two additional Security
Roles will exist.
Members of this role can connect and

authenticate with the Industrial
Graphics Server.
Note: Unlike the other security

roles, do not add individual users.
Instead, only add domain groups to
Industrial Graphics Users the role to ensure that the author-
ization proceeds in a distributed sys-
tem.
For more information, see the topic

Configure User Access for an Indus-
trial Graphics Web Client in the Plant
This security role is not in use for

Industrial Graphics R/W Users
AVEVA Plant SCADA 2020 R2.
During installation, by default the local Windows user groups are associated with these
security roles as members (see Windows User Groups and Security Roles).

You can view the current associated members with the security roles via the Security
Roles page under Plant SCADA in Configurator. When you select a role, the existing
members associated with the role will be listed in the Members of... section.
It is recommend to replace the local Windows groups associated with these security
roles, with your own domain groups. If required, you can also assign additional user
accounts or groups to a role (see Modify the Members of a Security Role).
See Also
Directory Security

Modifying the Members of a Security Role

The Security Roles page under Plant SCADA in Configurator lists the available Plant
SCADA Roles, depending on the components you have selected during Plant SCADA
installation.
By default, the Windows® User Groups created by the Plant SCADA installer are asso-
ciated with these roles (see Windows User Groups and Security Roles). If required, you
can change the members that are associated with each security role. You can also delete
the default groups and replace them with your own.
Adding Members to a Security Role

To add local or domain groups to a security role:
1. Open the Configurator.
2. From left side panel, select Plant SCADA | Security Roles.
3. Select a security role displayed in the table. The existing members associated with the
role will be listed in the Members of... section.

4. To add more members to the security role, click Add. The Select Users or Groups
dialog box opens.
5. Under Enter the object names to select type the name of local or domain group, that
you want to assign to the role, and then click OK.

You can use the Check Names button to verify if the entered names are valid.
Note: You can add a maximum of 10 members to a security role. To manage the
memberships through normal Windows group management practices, it is recom-
mended that you add a minimal number of members per security role. It is ideal to
have one domain group per role.
Removing Members from a Security Role

To remove local or domain groups from a security role:
1. From left side panel of the Configurator, select Plant SCADA | Security Roles.
2. Select a security role from the table. The existing members associated with that role
will be listed in the Members of... section.
3. Select the member that you want to remove from the role.
4. Click Remove.
The Plant SCADA Runtime Manager service account is not removable from the
Server Users role.
Note: When removing members from the security roles, make sure that each role has
at least one member before you apply the changes.
Applying the Changes in Security Roles

After modifying the members of a security role, stop all the other Plant SCADA pro-
cesses and services, then click Configure to apply the changes. This will update the
security on Plant SCADA's folders and registry keys to match the new members of each
role.
Resetting the Members of Security Roles

To reset all security roles to their default members, click Reset All from the Security
Roles page. Stop all the other Plant SCADA processes and services, then click Configure
to apply the changes. Any default user groups that no longer exist will be recreated.
Discarding the Changes in Security Roles

If you have not applied the changes after any modification and want to undo them, click
Close and Exit Configurator.

See Also
Security Roles
Add the Required Users to the Runtime Users Role
Add the Required Users to the Runtime Users Role

The Runtime Users role is used to control access to Plant SCADA's runtime. Any Win-
dows® user account that has to start runtime needs to be directly added to this role, or
one of the User Groups associated with the role (see Security Roles).
If you have configured Plant SCADA to use any of the following features, you will need
to ensure that the relevant user is added to the Runtime Users role so that runtime can
be launched.
l If Runtime Manager is running as a service and you are not using the default user
account “NT SERVICE\Citect Runtime Manager”.
l If you are using a local CTAPI application that is not being run by the currently
logged in user (for example, the CTAPI application is running as a Windows service
under a different user account).
To determine which users you need add into this role, check the following:
l If Runtime Manager is running as a service, check the properties of the "Plant
SCADA Runtime Manager" service. If this is not running under the "NT
SERVICE\Citect Runtime Manager" account, then the user this service is running
under will need to be added to the Runtime Users role.
l If you are running a CTAPI application as a different user to the currently logged in
user, then the user account this applications runs under needs to be added to the
Runtime Users role.
See Also
Modify the Members of a Security Role
Directory Security
The Plant SCADA directories under "%PROGRAMDATA%\AVEVA Plant SCADA 2020
R2" are protected by Windows® access control lists (ACLs) to avoid unauthorized
access. During installation, access permissions for these directories will be granted (with
certain operational restrictions) to the members of the following Plant SCADA Security
Roles.

Directory Security Role Permission
Configuration Users, Runtime Users and

Config Read/Write Access
Server Users

Data Read/Write Access
Server Users

Logs Read/Write Access
Server Users

User Read/Write Access
Server Users
Starter Configuration Users Read Access

Deployment\Client Read/Write Access
Server Users
Note: In addition to the above table, the required permissions will be granted to the
service accounts for Plant SCADA services. Full Control permission will also be gran-
ted to the local Administrators group and System account to access these directories.
See Also
Security Roles

Chapter 15: New Features in Plant SCADA 2020 R2
Plant SCADA 2020 R2 includes the following new features or changes in functionality.
Once you have installed this version, refer to the documentation for more information
on how to reconfigure your projects to take advantage of the new features and
improved functionality.
Rebranding to Plant SCADA

The 2020 R2 release signifies the transition away from the Citect SCADA brand to
AVEVA™ Plant SCADA. The new name reflects the positioning of Plant SCADA within
the broader family of AVEVA products.
The rebranding incorporates several changes, including updates to splash screens and
graphics, icons, installer and installation directories, start menu paths, and more.
To determine the new directory locations, see View a Project's Folders in the Plant
SCADA user documentation.
Integration of AVEVA™ Industrial Graphics

AVEVA Industrial Graphics is the common graphics technology used across AVEVA's
SCADA, HMI and cloud solutions. You can create HTML5 screens and dashboards in
Plant SCADA and access them in desktop browsers and mobile devices.
Industrial Graphics are accessible in Plant SCADA Studio for integrated browsing and
filtering. From here, they can be launched within the new Industrial Graphics Editor for
all editing activities. AVEVA Industrial Graphics are accessed by clients via an Indus-
trial Graphics Server. It authenticates clients details and provides access to the graphical
and functional content.
"IndustrialGraphics_Include" is a system project designed for the Industrial Graphics

platform. This project is included in the "ExampleSA" project for demonstration of Indus-
trial Graphics. It contains a set of user interface controls and ISA symbols for creating
Industrial Graphics contents.
For more information, see AVEVA Industrial Graphics in the Plant SCADA user doc-
umentation.
Integrated OPC UA Server Functionality

You can now make your I/O data accessible to third-party systems with the new OPC
UA Server. This enables IT and OT convergence through secure connectivity.
For more information, see Install an OPCUA Server.

IPv6 Support
Plant SCADA 2020 R2 supports Internet Protocol version 6 (IPv6) and will accept 128 bit
IP addresses (including any acceptable abbreviations). For example:
l 2001:0db8:0000:0000:0000:8a2e:0123:1234
or
l 2001:db8::8a2e:123:1234 (abbreviated).
You can now operate a Plant SCADA system on an IPv6 network. IPv6 protocol can be
used for communication between servers and clients, and for any drivers that support
IPv6.
IPv6 support can be enabled via the Network Model page of the Setup Wizard.
Graphics Usage
Supporting both Plant SCADA native graphics and AVEVA Industrial Graphics, the
new Graphics Usage feature allows you to identify the graphical references that exist in
your system. For example, you can confirm where a Genie or symbol is used, or you can
determine if a project contains any unused graphics.
To take advantage of this feature, see the new Used By section of the Libraries view in
the Visualization activity (see Browse Libraries in Plant SCADA Studio and/or Browse
Industrial Graphics Libraries in Plant SCADA Studio).
Graphics Editing Enhancements

Graphics Builder now persists its window positions and the size of the "Go To Object"
dialog.
Driver Classifications
As part of an ongoing effort to set clear expectations and provide better support to our
customers, we have introduced a classification system for our driver portfolio to com-
municate the level of ongoing maintenance and version updates that customers can reas-
onably expect. These classifications and status of each driver can be found online at
https://gcsresource.aveva.com/PlantSCADA/Drivers/.
In line with these classifications, we have limited the number of drivers included by
default on the Plant SCADA installation media to a reduced set of ‘core’ drivers that
have undergone recent updates, however all other drivers continue to be available for
download from the Communication Drivers page at the AVEVA Knowledge and Sup-
port Center located at https://softwaresupport.aveva.com/.
For more information, see Install Communication Drivers.

Note:
The following features are no longer supported with this release of Plant SCADA.
• EcoStruxure Web Services (EWS) are no longer supported. You will not be able to
create or use an EWS server or client.
• The Vijeo Web Gate Control has been deprecated and is no longer part of the Plant
SCADA installation. The control will still work with Plant SCADA. However, to con-
tinue to use it you will need to manually reinstall it from another source as it will
have been uninstalled when the previous version of Citect SCADA was uninstalled.
• The Pelco ActiveX Control has been deprecated and is no longer part of the Plant
SCADA installation. If you have upgraded your computer from a previous version
with this control installed, it will continue to function. However, it is recommended
that you communicate with Pelco cameras using a different method.

128
Chapter 16: Upgrading to Plant SCADA 2020 R2
This chapter describes the process required to migrate from and existing installation of
Citect SCADA to Plant SCADA 2020 R2.
Note: Cross version compatibility is not available for alarms version v7.20 onwards.
When updating the computer with a new product version, backup the existing projects
and uninstall the existing installation. Install the new version and restore projects into
the new version.
Note: The new version you are installing may have updates available. The update
may have a fix for the automatic upgrade and may be required to be installed before
restoring the project. Please refer to the Product Hub page of the AVEVA Know-
ledge & Support Center website at https://softwaresupport.aveva.com.
Before you review this information, check that you have the necessary hardware and
software required to run this version. See the requirements specified for the type of
Citect SCADA computer you are upgrading in the relevant section of the Install Guide.
When upgrading to Plant SCADA 2020 R2 you need to consider the following:
l Upgrade Method: Depending on whether your system can afford downtime and loss
of data, choose an upgrade method: Offline or Online.
l Upgrade Path: Upgrade path refers to the number of versions to which you need to
upgrade to get from your current version of Citect SCADA to Plant SCADA 2020 R2.
For upgrading to intermediate versions specified in the upgrade path (for example,
v2015 or v2016), refer to the documentation for those versions.
Note: For instructions related to previous versions of Citect SCADA, such as backing

up a or restoring a project, consult the documentation for that version.
Upgrade Method
Before you plan to upgrade to Plant SCADA 2020 R2, consider whether your
SCADA system can afford downtime and whether your historical information needs to
be available. The upgrade method you choose will depend upon this.

Upgrade methods are of the following types:

l Offline: This method requires your system to be shut down for the duration of the
upgrade. If your system can afford downtime and depending on whether historical
information needs to be available, this method is suitable for you. This is the basic
upgrade process that will be required even if you use the online upgrade method.
l Online: If you need your system to be available, this method is suitable for you. To
be able to conduct an online upgrade, you need to have at least one pair of redund-
ant servers (for details and other pre-requisites, see Pre-requisites for an Online
Upgrade).
Upgrade Path
Upgrade path refers to the versions you need to install to get from your current version
of Citect SCADA to Plant SCADA 2020 R2.
Some versions of Citect SCADA included substantial changes to the product, which
require incremental upgrades involving intermediate steps between versions. The num-
ber of necessary steps will depend on whether you do an offline or online upgrade.
l For an offline upgrade to Plant SCADA 2020 R2, you can upgrade a project directly
from any version of Citect SCADA from 5.21 onwards.
l For an online upgrade to version 2020 R2, you can go directly from the following ver-
sions:
l Citect SCADA v2018 Update 29 (March 2021) or later.
l Citect SCADA v2018 R2 Update 5 (April 2020) or later.
For both offline and online scenarios you need to:

1. Apply the latest patch to the version you are upgrading from.
2. Perform the upgrade to Plant SCADA 2020 R2.
3. Apply the latest updates to Plant SCADA 2020 R2.
Note: Any patches released from July to October 2020 should not be used in an
online upgrade scenario.
Offline Upgrade
Note: This is the basic upgrade process. You will need to perform these steps even if
you choose to use the Online Upgrade method.

An Offline Upgrade to Plant SCADA 2020 R2 comprises the following steps:
1. Backup your current project and relevant files.

Perform a backup of your project and other relevant files. For the upgrade to complete
smoothly, you need to back up a number of files/folders from your system other than
your project files. The number of files you need to back up depends on your system con-
figuration. For more information about performing a backup, refer to the Backing Up a
Project section in the online help of your current version.
The following files need to be backed up:
File Description
This is the main file to back up. For information about backing up a
Project backup (.ctz project, refer to your current version's online help. You need to have
file) the Save sub-directories and Save configuration files options
selected in the Backup dialog.
Citect.ini This file is located in the config folder.
If you have deployment configured, back up the following files:
• SE.Asb.Deployment.Server.WindowsService.exe.config
Deployment con-
figuration files
• SE.Asb.Deployment.Node.WindowsService.exe.config.
These are located in the path [CtEdit]Config.
Data directory This file is found on the path [CtEdit]Data.
This is located in the Deployment directory. For example:

Deployment data-
base %PROGRAMDATA%\AVEVA Plant SCADA 2020 R2\Deploy-
ment.
The Alarm Database is located in the Data directory:
[Data]\<Project
Alarm Database (for
Name>\<ClusterName.AlarmServerName>.
v2015 or later)
For each alarm server you have in your system, a corresponding
Alarm Database will exist. You need to backup all alarm databases.
Trend files: *.HST The path and names of these files are defined on the trend tag itself

File Description
and created in the Data directory defined in [CtEdit]Data. The files

will be named after the trend name and number of files. For
and *.00X
example, if the trend name is CPU, file names will be CPU.HST,
CPU.001, CPU.002 and so on.
These files contain the code that is executed on your reports. They
Report Files
are located in the [CtEdit]User\<Project Name> folder.
Plant SCADA includes some ActiveX controls, which will be available

with the 2020 R2 installation. However, you need to take a backup
of your custom ActiveX controls.
Check your ActiveX.dbf file in the [CtEdit]User\<Project Name>

folder. This file contains a list of the ActiveX controls in your project
Custom ActiveX Con- and their GUID. Using the GUID, find the path of an ActiveX control
trols (.OCX) using the Windows Registry key:
KEY_LOCAL_
MACHINE\SOFTWARE\Classes\CLSID\"GUID"\InProcServer32\.
The default value for this key is a path to the .DLL or .OCX file you
need to back up.
Backup the main <Project Folder>\Analyst Views and <Project

Process Analyst files
Folder>\Dictionary folders.
These files contain any logging (alarm logs, report logs) you have
Device logs configured in your project. You will find their location in the Devices
dialog. Refer to your online help for more information.
Check your Citect.ini file or use the Setup Editor, Paths section as
Additional Files
it could contain runtime files used by custom code in the project.
If you are aware of any driver hotfix in your system, backup this
driver DLL which is located in the Bin directory where Plant SCADA is
installed.
Driver Hotfixes
Note: The fixes contained in this hotfix may have been included in

the drivers which ship with Plant SCADA 2020 R2.

Note: Before you backup a project from version 2016 (or earlier) for upgrade to ver-
sion 2018 R2 (or later), you should check if the Citect.ini file uses the parameter
[CtEdit]ANSIToOEM. If so, confirm that the parameter is set to the required value.
Then perform an Update Pages with the Fast Update Pages option disabled. This
will back up the correct ANSI character values. Be aware that the Fast Update Pages
option is not available from version 2018. If you are using a later version and have
noticed inconsistencies due to the misconfiguration of [CtEdit]ANSIToOEM prior to
an upgrade, contact technical support.
2. Upgrade your licenses

In order to do this, you will either need to have a valid support agreement or you will
need to purchase a license upgrade. You can upgrade your key or soft license on the
License Activation page of the AVEVA Knowledge and Support Center. You can also
check the support status.
If your license is out of support, contact your local authorized AVEVA distributor. If
you don't know who your local distributor is, send an email to scada.orders@aveva.com
with your license and site ID details. For more information about licensing in Plant
SCADA 2020 R2, refer to the Licensing section of the Plant SCADA documentation.
3. Install Plant SCADA

Uninstall the current version of Citect SCADA completely and install version Plant
SCADA 2020 R2. For instructions, see Installing Plant SCADA 2020 R2.
Note: Do not uninstall Platform Common Services (PCS) if upgrading from Plant
SCADA 2018 R2.
4. Configure the Server Password

Configure the Server Password using the Configurator's Computer Setup page under
Plant SCADA. For more information, see Use Configurator to Set Up a Runtime Com-
puter.
5. Configure the System Management Server

Configure the System Management Server in the Configurator's System Management
Server page under Plant SCADA. For more information, see Configure a System Man-
agement Server in the Plant SCADA documentation.

6. Restore your project

Restore your project. For instructions on restoring your project, refer to the Plant
7. Upgrade your project

As a default, when you restore your project from a previous version, Plant SCADA will
force an update, and you will get a warning message. Click Yes to proceed with project
upgrade.
If this message is not displayed, you can force an update of all projects by setting the
[CtEdit]Upgrade INI parameter to 1. Close and re-open Plant SCADA Studio. Once you
re-open Plant SCADA Studio, you will get a warning message. After clicking Yes all pro-
jects will be upgraded.
8. Migrate your project

The automatic project upgrade does not fully upgrade your projects and needs to be fol-
lowed by the Migration Tool. The Migration Tool is a separate application that runs
automatically after the project upgrade has been executed. It adds computers from the
existing topology. You may need to run the Migration Tool separately for other com-
ponents.
9. Merge your INI file

If you have defined any project-specific parameters in your Citect.ini file, merge them
into the new version's INI file.
Merge any driver parameters from you old INI file as they will most likely be necessary
to interface with your I/O network. For a list of changes to .INI parameters, refer to the
topic Citect.INI Parameters in Version 2020 R2 in the Plant SCADA documentation.
10. Compile your project

After upgrading your project and running the Migration tool, compile your project to
ascertain that runtime functionality works as expected. It is very likely that you may
encounter errors when you compile your project. One of the common sources of errors
when upgrading is Cicode functions. This is because functions may have changed,
deprecated or simply because the compiler code has been updated to prevent runtime
errors. You can find a list of updates to Cicode functions in the What's New section of
the Plant SCADA documentation.

Refer to the Plant SCADA documentation for instructions on compiling your project.
Note: If you are upgrading from version 2018 R2, the compiler warning message
W1041 will be generated if the Address field for your network address is an IP
address. If this occurs and you want to use encryption, you need to set the DNS
Name field in the Topology|Computers view for the matching network address to
the DNS Name of the computer.
11. Run the Setup Wizard

Before running your project, run the Setup Wizard to configure the Runtime Manager
and other settings that are relevant to the runtime process. The Setup Wizard will auto-
matically determine the role of your computer based on the network addresses defined
in your project. After finishing the Setup Wizard, restore your historic data and other
files, and run your project.
12. Restore runtime files

After compiling your project, place the files necessary for runtime in the correct dir-
ectories. Refer to point 1 in this topic for the list of files you need to place in the cor-
responding directories as defined in your Citect.INI file and project configuration.
13. Restore historical data files

Restore the historical data files before running your upgraded projects.
Alarms
Convert your alarm database in the Data directory with the following steps:
1. Check that you have placed your backed-up alarm database in the directory defined
by the [CtEdit]Data parameter.
2. Delete any legacy database files.
Prior to version 7.30, Citect SCADA used the following alarm database files:
l <project>_<cluster>_ALMSAVE.DAT
l <project>_<cluster>_ALMINDEXSAVE.DAT
Or:
l ALMSAVE.DAT
l ALMINDEXSAVE.DAT.

If you are upgrading from a version prior to 7.30, these legacy files are converted to a
new alarm database format when the alarm server is launched. Once this occurs, these
files are no longer required.
If you are upgrading from a version later than 7.30 (2015 or later), you should delete
these files prior to starting the alarm server. Confirm that the directory specified by the
[Alarm]SavePrimary parameter does not contain the legacy alarm database files listed
above.
Note: If you do not delete these files, in some circumstances the legacy data from
these files may replace or merge into your current alarm database when you
launch the alarm server.
Trends
Follow these steps to convert the files:
1. Create the same file hierarchy on the new system.

2. Place the files in the same folders.
3. If you want to change the folder location or you cannot replicate the same file hier-
archy, edit the trend tag definitions to match the new file paths.
Note: If you are changing the trend tag name, use the trend renaming tool available
on the Product Hub page of the AVEVA Knowledge and Support Center.
14. Run your project

Run your project to check that the functionality works as intended:
l Check any Cicode that you needed to modify in order to compile your project.
l Test communications to your I/O devices, alarm triggering and trend capture.
Migrate to Production
Review the following information to complete your Offline Upgrade process and apply
the changes to your production system.

Testing Considerations
After the upgrade and configuration changes to the project are complete, it is recom-
mended to perform system testing of the new project version. This is to check that func-
tionally and operation behaves as expected before applying the new project to the
production environment.
Licensing
When changing to use a newer product version, the hardware/software key may need to
be updated. The hardware key is a physical key that plugs into either the parallel port
or USB port of your computer. To upgrade the key, a new authorization code is
required which can be created by using the AuthCode Generator. To prepare the sys-
tem, it is recommended to update the production machine keys before the project is
updated on the production machines as the updated key will still license the previous
version. You can update the hardware/software key in the Licensing activity in Plant
SCADA Studio.
Prepare Configuration [INI] Files

Before beginning any changes to the production computers, it is recommended that you
back up the configuration [INI] files for each machine as they may be required for ref-
erence.
The current configuration file can be used with the new product version after the path
parameters have been updated to the new version file locations. Refer to the setup of the
development environment section of the specific version for further parameter inform-
ation.
The Setup Editor and Setup Wizard can be used to finalize the configuration of the com-
puter setup.
Server Addresses
During a migration with an existing system, it may be useful to use a new set of IP
addresses and computer names for the new version. This is typically done when there is
a need to provide isolation between the system project versions to allow the two sys-
tems to individually co-exist on the network for a period of time. When isolated, the sys-
tems will be independent and not cross communicate or synchronize between the
existing and new versions. This type of upgrade would have the new version start with
a snapshot of the historical data from the previous system and then run in parallel.

Communication Drivers
The project may be using specialty drivers. If so, it is recommended that you back up
the driver files located in the product ‘bin’ directory. Existing specialty drivers that are
used may be required for the new version. The Connectivity Hub on the AVEVA Know-
ledge & Support Center can be checked for driver availability and compatibility at
https://softwaresupport.aveva.com.
Note: Plant SCADA 2020 R2 introduced a classification system for the driver port-
folio that reduced the number of drivers included by default with the Plant SCADA
installation media. Some drivers may need to be downloaded from the Connectivity
Hub at the AVEVA Knowledge and Support Center.
Specialty Software
The project may be using specialty software to provide certain system functionality.
These applications may be required to be updated or re-installed during the upgrade
process and considered in the context of the upgrade.
Format File
The project may be using custom configuration forms in the product. This configuration
is located in the FRM file which may be required in the new installation. For further
information, check the Tech Note "Upgrading with a modified CITECT.FRM file"
(TN3795) on the AVEVA Knowledge & Support Center.
Trend and Alarm Data

A project upgrade may also require the trend and alarm data to be updated based on
the new product features. It is recommended to keep a backup of the existing pro-
duction trend data files and the alarm save data file from the original
Once the data files have been upgraded, the updated data files may not be compatible
with the previous version.
It is not recommended to change the directory path of the trend data files during the
project upgrade as this may affect the trend operation. The default data directory may
be changed between product versions and may need to be considered in the context of
the install and upgrade with regards to the trend file location.

Troubleshooting Offline Upgrade

This section lists common issues you might encounter during your Offline Upgrade,
which may be compiling errors or any other pre-runtime issues.
Not able to upgrade license key

1. Check that you have correctly installed the latest versions of CiUSafe and the
Sentinel Driver via the License Activation page of the AVEVA Knowledge and Sup-
port Center.
2. Check that the Authorization code matches the Key you are trying to upgrade. If you
still cannot upgrade your license, please check the Tech Note "CIUSafe Error Return
Codes" (TN5882) on the Knowledge Base page of the AVEVA Knowledge and Sup-
port Center.
Compiler errors and warnings not related to deprecated functions

As Plant SCADA evolves, the compiler feature becomes stricter in order to maintain pro-
ject quality and runtime success. The fact that you are getting compiling errors that were
not appearing before is because of stricter compilation, which will result in more pre-
dictable and stable runtime. Refer to the error code in the error message to resolve any
errors and warnings. You can search the online help using the error code for more
information about a specific error code.
Online Upgrade
An online upgrade takes advantage of Plant SCADA's native server redundancy to
avoid loss of data and minimize downtime on a production system. There are two ways
to perform an online upgrade:
l Upgrade one by one — firstly primary servers, then clients and then standby servers.
l Upgrade side by side — where a new set of server and clients runs in parallel.
If the primary server has a lower version of AVEVA Plant SCADA than the standby
server, then the server communication will be lost. So, make sure to avoid the following
scenarios during online upgrade:
l Shutting down the upgraded primary server before the standby is upgraded.
l Stopping both the servers when the upgrade is in progress.
l Starting up the non-upgraded standby server, when the upgraded primary server is
running.

Similar to the offline upgrade, you will need to follow the upgrade path, and repeat the
process as many times as the number of steps in your upgrade path.
Refer to the relevant section depending upon your current version of Citect SCADA.
Pre-requisites for Online Upgrade

As mentioned earlier, an online upgrade will allow you to avoid downtime and loss of
data. It is important that you take into consideration the complexity and size of your pro-
ject when planning for this upgrade. It is recommended that you review the following
pre-requisites before you start an online upgrade:
1. At least one pair of redundant servers: This is to upgrade one server at the time
while the redundant server assumes primary operation, avoiding downtime and loss
of data.
2. Upgraded project: Check that your project runs and works properly on Plant
SCADA 2020 R2 before migrating to production and starting the online upgrade. If
your project is complex, it is recommended that you have a test environment as the
offline upgrade could be complex and could involve a long server downtime if done
on your production system.
3. Restore runtime files: Check that you have restored the necessary files for runtime
onto the appropriate directories to avoid any disturbances on the upgraded live sys-
tem.
4. Capture data files: To allow historic data to be restored into the new version, you
need to assess and move data files to the required location during the upgrade pro-
cess. This is described in detail in the online upgrade steps in the relevant sections.
5. Configure your running system for online upgrade: We recommend leveraging
your current redundant system and adding the following Citect.INI parameters
before the online upgrade:
l [LAN]EarliestLegacyVersion: Use 8100 for v2018, or 8200 for v2018 R2. This will
allow your upgraded servers to accept connections from the older version.
l [Alarm]EnableStateLogging: Set this parameter to 1 to allow logging the alarm
synchronization messages into the syslog file.

l [Debug]Kernel = 1 (optional): This allows you to use the Kernel to monitor pro-
gress during the upgrade.
Note: Before you perform an online upgrade from Citect SCADA version 2018 or
2018 R2, you need to install the latest product update. Updates for Plant SCADA are
available from the Product Hub page of the AVEVA Knowledge & Support Center
website at https://softwaresupport.aveva.com.

Upgrading from v2018

To upgrade from v2018:
1. Check that you have the RTM version and the latest update installed. For instruc-
tions on upgrading to this version, refer to the version 2018 documentation.
2. Check that you have added the following parameters in the .INI file to all your
server nodes before you start the online upgrade.
[LAN]EarliestLegacyVersion = 8100.
Restart the servers after adding the parameter for the changes to take effect.
3. Shutdown SCADA runtime on the primary server.
4. Upgrade Plant SCADA on this server according to the offline upgrade procedure.
5. Set up the Server Password in Configurator's Computer Setup page. See Use Con-
figurator to Set Up a Runtime Computer.
6. Configure your System Management Server and encryption settings based on your
requirements.
Note: For an online upgrade from v2018, encryption needs to be disabled or set
to Accept encrypted and non-encrypted connects (mixed mode). You can then
modify your encryption settings when the upgrade process is complete.
7. Place the backed-up Alarm database in the [CtEdit]Data directory. This will allow a
quicker synchronization of alarm servers.
8. Restart the primary server, which is now upgraded.
9. Plant SCADA v2020 R2 server will synchronize its alarm database with the running
v2018 server. You need to wait for the synchronization process to finish, and this will
depend on the size of your alarm database. The synchronization information is avail-
able from the main kernel window of the Alarm Process as well as the syslog.
10. Upgrade your client nodes one by one.
requirements.
12. Check the Server Authentication section of the Computer Setup page in Con-
figurator under Plant SCADA. If you have selected Configure Server Password,
make sure you use the same password as the one defined above in step 5.
13. Shutdown runtime on the standby server.
14. When the newly upgraded version 2020 R2 server assumes the primary server role it
will migrate the entire alarm database to the new format, and you should now be
able to see Alarm Summary data on all migrated clients.

16. Set up the Server Password in the Configurator, Plant SCADA, Computer Setup
page.
requirements.
18. Restart the standby server, which is now upgraded.
19. Check functionality of the system as a whole.
20. Test redundancy by switching off the primary server and checking that the standby
takes over and clients switch over.
Upgrading from v2018 R2

To upgrade from v2018 R2:
1. Check that you have the RTM version and the latest update installed. For instruc-
tions on upgrading to this version, refer to the version 2018 R2 documentation.
2. Check that you have added the following parameters in the .INI file to all your
server nodes before you start the online upgrade.
[LAN]EarliestLegacyVersion = 8200.
Restart the servers after adding the parameter for the changes to take effect.
3. Shutdown SCADA runtime on the primary server.
Note: Do not uninstall Platform Common Services (PCS) if upgrading from Plant
SCADA 2018 R2.
5. Set up the Server Password in Configurator's Computer Setup page. See Use Con-
figurator to Set Up a Runtime Computer.
requirements.
Note: The encryption settings in version 2020 R2 need to be configured to align

with the settings as they were in 2018 R2, otherwise communications may not be
successful.
The following table indicates the encryption settings that will align successfully
across version 2020 R2 and 2018 R2.

Encryption setting on Plant SCADA 2020 R2
Unencrypted Mixed Mode Encrypted

Unencrypted
OK OK unsuccessful
Encryption
setting on Mixed Mode
OK OK OK
2018 R2

Encrypted
unsuccessful OK OK
7. Place the backed-up Alarm database in the [CtEdit]Data directory. This will allow a
quicker synchronization of alarm servers.
8. Restart the primary server, which is now upgraded.
9. Plant SCADA v2020 R2 server will synchronize its alarm database with the running
v2018 R2 server. You need to wait for the synchronization process to finish, and this
will depend on the size of your alarm database. The synchronization information is
available from the main kernel window of the Alarm Process as well as the syslog.
10. Upgrade your client nodes one by one.
requirements.
12. Check the Server Authentication section of the Computer Setup page in Con-
figurator, under Plant SCADA. If you have selected Configure Server Password,
make sure you use the same password as the one defined above in step 5.
13. Shutdown runtime on the standby server.
14. When the newly upgraded version 2020 R2 server assumes the primary server role it
will migrate the entire alarm database to the new format, and you should now be
able to see Alarm Summary data on all migrated clients.
16. Set up the Server Password in the Configurator, Plant SCADA, Computer Setup
page.
requirements.
18. Restart the standby server, which is now upgraded.
19. Check functionality of the system as a whole.
20. Test redundancy by switching off the primary server and checking that the standby
takes over and clients switch over.

Note: Please review the changes that have been made to the Windows User Groups
that are created for version 2020 R2. See Windows® User Groups and Security Roles.
Troubleshooting Online Upgrade

This section lists common issues you might encounter during your Online Upgrade,
which may be related to runtime issues and redundancy connectivity.
Redundant servers do not communicate

I cannot make my redundant servers communicate and I keep getting the hardware
alarm “Redundant Server not found”.
1. Check that you have set your [LAN]EarliestLegacyVersion parameter correctly.
l If upgrading v2018 use [LAN]EarliestLegacyVersion=8100.
l If upgrading v2018 R2 use [LAN]EarliestLegacyVersion=8200.
l Check that you have run the Setup Wizard and set both servers to Networked
mode.
2. Set the same server password on both servers in the Setup Wizard.
3. If security is enabled, check that Plant SCADA Runtime Manager is running as a Win-
dows service.
4. Check that the Accept encrypted and non-encrypted connections (mixed
mode) option is selected in the Configurator, Plant SCADA, Encryption page.
Note: Version 2020 R2 should not have encryption enabled with Accept encryp-
ted and non-encrypted not selected, otherwise the servers will not be able to
communicate. Mixed Mode should be used, or encryption should be disabled.
My system is performing slowly even though Hardware and software requirements are met
Check your system’s power options: Control Panel, Power Options.

Remove Upgrade related parameters

After finalizing the upgrade process and confirming that runtime is fully functional, we
recommend removing or updating the following .INI parameters. You will need to
restart the servers after changing the parameters for the changes to take effect.
l [Debug]Kernel = 0: this is to enhance security and keep operators out of the kernel.
l [LAN]EarliestLegacyVersion: remove this parameter.

Migration Tool
The automatic update that occurs when you initially launch Plant SCADA 2020 R2 does
not fully upgrade your projects, and needs to be followed by the use of the Migration
Tool (if migrating from v7.x this is particularly noteworthy). The automatic update is a
passive action which updates the database field definition for any database that has
been changed between the two versions and copies new files that are necessary in 2020
R2.
The Migration Tool is a separate application which has to be run manually after the
automatic upgrade has been executed. It can be initiated after you have prepared the
project for final migration. This tool will accommodate the changes in project func-
tionality that are incorporated in 7.x and subsequent versions.
Note: Some of the features introduced in 2020 R2 of Plant SCADA require changes
in the project data from version 6.x.
UPGRADE ALTERS COMMUNICATIONS CONFIGURATIONS
After upgrading, confirm and adjust the configuration of I/O devices in your project.
damage.
Using the Migration Tool
Note: Before you use the Migration Tool, is recommended that you familiarize your-
self with the process that it performs, and the preparatory steps that you need to
carry out with your existing projects.
To run the Migration Tool:

1. Backup the projects that you need to migrate.
2. Navigate to the Project activity in Plant SCADA Studio, select Home, Migration Tool
to display the Migration Tool dialog.
3. Either accept the project displayed in the edit box, or browse for the project that you
wish to upgrade.

4. Specify the changes you would like to implement during the migration process by
selecting from the options described in the following table.
Option Description
Select this check box if you wish to delete these types of devices after
successful migration (see Remove Obsolete Memory and Alarm
Devices).
Remove obsolete
Memory and Note: Do not select this check box when you run the tool for the first
Alarm devices time on a project that contains any included projects which are
shared with more than one master project. If you want to delete
obsolete devices under these circumstances, you can run the tool a
second time using this option if the migration is successful after it is
run the first time.
Use this option to append information about the migration process to

Append to exist- the existing Migration Tool log file (located in Plant SCADA's User dir-
ing log file ectory). If this option is not selected, a new log file will be created when
migration is complete.
Create roles from

Select this option if you wish to migrate the users database from an
User security
existing project (see Creation of Roles).
information
Select this option to convert legacy menu entries to the format neces-
Copy XP_Style
sary for the new menu configuration system. By default, this option is
menu into Tab_
unchecked to avoid potential compile errors that may occur if the leg-
Style menu
acy menu.dbf contains functions which have been removed.
Migrate included Select this option to migrate the included projects associated with the
projects selected project (see Migrate Included Projects).
Select this option if you have an existing database that you want to
migrate into this version. When upgrading from an earlier version, and
the "PARENT" field of the equipment table was used, you should select
this check box. Otherwise existing data from the PARENT field will be
Migrate equip- ignored. If runtime browsing is used, the PARENT field will return the
ment database equipment parent (the substring of the equipment name without the
last '.' and anything after that).
To retrieve information that was stored in the previous "PARENT" field

the "COMPOSITE" field should be used.
Select this option if you want to migrate devices that currently use the
Migrate ABCLX to
ABCLX driver to the OPCLX driver. Select the Configure button to indic-
OPCLX
ate which I/O devices you would like to migrate.

Option Description
Note: You should confirm that the OPCLX driver is installed before
you use this option.
If you select this option, the storage method will be set to scaled (2-
byte samples) for all trends that have no storage method defined. Use
Migrate
this option to stop the compiler error message "The Storage Method is
Trend/SPC stor-
not defined". In previous versions, a blank storage method would
age method
default to scaled. However, this is no longer supported, resulting in the
compile error message.
If you select this option, computers will be created from the servers and
Create com-
network addresses that you have configured for a project and its
puters from Net-
include projects. This option distinguishes whether a computer has mul-
work Addresses
tiple IP addresses.
Note: If 'Copy XP Style menu into Tab_Style Menu' and 'Migrate Included Pro-
jects' are both selected when the migration tool runs, the following message will
be displayed: "Copying menus of included projects may lead to conflicts. Any
conflicts will need to be manually corrected". To avoid this from occurring, it is
recommended you run the migration tool twice. In the first instance just select
the option 'Copy XP_Style menu into Tab_Style Menu', and in the second
instance just select the option 'Migrate Included Projects'.
5. Click Migrate to begin the migration process.

A progress dialog will display indicating the stage of the conversion and the
name of the project being migrated. If you wish to cancel the migration at this
point click the Abort button.
Note: Aborting a migration will stop the migration process, and any changes
already completed will not be rolled back. You will have to restore your project
from the backup created in the first step.
When the migration process is concluded, a confirmation dialog box will display
indicating the number of variables converted and the number of I/O devices
deleted (if device deletion was selected at the start of migration).
6. Click the Close button to close the dialog.

Remove Obsolete Memory and Alarm Devices

When you use Plant SCADA's Migration Tool, the Remove obsolete Memory and
Alarm devices option adjusts the following:
Memory tags to local variables: tags that are on an I/O device that are configured to
use a 'memory' port.
Note: If there are real I/O devices in your project that have been set to use a
'memory' port during testing, these can be changed before running the migration
tool to avoid those tags getting adjusted.
Alarm devices: can remove I/O devices that have a protocol set to 'Alarm', which was
needed in earlier versions to enable alarm properties as tags. In version 7.x, the alarm
properties are enabled via a setting on the alarm server configuration form.
Memory Devices
In previous versions of Plant SCADA an I/O Device could be defined as a memory
device by setting the port value to "Memory". This was generally done for one of the fol-
lowing purposes:
l To provide for future devices that were not currently connected to the system, but
their points needed to be configured at this stage of project.
l For virtual devices where there was no corresponding physical I/O Device and you
needed data storage with the entire functionality normally associated with I/O vari-
ables such as alarms.
l To act as a variable which was local to the process being used in place of Cicode
global variables.
You can still use I/O Devices for future or virtual devices in version 7.0, but manually
set the Port parameter to an unused value other than Memory, and set the Memory
property of the device to True to indicate that it is an offline in-memory device before
running the Migration Tool.
You need to review your project to identify which memory I/O Devices are local vari-
able holders and which ones need to be changed to non-memory so that the Migration
tool does not convert their variables.
The Migration Tool will set any I/O Device's port which is identified as a Memory
device to the new Local Variable, and the original device record will be deleted.

Alarm Devices
In previous versions of Plant SCADA Alarm devices were defined as devices with their
Protocol property set to "Alarm". In version 7.0 the function of configuring such a device
is now replaced by setting the Publish Alarm Properties property to True on the Alarm
Server.
Alarm devices with their Protocol property set to "Alarm" will be deleted from I/O
Devices table by the Migration Tool.
The Migration tool can delete memory and alarm device records. If you want to delete
the devices at a later time, deselect the "Remove obsolete Memory and Alarm Devices"
option.
Note: Alarm devices with their Protocol property set to "Alarm" are no longer used
and will be removed by the Migration Tool. The Alarm Servers will now publish
Alarm Properties.
Converting Memory Variables

A memory variable is a variable with its I/O Device Port property set to either
"Memory" or "MEM_PLC".
If there are multiple I/O Devices with the same name, possibly on different I/O Servers,
the device would not be considered as a memory device regardless of its port value. In
other words, the Migration tool will not process the variables for memory devices with
duplicate names.
Inserting New Local Variables

When the Migration Tool runs, a local variable record will be inserted for each identified
memory variable, and the variable data will be copied into the new local variable.
Local variables have fewer fields than variables; the following table shows the mapping
from variable to local variable when copying their data.
Variable Tag Parameter or Constant Value Local Variable Parameter
Variable Tag name Name
Data Type Date Type

Variable Tag Parameter or Constant Value Local Variable Parameter
(Empty) Array Size
Eng. Zero Scale Zero Scale
Eng. Full Scale Full Scale
Comment Comment
With the exception of the Array Size, which has been introduced in version 7.0 exclus-
ively for local variables, every field receives its value from the same or similar field.
Deleting Variable Tags

Once the Migration Tool has created the local variable records it will insert those vari-
able tag records that have been converted in the previous step, and delete the original
variable tag.
If an error is detected during the insertion of the local variables, the deletion of the vari-
able tags will not be performed. If this occurs it is possible to have two records with
same name and data, one in the local variable (the newly inserted record) and one in the
variable tags (the original record that has not been deleted). You need to delete either of
the variables manually, or restore the backed up project after removing the cause of the
error then run the Migration Tool again.
Deleting Obsolete I/O Devices

Deleting obsolete I/O Devices is an optional step in the Migration Tool and will be per-
formed after the memory variables are converted. If the delete option is chosen, obsolete
Memory devices and Alarm devices will be deleted as the final step of the Migration
Tool operation.
Creation of Roles for Existing Users

When upgrading an existing project using the migration tool, a new role will be created
(if needed) for every existing user. The new role will have the same security settings that
were defined for that user and be given a generic name such as Role_1, Role_2 etc. Dur-
ing the upgrade process, if a role exists with the same security settings as the user, then
the existing role will be assigned to the user being upgraded. For example; If Role_1

exists and matches the security settings of the upgraded user then that user will be
assigned Role_1 also.
If you do not want to migrate users from an existing project, clear the option Create
Roles from User security information from the migration tool dialog before running it.
Migrate Included Projects

Each project may contain multiple included projects. Additionally, any included project
may contain its own included project so creating a cascading project.
The Migration Tool needs to process the original project and included projects in a
single step. The reason for this is that variables can be defined in one project that refer
to I/O Devices defined in another included project.
The Migration Tool performs this procedure sequentially on the "master" project then
each included project.
In the case where two master projects share the same project as an included project, you
should not select the "Remove obsolete Memory and Alarm devices" check box when
you process a project that contains shared included projects. This is because the removal
is performed at the conclusion of the migration process on each master and included
projects sequentially. This could cause the deletion of an I/O Device in the first master
project which is referenced by a tag in a shared included project which is processed in a
later step.
If two separate "master" projects contain the same included project, run the Migration
Tool on each "master" project without selecting to delete obsolete devices.
UPGRADE ALTERS COMMUNICATIONS CONFIGURATIONS
After upgrading, confirm and adjust the configuration of all I/O devices in your project.
damage.
To remove obsolete devices, it is recommended that once the Migration Tool has com-
pleted successfully (without the check box being selected), run it a second time with the
check box selected. This will remove the devices since every tag conversion were com-
pleted in the first pass of the Migration Tool.

Default Scale
The Scale properties in both variable tags and local variables are optional. If a Scale
value is not specified, the default value is indicated by a parameter in the Citect.ini file.
The parameter name is "DefaultSliderScale" under the [General] section in the Citect.ini
file. The default values for Scale is 0-32000, unless the default slider scale is true in
which case the default value depends on the type, for example, Integer, String, or so on.
The Migration Tool will read this parameter and if it is not set, or set to false, then it will
explicitly set any empty Scale property to a value in to the range of 0 to 32000. This will
be done even if either of the Zero Scale or Full Scale parameters has a value, in which
case the empty Scale parameter will receive the default value.
If the DefaultSliderScale in the Citect.ini file set to True, the Scale parameters will not be
populated with a default value if they are empty, rather they will be interpreted at
runtime.

154
Chapter 17: Uninstall or Change Components
You can uninstall Plant SCADA components using the Programs and Features page in
Windows® Control Panel. For a Plant SCADA installation, the list of programs can
include any of the following components:
l ArchestrA Data Store
l AVEVA Industrial Graphics Server
l AVEVA Plant SCADA 2020 R2
l AVEVA Plant SCADA 2020 R2 Web Server
l AVEVA Plant SCADA Connectivity Server
l AVEVA Plant SCADA Deployment
l AVEVA Plant SCADA Project DBF Addin
l AVEVA Plant SCADA Security Configuration
l Platform Common Services
l Schneider Electric Floating License Manager
l Sentinel System Driver Installer.
Note: If you want to add additional components to your Plant SCADA installation,
you will need to uninstall the existing Plant SCADA components before you can run
a new installation. You do not need to uninstall Platform Common Services, Arches-
trA Data Store, Floating License Manager or the Sentinel System Driver.
To uninstall a Plant SCADA component:

1. From the Windows Start menu open Control Panel.
2. Go to Programs then Programs and Features to display the Uninstall or Change a
Program page.
3. Locate the Plant SCADA program you want to remove and select Uninstall.
This will remove any files associated with the selected component and its registry
entries.
For some components, you can also select the following maintenance operations:
l Change —this option allows you to add components that were not installed during
the original installation, or remove selected components.
l Repair — this will reinstall all non-customizable files in the same location as the pre-
vious installation. If any of the files were accidentally deleted or modified, then this
option will restore the software back to its original state.

If the Change or Repair option is not available for a component, you will have to re-
install it from the Plant SCADA installation media to make any required modifications.
Reinstall Platform Common Services (PCS)

Only reinstall PCS if the support team advises it, or if you get a notification from the
troubleshooting tool in the Common Services portal. Do not install PCS on a computer
where it was not previously installed.
To reinstall Platform Common Services:

1. From the Plant SCADA installation media, locate the "ASBFrameworkInstallx64.msi"
file at AVEVA Plant SCADA\ISSetupPrerequisites\Platform Common Services x64.
Note: If you are using the Microsoft® Windows operating system and have User
Account Control (UAC) switched on, the UAC dialog will display when you
open the file. You will be required to supply administrator credentials if you are
not an administrator on the computer.
2. Run the "ASBFrameworkInstallx64.msi" file.

3. The Setup Wizard page appears. Click Next.
4. Then click Remove and continue with the installer instructions to uninstall PCS.
5. Restart the computer.
6. Run the "ASBFrameworkInstallx64.msi" file again.
7. The Setup Wizard page appears. Click Next.
8. In the Custom Setup page make sure that the "Platform Common Services Service
Repository" is set to "Entire feature will be not available". This is the default selec-
tion. Click Next.
Note: Installing the Platform Common Services Service Repository may cause
interoperability issues, if you install other AVEVA products on the same com-
puter.
9. Continue with the installer instructions to complete the installation.

Chapter 18: Manage Updates
AVEVA will periodically publish software updates for Plant SCADA. You can down-
load these updates from the Product Hub page of the AVEVA Knowledge & Support
Center website at https://softwaresupport.aveva.com.
To install a Plant SCADA software update

1. Go to the location where the update media was saved.
2. Run the executable file named "Plant SCADA <version> Update n.exe".
The following dialog will appear. It lists the components that will be updated.
3. Select Update to proceed.

If any Plant SCADA services or processes are using files that need to be updated, an
additional dialog will appear asking if you want to automatically shut everything down
or reboot after the update is installed.
4. Make your selection and click OK to complete the installation.
To uninstall a Plant SCADA software update
You can uninstall Plant SCADA updates from the Installed Updates page of Windows®
Control Panel. Be aware that each component that was updated will appear as a sep-
arate entry.

To fully uninstall an update, you need to uninstall each component individually. These
components can include the following:
l AVEVA Plant SCADA 2020 R2
l AVEVA Plant SCADA Connectivity Server
l AVEVA Plant SCADA Deployment
l AVEVA Plant SCADA Security Configuration.

Installation Guide

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Installation Guide

Uploaded by

Copyright:

Available Formats

AVEVA™ Plant SCADA 2020 R2

Installation and Configuration Guide

Chapter 1: Install Plant SCADA 11

Chapter 3: Install a Development Workstation 27

Chapter 4: Set Up a System Management Server 33

Chapter 5: Install a Runtime Server 43

Chapter 6: Install a Deployment Server 51

Chapter 7: Install an Industrial Graphics Server 63

Chapter 8: Install an OPC UA Server 73

Chapter 9: Install a Plant SCADA Web Server 85

Chapter 10: Install a Runtime-only Client 99

Chapter 11: AVEVA™ Enterprise Licensing 105

Chapter 12: Install Communication Drivers 111

Install Additional Communication Drivers 113

Chapter 13: Install OPC Factory Server 115

Chapter 14: Security Roles 117

Chapter 15: New Features in Plant SCADA 2020 R2 125

Chapter 16: Upgrading to Plant SCADA 2020 R2 129

Chapter 17: Uninstall or Change Components 155

Chapter 18: Manage Updates 157

The addition of either symbol to a “Danger” or “Warning”

This is the safety alert symbol. It is used to alert you to

© July 2021 AVEVA Group Plc. All rights reserved. 7

Before You Begin

UNINTENDED EQUIPMENT OPERATION

8 © July 2021 AVEVA Group Plc. All rights reserved.

© July 2021 AVEVA Group Plc. All rights reserved. 9

Chapter 1: Install Plant SCADA

This guide provides instructions for installing AVEVA™ Plant SCADA.

© July 2021 AVEVA Group Plc. All rights reserved. 11

12 © July 2021 AVEVA Group Plc. All rights reserved.

Windows® User Groups and Security Roles

Security Role Windows User Group Description

Members of this role can run

Configuration Users SCADA.ConfigUsers

Members of this role can run

© July 2021 AVEVA Group Plc. All rights reserved. 13

Security Role Windows User Group Description

Members of this role can run

If you are not running Plant

Note: If you are running

If you choose to install Deployment Server components on a clean computer, additional

Security Roles Windows User Group Description

Members of this role can add

Members of this role can

Members of this role can

If you choose to install an Industrial Graphics Server on a computer, additional security

Security Roles Windows User Group Description

Industrial Graphics Members of this role can con-

14 © July 2021 AVEVA Group Plc. All rights reserved.

Security Roles Windows User Group Description

Note: Unlike the other secur-

This security role is not in use

Windows User Group Name

Runtime Users SCADA.RuntimeUsers Citect.LocalUsers

Server Users SCADA.ServerUsers Citect.ServerUsers

Deployment Users SCADA.DeploymentUsers Asb.Deployment.DeployRole

Note: In an upgrade scenario, the Asb.Deployment.ReadRole user group is obsolete

© July 2021 AVEVA Group Plc. All rights reserved. 15

See Install Communication Drivers.

16 © July 2021 AVEVA Group Plc. All rights reserved.

OPC Factory Server

Fore more information, see Install OPC Factory Server.

Anti-virus Software Setup