Kanoa Ops Training

This section is focused on Kanoa Ops, the core operational foundation of Kanoa MES.

We'll start by modeling the assets within the plant, creating materials (items), linking them to assets, configuring their expected production rates, and configuring asset modes and states. We'll then connect PLC tags to automate data collection, schedule operations on assets, and pull production orders from an ERP. Next, we'll manage users and their roles, customize the navigation menu, build dashboards and marquees, and use scripts to scale the model across the enterprise. Finally, we'll explain speed losses with performance reasons, record custom and measured process values, and analyze how effectively operators' time is used.

caution

The first user to log into a freshly installed Kanoa MES application automatically receives Gateway Admin rights, and only Gateway Admins can grant Gateway Admin rights to other users. Do not log in as admin. Create a user in the Ignition default user source with a first and last name, and log in as that user.

Let's start by having you log into the application. This is a really important first step!

Log In with your username

1. Create a user in the Ignition default user source with a first and last name.
2. Launch the KanoaMES project from the Gateway Page and log in as that user.

Reference Materials: Users - Learn how Kanoa manages users.

Ignition provides a wealth of user security management choices, giving you the option of managing users within the Ignition application, through Active Directory or through an Identity Provider. KanoaMES extends this security model to allow the management of users and their roles on an asset by asset basis.

Kanoa's security implementation manages user permissions through asset-role associations.

It may support user management, such as user creation, editing, and deleting only with an internal user source. Any other type of user authentication, such as an AD User Source, or an Identity Provider, will need to be managed externally. The security table by default, will populate with users that are in each of the gateway's user sources. Users stored in an Identity Provider will not show up initially. Kanoa's security implementation stores user data in parallel. For each user in the gateway's user sources, our database also stores a record for that user. A user's database record is initialized either upon their first login or when another user edits their information.

Users can also be created through the security table. Creating a user through the security table will create a new user in the gateway's 'default' user source, and also initialize a record for them in the database. Users may have their basic information edited, such as their first and last name. This will update their record in the database, but note that only users in the 'default' user source will have their information updated in both places. Users in any type of other user sources, or an identity provider will need to have their information updated externally. All users may have their asset-role associations configured. Users that are a part of the 'default' user source may also be deleted. Deleting a user through the security table will delete them both in the 'default' user source, and delete their record in the database. Users not in the 'default' user source will have their database record deleted, but will still need to be deleted externally at their corresponding user source/identity provider.

---

Gateway Admin

KanoaMES supports multi-enterprise asset hierarchies on the same gateway server. Because of this we provide a reserved 'Gateway Admin' role that provides 'administrator' level rights for all enterprises. The Gateway Admin is the only user who can make another user an 'Administrator' for one or more enterprises. The 'administrator' can then manage the access and roles users have within that enterprise. Users with the 'Gateway Admin' role have full access to the application, being able to view all users in the security table, and being able to perform any action in any view, with any assets.

info

The first user to log into a freshly installed Kanoa MES application automatically receives Gateway Admin rights, and only Gateway Admins can grant Gateway Admin rights to other users.

---

Ignition Authentication vs Kanoa Authorization

Kanoa security builds on top of Ignition security:

• Ignition authenticates the user Confirms the user is who they say they are, using Ignition internal user sources, Active Directory, or Identity Providers.
• Kanoa authorizes the user Determines what the authenticated user can do inside Kanoa, applying permissions based on user, role, and asset.

Kanoa extends Ignition's security model by managing user roles on an asset-by-asset basis.

---

Security Roles and Functions

Kanoa roles are configured with specific permissions, called functions in the documentation. Functions determine whether users can perform certain actions in the MES application. Provided functions include:

The core structure is:

• Roles are created.
• Permissions (functions) are assigned to roles.
• Users are assigned roles.
• Role assignments are scoped to assets.

A user can have a role for one part of the plant but not another. For example, a user can be an operator for Manual Pack 1 but not have operator permissions for Machine 1 or a user can have permissions for an entire area or site.

Asset level security lets Kanoa scale across multiple lines, areas, sites, and enterprises while keeping users from accessing or modifying data outside their responsibility. A user at Site A shouldn't necessarily be able to operate or edit data for Site B; a packaging operator may not need access to machining assets; a supervisor may need broader access across an area or site. The Kanoa documentation specifically notes that a user can be assigned a role along with a list of assets where that role is valid.

---

User Roles & Functions

Our security model allows for custom roles to be created and functions enabled for that role. A function is a reserved term that is used throughout the MES application to determine if a user has rights to perform these functions. In this table, roles are linked to functions. A role has access to a function as indicated by the checkmark. New roles can be created by clicking the + button. Once a role has been created, functions associated with that role can be set by setting the checkbox in the table.

The following functions have been provided....

Configure Security | Configure Assets | Configure Items | Operate Assets | Edit Operations | Schedule Shifts | Schedule Operations | Configure Quality | Enter Checks | Approve Checks

You can create custom roles and enable functions for each role through the role configuration interface.

For more information about how functions are used within the Kanoa MES, see Security Functions Overview

---

User Sources and User Management

Kanoa works with different Ignition user sources:

• Internal Ignition user source: users can be created, edited, and deleted through the Kanoa security table.
• Active Directory or an Identity Provider: authentication and user management must generally be handled externally; Kanoa manages the user's asset-role associations.

Kanoa also stores user data in parallel in its own database. A user record is initialized either when the user first logs in or when another user edits their information.

---

Security Checks in Screens

Kanoa screens use security checks to decide which controls or actions are available to the current user. Kanoa-provided screens already include this logic, but custom Perspective screens may need their own checks. Screen designers must intentionally apply the same security rules when building custom views. You'll revisit this during screen customization.

---

Configuration

The user security model has the following configuration parameters...

• Allow Guest: Allows guests not logged in to view all assets
• User Source: Specifies the name of the ignition user source that users will be stored and retrieved from
• User Source Options: Specifies the user sources that users queried against in the user table

---

User Configuration

When the ignition user source is set to internal, users can be added and deleted via the User table. If the userSource is set to Active Directory, only a user's roles can be configured.

The User Sources drop down can be used to filter users by the user source.

The 'active' field is set the first time a user logs into the MES application.

Creating and Editing Users

Click the + button to add a new user or select a user and click the button.

A first and last name is required for a user. This allows us to filter out users that may have been setup for kiosk auto-login or Active Directory printers etc.

A user can be assigned a role along with a list of assets where that role is valid. This allows you to set a user to be an operator at say the mill, but not at the packaging line.

A user can given Gateway Admin permissions by enabling the Gateway Admin checkbox. There is no need to set specific roles to specific assets for a Gateway Admin as they automatically inherit all rights over all assets.

The first user to log into a freshly installed KanoaMES application will automatically be granted Gateway Admin rights. Only Gateway Admins can give Gateway Admin rights to other users.

To add a role to a user, select the role you wish to assign to the user and then click on the to select the assets.

To remove a user's roles, select the role you wish to remove from the user and then click the 'Remove assets' button.

From Users →

Next let's setup this Gateway as a development environment. In a development environment, gateway admins can delete asserts even if they have production data linked to them. In a production environment, we provide safeguards against inadvertently deleting all your production data.

Setup Gateway as Development

1. Navigate to Configuration → Application → Settings.
2. set Environment to 'Development'

Check your work

Copy this script into the Ignition Designer Script Console (Tools → Script Console) and run it. It checks that a user with a first and last name (not admin) has logged in to Kanoa and is the Gateway Admin, and that the environment is set to Development. Each check prints PASS or FAIL with what to fix. It doesn't change anything.

Show the check script

checkLesson-opsStart.py

# Kanoa Ops Training - check the Ops Training start page
#
# Run in the Ignition Designer Script Console (Tools > Script Console), in the
# project that inherits KANOA_SCRIPTS. It only reads; it changes nothing.
# Every check prints PASS or FAIL with what to fix, then a summary.

ADMIN_NAMES = ['admin']	# built-in gateway accounts you shouldn't log in to Kanoa with

results = []

def check(ok, what, fix=None):
	results.append(bool(ok))
	if ok:
		print 'PASS  %s' % what
	else:
		print 'FAIL  %s' % what
		if fix:
			print '      -> %s' % fix

def note(what):
	print 'NOTE  %s' % what

def field(row, *names):
	for n in names:
		if n in row and row[n] is not None:
			return row[n]
	return None

def text(v):
	return '' if v is None else unicode(v).strip()

def rows(data):
	# Kanoa returns a dataset, a list of dictionaries, or None
	if data is None:
		return []
	if hasattr(data, 'getRowCount'):
		cols = list(data.getColumnNames())
		return [dict((c, data.getValueAt(i, c)) for c in cols) for i in range(data.getRowCount())]
	return [dict(r) for r in data]

print '=' * 70
print 'Kanoa Ops Training - getting started check'
print '=' * 70

# 1. Logged in as your own user, who became Gateway Admin by logging in first.
# Kanoa creates a user's record the first time they log in to the application.
print '\n-- Your user'
users = rows(system.kanoa.security.getUsers({}))
admins = []
for u in users:
	try:
		if system.kanoa.security.checkIsGatewayAdmin(field(u, 'userId')):
			admins.append(u)
	except:
		pass

def describe(u):
	name = ('%s %s' % (text(field(u, 'firstName')), text(field(u, 'lastName')))).strip()
	return '%s (%s)' % (text(field(u, 'userName')), name or 'no name')

own = [u for u in users if text(field(u, 'userName')).lower() not in ADMIN_NAMES]
named = [u for u in own if text(field(u, 'firstName')) and text(field(u, 'lastName'))]
ownAdmins = [u for u in admins if u in named]

check(named, 'A user with a first and last name has logged in to Kanoa',
	'In the Ignition default user source, create a user with a first and last name, then launch the '
	'KanoaMES project from the Gateway page and log in as that user.' +
	((' Users without a name: %s.' % ', '.join(describe(u) for u in own)) if own else ''))
if named:
	check(ownAdmins, 'Your user is a Gateway Admin',
		('Gateway Admins: %s. ' % ', '.join(describe(u) for u in admins) if admins else '') +
		'The first user to log in becomes Gateway Admin. Log in as a Gateway Admin, then in Configuration > Users '
		'give your user the Gateway Admin role.')
if ownAdmins:
	note('Gateway Admin: %s' % ', '.join(describe(u) for u in ownAdmins))
builtIn = [u for u in admins if text(field(u, 'userName')).lower() in ADMIN_NAMES]
if builtIn:
	note("%s is a Gateway Admin. That's fine, but don't use it for the training." % ', '.join(describe(u) for u in builtIn))

# 2. The gateway is set up as a Development environment
print '\n-- Environment'
configs = rows(system.kanoa.config.getConfig({}))
envRows = [c for c in configs if 'environment' in text(field(c, 'configName')).lower()]
if not envRows:
	note("Couldn't find the environment setting%s. Check Configuration > Application > Settings by hand."
		% ((' (config names: %s)' % ', '.join(sorted(set(text(field(c, 'configName')) for c in configs)))) if configs else ''))
else:
	value = text(field(envRows[0], 'configValue', 'value', 'configValueString'))
	check(value.lower().startswith('dev'), 'Environment is Development',
		"It's '%s'. Go to Configuration > Application > Settings and set Environment to Development." % (value or 'not set'))

passed = results.count(True)
print '\n' + '=' * 70
print 'Result: %d of %d checks passed' % (passed, len(results))
if passed == len(results):
	print "All good. You're ready to start."
else:
	print 'Fix the FAIL items above, then run this again.'
print '=' * 70