Remote Access To Simatic Hmi Operator Panels: Sm@Rtserver
Remote Access To Simatic Hmi Operator Panels: Sm@Rtserver
https://support.industry.siemens.com/cs/ww/en/view/109476153
Warranty and Liability
We do not accept any liability for the information contained in this document.
Any claims against us – based on whatever legal reason – resulting from the use of
the examples, information, programs, engineering and performance data etc.,
described in this Application Example shall be excluded. Such an exclusion shall
not apply in the case of mandatory liability, e.g. under the German Product Liability
Act (“Produkthaftungsgesetz”), in case of intent, gross negligence, or injury of life,
body or health, guarantee for the quality of a product, fraudulent concealment of a
deficiency or breach of a condition which goes to the root of the contract
Siemens AG 2016 All rights reserved
Security Siemens provides products and solutions with industrial security functions that
informa- support the secure operation of plants, systems, machines and networks.
tion In order to protect plants, systems, machines and networks against cyber
threats, it is necessary to implement – and continuously maintain – a holistic,
state-of-the-art industrial security concept. Siemens’ products and solutions only
form one element of such a concept.
Customer is responsible to prevent unauthorized access to its plants, systems,
machines and networks. Systems, machines and components should only be
connected to the enterprise network or the internet if and to the extent necessary
and with appropriate security measures (e.g. use of firewalls and network
segmentation) in place.
Additionally, Siemens’ guidance on appropriate security measures should be
taken into account. For more information about industrial security, please visit
http://www.siemens.com/industrialsecurity.
Siemens’ products and solutions undergo continuous development to make them
more secure. Siemens strongly recommends to apply product updates as soon
as available and to always use the latest product versions. Use of product
versions that are no longer supported, and failure to apply latest updates may
increase customer’s exposure to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial
Security RSS Feed under http://www.siemens.com/industrialsecurity
Table of Contents
Warranty and Liability ................................................................................................. 2
1 Task ..................................................................................................................... 4
2 Solution............................................................................................................... 5
2.1 Overview............................................................................................... 5
2.2 Hardware and software components ................................................... 6
2.2.1 Validity .................................................................................................. 6
2.2.2 Components used ................................................................................ 6
3 Principle of Operation ....................................................................................... 8
3.1 Sm@rtServer ........................................................................................ 8
3.2 Application example ............................................................................. 8
4 Installation and Startup ..................................................................................... 9
4.1 Installing the software ........................................................................... 9
4.2 Startup .................................................................................................. 9
4.2.1 Sample project ..................................................................................... 9
4.2.2 Project library ..................................................................................... 11
4.2.3 Transferring the license ...................................................................... 12
4.2.4 Operator panel settings ...................................................................... 13
4.2.5 Sm@rtServiceMonitor ........................................................................ 15
4.2.6 Transferring Sm@rtServiceMonitor to the Comfort Panel ................. 17
Siemens AG 2016 All rights reserved
1 Task
Remote access is used to its full extent when you can use the same functions as if
you were standing right in front of the operator panel. Using existing hardware such
as your smartphone, tablet or standard notebook enables you to achieve the
greatest possible flexibility.
Apart from all the advantages remote access provides, you still need to be aware
of the hazards such an intervention may involve.
In most cases, the user remotely accessing the plant cannot see what is happening
in the plant at the moment of access. The intervention must not put the staff on site
or the plant at risk. To this end, it is important that you lock certain functions (e.g.,
manual control of a gripper) for the remote maintenance user. In addition, the staff
on site should be informed of an intervention and be able to stop it at any time if
necessary.
Moreover, it must be ensured that only authorized persons are provided with
access to the plant. Unfortunately, total network security cannot be guaranteed.
Therefore, it makes sense to inform the staff not only of the fact that a remote
maintenance user is accessing the operator panel, but also of who this is.
Figure 1-1
Siemens AG 2016 All rights reserved
2 Solution
2.1 Overview
Diagrammatic representation
The diagrammatic representation below shows the most important components of
the solution:
Figure 2-1
VPN
Configuration
Siemens AG 2016 All rights reserved
The SIMATIC HMI Comfort Panel or the WinCC Runtime Advanced PC operates
as a Sm@rtServer. To reduce the risk of third-party intervention, connect your
Sm@rtClient, a tablet with the SIMATIC WinCC Sm@rtClient app in the above
figure, to the SIMATIC HMI operator panel using VPN.
The “Sm@rtServiceMonitor” tool is used to check the Sm@rtClient connections to
the operator panel. The IP addresses of the devices accessing the operator panel
are stored in internal WinCC tags for further processing. This allows you to check
who is currently accessing the operator panel at any time and, if necessary,
terminate remote access.
Advantages
The solution presented here offers the following advantages:
Flexibility through a variety of Sm@rtClient solutions
– The Sm@rtClient app for Android and iOS enables you to access the
Sm@rtServer from mobile devices such as smartphones or tablets.
– The Sm@rtClient Viewer enables you to access the Sm@rtServer from a
programmer or another standard PC.
– WinCC Control Sm@rtClient View enables you to access the Sm@rtServer
via another SIMATIC HMI Comfort Panel or a WinCC Runtime Advanced
station.
– Internet Explorer enables you to access the Sm@rtServer from any PC.
The operator panel layout is represented by the Sm@rtClient app and the
Sm@rtClient Viewer and you can use, for example, keyboards
Up to three Sm@rtClients per SIMATIC HMI Comfort Panel or four per WinCC
Runtime Advanced station are simultaneously possible (number depends on
the device, see \5\)
Operator actions are displayed on the device on site; i.e., an employee on site
can follow your operator steps
Scope
This application does not include a description of
the basics of configuring with WinCC (TIA Portal)
setting up a VPN connection; information on this topic can be found in the
“VPN connection” document.
Note With TIA Portal V14 or higher, Sm@rtServer is also available for SIMATIC HMI
Basic Panels. The “Sm@rtServiceMonitor” tool can only be used with SIMATIC
HMI Comfort Panels and WinCC Runtime Advanced.
Hardware components
Table 2-1
Component No. Article number Note
TP1200 Comfort 1 6AV2124-0MC01-0AX0
Smartphone 1 Android or iOS
Configuring and using the VPN connection requires more components. Details can
be found in the “VPN connection” document.
Table 2-3
Siemens AG 2016 All rights reserved
Component Description
109476153_Remote_Panels_SmartServer_DOKU_en.pdf This document
109476153_Remote_Panels_ComfortPanel_Proj.zip WinCC (TIA Portal) project for
Comfort Panels
109476153_Remote_Panels_RTAdv_Proj.zip WinCC (TIA Portal) project for
WinCC Runtime Advanced
PC stations
109476153_Remote_Panels_SmartServer_Library.zip WinCC (TIA Portal) library
109476153_Remote_Panels_ComfortPanel_Tool.zip “Sm@rtServiceMonitor” for
SIMATIC HMI Comfort Panels
109476153_Remote_Panels_RTAdv_Tool.zip “Sm@rtServiceMonitor” tool
for WinCC Runtime Advanced
3 Principle of Operation
3.1 Sm@rtServer
The WinCC Sm@rtServer option enables operator control and monitoring of
operator panels via the intranet/internet. The Sm@rtServer provides its user
interface for the Sm@rtClients. Various devices can be used as a Sm@rtClient, for
example a standard PC, a smartphone or another SIMATIC HMI Panel. The
Sm@rtClient concept is not only used for operator control and monitoring when
performing service jobs, it can also be used for large, distributed machines and
plants. The option of mobile end use makes this solution also suitable for
commissioning as you can move around the entire plant, regardless of the operator
panel’s place of installation.
Sample project
In the event of a value change of one of the tags, “VncClient1”, “VncClient2”,
“VncClient3” or “VncClient4”, the “CheckConnections” script is called.
This script first checks what has changed compared to the previous cycle.
If a user is logged in to the operator panel on site and a new Sm@rtClient
connects, a message appears on the operator panel. This message is displayed for
a defined time and enables the operator on site to directly terminate the incoming
connection. (See chapter 5.2 Sample project). The remote operator cannot access
the SIMATIC HMI Comfort Panel until this time has elapsed. In the sample project,
the default setting for this time is 10 seconds; however, you can change this setting
(see chapter 6 Additional Notes).
As long as (at least) one Sm@rtClient connection to the operator panel is active,
this is indicated by a flashing button. Clicking this button allows you to terminate
the connections at any time.
4.2 Startup
The application example can be started up in different ways.
First, establish a VPN connection between the SIMATIC HMI Comfort Panel /
WinCC Runtime Advanced PC station and the Sm@rtClient. More information
can be found in the “VPN connection” document.
Depending on whether you want to use the project contained in this entry or
include the functionality in your own project, follow the steps described in
chapter 4.2.1 Sample project or 4.2.2 Project library.
Then transfer, if not yet available, the Sm@rtServer license to the operator
panel as described in chapter 4.2.3 Transferring the license.
Make the necessary Sm@rtServer and web server settings as described in
chapter 4.2.4 Operator panel settings and then configure the tool following the
steps in Chapter 4.2.5 Sm@rtServiceMonitor.
Siemens AG 2016 All rights reserved
If you are using a SIMATIC HMI Comfort Panel, transfer the tool with SIMATIC
ProSave (see chapter 4.2.6 Transferring Sm@rtServiceMonitor to the Comfort
Panel)
Depending on the Sm@rtClient you are using, follow the instructions in chapter
4.2.7 Sm@rtClient app, 4.2.8 Sm@rtClient application, 4.2.9 Sm@rtClient
control or 4.2.10 Internet Explorer.
Table 4-1
No. Action
1. Depending on your operator panel, download the
“109476153_Remote_Panels_ComfortPanel_Proj.zip” or
“109476153_Remote_Panels_RTAdv_Proj.zip” sample project.
2. Unzip the project.
3. Use WinCC (TIA Portal) to open the project.
4. Go to the project view.
No. Action
5. Open the device configuration and set the IP address and subnet mask of the
operator panel.
Siemens AG 2016 All rights reserved
6. If you are using a different SIMATIC HMI Comfort Panel or SIMATIC IPC, right-
click the device and select “Change device / version”.
Table 4-2
No. Action
1. Download the “109476153_Remote_Panels_SmartServer_Library.zip” library.
2. Unzip the folder.
3. Open the project into which you want to integrate the functionality and go to the
project view.
4. Open the Runtime settings of the operator panel and in Services, select “Start
Sm@rtServer” and “Web service SOAP”.
Siemens AG 2016 All rights reserved
7. Use drag and drop to move the “Task_Change_User” task to the task scheduler.
8. Use drag and drop to move the “Tags_SmartClient” tag table to the “HMI tags”
folder.
9. Use drag and drop to move the “Screen_User_Access” screen to the “Screens”
folder.
10. Drag the “Connected_Clients” faceplate to a screen.
11. Use drag and drop to move the “VBScript_SmartClient” VB scripts to the “Scripts
> VB scripts” folder.
12. Use drag and drop to move the “Template_Objects” objects to your template.
13. Transfer the project to your operator panel.
Note Comfort / Mobile Panels with version V14 or higher no longer require a separate
license.
Comfort Panel
Table 4-3
No. Action
1. In TIA Portal, select “Online > HMI Device maintenance > Authorize/License”.
Siemens AG 2016 All rights reserved
2. Enter the load options and click the “Start search” button. Select the operator
panel and click “Load”.
The Automation License Manager opens.
3. Use drag and drop to move the “Sm@rtServer for SIMATIC Panels” license from
the license data medium to the operator panel.
Table 4-4
No. Action
1. Comfort Panel:
In the SIMATIC HMI Comfort Panel’s Start Center, select “Settings”.
Double-click “WinCC Internet Settings”.
No. Action
4. If necessary, make other settings such as the ports. More information on the
settings can be found in the manual: “WinCC Advanced > Visualize processes >
Options > WinCC Sm@rtServer > Basics > Settings for Sm@rt options >
Configurations on the HMI device > ‘Sm@rtServer Dialog: Current User
Properties’ ”.
Use the “Apply” button to confirm the changes.
5. Go to the “Web Server” tab.
For “Start automatically after booting” and “Close with Runtime”, make the same
settings as for the Sm@rtServer (Step 3).
6. Click the “User Administration” button.
Siemens AG 2016 All rights reserved
7. Create a new user, “SoapUser”, and assign a password to this user. Click the
“Apply” button.
8. Go to the “Authorizations” tab and enable the “SoapUser” authorization for this
user.
No. Action
11. Uncheck the “Validate Signatures” check box.
When the “Sm@rtServiceMonitor” tool has been transferred, you can check the
check box again.
4.2.5 Sm@rtServiceMonitor
Siemens AG 2016 All rights reserved
Table 4-5
No. Action
1. Download the “Sm@rtServiceMonitor_Panel” or “Sm@rtServiceMonitor_PC” tool
and unzip the zip folder.
2. Start the “SetPasswordTool.exe” tool.
No. Action
4. Enter the password of the “SoapUser” user and press Enter to confirm. Repeat
this step.
To use the tool on a WinCC Runtime Advanced PC, copy the files to the Runtime
PC and manually start the “SmartServiceMonitor.exe” or add a shortcut to this file
to the PC’s Startup folder.
To use the tool on a Comfort Panel, you can transfer it with SIMATIC ProSave.
Table 4-6
No. Action
1. Open SIMATIC ProSave. In the “General” tab, set the device type, the connection
type and the operator panel’s address.
Siemens AG 2016 All rights reserved
No. Action
Siemens AG 2016 All rights reserved
4. Click the “>>” button to install the “SmartServiceMonitor” tool on the operator
panel.
After installation, the operator panel restarts.
Note To uninstall the tool, exit the tool (see the Sm@rtServiceMonitor chapter) and
click the “<<” button.
Table 4-7
No. Action
1. Download the “SIMATIC WinCC Sm@rtClient” app to your smartphone or tablet
and install it. You can find the app in \3\ (iOS), \4\ (Android) or using the following
QR code.
2. Start the NCP VPN Client app and establish a connection to the automation cell.
Detailed information on this topic can be found in the “VPN connection”
document.
3. Start the SIMATIC WinCC Sm@rtClient app and either manually add a new
connection or use automatic HMI panel detection to search for the desired
Siemens AG 2016 All rights reserved
4. Password protect both the device and the app to prevent unauthorized persons
from accessing the Sm@rtServer. If possible, do not save the password along
with the connection settings, but enter it manually when prompted.
You can save the connection settings and therefore automatically save the
Sm@rtClient application without user input.
Table 4-9
No. Action
1. When the connection has been established, right-click the title bar of the
Sm@rtClient application.
2. Select “Save connection info as...”.
Siemens AG 2016 All rights reserved
Confirm the message with “Yes” only if you can ensure that no unauthorized
person can access this file.
5. Using command prompt or a batch file, you can then open the Sm@rtClient
application with this configuration as a parameter.
Example:
“smartclient.exe –config Configuration.sac”
Table 4-10
No. Action
1. Open the WinCC (TIA Portal) project with the operator panel from which you
want to access the Sm@rtServer.
2. Insert the “Sm@rtClient view” control into a screen.
3. In “Properties > General”, enter the IP address or device name, port and, if
necessary, other settings.
4. In “Properties > Scaling”, you can set whether the display will be scaled when
Siemens AG 2016 All rights reserved
Table 4-11
No. Action
1. Download Java Runtime from www.java.com and install it.
2. Open Internet Explorer. In the address bar, enter “http://IP address:port”. Enter
the Sm@rtServer password and click “OK”.
Note More information on the Java security settings can be found here:
http://support.automation.siemens.com/WW/view/en/101977511
2 3
The items included in the screen are part of the “Template_Topic_001” template.
Field 1, “New connected client:”, displays the IP address of the Sm@rtClient last
connected to the Sm@rtServer. Use static IP addresses on your Sm@rtClients so
that the operating staff on site can immediately decide whether unauthorized users
are accessing the plant.
Button 2 flashes blue/yellow while one or more Sm@rtClients are accessing the
Sm@rtServer. The button is not displayed until a Sm@rtClient is connected.
Clicking the button disconnects all connected Sm@rtClients.
Button 3 allows you to log in a user. The sample project contains the following
users:
Table 5-1
User name Password
User user
Administrator admin
Field 4 displays the user name of the logged in user.
Logging in a user is necessary for the following function.
Figure 5-3
1
2
Siemens AG 2016 All rights reserved
If a user has logged in to the operator panel and a Sm@rtClient connects to the
Sm@rtServer, this user interface appears.
A ten-second time window starts, in which the user can decide whether the
connection may be established. An I/O field (1) displays the remaining time.
The time can be set in the WinCC project. For details, see the Additional Notes
chapter.
The “Cancel” (2) button allows you to terminate the connection. Clicking the button
disconnects all connected Sm@rtClients.
The I/O field (3) displays the IP address of the newly connected client so that the
operator on site can decide whether this client gains access.
To allow the connection and to be able to access the operator panel, wait until the
time expires. Then the previous screen is activated and the locally logged in user is
logged out.
Figure 5-4
1
2
This screen displays the IP addresses and the number of currently connected
Sm@rtClients (1).
To disconnect the connected Sm@rtClients, the Sm@rtServer is restarted. If the
Sm@rtServer does not start correctly, you can use the button (2) to start it
Siemens AG 2016 All rights reserved
manually.
5.3 Sm@rtServiceMonitor
When transferring the “Sm@rtServiceMonitor” tool with ProSave as described
above, it starts automatically with the SIMATIC HMI Comfort Panel. If the tool has
been manually transferred to the operator panel, you need to start it manually
when starting the operator panel.
If you are using the tool on a PC, you can copy a shortcut to the tool to the PC’s
Startup folder.
As can be seen in the screenshot below, the icon bordered in red in the Comfort
Panel’s/PC’s taskbar indicates whether the tool has been started.
Figure 5-5
Double-clicking the icon opens the diagnostic window. It allows you to check
whether the “Sm@rtServiceMonitor” tool works correctly.
Figure 5-6
2
Siemens AG 2016 All rights reserved
3 4
If the “Auto Scroll” check box (1) is checked, the most recent messages are
automatically displayed. However, you can also use the scroll bar (2) to search for
old entries.
The “Hide” (3) button closes the diagnostic window.
The “Close” (4) button exits the tool.
6 Additional Notes
The time until the remote maintenance user gains access to the operator panel can
be set in the WinCC (TIA Portal) project.
To do this, open the “Screen_User_Access” screen. Open the “Properties >
Events” of the screen. Change the cycle of the “SimulateTag” system function with
the “LogoutLocalUser” tag. The value corresponds to a multiple of 200 ms, i.e., for
example, 50 for 10 seconds.
Figure 6-1
Siemens AG 2016 All rights reserved
Open the “Tags_SmartClient” tag table. For the “Logout_Time” tag, set the desired
time in seconds as the start value.
Figure 6-2
8 History
Siemens AG 2016 All rights reserved
Table 8-1
Version Date Modifications
V1.0 05/2015 First version
V1.1 08/2015 New for WinCC Runtime Advanced, description extended
V1.2 12/2016 TIA Portal V14 update