Documente Academic
Documente Profesional
Documente Cultură
Version 11.4
Advanced ADMIN
Administration
Course Workbook
PLEASE NOTE:
AVEVA has a policy of continuing product development: therefore, the information
contained in this document may be subject to change without notice.
AVEVA MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
DOCUMENT, INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
While every effort has been made to verify the accuracy of this document, AVEVA
shall not be liable for errors contained herein or direct, indirect, special, incidental or
consequential damages in connection with the furnishing, performance or use of this
material.
This manual provides documentation relating to products which you may not have
access to or which may not be licensed to you. For further information on which
Products are licensed to you please refer to your licence conditions.
All rights reserved. No part of this document may be reproduced, stored in a retrieval
system or transmitted, in any form or by any means, electronic, mechanical,
photocopying, recording or otherwise, without prior written permission of AVEVA.
The software programs described in this document are confidential information and
proprietary products of AVEVA Ltd or its licensors.
Visit our website at http://www.aveva.com
Contents
Advanced ADMIN
Administration
Session 1
Introduction
Content
A one-day course on use of Advanced ADMIN
Concepts and Terminology
Database Extracts
Data Access Control
Assumptions
Level of knowledge of Administration
Level of knowledge of PDMS
ADVADM5
This course is designed and run by AVEVA Ltd. to familiarise users with Extracts and
Data Access Control techniques for Vantage PDMS.
It assumes that participants are fully conversant with the PDMS ADMIN module and
have themselves, administered a PDMS project.
Course delivery
Workbook
ADVADM6
The course will consist of lecture material together with practical exercises for each
session. There will be a large worked exercise on day two.
The supporting workbook provides a backup to the lecture and exercises during the
course and a valuable reference guide after the course.
At the end of the workbook you will find references to further reading and information
sources.
Session 2
Database Extracts
ADVADM10
Extracts
Master DB
Extract A Extract B
SAVEWORK
ADVADM11
When you do a SAVEWORK, the changed data will be saved back to the Extract.
The unchanged data will still be read via pointers back to the Master db.
When required, changes made to the Extract are written back to the Master db.
The Extract itself can be updated to reflect changes made to the Master.
1 Extracts
PIPES
PIPES_X PIPES_X2
In this example:
PIPES istheMaster
andtheparentofPIPES_X1
PIPES_X1 isachildofPIPES
andtheparentofPIPES_X10
PIPES_X10 isachildofPIPES_X1
The members of PIPES are PIPES_X1 and PIPES-X2.
Write access to extracts is controlled in the same way as any other database:
The user must be a member of the Team owning the Extract. Extracts in the same family can
be owned by the same team or by different teams.
The user must select an MDB containing the extract.
Data Access Control can be applied.
Note: At this release, you can only create an extract at the bottom of an
extract tree: you cannot insert a new extract between existing
generations, or create a new master for the extract family.
You can query the following attributes to get information about the structure of
an extract family
DB attributes
All master databases (that is, normal multiwrite databases which are going to
have extracts created from them) must be created at the Hub (when GLOBAL
is used. They can be created before giving the make global command).
You should specify the database numbers and matching database file numbers
for each database. For example:
cr db pipe/pipe-a desi acc multiwrite claim explicit db no n fino n
Extracts can be created at any Location: the parent extract must be allocated to
the Location first.
Like other databases in a global project, extracts have a primary Location, and
this need not be the same as the Primary location of the parent database. By
default, the primary location of the new extract will be the current location.
If you are at the Hub and creating an extract for a satellite, use the AT option in the CREATE
command, The extract will be created with its primary location at the Satellite specified.
If you are at an administering location, you must also use the AT option if you want to
specify that the extract will be created at the administered location, otherwise the extract will
be created at the administered location (that is, the true current location, queried using
Q CURLOC). The parent extract must be allocated to the current location.
When you are creating an Extract at a satellite, make sure you give the CREATE EXTRACT
command only once and check that the command has completed before issuing a second
CREATE EXTRACT command.
The CREATE EXTRACT command will be executed by the Daemon (which will
imply a delay in executing the command) if any of the following is true:
Working extracts can only be created at the location where the parent extract is
primary.
Working extracts do not need to be added to MDBs. When you select an MDB
that includes databases for which you have working extracts, you will actually
write your data to the working extract.
When you issue data from a working extract, it will be issued to the database
from which the working extract has been created.
In order to issue data from an extract which has working extracts to an extract
further up the extract tree, there must be a user who does not have a working
extract: see the following diagram.
Extract 1
USERA and
USERB will issue
to Extract 2.
You must have
Extract 2 another user with
no working extract
to issue from
Extract 2 to
Extract 1.
Working Working
Extract of 2 Extract of 2
for USERA for USERB
Extracts can be used to control approving and issuing of work. For example,
changes can be issued when given criteria are met. Other users can then read the
approved data rather than the working data.
Variant extracts are extracts that allow work on elements without having to claim
items.
Extract Families
PIPES Master db
ADVADM14
Extract families enable several users work to be combined into another higher-level
extract, which can then be approved before it is used to update the master.
Write access to the Extracts is controlled in the first place by the user selecting the
MDB containing the Extract.
Extracts in the same family can be owned by the same team or by different teams.
Data Access Control can be applied.
Every Extract db will have the same db number as the Master db.
Every Extract in an Extract family will have a unique Extract Number.
Q EXTOWN gives the owner of an Extract; Q EXTNO gives the Extract Number.
Note: Thedatabasesshownareallpartofthesameextractfamily,and
sotheywillallhavethesamedatabasenumber,forexample200.
Operations on Extracts - 1
EXTRACT CLAIM
The transfer of write access of a given
primary element to an Extract.
A claim can be to a first-level Extract from
a Master db, or to a low-level Extract from a
higher-level Extract.
/PIPE1
PIPES
PIPES_X1 PIPES_X2
/BRAN1-1
ADVADM16
Operations on Extracts - 2
REFRESH
Updates an Extract with changes made in the owning db. A
REFRESH can be to a first-level Extract from a Master db, or
to a low-level Extract from a higher-level Extract (one level at
a time).
changes
PIPES
changes
PIPES_X1 PIPES_X2
ADVADM17
The user of an extract gives the REFRESH command and updates the changes from
the higher-level db. The user of another extract will not see the changes unless they
also do a REFRESH.
Command syntax for REFRESH:
EXTRACT REFRESH DB DB/NAME
EXTRACT REFRESH CE
EXTRACT REFRESH CE HIERARCHY
EXTRACT REFRESH gid
EXTRACT REFRESH gid HIERARCHY
Operations on Extracts - 3
FLUSH
Local changes are copied to the owning db, but the elements
are not released. Users who have access to the owning db
can now see the changes, but they can not make changes of
their own to the elements.
changes
PIPES
PIPES_X1 PIPES_X2
changes
ADVADM18
Operations on Extracts - 4
RELEASE
Use after local changes have been FLUSHed to the owning
db; Users who have write access to the owning db can now
make changes of their own to the elements.
changes
PIPES
PIPES_X1 PIPES_X2
changes
ADVADM19
RELEASE can only be used if you have not made any changes, or if all the changes
that have been done have been FLUSHed.
Operations on Extracts - 5
ISSUE
The same as FLUSH followed by RELEASE. Local
changes are copied to the owning db, and the changed
elements are released. Users who have write access to
the owning db can now make changes to the elements.
DROP
Local changes will be abandoned. There will be no
change to the owning db, and it will return to its state
before the changes were made (even if the user has
done a SAVEWORK). The elements which were being
worked on will NOT be released.
ADVADM20
CLAIM Claimstheelementorthewholedatabasetotheextract.
FLUSH Writesthechangesbacktotheowingextract.TheExtract
claimismaintained.
ISSUE Writesthechangesbacktotheowingextract,and
releasestheextractclaim.
RELEASE Releasestheextractclaim:thiscommandcanonlybe
usedtoreleasechangesthathavealreadybeenflushed.
REFRESH Refreshestheextractwithchangesthathavebeenmade
totheowingextract.
DROP Dropschangesthathavenotbeenflushedorissued.The
userclaimmusthavebeenunclaimedbeforethis
commandcanbegiven.
The HIERARCHY keyword must be the last on the command line. It will attempt to claim
to the extract all members of the elements listed in the command which are not already
claimed to the extract.
The elements required can be specified by selection criteria, using a PML expression.
For example:
EXTRACT CLAIM ALL PIPE WHERE (:OWNER EQ USERA) HIERARCHY
Before you start work on an extract, you should do a GETWORK and an EXTRACT
REFRESH, which will ensure that you have an up-to-date view of the database.
This section explains what different users will see as a result of Q CLAIMLIST
commands.
For this example, take the case of a database PIPE/PIPE, accessed by USERA, with
two extracts. Users USERX1 and USERX2 are working on the extracts.
DB PIPE/PIPE
USERA
DB PIPE/PIPE-X2
DB PIPE/PIPEX1
USERX2
USERX1
USERA creates a Pipe and flushes the database back to the owning database,
PIPE/PIPE. The results of various Q CLAIMLIST commands by the three Users, together
with the extract control commands which they have to give to make the new data
available, are shown in the following diagram.
USERA:
EXTRACT REFRESH DB PIPE/PIPE
Q CLAIMLIST:
none
Q CLAIMLIST OTHER:
/PIPE-100 Extract PIPE/PIPE_EX7001
Q CLAIMLIST EXTRACT:
/PIPE-100
Note:
Q CLAIMLIST EXTRACT
tellsyouwhatyoucanflush
Q CLAIMLIST OTHERS
tellsyouwhatyoucan'tclaim
You can query the extract claimlist for a named database. The database can be the
current on or its owner:
Q CLAIMLIST EXTRACT DB dbname
When you create an element, PDMS only sees it as a user claim, not an extract claim,
until the element is flushed. It will then be reported as an extract claim (as well as a
user claim, if it has not been unclaimed).
Note that a change in the claim status of an existing element will be shown by the
appropriate Q CLAIMLIST command as soon as appropriate updates take place, but a
user will have to GETWORK as usual to see the changes to the Design model data.
We recommend that:
Databases which are going to own extracts should be created with explicit claim mode.
Before you make a user or extract claim, you should do an EXTRACT REFRESH and GETWORK.
If you need to claim many elements to an extract, it improves performance if the elements
are claimed in a single command, for example, by using a collection:
EXTRACT CLAIM ALL FROM !COLL
Global Only
The admin daemon will only be involved in the claiming process if the user is claiming
an element from a secondary database / extract to their current primary extract. In this
instance, the user will be warned that the element is now being claimed by the admin
daemon. The user will know when the claim is completed, by using GETWORK and
checking the claim list.
MASTE
R
2
FLUSH
A1 3 B1
REFRESH 4
1
REFRESH
FLUSH
A2 B2
Global Only
The admin daemon will only be involved in the flush process if the user is flushing
changes to a secondary database / extract from their current primary extract.
Global Only
The admin daemon will only be involved in the release process if the user is releasing
elements to a secondary database / extract from their current primary extract.
When you are flushing / releasing data from a satellite to another location, you should
check that the flush has been successful before releasing the changes.
Global Only
The refresh command will only refresh from databases local to the satellite. Therefore,
if a secondary database has not yet been automatically updated with changes made to
the database at the primary location, then these changes will not yet be visible at the
local satellite. Extracts below the database will only see the latest version of the
secondary database when they are refreshed. To see the changes made to the
primary database, you must wait for the next scheduled automatic update before
refreshing.
Working Extracts
are one per user Extracts
only require the use of a single MDB
DROP operations only remove one users changes
ADVADM22
Note that the Working Extracts themselves are not members of an MDB; the owning
Extract db is the member of the MDB.
Use: Allows an Extract to be controlled such that users are restricted to their own
work area and are not allowed to issue other users work.
4 Extract Sessions
When an extract is created, it is created at a particular session number in the parent
extract. This is called the linked session. As the owner extract is modified, and new
sessions added, the linked session on the child extract will not change until a refresh
or flush is made.
Note that ISSUE and DROP cause an automatic refresh.
While a user is making changes only to the extract, the linked session number in the
owner stays the same. On refreshing, the local extract is linked to the most recent
version of the parent extract.
The new session number linked to in the owner depends on the number of flushes
done by other users. In the example the linked session number goes from 10 to 15,
indicating that five flushes have been made by other users in the meantime (assuming
that not work is being done directly on the owner).
We recommend that you should MERGE CHANGES at the lowest level of extracts first,
and then work up the tree.
In a Global project, MERGE CHANGES can only be carried out at the location at which
the database and all its descendant extracts are primary.
Note: BACKTRACKisnotallowedforextractdatabases.
Creating an Extract -1
Gives the
Databases & Extracts
form
ADVADM24
cr db teama/dbA DESI access MULTIWRITE CLAIM EXPLICIT dbno 1 fino 1 desc 'Master Data'
cr ext teamb/dbB FROM teama/dbA CLAIM EXPLICIT extno 1001 desc 'Data For Approval'
cr ext teamc/dbC FROM teama/dbA CLAIM EXPLICIT extno 1002 desc 'Site Change Approval'
cr var teamc/dbD FROM teama/dbA CLAIM EXPLICIT extno 1003 desc 'Cross Discip Approval'
cr ext teamd/dbE FROM teamb/dbB CLAIM EXPLICIT extno 1004 desc 'Fab Update Area'
cr ext teamd/dbF FROM teamb/dbC CLAIM EXPLICIT extno 1005 REFB 10 desc 'Constr Update Area'
cr ext teamd/dbG FROM teamb/dbC CLAIM EXPLICIT extno 1006 REFB 10 desc 'Work Area'
Creating an Extract -2
ADVADM25
Gives . . . .
ADVADM26
ADVADM27
TeamMaster
MDBMASTER
DB UserMaster
ADVADM28
Default PDMS data access control will apply to the Project unless the Data Access
Control option in ADMIN is switched on.
To switch DAC on:
Project > Data Access Control
Once DAC is switched on, General Users will not have write access to any
elements unless ACRs have been set up to give them access rights. Free Users
always have full access to all elements.
Example Roles - Create, Modify and Delete all types of Piping elements.
Example Scopes - a particular Site in DESIGN or Registry in DRAFT, or a specified
volume within the model.
ADVADM32
User
User
ACR1
ACR1 ACR2
ACR2
Scope
Scope Role
Role
Perop1
Perop1 Perop2
Perop2
ADVADM33
Enabling DAC
From the Project pull-down, select:
to give . . .
ADVADM34
Select Roles
Gives the
Create Role
form
Creating Roles
Remember that Roles are defined in terms of
Permissible Operations (Perops), so these must be
created first.
On the Create Role form:
Enter Name
Gives the
Create Permissible
Operation form
ADVADM36
When you click Apply, the form changes to a Modify Role form and the Role is
added to the relevant list in the Admin Elements form. The Create button now
becomes active.
ADVADM37
You can add Element types to the list by pressing All or by typing them one at a
time into the text box. You can remove an element type by selecting it in the list and
pressing Remove. In the event of contradictory list members, the list member which
is highest in the list will always win. A negative condition will always win,
irrespective of its position in the list.
The Attributes list lets you to specify that the operation is allowed (+) or disallowed
(-) only for specified attributes of the selected element. You can add attributes to the
list by pressing All or by typing attribute names one at a time into the text box.
You can further restrict accessible elements by giving a Qualifying Condition, using
a PML expression. For example:
ALL PIPES WITH ATTRIB ABORE LT 150
If you specify a qualifying condition, you can also set a Message to be output if the
user is refused access to the element because the condition is not met.
The Operations options specify the operations allowed on the elements. Claim and
Issue are only used in Multiwrite Databases.
Note: All required operations must be set explicitly. For example, if you select
Create, you must also select Modify and Delete, if that is what you want. A Perop
with all options set to Ignore has no effect.
Creating Scopes
Then click
Create . . .
ADVADM38
The Description is optional, but it is recommended: when you create ACRs, the
Description is built automatically from the Descriptions of the Role and the Scope.
The Scope Selection is a PML expression.
Note that, unlike Roles, Scopes are project-specific, and they are defined in terms of
specific parts of the project data. For example, you can specify a Scope as being a
given Site (in DESIGN) or Drawing (in DRAFT).
ADVADM39
Creating an ACR
Description is generated automatically from the Descriptions of the Role and the
Scope, and you cannot change it.
The syntax is:
NEW ACR /name
DESC text_string
ROLEREF /text_stringROLE
SCOPEREF /text_stringSCOPE
Applying ACRs
ADVADM42
When you are planning how to set up ACRs for your Users, the main thing to
remember is that once DAC is switched on, no General Users have write access to
anything unless they are given an ACR that allows it.
The order of ACRs is important. Once PDMS has found an ACR which excludes a
User from carrying out a task, it will look no further in the list. For example, if a User
has an ACR which only allows Modification of Pipes within a given Zone, but not
Creation, and that ACR is first in the list, the User will not be able to Create Pipes in
that Zone even if an ACR later in the list allows it.
A User can be assigned one (or more) ACR Groups, or several ACRs. ACR Groups
simply provide a shortcut.
5.1 Introduction
The basic method of controlling users access to data in PDMS is by means of the
Teams-owning-databases mechanism only members of the Team owing the
database have write-access to it. This is always the case, but you can additionally use
Access Control Rights (ACRs) to provide a much more sophisticated level of Data
Access Control (DAC). ACRs allow you to:
Restrict Users access to named elements or given element types, or particular volumes of
the model.
Restrict the type of operation (for example, Create, Modify or Delete) a User can carry out on
elements.
Restrict which attributes a User can set or change.
Note: DAC will only take effect if it is switched on for the project. Once
DAC is switched on, no General Users will be able to write to any
database unless they have ACRs permitting them to do so.
A Role is a set of Permissible Operations (Perops for short) which define the
operations that can be performed on a given element type.
User
ACR1 ACR2
Scope Role
Perop1 Perop2
Operator Attributes
The Operator attribute are attributes which define the operations that the Role will
allow. There are six attributes, each of which can be set to GRANT, DENY or IGNORE.
Note: Alltheoperationsyourequiremustbespecifiedexplicitly.For
example,ifyouselectCreate,youmustalsoselectModifyand
Delete,ifthatiswhatyouwant.
Aclass
The Attribute Class (attribute Class) of the Perop can be set to ALL, or a list of the
Attributes which the Perop allows to be set or changed. You can use the NOT keyword
to stop users changing a small number of attributes: for example, setting the Aclass to
NOT ABORE HBORE TBORE
means that users will be able to change all the attributes of the elements given in
Eclass except ABORE, HBORE and TBORE.
Note that you can also use User-defined attributes (UDAs) in this setting.
Condition
The Condition is a PML expression which further restricts the elements to which the
operations can be applied. For example:
ABORE OF BRANCH LT 150MM
Acrmessage
If you specify a Condition, you can set a message which will be output when the User
is refused access to the element because the condition is not met. For example:
You can only create branches with bore less than 150MM
ISSUE
PIPE/CHECKED
ADVADM44
Summary
Extracts
Existing Multiwrite facilities
Extracts and there benefits
Extract operations in Design
Working and Variant Extracts
Data Access Control
Scopes and Roles
Access Control Rights
ADVADM45
TeamMaster
DB
MDBMASTER
UserMaster
TeamA TeamB
Extract Extract
MDBA UserA UserB MDBB
AA AB BA BB
ADVADM46
ADVADM48
E x e r c is e 4 - D a ta A p p r o v a l
U s in g A C R S a n d th e s tr u c tu r e c r e a te d in
E x e r c is e 3 , d e fin e a n a p p r o v a l m e c h a n is m t h a t
w ill o n ly a llo w th e f o llo w in g :
U ser E le m e n t s A ttrib u te s C o n d it io n O p e r a t io n s
AA P ip e a n d B r a n A ll F u n c o f P ip e e q P r e lim in a r y C la im , M o d if y
AA B e lo w P ip e A ll F u n c o f P ip e e q P r e lim in a r y C r e a t e , M o d if y , D e le te
AA P ip e F u n c o f P ip e e q D e s ig n e d Is s u e
USERA P ip e F u n c o f P ip e e q A p p r o v e d Is s u e
USERA P ip e A ll C re a te
USERA P ip e Func F u n c o f P ip e e q D e s ig n e d M o d if y
ADVADM 49
ADVADM50
ADVADM51
Session 4
Review and Feedback
Also available
Summary
Database Extracts
Database Extract Families
Data Access Control
Roles, Scopes and Perops
Discussion