File system folders in AVEVA Unified Engineering

Standard Pre-created File System Folders

When an AVEVA Unified Engineering environment is deployed, a standard structure of folders and files is created on the shared storage file system (P:\) that must be adhered to.

Prescribing the system folder structure enables AVEVA to retrospectively:

• Extend AVEVA Unified Engineering managed service with new products, features and functionalities without affecting existing project data and folders.

• Implement self-service administration features in CONNECT with the AVEVA Unified Engineering environment by knowing exactly where project data and folders reside

• Effectively recover data and files as part of the managed service by knowing exactly where project data and folders reside

• Change the file system folder access mode

• Apply file system folder project access control

The table below illustrates the standard folder structure and their purpose.

Important: Do not remove the standard structure folders, as this has a detrimental effect on the automated upgrade process.

Creating New File System Folders

It is acceptable to create new file system folders on the shared storage (P:\) under the pre-created standard file system folders. That is, under P:\AVEVAFiles\ or P:\ProjectFiles\ (or any sub-folders) but not at the root (P:\) level.

When you create a new system folder under a pre-created system folder, it will automatically inherit the same permissions as the pre-created system folder.

For example, if the pre-created system folder was only writable to by CONNECT users in a particular CONNECT Group (by virtue of roles being attached), then the new system folder will only be writable to by these users as well. Consider carefully before creating folders so you can use the existing discipline-based roles to control access. Refer to the section below on further details relating to File System Access Controls.

If you create new system folders and alter permissions using folder security (not recommended), please ensure that the AWS Delegated FSx Administrators Group is retained so that the Unified Engineering automated upgrade process has access.

File System Folder Access Controls Prerequisites

For File System Folder Access Controls to be supported, it is important that the standard file system folder structures have been implemented and adhered to.

That is:

AVEVA Product Projects\Project Definition Files are located under P:\AVEVAFiles\<Engineering or PID or ElecInst>\

One <Project> sub-folder for each Project

P:\AVEVAFiles\Engineering \XYZ

Working project files organized by <Discipline> are located under P:\ProjectFiles\<Discipline>\

One <Project> sub-folder for each Project

P:\ProjectFiles\Design\XYZ

If standard project-related folder structures have not been implemented and File System Folder Access Controls are required, the projects should be reorganized accordingly with the assistance of AVEVA Cloud Dev Ops and Professional Services.

File System Folder Access Control Introduction

Unified Engineering offers access control modes for the following standard file system folders and <Project>-related folders:

File System Folder access controls are independent of access controls embedded in AVEVA Products.

AVEVA Product access is generally dependent of File system folder access. Revoking access to file system folders implies access via the product is not possible.

With read file system folder permissions, different products react differently. For example, Engineering (Dabacon) based products will not login to a project if none or read file system folder permissions are applied (this is because these products always require write access to certain database files to function). However, Electrical, Instrumentation and P&ID users with read access will be able to launch the product and potentially update data depending on their permissions in the SQL database (data is stored in SQL).

File System Folder access controls comprise a switchable UE environment-wide access control mode with (optional) project folder access control as described below.

The following access control modes are available in Unified Engineering:

• Access Mode 1 (Default). Read as standard \ Discipline Role-based write

  • All users have read permissions on all standard file system folders and <Project>-related sub-folders.

  • Assigning CONNECT discipline-based roles to groups and users to these groups grants write permissions to the standard file system folders and <Project>-related sub-folders (see the “access privileges of the roles and their purpose” table in Default groups and assigned roles for AVEVA Unified Engineering for details).

  • Typical Use Cases: Single stakeholder multi-discipline-user, demonstration, PoC, trial environments.

• Access Mode 2. None as standard \ Discipline Role-based write

  • All users have no access permissions to standard file system folders and <Project>-related sub-folders.

  • Assigning CONNECT discipline-based roles to groups and users to these groups grants write permissions to the standard file system folders and <Project>-related sub-folders.

  • Typical Use Cases: Multi stakeholder\partners single-discipline-user environments

Project Folder Access Control

Access Modes above can be extended to support Project Folder Access Control.

• Project Folder Access Control

  • Overrides the two access control mode discipline-based access control at <Project> related folder level

  • Assigning AVEVA users to groups, grants specific permissions to <Project>-related folders

  • Supports No, Read and Read-Write access permissions.

  • Can be implemented for one or more <Project>s

  • Other non-project access controlled projects continue to follow the standard Access Mode permissions.

The combination of Access Mode and Project Access Controls have subtle differences in relation to access control.

The following table summarizes these differences:

(*1) Discipline-based Roles prefixed “Standard”. Design, Drafting PID, Drafting Diagrams, Electrical Design, I&C Design, Mechanical, Process, Project Controls, Project Management, Simulation

(*2) Project Access groups (with write permission) created by Customer Admin and linked by AVEVA Cloud DevOps.

Project Folder Access Control in this release of Unified Engineering, can be described as a “Partial” self-service model in that an initial request to CloudDevops is required to setup read or read-write permissions on a project linked to a specific CONNECT Group created by the customer administrator, thereafter customer administrators can assign users to the Group in CONNECT, controlling access, without any further AVEVA involvement. This is described in more detail below.

Project Access Control is managed by adding CONNECT users to CONNECT groups created by the customer administrator. These CONNECT groups align with Active Directory security groups in the Unified Engineering environment granting Read or Read\Write permissions on all <Project>-related folders. For this to work, AVEVA Cloud DevOps must link the CONNECT Group with Active Directory Security Groups as a one-off action, thereafter customer administrators can assign users to groups in CONNECT in a self-service manner.

With Project Folder Access Control applied to a <Project>, by default all users have no access to the <Project>-related folders unless added to appropriate CONNECT groups.

Switching Access Modes

The following sections describe the Modes in more detail including how to implement them.

Access Mode 1. Read as standard \ Discipline Role-based write (Default)

This Access Mode is implemented by default on all newly provisioned UE environments.

No action is required to implement this Access Mode, unless you wish to switch back to this from Access Mode 2, in which case see below.

Access Mode 2. None as standard \ Discipline Role-based write

This Access Mode can be implemented on request (or switched back to Access Mode 1 if required).

To switch between Access Modes 1 & 2, raise a support case via the AVEVA Knowledge & Support Center with the following details:

• Request to switch Unified Engineering standard file system folders access

  This should be in the description of the support case

  • From “Access Mode 1. Read as standard \ Discipline-based write” to “Access Mode 2. None as standard \ Discipline-based write”

  • Or vice-versa

• CONNECT Account

  This is the name of the account from the profile icon in CONNECT

• CONNECT folder in which the Unified Engineering Environment is deployed

  This is the name of the CONNECT folder in which Unified Engineering has been enabled

Implementing Project Access Control

To enable read or read-write Project Folder Access Control for a <Project>:

• Create a new group in CONNECT to control access to <Project>-related folders.

  A recommended format is to Prefix with “Project” and include Project Name, Project Type and Permissions, for clarity and differentiation with other groups. Suffix with the CONNECT folder name in brackets if the project relates to an AVEVA Unified Engineering on CONNECT environment in a CONNECT folder (if at account level, no suffix is required).

• Note that “Engineering” Project Type represents any Dabacon-based project (E3D, Engineering, Diagrams etc)

  E.g. Project Engineering SWS RW for read-write on Engineering (Dabacon) project SWS in a Unified Engineering environment enabled at the CONNECT account level.

  

  or Project ElecInst SWS R for read on Electrical\Instrumentation project SWS in a Unified Engineering environment enabled at the CONNECT account level.

  

  or Project PID 12345 RW for read-write on P&ID project 12345 in a Unified Engineering environment enabled at the CONNECT account level.

  

  or Project Engineering SWS RW (Elkhorn) for read-write on Engineering (Dabacon) project SWS in a Unified Engineering environment enabled at the Elkhorn CONNECT folder level

  

• Add the “Standard Customer” role for the UE service and relevant folder to the group

  

• Raise a support case via the AVEVA Knowledge & Support Center with the following details:

  • Request to implement Unified Engineering Project Access Control for a Project

    This should be in the description of the support case

  • CONNECT Account

    This is the name of the account from the profile icon in CONNECT

  • CONNECT folder in which the Unified Engineering Environment is deployed

    This is the name of the CONNECT folder in which Unified Engineering has been enabled

  • Name of CONNECT Group

    This is the name of the CONNECT Group the customer admin created

  • Project Type

    3 valid values: Engineering or PID or ElecInst

    Note that “Engineering” Project Type represents any Dabacon-based project (E3D, Engineering, Diagrams etc)

  • Project Name

    The name of the project for the Project Type

    • Dabacon: 3-letter Project designator from the tile on login screen

    • PID: Project Name from the tile on login screen

    • AIAE: Project Name from the tile on login screen

  • File System Project Folder

    The name of the <Project> folder storing the project

    • Dabacon: Folder name under P:\AVEVAFiles\Engineering\

    • PID: Project Folder name under P:\AVEVAFiles\PID\

    • AIAE: Folder name under P:\AVEVAFiles\ElecInst\

  • File Permission

    Read or Read-Write

• AVEVA Support\Cloud Dev Ops will link the CONNECT group to Active Directory permissions and notify the customer via the support case once actioned.

• Add users to the group in CONNECT to control access.

For more information on Project Access Control, please discuss with your AVEVA support contact or raise a support incident via the AVEVA Knowledge & Support Center https://softwaresupport.aveva.com.