Advanced Admin Pdms

Advanced ADMIN Version 11.4

Advanced ADMIN Administration

Course Workbook

PLEASE NOTE: AVEV AVEVA A has a policy of continuing product development: therefore, the information contained in this document may be subject to change without notice. AVEV AVEVA A MAKE !" #A$$A!%& #A$$A!%& "' A!& K(!) #(%* $E+A$) %" %*( )"-ME!%, (!-)(!+ /-% !"% (M(%E) %", %*E (M0(E) #A$$A!%(E "' ME$*A!%A/((%& A!) '(%!E '"$ A 0A$%(-A$ 0-$0"E. #hile every effort has been made to verify the accuracy of this document, AVEVA shall not be liable for errors contained herein or direct, indirect, special, incidental or conse1uential damages in connection with the furnishing, performance or use of this material.

%his manual provides documentation relating to products which you may not have access to or which may not be licensed to you. 'or further information on which 0roducts are licensed to you please refer to your licence conditions.

Copyright 2017 AVEVA Limited

All rights reserved. !o part of this document may be reproduced, stored in a retrieval syst system em or tran transm smit itte ted, d, in any any form form or by any any mean means, s, elec electr tron onic ic,, mech mechan anic ical al,, photocopying, recording or otherwise, without prior written permission of AVEVA. AVEVA. %he software programs described in this document are confidential information and proprietary products of AVEVA td or its licensors. Visit our website at http:22www.aveva.com

AVEVA Ltd, High Cross, Madingley Road, Cambridge Cambridge CB3 0HB, UK

Introduction

Contents

Advanced A!"N Admini#tration

Session 1: Introduction To The Course

Session 2: Database Extracts

Session 3: Data Access Control

Session 4: evie! and "eedbac#

(ntroduction 342

Advanced ADMIN Training Manual

Introduction

Session

1

Introduction

(ntroduction 341


Introduction

"ntrod$cing the co$r#e



Content 6 A one%day co$r#e on $#e o& Advanced A!"N 6 Concept# and Termino'ogy 6 ata(a#e E)tract# 6 ata Acce## Contro'



A##$mption# 6 Leve' o& *no+'edge o& Admini#tration 6 Leve' o& *no+'edge o& P!S A)VA)M5

%his course is designed and run by AVEVA td. to familiarise users with E7tracts and )ata Access ontrol techni1ues for Vantage 0)M. (t assumes that participants are fully conversant with the 0)M A)M(! module and have themselves, administered a 0)M project.

At the end of this session you will be able to: 0rovide sufficient information and practice to enable a VA!%A+E 0)M Administrator to design an A)M(! set4up using )atabase E7tracts and )ata Access ontrol 8)A9. And understand: 

oncepts and %erminology



)atabase E7tracts



)ata Access ontrol

(ntroduction 342


Introduction

Co$r#e de'ivery

Training materia'

Practica' e)erci#e#

,or*(oo*

A)VA)M:

%he course will consist of lecture material together with practical e7ercises for each session. %here will be a large wor;ed e7ercise on day two. %he supporting wor;boo; provides a bac;up to the lecture and e7ercises during the course and a valuable reference guide after the course. At the end of the wor;boo; you will find references to further reading and information sources.

(ntroduction 34-


Introduction

(ntroduction 34.


Database Extracts

Session

2

Database Extracts

E)tended !$'ti+rite /aci'itie# 

evie+ o& Simple !$'ti+rite ata(a#e# 6 A''o+# more than one $#er to +rite to a given data(a#e 6 E'ement# in a !$'ti+rite data(a#e m$#t (e claimed (e&ore modi&ication i# po##i('e No other $#er can c'aim an e'ement that ha# a'ready (een c'aimed 6 C'aim mode can (e explicit or implicit  6 E'ement# are $nc'aimed (y a mod$'e change or E"T 6 On'y primary elements can (e c'aimed A)VA)M3<

)atabase E7tracts =41


Database Extracts

E)tract# 



An Extract d( provide# a mean# o& +or*ing on data in a Master d( +itho$t the data in the !a#ter d( (eing $pdated $nti' the $#er choo#e# A $#er c'aim# e'ement# to +or* on in the E)tract A SAVE,O3 #ave# +or* (ac* to the E)tract4 not to the !a#ter d( C'aim# made in thi# +ay are persistent  !a#ter 5

E)tract A

E)tract 5

SAVE,O3 A)VA)M33

#hen you do a AVE#"$K, the changed data will be saved bac; to the E7tract. %he unchanged data will still be read via pointers bac; to the Master db. #hen re1uired, changes made to the E7tract are written bac; to the Master db. %he E7tract itself can be updated to reflect changes made to the Master.



Database Extracts

E)tract d(# % /eat$re# 

,hen an E)tract i# created it i# e##entia''y an empty d(4 +ith pointer# (ac* to the data in the !a#ter d(



E)tract# can on'y (e created &rom !$'ti+rite d(# and are them#e've# !$'ti+rite



6o$ can create E)tract d(# &rom any d( that can (e !$'ti+rite4 ie ES"4 PA4 CATA and "SO



6o$ can create many E)tract# &rom one !a#ter d(4 and a'#o create E)tract# o& E)tract#4 th$# creating an Extract Family 710 'eve'# ma)im$m8



6o$ cannot create E)tract# &rom foreign d(#



6o$ cannot create E)tract# &rom copy d(#

A)VA)M3=

C'aim mode must be set when a Multiwrite db is created. E)p'icit claim 4 you must claim any element you wish to change before the modification starts. E7plicit claim mode is recommended when e7tracts are distributed. %his avoids delays when claiming across a location. "mp'icit claim 4 an element will be claimed automatically when it is modified. )isadvantage of implicit claim mode is that you could spend some time defining a change, then not be able to apply the changes if the element had already been claimed by someone else. Elements can be unclaimed at any time, providing they have not been modified since the last AVE#"$K.

)atabase E7tracts =4-


Database Extracts

1 Extracts An e7tract is created from an e7isting )atabase. #hen an E7tract is created, it will be empty, with pointers bac; to the owning or ma#ter database. E7tracts can only be created from Multiwrite databases, and all e7tracts are themselves Multiwrite. &ou can create E7tract )/s from any type of database that can be multiwrite, that is )E(, 0A)), A%A and ("). &ou cannot create e7tracts from foreign )/s. &ou cannot create e7tracts from copy )/s.

An e7tract can be wor;ed on by one -ser at the same time as another user is wor;ing on the master or another e7tract. #hen a user wor;s on the e7tract, elements are c'aimed to the e7tract in a similar way to simple multiwrite databases, so no other -ser can wor; on them. #hen an e7tract -ser does a SAVEWORK, the changed data will be saved to the E7tract. %he unchanged data will still be read via pointers bac; to the master )/. #hen appropriate, the changes made to the e7tract are written bac; to the master. Also, the e7tract can be updated when re1uired with changes made to the master.

1$1 Extract "a%ilies A Master )/ may have up to ><<< e7tract )/s. &ou can create an e7tract from another e7tract, forming a hierarchy of e7tracts. All the e7tracts derived from the same master are describes as an E)tract /ami'y. %he original database is ;nown as the Master database. %he Master database is the o+ner or parent of the first level of e7tracts. (f a more comple7 hierarchy of e7tracts is created, the lower level e7tracts will have parent e7tracts which are not the master. %he e7tracts immediately below an e7tract are ;nown as e)tract mem(er#.

)atabase E7tracts =4.


Database Extracts

%he following diagram illustrates an e7ample of an e7tract family hierarchy:

0(0E

0(0E?@

0(0E?@3<

0(0E?@33

0(0E?@=

0(0E?@3=

(n this e7ample: PIPES

is the Master and the parent of PIPES_X1

PIPES_X1

is a child of PIPES and the parent of PIPES_X10

PIPES_X10

is a child of PIPES_X1

%he members of 0(0E are 0(0E?@3 and 0(0E4@=. #rite access to e7tracts is controlled in the same way as any other database: %he user must be a member of the %eam owning the E7tract. E7tracts in the same family can be owned by the same team or by different teams. %he user must select an M)/ containing the e7tract. )ata Access ontrol can be applied.

Note:

At this release, you can only create an e7tract at the bottom of an e7tract tree: you cannot insert a new e7tract between e7isting generations, or create a new master for the e7tract family.



Database Extracts

3.3.3 uerying E7tract 'amilies &ou can 1uery the following attributes to get information about the structure of an e7tract family

DB attributes E@%!" E@%"#! E@%MA E@%A E@% E@%)E E@%'AM (E@"0 (E@M0 (E@A0 VA$ %$"

E7tract !umber E7tract "wner E7tract Master E7tract Ancestors E7tract hildren E7tract )escendants E7tract 'amily "wner 0rimary *ere Master 0rimary *ere Ancestry 0rimary *ere Variant ontrolled

1$2 Creatin& Master and Extract Databases 3.=.3 reating Master )atabases All ma#ter databases 8that is, normal multiwrite databases which are going to have e7tracts created from them9 must be created at the *ub 8when +"/A is used. %hey can be created before giving the command9. &ou should specify the database numbers and matching database file numbers for each database. 'or e7ample: cr d( pipepipe%a de#i acc m$'ti+rite c'aim e)p'icit d( no n &ino n 3.=.= reating E7tracts 8including +lobal wor;ing practice9 E7tracts can be created at any ocation: the parent e7tract must be allocated to the ocation first. i;e other databases in a global project, e7tracts have a primary ocation, and this need not be the same as the 0rimary location of the parent database. /y default, the primary location of the new e7tract will be the current location.

)atabase E7tracts =4;


Database Extracts

(f you are at the *ub and creating an e7tract for a satellite, use the AT option in the CREATE command, %he e7tract will be created with its primary location at the atellite specified. (f you are at an administering location, you must also $#e the AT option if you want to specify that the e7tract will be created at the administered location, otherwise the e7tract will be created at the administered location 8that is, the true current location, 1ueried using Q CURLOC9. %he parent e7tract must be allocated to the current location. #hen you are creating an E7tract at a satellite, ma;e sure you give the CREATE EXTRACT command only once and chec; that the command has completed before issuing a second CREATE EXTRACT command.

%he CREATE EXTRACT command will be e7ecuted by the )aemon 8which will imply a delay in e7ecuting the command9 if any of the following is true: (f the current location is a satellite (f the parent e7tract is primary at another location (f the new child e7tract is specified to be primary at another location

8A% loc option9.

!ote that the ALLOCATE ommand allows child e7tracts to be allocated to a satellite without their parent being allocated, but you will not be able to open the e7tract until all its ancestors have been allocated to the location. 3.=.B reating #or;ing E7tracts #or;ing e7tracts can only be created at the location where the parent e7tract is primary. #or;ing e7tracts do not need to be added to M)/s. #hen you select an M)/ that includes databases for which you have wor;ing e7tracts, you will actually write your data to the wor;ing e7tract. #hen you issue data from a wor;ing e7tract, it will be issued to the database from which the wor;ing e7tract has been created.



Database Extracts

(n order to issue data from an e7tract which has wor;ing e7tracts to an e7tract further up the e7tract tree, there must be a user who does not have a wor;ing e7tract: see the following diagram.

E7tract 3

USERA and USERB will issue to Extract 2. You must have another user with no woring extract to issue !rom Extract 2 to Extract ".

E7tract =

#or;ing E7tract of = for -E$A

)atabase E7tracts =4<

#or;ing E7tract of = for -E$/


Database Extracts

E)tract d(# % 5ene&it# 

They a''o+ persistent c'aim# % changed e'ement# are not $nc'aimed +hen the $#er change# mod$'e or e)it# &rom P!S



The ma#ter 5 i# +ritten to 'e##4 there&ore 'e## #e##ion data i# recorded4 and change management i# (etter contro''ed



=#er# may have >+or*ing e)tract#? &or their private $#e 7Working E)tract#8



e#ign >variant#? can (e tried and maintained 7Variant E)tract#8 A)VA)M3B

E7tracts can be used to control approving and issuing of wor;. 'or e7ample, changes can be issued when given criteria are met. "ther users can then read the approved data rather than the wor;ing data. Variant e7tracts are e7tracts that allow wor; on elements without having to claim items.

)atabase E7tracts =4@


Database Extracts

E)tract /ami'ie# 

An E)tract can (e created &rom another E)tract



T+o or more E)tract# derived &rom the #ame ma#ter d( &orm an Extract Family 



"n the hierarchy (e'o+4 P"PES i# the Master 54 P"PES1 i# owned (y P"PES and i# a member o& P"PES4 P"PES10 i# owned (y P"PES1 !a#ter d(

P"PES P"PES2

P"PES1

P"PES10

P"PES11

P"PES12

/ir#t%'eve' E)tract#

Second%'eve' E)tract#

A)VA)M3C

E7tract families enable several usersD wor; to be combined into another higher4level e7tract, which can then be approved before it is used to update the master. #rite access to the E7tracts is controlled in the first place by the user selecting the M)/ containing the E7tract. E7tracts in the same family can be owned by the same team or by different teams. )ata Access ontrol can be applied. Every E7tract db will have the same db number as the Master db. Every E7tract in an E7tract family will have a uni1ue E)tract N$m(er . B ETO,N gives the owner of an E7tract B ETNO gives the E7tract !umber.



Database Extracts

!$'tip'e ata(a#e# v# E)tract# 

=#e E)tract# &or: 6 Contro''ing data +or*&'o+ +ithin a di#cip'ine 6 Contro''ing cro## di#cip'ine modi&ication# 7eg penetration#4 #$pport#8 6 Per#i#tent c'aim# 6 "ntegrated +or*ing environment +ith other o&&ice# 7'o(a'D8



=#e Separate ata(a#e# &or: 6 Ena('ing cro## di#cip'ine revie+  approva' o& data 6 Cata'og$e4 Li(rary and Temp'ate data 6 Sp'itting data into #ma''er $nit# to avoid ma## data proce##ing thro$gh 'arge co''ection#4 c'a#hing and #patia' map $pdate# 6 Contro''ing the vi#i(i'ity o& data in +or*ing area# 6 Contro''ing the di#tri($tion o& #$(%contractor# data 6 Separating common data &or e)port acro## proect# 6 ed$cing the con#eF$ence# o& po##i('e data corr$ption A)VA)M35



Database Extracts

2 Settin& u' an Extract (ierarch) /efore you start creating e7tracts and wor;ing e7tracts, you should have a clear plan of how they will be used. &ou should maintain diagrams of the basic master 2 e7tract 2 wor;ing e7tract database organisation. %hese help when devising flush and release procedures, and defining M)/s.

'ile number =<< )b number =<<

0(0E20(0E

%irst level extract 'ile numbers will be =<
0(0E2$EV(E#

Second level extract 0(0E2-$$E!%

#oring extract !or UserA

#oring extract !or UserB

'ile numbers will be =<
#oring extract !or User$

#or;ing e7tracts are identified as 0(0E2-$$E!%?E@xxxx where xxxx is the e7tract number

Note: The databases shown are all part of the same extract family, and



Database Extracts

so they will all have the same database number, for example 200.

Operation# on E)tract# % 1 

ETACT CLA"! 6 The tran#&er o& +rite acce## o& a given primary e'ement to an E)tract 6 A c'aim can (e to a &ir#t%'eve' E)tract &rom a !a#ter d(4 or to a 'o+%'eve' E)tract &rom a higher%'eve' E)tract P"PE1

5AN1%1 P"PES10

P"PES P"PES2

P"PES1

P"PES11

P"PES12

A)VA)M3:



Database Extracts


E/ESG 6 =pdate# an E)tract +ith change# made in the o+ning d( A E/ESG can (e to a &ir#t%'eve' E)tract &rom a !a#ter d(4 or to a 'o+%'eve' E)tract &rom a higher%'eve' E)tract 7one 'eve' at a time8 change# P"PES

change#

P"PES2

P"PES1

P"PES10

P"PES11

P"PES12

A)VA)M3F

%he user of an e7tract gives the E/ESG command and updates the changes from the higher4level db. %he user of another e7tract will not see the changes unless they also do a E/ESG. ommand synta7 for E/ESG: ETACT E/ESG 5 5NA!E ETACT E/ESG CE ETACT E/ESG CE G"EACG6 ETACT E/ESG gid ETACT E/ESG gid G"EACG6



Database Extracts

Operation# on E)tract# % 

/L=SG 6 Loca' change# are copied to the o+ning d(4 ($t the e'ement# are not released  =#er# +ho have acce## to the o+ning d( can no+ #ee the change#4 ($t they can not ma*e change# o& their o+n to the e'ement#

change# P"PES P"PES2

P"PES1

change# P"PES10

P"PES11

P"PES12

A)VA)M3>

ommand synta7 for /L=SG: ETACT /L=SG 5 5NA!E ETACT /L=SG CE ETACT /L=SG CE G"EACG6 ETACT /L=SG gid ETACT /L=SG gid G"EACG6



Database Extracts

Operation# on E)tract# % . 

ELEASE 6 =#e a&ter 'oca' change# have (een /L=SGed to the o+ning d(H =#er# +ho have +rite acce## to the o+ning d( can no+ ma*e change# o& their o+n to the e'ement#

change# P"PES

change# P"PES10

P"PES2

P"PES1

P"PES11

P"PES12

A)VA)M3G

ELEASE can only be used if you have not made any changes, or if all the changes that have been done have been /L=SGed. ommand synta7 for ELEASE: ETACT ELEASE 5 5NA!E ETACT ELEASE CE ETACT ELEASE CE G"EACG6 ETACT ELEASE gid ETACT ELEASE gid G"EACG6



Database Extracts


"SS=E 6 The #ame a# /L=SG &o''o+ed (y ELEASE Loca' change# are copied to the o+ning d(4 and the changed e'ement# are re'ea#ed =#er# +ho have +rite acce## to the o+ning d( can no+ ma*e change# to the e'ement#



OP 6 Loca' change# +i'' (e a(andoned There +i'' (e no change to the o+ning d(4 and it +i'' ret$rn to it# #tate (e&ore the change# +ere made 7even i& the $#er ha # done a SAVE,O38 The e'ement# +hich +ere (eing +or*ed on +i'' NOT (e re'ea#ed

A)VA)M=<

ommand synta7 for "SS=E: ETACT "SS=E 5 5NA!E ETACT "SS=E CE ETACT "SS=E CE G"EACG6 ETACT "SS=E gid ETACT "SS=E gid G"EACG6 ommand synta7 for OP: ETACT OP 5 5NA!E ETACT OP CE ETACT OP CE G"EACG6 ETACT OP gid ETACT OP gid G"EACG6



Database Extracts

3 *sin& Extracts in DESI+N A useful 1uerying command when you are using e7tracts in )E(+! is: B 5NA!E %his command will return the name of the database which you are actually writing to.

3$1 *ser Clai%s !ormal multiwrite databases re1uire the user to claim an element before changing it. %his is ;nown as a $#er c'aim. )epending on how the database is set up when it is created, user claims can be implicit or e7plicit, and in either case, when a new element is created, it will be claimed to the user who created it.

Note: In a global project, we recommend that multiwrite databases should be created with EXPLICIT claim mode. -ser claims can be e7plicitly released 8 $nc'aimed9 by the user during a 0)M session, and elements are always unclaimed when the user changes modules or leaves 0)M. %he commands for user claims are: CLA"!    =NCLA"!   

3$2 Extract Clai%s #hen you are using e7tracts, another type of claim, ;nown as an e)tract c'aim, is made as well as user claims. 





(f an element is claimed to an e7tract, only users with write access to the e7tract will be able to ma;e a user claim and start wor; on the element. "nce a user has made a user claim, no other users will be able t o wor; on the elements claimed, as in a normal multiwrite database. (f a user unclaims an element, it will remain claimed to the e7tract until the e7tract claim is re'ea#ed.



Database Extracts

3$3 Co%%and S)ntax %he command synta7 for handling e7tract claims in )E(+! is as follows: >- EXTRACT -+| || || || || | | -

CLAIM ---. | FLUSH ---| | RELEASE -| | ISSUE ---| .-----<---. | / | DROP ----+-*- element -+- HIERARCHY -. | | | | -------------| | | REFRESH -+--- D! "#n$me -------------+--->

CLAIM

Claims the element or the whole database to the extract.

FLUSH

Writes the changes back to the owing extract. The Extract claim is maintained.

ISSUE

Writes the changes back to the owing extract, and releases the extract claim.

RELEASE

Releases the extract claim: this command can only be used to release changes that have already been flushed.

REFRESH

Refreshes the extract with changes that have been made to the owing extract.

DROP

Drops changes that have not been flushed or issued. The user claim must have been unclaimed before this command can be given.

%he HIERARCHY ;eyword must be the last on the command line. (t will attempt to claim to the e7tract all members of the elements listed in the command which are not already claimed to the e7tract. %he elements re1uired can be specified by selection criteria, using a 0M e7pression. 'or e7ample: EXTRACT CLAIM ALL PIPE %HERE &'O%(ER E) USERA, HIERARCHY



Database Extracts

3$4 elationshi' bet!een Extract and *ser Clai%s (f the databases are set up with imp'icit claim, when the user modifies the element, the element will be claimed both to the e7tract and then to t he user. (f the element is already claimed to the e7tract, then the claim will only be made to the user. (f the databases are set up with e)p'icit claim, then the user will need to use the A(M command before modifying the element.

B.C.3 *ow to 'ind "ut #hat &ou an laim /efore you start wor; on an e7tract, you should do a GETWORK and an EXTRACT REFRESH, which will ensure that you have an up4to4date view of the database. %his section e7plains what different users will see as a result of Q CLAIMLIST commands. 'or this e7ample, ta;e the case of a database 0(0E20(0E, accessed by -E$A, with two e7tracts. -sers -E$@3 and -E$@= are wor;ing on the e7tracts.

)/ 0(0E20(0E =SEA

)/ 0(0E20(0E@3 =SE1

)/ 0(0E20(0E4@= =SE2

-E$A creates a 0ipe and flushes the database bac; to the owning database, 0(0E20(0E. %he results of various Q CLAIMLIST commands by the three -sers, together with the e7tract control commands which they have to give to ma;e the new data available, are shown in the following diagram.



Database Extracts

=SEA: ETACT E/ESG 5 P"PEP"PE  A(M(%: none  A(M(% "%*E$: 20(0E43<< E7tract 0(0E20(0E?E@F<<3  A(M(% E@%$A%: 20(0E43<<

=SE1 creates 0(0E43<<

=SE2:

ETACT /L=SG 5 P"PEP"PE

ETACT E/ESG 5 P"PEP"PE

 A(M(%:

 A(M(%:

none  A(M(% "%*E$:

none  A(M(% "%*E$:

none  A(M(% E@%$A%:

20(0E43<< E7tract 0(0E20(0E?E@F<<3  A(M(% E@%$A%:

20(0E43<<

none &ote that USER'2 must use  A(M(% "%*E$ 8not  A(M(% E@%$A%9 to see the claim

Note:

Q CLAIMLIST EXTRACT tells you what you can flush

Q CLAIMLIST OTHERS tells you what you can't claim



Database Extracts

&ou can 1uery the e7tract claimlist for a named database. %he database can be the current on or its owner: ) CLAIMLIST EXTRACT D! "#n$me

#hen you create an element, 0)M only sees it as a user claim, not an e7tract claim, until the element is flushed. (t will then be reported as an e7tract claim 8as well as a user claim, if it has not been unclaimed9. !ote that a change in the claim status of an e7isting element will be shown by the appropriate  CLA!ML!"# command as soon as appropriate updates ta;e place, but a user will have to $E#%&RK as usual to see the changes to the )esign model data. #e recommend that: )atabases which are going to own e7tracts should be created with e7plicit claim mode. /efore you ma;e a user or e7tract claim, you should do an EXTRACT REFRESH and GETWORK . (f you need to claim many elements to an e7tract, it improves performance if the elements are claimed in a single command, for e7ample, by using a collection: EXTRACT CLAIM ALL FROM COLL

(lobal )nl* +he admin daemon will onl* be involved in the claiming ,rocess i! the user is claiming an element !rom a secondar* database - extract to their current ,rimar* extract. In this instance the user will be warned that the element is now being claimed b* the admin daemon. +he user will now when the claim is com,leted b* using (E+#)R/ and checing the claim list.

3$, "lushin& Chan&es #hen an e7tract user ma;es changes and saves them, they are stored in the e7tract. %hese changes can be made available to users in other e7tracts using the EXTRACT FLUSH command. %he FLUSH command operates on a single element or a database or a collection of elements. %he changes to these elements will be made available in the owning e7tract.



Database Extracts

(f changes need to be made available in the master database, it will be necessary to flush the changes up through each level of e7tracts. -sers accessing e7tracts in other branches of the e7tract tree will need to use EXTRACT REFRESH to see the changes. %he following diagram illustrates the se1uence of commands that need to be given so that a user wor;ing on e7tract /= will be able to see the changes made by a user wor;ing on e7tract A=.

MA%E $

= '-* A3 3 '-* A=

B /3 $E'$E*

C $E'$E*

/=

(lobal )nl* +he admin daemon will onl* be involved in the !lush ,rocess i! the user is !lushing changes to a secondar* database - extract !rom their current ,rimar* extract.

3$- eleasin& Clai%s Elements that have been claimed to an e7tract will remain claimed to that e7tract until they are released. Any changes must have been flushed to the owning e7tract before the e7tract claim is released. %he EXTRACT RELEASE command operates on a single element or a database or a collection of elements. %he elements claimed will be released from 8that is, no longer claimed in9 the current e7tract, at which point they will be claimed by the owning e7tract. (f elements need to be made available in the master database, it will be necessary to release the elements up through each level of e7tracts.



Database Extracts

(lobal )nl* +he admin daemon will onl* be involved in the release ,rocess i! the user is releasing elements to a secondar* database - extract !rom their current ,rimar* extract. #hen *ou are !lushing - releasing data !rom a satellite to another location *ou should chec that the !lush has been success!ul be!ore releasing the changes.

3$. Issuin& Chan&es %he ISSUE command is simply a combination of FLUSH and RELEASE.

3$/ Dro''in& Chan&es &ou can drop changes that have not been flushed. %he EXTRACT DROP command will operate on a single element or a database or a collection of elements. &ou cannot drop an element if it owns other significant elements. &ou have to list all the elements in the same EXTRACT DROP command, or drop the lower4level elements first. &ou must UCLAIM any user claim on an element before you can drop it. %he DROP command should be used with care. "nce the changes have been dropped they can only be retrieved using session data or from bac;up.

3$0 ereshin& an Extract (f changes have been made to the data in an e7tract, the changes will not be visible in lower e7tracts unless these e7tracts are refreshed. %he refresh command operates on a database, and it refreshes the database to loo; at the latest state of the owning e7tract. (f the changes are in the master and need to be made available in an e7tract several levels down, each e7tract will need to be refreshed in turn, starting with the e7tract directly beneath the master database and continuing down to t he lower e7tracts.



Database Extracts

!ote the difference between REFRESH and GETWORK : GETWORK will get changes made to databases in the current M)/. REFRESH will get changes made to the owning e7tracts of e7tracts in the M)/.

(lobal )nl* +he re!resh command will onl* re!resh !rom databases local to the satellite. +here!ore i! a secondar* database has not *et been automaticall* u,dated with changes made to the database at the ,rimar* location then these changes will not *et be visible at the local satellite. Extracts below the database will onl* see the latest version o! the secondar* database when the* are re!reshed. +o see the changes made to the ,rimar* database *ou must wait !or the next scheduled automatic u,date be!ore re!reshing.

3$1 artial 'erations #hen named elements are specified in an ISSUE, DROP or FLUSH command, it is ;now as a partial issue, drop or flush. %here are some restrictions on what you can do, as follows: #here a non primary element has changed owner, then the old primary owner and the new primary owner must both be issued bac; at the same time. "therwise there is potential for inconsistencies to occur. (f an element has been unnamed, and the name reused, then both elements must be flushed bac; together. (f an element and its owner have been created then : 



(f the element is included in a partial flush, then its owner must also be included. (f the owner is include in a partial drop, then the element itself must be included.

(f an element and its owner have been deleted then : 







(f the element is included in a partial drop, then its owner must also be included.. (f the owner is included in a partial flush, then the element itself must be included. %he HIERARCHY option will scan elements in both the e7tract and owned e7tract. %hus deleted2moved elements will be included as part of the issue2drop2flush.

&ou can use selection criteria to specify partial issues and flushes.



Database Extracts

Type# o& E)tract % Standard E)tract# 

Simi'ar to norma' data(a#e#4 ie can (e o+ned (y any team4 given any name4 added to !5# in the $#$a' +ay



C'aiming can (e imp'icit or e)p'icit % i& an e'ement i# (eing +or*ed on (y any $#er in the E)tract /ami'y4 no other $#er can +or* on it



Change# &'$#hed (ac* to o+ning data(a#e % c'aimed e'ement# can then (e re'ea#ed4 or *ept c'aimed o$t &or &$rther modi&ication A)VA)M=3



Database Extracts

Type# o& E)tract % Working E)tract# 

,or*ing E)tract# 6 are >one per $#er? E)tract# 6 on'y reF$ire the $#e o& a single !5 6 OP operation# on'y remove one user’s change# !5 A

Approva' E)tract

!5 5

evie+ E)tract

=SEA

=SE5

=SEC

,or*ing E)tract#

A)VA)M==

!ote that the #or;ing E7tracts themselves are not members of an M)/ the owning E7tract db is the member of the M)/. -se: Allows an E7tract to be controlled such that users are restricted to their own wor; area and are not allowed to issue other usersD wor;.



Database Extracts

Type# o& E)tract % Variant E)tract# 

Any e'ement can (e modi&ied4 ie e'ement# are NOT c'aimed



i&&erent $#er# can modi&y the #ame e'ement in di&&erent 7variant8 E)tract#



"& t+o $#er# modi&y the #ame attri($te4 the change# may con&'ict There&ore4 contro' o& thi# #it$ation may (e reF$ired4 $#ing AC#



The $#er +ho ha# i##$ing right# m$#t re#o've any con&'ict# (e&ore i##$ing change# (ac* to the !a#ter d( A)VA)M=B



Database Extracts

4 Extract Sessions #hen an e7tract is created, it is created at a particular session number in the parent e7tract. %his is called the 'in*ed #e##ion. As the owner e7tract is modified, and new sessions added, the lin;ed session on the child e7tract will not change until a refresh or flush is made. !ote that ISSUE and DROP cause an automatic refresh.

E)tract #e##ion no

Lin*ed #e##ion in o+ner

Comment

3

3<

E7tract created

=

3<

Modification made on e7tract

B

3<

Modification made on e7tract

C

35

$efreshed from owner.

5

35

'urther modification.



3>

(ssued

F

3>

'urther modification

>

3>

'urther modification

G

=5

(ssued

#hile a user is ma;ing changes only to the e7tract, the lin;ed session number in the owner stays the same. "n refreshing, the local e7tract is lin;ed to the most recent version of the parent e7tract. %he new session number lin;ed to in the owner depends on the number of flushes done by other users. (n the e7ample the lin;ed session number goes from 3< to 35, indicating that five flushes have been made by other users in the meantime 8assuming that not wor; is being done directly on the owner9.



Database Extracts

4$1 Mer&in& Chan&es #hen a MERGE CHAGES command is given on a )/ with e7tracts, all the lower e7tracts have to be changed to ta;e account of this. %hus doing a MERGE CHAGE on a )/ with e7tracts should not be underta;en lightly. %he following restrictions apply: 



Any sessions lin;ed to owned e7tracts must be preserved. %here may be no users on any lower e7tracts.

#e recommend that you should MERGE CHAGES at the lowest level of e7tracts first, and then wor; up the tree. In a (lobal ,ro0ect MERGE CHAGES can onl* be carried out at the location at which the database and all its descendant extracts are ,rimar*.

Note: !ACKTRACK is not allowed for extract databases.

4$2 5arient Extracts Varients are a special type of e7tracts, with less rigourous control of claiming elements and writing data bac; to the owning e7tract. %hey are designed to allow users to try out different designs, which then may or may not be written bac; to the master. Varients are different from normal e7tracts 8including #or;ing e7tracts9 in the following ways: Any element can be modified without being claimed, and so different users can modify the same element in different varients. #hen data is written bac; to the owning database, it will overwrite any conflicting data in the owner. A varient can have normal e7tracts created from it. !ote that in this case, the varient forms a new root for claiming elements: claims in e7tracts below the varient will not be visible from other parts of the e7tract family, and claims in other parts of the family will not be visible in e7tracts owned by the varient.

)atabase E7tracts =4-0


Database Extracts

Creating an E)tract %1 

On the Admin Elements &orm #e'ect Databases  Extracts &rom the Elements 'i#t4 #e'ect a !$'ti+rite d( &rom the 'i#t4 then c'ic* !reate:

ive# the Databases  Extracts &orm

Se'ect An Extract of a D"4 then c'ic* #$ to give   

A)VA)M=C

E7amples of ynta7 for E7tracts, Variants and #or;ing E7tracts: cr db teama2dbA

)E(

access M-%(#$(%E

cr e7t teamb2db/

'$"M

teama2dbA

A(M E@0((% e7tno 3<<3

desc H)ata 'or ApprovalH

cr e7t teamc2db

'$"M

teama2dbA

A(M E@0((% e7tno 3<<=

desc Hite hange ApprovalH

cr var teamc2db)

'$"M

teama2dbA

A(M E@0((% e7tno 3<
desc Hross )iscip ApprovalH

cr e7t teamd2dbE

'$"M

teamb2db/

A(M E@0((% e7tno 3<
desc H'ab -pdate AreaH

cr e7t teamd2db'

'$"M

teamb2db

 A(M E@0((% e7tno 3<<5 $E'/ 3< des c Hons tr -pdate Ar eaH

cr e7t teamd2db+

'$"M

teamb2db

A(M E@0((% e7tno 3<< $E'/ 3< desc H#or; AreaH


A(M E@0((% dbno 3

fino 3

desc HMaster )ataH


Database Extracts

Creating an E)tract %2 

The !reate Extract &orm Se'ect the data(a#e &or the E)tract

and the o+ning Team

Enter a %ame and a Description &or the E)tract4 then Apply the &orm

A)VA)M=5

Variant E7tracts are created by chec;ing the Variant bo7.



Database Extracts

Creating a ,or*ing E)tract 

On the Admin Elements &orm #e'ect Working Extracts &rom the Elements list 4 then c'ic* !reate&

ive#   

'

A)VA)M=:

)atabase E7tracts =4--


Database Extracts

The !reate Working Extracts &orm Se'ect the d( &rom +hich to create the ,or*ing E)tract

Se'ect the =#er &or the ,or*ing E)tract

Enter a e#cription &or the ,or*ing E)tract4 then Apply the &orm

A)VA)M=F

)atabase E7tracts =4-.


Database Extracts

E)erci#e 1 % Simp'e E)tract Tree 

"n A!"N4 create the #tr$ct$re #ho+n (e'o+: %eamMaster

5

%eamA M)/A -serA

E)tract

M)/MA%E$ -serMaster

E)tract

%eam/

M)//

-ser/

A)VA)M=>



Database Extracts

E)erci#e 1 % Simp'e E)tract Tree 

Gaving created the team#4 data(a#e#4 $#er# and !5#4 add the data(a#e# to the re'evant !5# and any other cata'og$e data(a#e# yo$ reF$ire =#e !5 TA"NA a# a temp'ate



No+ go into P!S into ES"N a# =SEA and a# =SE5 and te#t the #et%$p4 $#ing c'aim4 re&re#h4 i##$e etc



Create #ome P!S e'ement# a# =SEA and i##$e the e'ement# Then go in a# =SE5 and re&re#h the data(a#e to #ee the change# A)VA)M=G

)atabase E7tracts =4-;


Session

3

Data Access Control 6DAC7

)ata Access ontrol 8)A9 B41


Data Access $ontrol 1DA$

"mproved ata Acce## Contro' 7AC8 

=#er# are mem(er# o& Team# On'y Team mem(er# have ,rite acce## to d(# o+ned (y the Team



Acce## Contro' ight# 7AC#8 a''o+ the Admini#trator to: 6 e#trict =#er#? acce## to named e'ement# or given e'ement type#4 or partic$'ar vo'$me# o& the mode' 6 e#trict the type o& operation a =#er can carry o$t on e'ement# 6 e#trict +hich attri($te# a =#er can #et or change



AC can (e app'ied to =pdate or !$'ti+rite 7contro''ed or $ncontro''ed8 data(a#e# A)VA)MB<

e&a$'t 0)M data access control will apply to the 0roject unless the )ata Access ontrol option in A)M(! is switched on. %o switch )A on: 'ro(ect ) Data Access !ontrol* "nce )A is switched on, enera' -sers will not have write access to any elements unless A$s have been set up to give them access rights. /ree -sers always have full access to all elements.



A!+s4 +oles and Scopes 

Each =#er can (e given one or more AC# Each AC con#i#t# o&: 6 A +ole4 +hich de&ine# +hat operation# the =#er can carry o$t on +hich e'ement# 6 A Scope4 +hich de&ine# the part o& the e#ign to +hich the o'e app'ie#



o'e# and Scope# are re&erenced (y AC# and m$#t there&ore (e created (e&ore the AC ha# it# o'ee& and Scopee& #et



o'e# are 'i*e'y to (e $#ed on a'' Proect#4 ($t Scope# are 'ro(ect,Specific  A)VA)MB3

E7ample o'e# 4 reate, Modify and )elete all types of 0iping elements. E7ample Scope# 4 a particular ite in )E(+! or $egistry in )$A'%, or a specified volume within the model.

)ata Access ontrol 8)A9 B4-



'ermissible #perations 7'erops8 

A +ole i# a #et o& 'ermissible #perations -'erops84 +hich de&ine the operation# that can (e per&ormed on a given e'ement type

A)VA)MB=

)ata Access ontrol 8)A9 B4.


S$mmary o& A!"N hierarchy $#ed in ata Acce## Contro' =#er =#er

AC1 AC1

Scope Scope

AC2 AC2

o'e o'e

Perop1 Perop1

Perop2 Perop2

A)VA)MBB




Ena('ing AC 

/rom the 'ro(ect p$''%do+n4 #e'ect:

Data Access !ontrol . . .

to give . . .

A)VA)MBC

%o switch A$s on in a 0roject: !avigate to 2I$" et attribute A$ to %$-E

)ata Access ontrol 8)A9 B4;


Creating o'e# and Scope# 

emem(er that AC# are de&ined in term# o& +oles and Scopes4 #o the#e m$#t (e created &ir#t 6 On the Admin Elements &orm:

Se'ect +oles ive# the !reate +ole &orm

Then c'ic* !reate A)VA)MB5

+ive the $ole a &ame and a Descri,tion. )escription is optional, but is recommended when you later create A$s, the A$ )escription is built from the )escriptions of the $ole and the cope. ogical naming conventions help when generating an A$ system. E7ample synta7: !E# $"E 2name )E Jte7t?stringD !E# 0E$"0 2name "0$EA%E +$A!% "0M")('& +$A!% "0)EE%E +$A!% "0(-E +$A!% "0)$"0 +$A!% EA (%E AA 0-$0 !AM '-! VE "!) 8purp of site e1 JA)MD9




Creating o'e# 

emem(er that +oles are de&ined in term# o& 'ermissible #perations 7'erops84 #o the#e m$#t (e created &ir#t 6 On the !reate +ole &orm: Enter Name

ive# the !reate 'ermissible #peration &orm

C'ic* App'y4 then Create

A)VA)MB:

#hen you clic; App'y, the form changes to a 3odi!* Role form and the $ole is added to the relevant list in the Admin Elements form. %he Create button now becomes active.

)ata Access ontrol 8)A9 B4<


Creating Permi##i('e Operation# 7Perop#8 Name the Perop

Speci&y the e'ement type# to +hich the Perop i# to app'y

Speci&y F$a'i&ying condition# and corre#ponding me##age

Speci&y all operation# a''o+ed Speci&y the attri($te# o& the e'ement to +hich the Perop i# to app'y

A)VA)MBF

&ou can add E'ement type# to the list by pressing A'' or by typing them one at a time into the te7t bo7. &ou can remove an element type by selecting it in the list and pressing emove. (n the event of JcontradictoryD list members, the list member which is highest in the list will always JwinD. A negative condition will always win, irrespective of its position in the list. %he Attri($te# list lets you to specify that the operation is allowed 8D9 or disallowed 8%9 only for specified attributes of the selected element. &ou can add attributes to the list by pressing A'' or by typing attribute names one at a time into the te7t bo7. &ou can further restrict accessible elements by giving a B$a'i&ying Condition, using a 0M e7pression. 'or e7ample: A 0(0E #(%* A%%$(/ A/"$E % 35< (f you specify a 1ualifying condition, you can also set a !e##age to be output if the user is refused access to the element because the condition is not met. %he Operation# options specify the operations allowed on the elements. C'aim and "##$e are only used in !$'ti+rite ata(a#e#.

)ata Access ontrol 8)A9 B4@



Note: All re1uired operations must be set e7plicitly. 'or e7ample, if you select Create, you must also select !odi&y and e'ete, if that is what you want. A 0erop with all options set to (gnore has no effect.

Creating Scope# 

On the Admin Elements &orm   

Se'ect Scopes &rom the Elements 'i#t

ive the Scope a %ame and a Description

ive# the Create Scope &orm

e&ine the Scope Then c'ic* !reate . . .

A)VA)MB>

%he )escription is optional, but it is recommended: when you create A$s, the )escription is built automatically from the )escriptions of the $ole and the cope. %he Scope Se'ection is a 0M e7pression. !ote that, unli;e $oles, copes are project4specific, and they are defined in terms of specific parts of the project data. 'or e7ample, you can specify a cope as being a given ite 8in )E(+!9 or )rawing 8in )$A'%9.



Creating AC# and AC ro$p# 



No+ that Scope#4 o'e# and Perop# have (een created4 AC# can (e de&ined On the Admin Elements &orm4 #e'ect A!+s  A!+ /roups &rom the Elements 'i#t4 then c'ic* !reate ive# the A!+s and A!+ /roups &orm

Se'ect +hether yo$ +i#h to create one A!+ or an A!+ /roup4 then c'ic* O3

A)VA)MBG

etting Acce## Contro' ight# gives the $reate A$R form. etting A gro$p o& AC# gives the $reate A$R (rou, form.




Creating an AC 

7Scope#4 o'e# and Perop# have a'ready (een created % #ee e)erci#e# in training man$a'8 ive the AC a Name

and the Scope

Se'ect the o'e

App'y the &orm Note #e'ected o'e and Scope name# have (een #et here

A)VA)MC<

e#cription is generated automatically from the e#cription# of the o'e and the Scope, and you cannot change it. %he synta7 is: !E# A$ 2name )E Jte7t?stringD $"E$E' 2te7t?string$"E "0E$E' 2te7t?string"0E



Creating an A!+ /roup 

7 A group of A!+s ha# (een #e'ected &rom the A!+s and A!+ /roups &orm8 ive the AC ro$p a Name and a e#cription

Se'ect the AC# that yo$ +ant to (e in the AC ro$p

Move the selected ACRs to the Group

Apply the &orm A)VA)MC3

&ou can now assign an A$ +roup to a -ser.




App'ying AC# 

A =#er can have #evera' AC# 6 Se'ect 0sers on the Admin Elements &orm and #e'ect the =#er yo$ +i#h to a##ign AC# to

Modify the =#er to give   

A)VA)MC=

#he syntax is( )U"ER ACRL! )ACR* )ACR+  -here )U"ER is the .ser to -hi/h the ACRs are to be assigned and ACRL! ACR List1 s2e/iies all ACRs or that .ser'



A##igning AC# to a =#er 

The Modify 0ser &orm

Se'ect the AC# 7or the AC ro$p8 that yo$ +ant to a##ign to the =#er

A##ign the #e'ected AC# 7or AC ro$p8 to the =#er A)VA)MCB

#hen you are planning how to set up A$s for your -sers, the main thing to remember is that once )A is switched on, no enera' -sers have write access to anything unless they are given an A$ that allows it. %he order of A$s is important. "nce 0)M has found an A$ which e7cludes a -ser from carrying out a tas;, it will loo; no further in the list. 'or e7ample, if a -ser has an A$ which only allows Modification of 0ipes within a gi ven one, but not reation, and that A$ is first in the list, the -ser will not be able to reate 0ipes in that one even if an A$ later in the list allows it. A -ser can be assigned one 8or more9 A$ +roups, or several A$s. A$ +roups simply provide a shortcut.




, Data Access Control ,$1 Introduction %he basic method of controlling users access to data in 0)M is by means of the %eams4owning4databases mechanism 6 only members of the %eam owing the database have write4access to it. %his is always the case, but you can additionally use Acce## Contro' ight# 8A$s9 to provide a much more sophisticated level of )ata Access ontrol 8)A9. A$s allow you to: $estrict -sersD access to named elements or given element types, or particular volumes of the model. $estrict the type of operation 8for e7ample, reate, Modify or )elete9 a -ser can carry out on elements. $estrict which attributes a -ser can set or change.

Note: )A will only ta;e effect if it is switched on for the project. "nce )A is switched on, no +eneral -sers will be able to write to any database unless they have A$s permitting them to do so.

,$2 ACs8 oles and Sco'es Each -ser can be given one or more Access ontrol $ights 8A$s9. Each A$ consists of two parts: A o'e, which defines what operations a -ser can carry out on which elements. 'or e7ample, create, modify and delete all types of 0iping elements. A Scope, which defines the part of the design to which the $ole applies, for e7ample, a particular ite 8in )E(+!9 or $egistry 8in )$A'%9, or a specified volume within the model. $oles and copes must be created before you can create A$s. %hey are both defined within a project, but $oles are li;ely to be ompany4wide and used for all projects, and so they are defined in very general terms: copes are project4specific.

921 Permi##i('e Operation# Perop#8 A $ole is a set of Permi##i('e Operation# 8Perop# for short9 which define the operations that can be performed on a given element type.



%he hierarchy of A)M(! elements used in )A is shown below:

=#er

AC1

Scope

AC2

o'e

Perop1

Perop2

,$3 Creatin& oles and ero's %o create a $ole in a project, use the Admin Elements form to display navigate to the $ole #orld 2I$" 8in the system database9 and give the command: ne+ ro'e /rolename &ou can then set the )escription attribute of the $"E. %hen create the 0erops which are owned by the $"E: ne+ perop /name




!ow set the attributes of the 0erop:

Operator Attributes %he "perator attribute are attributes which define the operations that the $ole will allow. %here are si7 attributes, each of which can be set to +$A!%, )E!& or (+!"$E.

If is set to Grant, the Perop will allow users to create the elements specied in the Perop's Eclass attribute, and set their attributes specied in the Perop's Aclass attribute . If is set to Grant, the Perop will allow users to modify the attributes (specied in the Perop's Aclasss attribute) of the elements (specied in the Perop's Eclass attribute). If is set to Grant, the Perop will allow users to delete the elements specied in the Perop's Eclass attribute. If is set to Grant, the Perop will allow users to mae a user claim or an e!tract claim. If is set to Grant, the Perop will allow users to issue chan"es from e!tract databases. If Drop is set to Grant, the perop will allow users to drop chan"ed from the e!tract database. Note: All the operations you require must be specified explicitly. For example, if you select , you must also select and , if that is what you want.



%he Element lass 8Eclass9 attribute of the 0erop specifies all the element types on which the user can perform the operations specified.

Note: All elements must be specified individually: the permission does not cascade to the members of the elements specified. Hence, if you want the Perop to give permissions applying to Branch members, you will need to specify each Piping component (ELBO, FLAN, GASK etc.) individually. &ou can use the !"% ;eyword to stop users changing a small number of elements: for e7ample, setting the Eclass to !"% (%E "!E means that users will be able to change all elements e7cept (%Es and "!Es.

Aclass %he Attribute lass 8attribute lass9 of the 0erop can be set to A, or a list of the Attributes which the 0erop allows to be set or changed. &ou can use the !"% ;eyword to stop users changing a small number of attributes: for e7ample, setting the Aclass to !"% A/"$E */"$E %/"$E means that users will be able to change all the attributes of the elements given in Eclass e7cept A/"$E, */"$E and %/"$E. !ote that you can also use -ser4defined attributes 8-)As9 in this setting.

Condition %he ondition is a 0M e7pression which further restricts the elements to which the operations can be applied. 'or e7ample: A!ORE OF !RA(CH LT 0MM

Acrmessae (f you specify a ondition, you can set a message which will be output when the -ser is refused access to the element because the condition is not met. 'or e7ample: Y12 3$n 1nl4 35e$te #5$n36e7 89t6 #15e le77 t6$n 0MM




,$4 Creatin& Sco'es !ote that, unli;e $oles, copes are project4specific, and they are defined in terms of specific parts of the project data. 'or e7ample, you can specify a cope as being a given ite 8in )E(+!9 or )rawing 8in )$A'%9. %o create a cope, navigate to the cope #orld 2I 8in the ystem database9 and give the command: ne+ #cope /scopename %he most important attribute of the cope is "E, which actually defines what the cope is. (t is set to a 0M e7pression. 'or e7ample: ALL :O(E %ITH FU(C E) PIPE

&ou can also set the )escription attribute of the cope.

,$, Creatin& ACs %o create an A$, navigate to the A$ #orld 2IA$ 8in the ystem database9 and give the command: ne+ acr /acrname %he most important attributes of A$s are %he $"E$E', which must be set to the name of a $ole, for e7ample: 51le5e; /51leA

%he "0E$E', which must be set to the name of a cope, for e7ample: 731e5e; /9e=1ne7

&ou can also set the )escription attribute of the A$. A$s can be collected into AC ro$p#, which can then be assigned to -sers. A$ +roups can only contain A$s, not other A$ +roups.

,$- Assi&nin& ACs to *sers %he ne7t step is to assign A$s to -sers, by setting the A$( 8A$ ist9 attribute of each user to contain all the A$s needed by that user. 'or e7ample: $35l9 /$35 /$35 /$35?5 . . .

,$. (o! ACs are A''lied A -ser can have several A$s. 'or e7ample, someone might be able to create, modify and delete all types of 0ipewor; in one area, but only be able to modify certain attributes of teelwor;. #hen you are planning how to set up A$s for your -sers, the main thing to remember is that once )A is switched on, no +eneral -sers have write access to anything unless they are given an A$ that allows it.



#hen a -ser attempts to carry out a tas;, the list of the -serHs A$s will be chec;ed until an A$ that allows the tas; is found. 'or e7ample, consider a -ser trying to create a 0ipe with a bore of 35. %here may be one A$ which allows creation of 0ipes with bore less than 3<<, and a second A$ which allows creation of 0ipes with bore less than =<<: the operation will be allowed !egative A$s 8that is, A$s which use negative 0erops9 are processed differently. "nce 0)M has found a negative A$ which e7cludes a user from carrying out a tas;, it will loo; no further in the list. %his means that for efficient performance, negative A$s should be placed at the top of the -serHs A$ list.




,$/ *sin& *DAs in DAC &ou can set the Aclass 8Attribute lass9 to restrict access to elements with particular attributes, which can include -)As. (f you want to use -)As, you must: Modify the A)M(! Module definition to give access to )(% databases using the E)(% M")-E command in A)M(! as follows: E"T !O A!"N !OE "CT EA et up an M)/ containing the )(% database in which the -)As are stored, and ma;e sure you select it as you enter A)M(!. -sers will also need to have read access to the )(% database via their M)/s. %he following simple scenario illustrates how you could use -)As in )ata Access ontrol combined with e7tracts, to control wor; flow. %he )esigner $ole would give access to all 0iping elements e7cept those with the -)A :(-E) set to %$-E.

Designer creates data in woring extract and issues to 4I4E-$URRE&+

#or;ing e7tract for -E$A

(-E

0(0E2-$$E!% -ser *EKE$ (-E

Data is checed b* user $5E$/ER who does not have a woring extract o! 4I4E-$URRE&+ I! )/ 6$5E$/ED set to +RUE and elements issued to 4I4E-$5E$/ED &ow Designers cannot modi!* checed data.

0(0E2*EKE)



E)erci#e 2 % ata Acce## Contro' 

Create a AC #et that on'y a''o+# a piping engineer create and modi&y pipe#



!a*e #$re yo$ #et the AC $p #o that the $#er cannot create anything other than pipe# and (e'o+



A##ign thi# ne+ AC to =SEA4 created in E)erci#e 1



o into P!S and te#t the $#er# acce## to ES"N A)VA)MCC








S$mmary E7tracts 6 E7isting Multiwrite facilities 6 E7tracts and there benefits 6 E7tract operations in )esign 6 #or;ing and Variant E7tracts



)ata Access ,ontrol 6 copes and $oles 6 Access ,ontrol $ights

A)VA)MC5



E)erci#e - % ,or*ing E)tract# 

"n A!"N4 create the #tr$ct$re #ho+n (e'o+: 5

%eamMaster M)/MA%E$ -serMaster

%eamA M)/A

%eam/

E)tract

E)tract

-serA

-ser/

AA

A/

/A

M)//

//

A)VA)MC:





Gaving created the team#4 data(a#e#4 $#er# and !5#4 add the data(a#e# to the re'evant !5# and any other cata'og$e data(a#e# yo$ reF$ire =#e !5 TA"NA a# a temp'ate



"& yo$ enter P!S a# a +or*ing e)tract $#er 7AA8 then +hen yo$ #et the !5 !5A4 the +or*ing e)tract +i'' a$tomatica''y (e #+apped into the !5 &or that $#er



Try +or*ing in ES"N a# a +or*ing e)tract $#er and i##$e the +or* Enter P!S a# =SEA and i##$e the +or* to the !a#ter d( A)VA)MCF




Chec* the !a#ter 5 ha# the data yo$ e)pected



E)periment +ith the #et%$p and &ami'iari#e yo$r#e'& +ith each d( and it# ro'e in the #tr$ct$re

A)VA)MC>




E ) e r c i# e . %  a ta A p p r o v a ' 

= # in g A C 0 S a n d th e # tr $ c t$ r e c re a te d in E ) e r c i# e - 4 d e &in e a n a p p r o v a ' m e c h a n i# m th a t + i'' o n 'y a ''o + t h e & o ' 'o + in g : = #er

E 'e m e n t#

A ttr i( $ te #

C o n d it io n

O p e r a t io n #

AA

0 ip e a n d / r a n

A ll

' u n c o f 0 ip e e 1 0 r e lim in a r y

 la im , M o d if y

AA

/ e lo w 0 ip e

A ll

' u n c o f 0 ip e e 1 0 r e lim in a r y

 r e a t e , M o d if y , ) e le te

AA

0 ip e

' u n c o f 0 ip e e 1 ) e s ig n e d

(s s u e

-E$A

0 ip e

' u n c o f 0 ip e e 1 A p p r o v e d

(s s u e

-E$A

0 ip e

A ll

-E$A

0 ip e

'unc

 re a te ' u n c o f 0 ip e e 1 ) e s ig n e d

M o d if y

A)VA)MCG



E)erci#e . % ata Approva' 

o into P!S a# =SEA and create #ome pipe# and #et the &$nction to IPre'iminaryJ



No+ go in a# the piping $#er AA and create the piping component# and te#t yo$r AC#



Change the &$nction to Ie#ignedJ and i##$e the comp'eted pipe



/ina''y go into P!S a# =SEA and change &$nction o& a pipe that i# e#igned to Approved and i##$e

A)VA)M5<


Advanced ADMIN Training Manual Manual


E)erci#e 9 % Proect Str$ct$re 

Con#ider yo$r company?# reF$irement# &or acce## contro' and approva' mechani#m# and the +ay in +hich they divide the data into data(a#e#



e#ign an e)tract #tr$ct$re &or the a typica' proect proced$re +ithin yo$r company $#ing the ne+ A!"N &aci'itie# avai'a('e



ra+ yo$r #tr$ct$re o$t (e&ore creating it +ithin P!S A!"N

A)VA)M53

)ata Access ontrol 8)A9 B4-0

Advanced ADMIN Training Manual Manual

Review and %eedbac

Session

4

evie! and "eedbac#

$eference and 'urther $eading ummary )iscussion 'eedbac; from %raining ourse )elegates

+e1iew and Feedback 2,3

Ad1anced ADM4% 5raining 5raining Manual


eerence and "urther eadin&

Other So$rce# o& "n&ormationK •The PDMS ADMIN Command Reference Manual . See C:\CADCENTRE\pdms11.3\manuals\pdms1131\man17\doc1.pdf

•The PDMS ADMIN User Guide. See C:\CADCENTRE\pdms11.3\manuals\pdms1131\man1\doc1.pdf

•The !nl"ne #elp

$%n a s&anda'd "ns&alla&"on of PDMS 11.3

A'#o avai'a('e =#ing P!S 'o(a' !anagement P!S 'o(a' =#er $ide P!S A!"N Command e&erence $ide


Ad1anced ADM4% 5raining Manual


Su%%ar)

)atabase E7tracts )atabase E7tract 'amilies )ata Access ontrol $oles, copes and 0erops


Ad1anced ADM4% 5raining Manual

Advanced Admin Pdms

Recommend Documents