Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category

Tech Note 1000

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category

All Tech Notes, Tech Alerts and KBCD documents and software are provided "as is" without warranty of any kind. See the Terms of Use for more information.

Topic#: 002830
Created: January 2014

Introduction
This Essentials Guide is the 3rd in a projected series.

This Tech Note discusses the IDE Attribute Category and its usage. In addition, we utilize an ArchestrA Object Toolkit (AOT) sample to
demonstrate the assignment of additional Attribute Categories at the ArchestrA Object (AA Object) level. Included is a table listing all
Attribute Category types available in ArchestrA.

Application Versions
Wonderware Application Server 2012 and later

Attribute Category Review

The Attribute Category determines the behavior of one attribute. The defined attribute has the same behavior for every Galaxy logged-
on user.

The category of an attribute is used to denote whether:

This attribute is accessible during the configuration or runtime.

This attribute can provide value propagation with object templates.

This attribute’s value will be retained during a failover.

All attributes existing in the ArchestrA provided by primitives or objects, such as WinPlatform, AppEngine, etc. have corresponding
Category Types predefined. For example,

Primitive Attribute Category

WinPlatform PlatformInfo Calculated

WinPlatform Host SystemWriteable

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category
AppEngine ScanStatCmd Writeable_US

AppEngine ExecutionRelatedObject Writeable_C_Lockable

... ... ...

The ArchestrA attribute can use many available Category Types. See the end of this Tech Note for details.

Define the following four types of the Category when creating an UDA (in the IDE):

Calculated: Permits only scripts within the same object to write to the attribute. Calculated attributes are not saved across
restarts.

Calculated Retentive: Permits only scripts within the same object to write to the attribute. Calculated Retentive attributes are
saved across restarts.

Object Writable: Permits other objects to write to this attribute in addition to being set by scripts within this object. Object
Writeable attributes are saved across restarts, and they are Writeable_S. This category is not user-writeable.

User Writeable: Permits other users to write to this attribute in addition to being set by scripts and objects throughout the
system.

User writeable attributes are saved across restarts, they are Writeable_USC_Lockable, and they can be locked at configuration
time. This category is user writeable.

We will explain each Category Type in the following section.

For other Category Types, you can use Wonderware AOT to create customized primitives or objects with the desired Category Type for
each attribute. We will show this procedure in a later section of this Tech Note.

IDE Category Types Working Scenarios

Initialization
Among the IDE Category Types, the Calculated and Calculated Retentive cannot have a predefined initial value after it is deployed. At
this moment, the attribute’s Quality is showing 20:Initializing.

FiGurE 1: INitial RuNtiME ValuEs of IDE CatEGorY TYpEs

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category

Writeable Restriction
Due to the definition of IDE Category Types, only the logged-on user can change value of User writeable Category Type. Otherwise, we
will see an error:

FiGurE 2: LoGGEd -ON UsEr CaNNot CHaNGE tHE ABovE THrEE CatEGorY TYpEs' ValuEs iN OBJEct ViEwEr or INToucH UsEr INput

Writeable for Script

Script has the Writeable permission on all of the four IDE Category Types' attributes.

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category

FiGurE 3: Script caN WritE ValuEs to All IDE CatEGorY TYpEs

Writeable for Crossing AA Objects

For the Calculated or Calculated Retentive type of attribute, Script only has the Write permission within the AA Object's boundary.

1. Set up an object called UDOCategoryTest (AA Object) with the following initial values:

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category

FiGurE 4: AA TEst OBJEct INitial ValuEs

2. Set up another object called UDOCategoryOtherObj (AA Object) with the following script:

FiGurE 5: Script for UDOCatEGorYOtHErOBJ

3. To test, from the UDOCategoryOtherObj AA Object, set the command me.CrossObject to True.

The values for the Calculated and Calculated Retentive type attributes do not change.

FiGurE 6: CalculatEd aNd CalculatEd REtENtivE AttriButE TYpEs CaNNot CHaNGE ValuE Across tHE AA OBJEct's BouNdarY

Attribute Value for Failover

Among the four IDE Category Types, only the Calculated UDA is not Checkpointed. This means the value of the UDA is not passed to
the newly-started partner AppEngine after a Failover is finished.

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category

FiGurE 7: INitial SEttiNGs for IDE CatEGorY UDAs

FiGurE 8: UDA ValuEs BEforE FailovEr

FiGurE 9: AftEr FailovEr, CalculatEd TYpE UDA DoEs Not HavE tHE ValuE PassEd to tHE NEwlY-StartEd PartNEr AppENGiNE

Field Attributes
Each Field Attribute could have one Access mode selecting from Input, Output or InputOutput Extensions.

Unlike the UDA, within the Field Attribute, each Access Extension mode has different Category Types defined.

Access Extension Category Types Selection

Input NONE

Output Calculated, Calculated Retentive, Object Writeable and User Writeable

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category

InputOutput Object Writeable and User Writeable

The following bullets give detailed explanations.

Input Access mode: A Field Attribute (FA) with this mode means this FA cannot have its own value or quality. It only references
the value or quality from other Attribute. There is no Writeable Requirement. Therefore, Input Extension does not need any
IDE Category.

The following screenshots show the principle of the Input Extension Access mode.

FiGurE 10: DEfiNE aN INput AccEss ModE FiEld AttriButE WitHout ANY INput SourcE (REfErENcE to OtHEr AttriButE)

In the Object Viewer, the Input Access mode Field Attribute does not have any initial value and the Quality is bad. If setting a
value to this attribute, we see the error.

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category

FiGurE 11: INput AccEss ModE FiEld AttriButE CaNNot SEt ANY ValuE BEcausE it is for rEfErENciNG OtHEr AttriButEs

Add a reference in the Input source Text box (Figure 12 below).

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category

FiGurE 12: Add a REfErENcE to tHE CPULoad SYstEM AttriButE iN tHE INput SourcE TEXt BoX

The result is that the Field Attribute called ExecuteCntFieldAttribute is pointing to the CPULoad Attribute:

FiGurE 13: FiEld AttriButE PoiNts to CPULoad AttriButE

Output Access Mode

Unlike the Input Extension, the Output Extension allows the Field Attribute's value to write to an external reference destination. In
other words, when this Field Attribute's value is changed, it updates the value of the external attribute.

Because of the Writeable requirement, the Output Extension Access mode needs all four IDE’s Category Types. The following screenshots

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category
demo the principle of the Output Extension Access mode.

Setup

Item Definition Value

Field Attribute OutputExtensionMode

Access Mode Output

Output Source Me.GRPlatformCPULoad

UDA GRPlatformCPULoad

FiGurE 14: ValuE ModificatioN oN OutputEXtENsioNModE UpdatEs tHE Output DEstiNatioN ME.GRPlatforMCPULoad

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category

FiGurE 15: ModifY tHE ValuE of tHE FiEld AttriButE OutputEXtENsioNModE witH a SiMplE Script

FiGurE 16: GRPlatforMCPULoad UDA

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category
After the deployment, you see the following result.

FiGurE 17: REsult of tHE Output AccEss ModE

InputOutput Access Mode

The InputOutput Extension is to allow an attribute in AA Object to be configured so that its value is both read and written to an external
reference destination. The primary job of the InputOutput Extension is to monitor the value/quality of an input and to send output upon
change.

By design, InputOutput Access mode makes only the Object writeable and User writeable attributes available.

Use AOT to Create AA Object with Other Category Types

In addition to the four Category Types configurable via the IDE, more Category Types are available for certain System AA Objects such
as WinPlatform_001. These category types are easily viewable with the Object Viewer.

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category

FiGurE 18: CatEGorY TYpEs iN REd arE Not IDEs SElEctaBlE CatEGorY TYpEs

If your business logic calls for attributes with Category Types not found in the IDE, these additional attributes are configurable. In this
case, Wonderware's ArchestrA Object Toolkit (AOT) is the bridge between your customized attributes and other Category Types.

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category
In this section, we will give a brief view on the construction of this bridge.

Note: AOT has additional functionalities that allow you to build a full AA Object. That process is outside the scope of this Tech Note.

1. Build a single attribute AA Object using the AOT.

FiGurE 19: All AvailaBlE ArcHEstrA CatEGorY TYpEs

2. After making an AOT build, generate the aaPDF file. In this example, we have built AOTAttributeDemo1.aaPDF.

3. Import the AOTAttributeDemo1.aaPDF into the IDE and create an instance of the new imported template (Figure 20 below).

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category

FiGurE 20: IMportEd AOT TEMplatE aNd INstaNcE

4. View the new attribute created by AOT in Object Viewer (Figure 21 below).

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category

FiGurE 21: AOT UsEd to CrEatE NEw AttriButE SYstEMWritEaBlEAttr, witH tHE SYstEMWritEaBlE CatEGorY TYpE

AA Object Category Types

IDE Category
Category Name Description
Name

PackageOnly Only exists at config time. Not deployed.

PackageOnly_Lockable Only exists at config time. Not deployed. Can be locked.

Calculated Only exists at run time. Not externally writeable by users. Run time changes are not persisted to disk by the AppEngine. Calculated

Only exists at run time. Not externally writeable by users or other objects. Run time changes are persisted to disk by the
Calculated_Retentive Calculated_Retentive
AppEngine. Constant Defined by an object developer. Never changes. Exists at config time and run time.

Exists at config time and run time, but only the Security Classification is configurable. Only externally writeable by users at run
Writeable_U
time.

Writeable_S Only exists at run time. Only externally writeable by other objects at run time. Object Writable

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]

Wonderware Application Server Security Troubleshooting Essentials Part 3: Attribute Category

Exists at config time and run time, but only Security Classification is configurable. Externally writeable by users or other objects
Writeable_US
at run time.

Writeable_UC Exists at config time and run time. Only externally writeable by users at run time.

Writeable_UC_Lockable Exists at config time and run time. Only externally writeable by users at run time. Can be locked.

Writeable_USC Exists at config time and run time. Externally writeable by users or other objects at run time.

Writeable_USC_Lockable Exists at config time and run time. Externally writeable by users or other objects. Can be locked. User Writeable

Writeable_C_Lockable Exists at config time and run time. Not writeable at run time, even by the object itself. Can be locked.

Designation for an Attribute Category means that the Attribute may only receive write requests and they may only originate
SystemSetsOnly from an object, including the same object containing the Attribute. This means that write requests from clients will not be
processed.

An Attribute Category restricted to reading and writing of the value only within the object itself. The Attribute is not accessible
SystemInternal
by external objects or clients.

Is an Attribute Category designation restricted to writing the value from within the object itself. The Attribute is not accessible by
SystemWriteable
external objects or clients.

References
Wonderware Application Server 2012 R2 – IDE.PDF

ArchestraObject_Toolkit_Development_Guide

Wonderware FactorySuite A2 Deployment Guide

A. Rantos, E. Xu

Tech Notes are published occasionally by Wonderware Technical Support. Publisher: Invensys Systems, Inc., 26561 Rancho Parkway South, Lake Forest, CA 92630. There is also
technical information on our software products at Wonderware Technical Support.

For technical support questions, send an e-mail to [email protected].

Back to top

©2014 Invensys Systems, Inc. All rights reserved. No part of the material protected by this copyright may be reproduced or utilized in any form or by any means, electronic or
mechanical, including photocopying, recording, broadcasting, or by any information storage and retrieval system, without permission in writing from Invensys Systems, Inc.
Terms of Use.

file:///C|/inetpub/wwwroot/t002830/t002830.htm[1/8/2014 2:15:32 PM]