FactoryTalk AssetCentre: automatic, versioned PLC/HMI program backup

From manual to automatic backup

The periodic PLC/HMI program backup package works in cycles: upload the program, compare it with the copy stored last time, record the differences and report any change without supporting documentation. This approach is easy to start, but the workload grows with the number of PLCs and changes only come to light at the next cycle. For plants with many PLCs, the next step to consider is Rockwell Automation's FactoryTalk AssetCentre, so that comparison and versioning run automatically. Related project: P&G Vietnam Dong An plant – FactoryTalk AssetCentre for LFE Making and the packing lines. The device list and access rights compiled in the manual package also serve as input for setting up AssetCentre.

What AssetCentre does

According to FTAC-GR002K (edition 16.00, p. 8):

• Archive – versioned repository. Files are stored in a Microsoft SQL Server database (p. 77). To edit a file it must be checked out, by only one person at a time; check-in creates a new version, and older versions can still be retrieved (p. 77, p. 79, p. 81). Security policy can make a check-in comment mandatory (p. 82). The "pinned" version is the master used by schedules (p. 77).
• Disaster Recovery – scheduled backups (p. 60): Backup stores a copy of the device's files; Backup and Compare uploads from the device, compares it with the master in the Archive and reports differences — if saving is selected, the uploaded copy becomes the new master; Change Detect monitors ControlLogix from version 20 by polling continuously. It can be configured to create a new version only when there are differences (FTALK-WP023B p. 44).
• Logs. The Event Log records system events such as an upload or a completed schedule; the Audit Log records user actions such as editing a Studio 5000 Logix Designer project (GR002K p. 67). Periodic searches of the Audit Log, for example program edits at the end of each shift, can be sent by email (p. 67). Check-out/check-in is recorded with the user name, object and time in both the Audit Log and the Archive history (WP023B p. 35).
• Management of Change (optional). An electronic approval step for check-out/check-in: the requester enters a reason, the approval group receives an email, a minimum number of approvers can be set and requests can be escalated when nobody responds (GR002K p. 85–86, p. 132–133).

Supported devices (GR002K p. 15–19): Logix 5000, MicroLogix, PLC-5 and SLC 500 controllers; PowerFlex drives, E300 relays; PanelView, PanelView Plus, MobileView; FactoryTalk View SE, FactoryTalk Directory, FactoryTalk Optix Runtime; Stratix switches; devices with an FTP server such as robots (Generic FTP Device); shared folders on computers (Remote Computer). Some third-party controllers are also supported when the agent computer has the corresponding programming software installed (FTAC-IN005N p. 15). Devices without a built-in type can be declared as a Custom Device (GR002K p. 18), but WP023B recommends native integration where available (p. 44).

Setting up the system

Four components (IN005N p. 8): the server, which coordinates and requires SQL Server (usually on the same machine); agents, which run scheduled operations and can spread the load across several machines; the desktop client and the web client. All components must be the same version (p. 8). Users authenticate through FactoryTalk Directory (GR002K p. 24).

Sequence according to GR002K:

1. System configuration: users, groups, function-based permissions, email address book, database limits (p. 24–33).
2. Asset tree: plan it beforehand, organised by location, material flow or machine type; set security from the root down, because assets inherit the permissions of the container that holds them (p. 51–53). Asset Inventory scans the network for hardware, firmware and software information, which helps build the tree the first time (p. 54–55).
3. Agent groups and schedules: to back up a group of devices, place them in one container and schedule the container; each device needs Configuration Data declared to identify its master file (p. 51, p. 63).
4. Notifications: the end-of-schedule report shows whether there were differences; per-device reports can attach a Compare Report (p. 64–65).

Network ports to open

FTAC-RM001B (based on edition 15.00, p. 7) describes a Logix backup schedule: the agent fetches the ACD file from the server, goes online through FactoryTalk Linx or RSLinx, uploads with Studio 5000, then sends the file back to the server to be stored as a new version (p. 12–13).

The table above lists only the main ports; the full list for each server, agent and client machine is in RM001B p. 19–30. Ports 7002 and 7004 can be changed (p. 20). Rockwell's testing used 51 dynamic ports; narrowing the range too far can cause timeouts (p. 21). IN005N (edition 16.00) gives a TCP range of 7002–7004 (p. 16), so recheck on the actual system at the exact version before writing rules. For zoning principles, see the article Firewall for FactoryTalk systems.

What to decide beforehand

• Who approves changes: who may check out/check in in each area, whether Management of Change is enabled, and which group approves. Management of Change requires version 11.00 or later and a Windows domain (GR002K p. 126).
• How long to retain data: set limits on database size, maximum number of versions per asset and log size, with email warnings (GR002K p. 32–33). Archive Cleanup and Log Cleanup delete old versions and logs; deleted versions cannot be recovered, so back up the database first (FTAC-UM001E p. 13–14, p. 17). WP023B recommends coordinating data clean-up with IT's retention policy and backup schedule (p. 50–51).
• Backing up AssetCentre itself: the Archive, logs and asset tree all reside in SQL Server; Management of Change data resides in a separate LLumin database and must also be backed up (IN005N p. 46); IN005N describes scheduling backups with a maintenance plan, with backup files on a different drive from the data drive (p. 46, p. 51–56). From version 15.00, sensitive data is encrypted with a key derived from a passphrase; if the passphrase is lost a new key must be generated, and previously encrypted data can no longer be accessed (p. 17). Archive Extractor, run manually or scheduled as a Windows task, extracts the latest or pinned version of each file to a separate folder, so the files remain available if the AssetCentre server fails (UM001E p. 17).
• Restore drills: periodically take the master copy of a sample controller, open it with the exact programming software version, and download it to a test controller or during a planned shutdown; also test-restore the AssetCentre database according to IN005N (p. 57).