Area of Responsibility (AOR) Areas and Groups

AVEVA Enterprise SCADA has a layered approach to access control. Configuring the Area of Responsibility (AOR) Areas and Groups requires you to understand the relationships between Users, Groups, AOR Areas, AOR Groups and product objects.

Lower layer objects (such as Analog object 1) are assigned to an AOR Group object. The AOR Group objects are used to group closely-related objects; for example, all objects in a station that need to be controlled or viewed together. The AOR Group objects, in turn, are assigned to the AOR Area objects. Each AOR Group object can be included in several AOR Areas, where each AOR Area would define a different set of access permissions for their associated AOR Groups. The AOR Area objects are then assigned to a Private OASyS DNA User and group objects and Windows User and Group objects, or they are nested into larger AOR Areas.

Notes: The Network Management Console (NMC) is normally used to edit AOR Areas and AOR Groups. However, in older releases, AOR configuration was stored in the RealTime database (RTDB) and edited using the Advanced Database Editor (ADE). Upgrading projects wishing to keep the AOR configuration mastered within the RTDB will set the LegacyAOR mode. When the system has been configured for LegacyAOR mode, the NMC will not display the AOR Group nor the AOR Area folder nodes, as the ADE is the tool used in the LegacyAOR mode. Regardless of the LegacyAOR mode setting, the DNA Identity Test Tool will always show which AOR Groups and permissions are assigned to you.

The UniqueID element is used during replication across non-trusted domain boundaries (e.g., from the secure operations center to a non-secure decision support system). When creating a new AOR Area or AOR Group object using an XML data file, do not assign any value to the UniqueID element; AVEVA Enterprise SCADA will assign a unique identifier value whenever the value is not assigned.