Application Note. A Web Visualization since the JVM-7 Update 51. Version 1.2.3

Transcription

1 Application Note A Version 1.2.3

2 2 Application Note A by WAGO Kontakttechnik GmbH & Co. KG All rights reserved. WAGO Kontakttechnik GmbH & Co. KG Hansastraße 27 D Minden Tel.: +49 (0) 571/ Fax: +49 (0) 571/ Web: info@wago.com Technical Support Tel.: +49 (0) 571/ Fax: +49 (0) 571/ support@wago.com Every conceivable measure has been taken to ensure the accuracy and completeness of this documentation. However, as errors can never be fully excluded, we always appreciate any information or suggestions for improving the documentation. We wish to point out that the software and hardware terms, as well as the trademarks of companies used and/or mentioned in the present document are generally protected by trademark or patent.

3 Application Note A Table of Contents 3 Table of Contents 1 Notes about this Documentation Copyright Number Notation Font Conventions Symbols Legal Bases Subject to Change Personnel Qualification Limitation of Liability Scope of Functions Background Effect Remedy Do not perform updating of the Java runtime environment Integrating the controller addresses into the Exception List Updating of "WebVisu" on the controller Additional Notes Background Information about the Visualization Process Connection setup between the visualization PC and the WAGO controller Loading and checking the signed RIA Loading and presentation of the application-specific visualization General Information on Handling of Certificates Internet connection required for starting of "Web-Visu" Using JPEG Images Validity period of the electronic certificate Determining the current version of the JAVA Applets Central Distribution of JAVA Settings Importing Certificates Software Adaptations for the JVM-7 Update Loading using FTP Using CODESYS V CODESYS V CODESYS V to V CODESYS V and older Using WAGOupload with Controllers Current Browser Appendix Product Relevance Determining Your JAVA Applet Version... 24

4 4 Notes about this Documentation Application Note A Notes about this Documentation 1.1 Copyright This documentation, including all figures and illustrations contained therein, is subject to copyright protection. Any use of this documentation that infringes upon the copyright provisions stipulated herein is prohibited. Reproduction, translation, electronic and phototechnical filing/archiving (e.g., photocopying), as well as any amendments require the written consent of WAGO Kontakttechnik GmbH & Co. KG, Minden, Germany. Non-observance will entail the right of claims for damages. 1.2 Number Notation Table 1: Number Notation Number code Example Note Decimal 100 Normal notation Hexadecimal 0x64 C notation Binary '100' ' ' In quotation marks, nibble separated with dots (.) 1.3 Font Conventions Table 2: Font Conventions Font type Indicates italic Names of paths and data files are marked in italic-type. e.g.: C:\Programme\WAGO-I/O-CHECK Menu Menu items are marked in bold letters. e.g.: Save > A greater-than sign between two names means the selection of a menu item from a menu. e.g.: File > New Input Designation of input or optional fields are marked in bold letters, e.g.: Start of measurement range Value Input or selective values are marked in inverted commas. e.g.: Enter the value 4 ma under Start of measurement range. [Button] Pushbuttons in dialog boxes are marked with bold letters in square brackets. e.g.: [Input] [Key] Keys are marked with bold letters in square brackets. e.g.: [F5]

5 Application Note A Notes about this Documentation Symbols Personal Injury! Indicates a high-risk, imminently hazardous situation which, if not avoided, will result in death or serious injury. Personal Injury Caused by Electric Current! Indicates a high-risk, imminently hazardous situation which, if not avoided, will result in death or serious injury. Personal Injury! Indicates a moderate-risk, potentially hazardous situation which, if not avoided, could result in death or serious injury. Personal Injury! Indicates a low-risk, potentially hazardous situation which, if not avoided, may result in minor or moderate injury. Damage to Property! Indicates a potentially hazardous situation which, if not avoided, may result in damage to property. Damage to Property Caused by Electrostatic Discharge (ESD)! Indicates a potentially hazardous situation which, if not avoided, may result in damage to property. Important Note! Indicates a potential malfunction which, if not avoided, however, will not result in damage to property.

6 6 Notes about this Documentation Application Note A Additional Information: Refers to additional information which is not an integral part of this documentation (e.g., the Internet).

7 Application Note A Legal Bases 7 2 Legal Bases 2.1 Subject to Change WAGO Kontakttechnik GmbH & Co. KG reserves the right to make any alterations or modifications that serve to increase the efficiency of technical progress. WAGO Kontakttechnik GmbH & Co. KG owns all rights arising from granting patents or from the legal protection of utility patents. Third-party products are always mentioned without any reference to patent rights. Thus, the existence of such rights cannot be excluded. 2.2 Personnel Qualification The use of the product described in this document is exclusively geared to specialists having qualifications in PLC programming, electrical specialists or persons instructed by electrical specialists who are also familiar with the appropriate current standards. Moreover, the persons cited here must also be familiar with all of the products cited in this document, along with the operating instructions. They must also be capable of correctly predicting any hazards which may not arise until the products are combined. WAGO Kontakttechnik GmbH & Co. KG assumes no liability resulting from improper action and damage to WAGO products and third-party products due to non-observance of the information contained in this document.

8 8 Legal Bases Application Note A Limitation of Liability This documentation describes the use of various hardware and software components in specific example applications. The components may represent products or parts of products from different manufacturers. The respective operating instructions from the manufacturers apply exclusively with regard to intended and safe use of the products. The manufacturers of the respective products are solely responsible for the contents of these instructions. The sample applications described in this documentation represent concepts, that is, technically feasible application. Whether these concepts can actually be implemented depends on various boundary conditions. For example, different versions of the hardware or software components can require different handling than that described here. Therefore, the descriptions contained in this documentation do not form the basis for assertion of a certain product characteristic. Responsibility for safe use of a specific software or hardware configuration lies with the party that produces or operates the configuration. This also applies when one of the concepts described in this document was used for implementation of the configuration. WAGO Kontakttechnik GmbH & Co. KG is not liable for any actual implementation of the concepts.

9 Application Note A Scope of Functions 9 3 Scope of Functions This application note explains how you can use the Web visualization with the Java runtime environment JVM 7 Update 51 (7u51). 3.1 Background 3.2 Effect As part of the planned update of the Java runtime environment - also known as Java Runtime Environment (JRE), or Java Virtual Machine (Java VM, JVM) Oracle has announced in its blog (see that it will be modifying the security provisions for execution of Rich Internet Applications (RIAs) starting with the Java 7 update 51 (7u51) version which will be available as of January 14, These changes stipulate that an RIA may thereafter only be executed within the Java runtime environment started in the Internet browser when it possess a digital signature, or has been entered in an Exception List. The user interfaces (also known as WebVisu ) which can be generated using the CODESYS V2.3 development environment and stored on WAGO controllers with the control program are included in the group of Rich Internet Applications (RIA). Execution of the controller user interface will be prevented by the changes planned by Oracle to the security provisions after updating to Version 7u51 of the Java runtime environment, provided that this has not been preemptively corrected in advance. 3.3 Remedy Three possible approaches are currently available as a remedy to the cited effect. These are explained below: Do not perform updating of the Java runtime environment To the extent that the announced updating of the Java runtime environment on the specific computer which is to have access to the controller user interface is not carried out, that computer will continue to not be affected by the restriction cited above Integrating the controller addresses into the Exception List In the future, according to the announcement cited above starting from Version 7u51 of thejava runtime environment, an Exception List will be available under the Security tab of the Java Control Panel installed with the Java runtime environment. This list contains the addresses of the controllers for which the exception applies, given in the following format:

10 10 Scope of Functions Application Note A address>/plc/ Essential for each entry are both the leading " and the final "/". Exceptions are stored in the file exception.sites in the corresponding user directory. Central deployment of the file generated in this manner can be conducted by a system administrator Updating of "WebVisu" on the controller Based upon current knowledge, the most recommendable remedy over the long term appears to be the updating of the RIA, i.e., the "WebVisu" basic data on the controllers. There is a potential risk of malicious code infiltrating the system in particular when the visualization PC is connected to the Internet. The user interface need not be updated in this process, nor must the control program be recompiled. Only the files webvisu.jar and minml.jar need to be updated on the controller data buffer. These new files contain the signature required by the Java runtime environment. More information about the procedure for replacing these files is given in the following sections. 3.4 Additional Notes The information given below explains the general functioning of "Web-Visu" and provides notes on its use Background Information about the Visualization Process Connection setup between the visualization PC and the WAGO controller "Web-Visu" is loaded in the following steps after you enter the controller address in the Web browser of the visualization PC: (1) Call up the webvisu.htm Website at address>/plc/webvisu.htm (2) The controller then provides the webvisu.htm Website to the visualization PC browser. (3) The website is interpreted by the browser before it is displayed. (4) The Java runtime environment installed on the PC is started using the information from the webvisu.htm site.

11 Application Note A Scope of Functions Loading and checking the signed RIA Further steps are performed before the configured "Web Visu" is presented: (5) When the Java runtime environment is started it will request the "Web-Visu" basic files. (6) The controller provides the signed "Web-Visu" basic files (RIA) to the Java runtime environment that has been started. (7) When certificate verification is active (see Internet connection required for starting of "Web-Visu"), the Java runtime environment will establish an Internet connection to the certificate provider to ensure that the certificate is valid. (8) After validation of the certificate, the Java runtime environment then checks whether the certificate is already located in the local certificate buffer and whether it is classified as a trusted certificate by this provider and the storage location (URL). If it is not, the user must then explicitly agree to execution of the Web-Visu basic files (RIA). After verification of the validity of the certificate ((7) and (8)) the Java runtime environment then starts the "Web-Visu" basic files (RIA) provided by the controller.

12 12 Scope of Functions Application Note A Loading and presentation of the application-specific visualization The application-specific visualization interface is not loaded or displayed until the following two steps are carried out: (9) The "Web-Visu" reload the application-specific files from the controller using the parameters from webvisu.htm. (10) The requested files are transferred from the controller to the visualization PC. You may have to make appropriate settings in the Java runtime environment for proper display (see Using JPEG Images) General Information on Handling of Certificates The signature is calculated from the signed data (RIA) and from the private signature key from the software provider using a unique calculation rule. The signature is checked using the public key that fits with the private key from the software provider. The public key is provided with the software as an electronic certificate. See also This electronic certificate is checked by the Java runtime environment and stored on the PC being used. Stored certificates can be viewed using the Java Control Panel. Along with the certificate, information indicating whether the certificate is trusted is also stored. This trusted classification refers both to the provider of the certificate and to the storage location (URL) of the "Web-Visu" basic files (RIA). The certificate furnished with the software can be manually exported from the certificate buffer, or imported into the certificate buffer. (see Importing Certificates) Internet connection required for starting of "Web-Visu" When Web Visu is started, a check is made via the Internet at the certificate provider whether the certificate has been withdrawn. Therefore, it is recommended to have an Internet connection set up for this. A security warning is displayed if no Internet connection has been set up: "It could not be verified that the certificate used to identify this application has not been withdrawn."

13 Application Note A Scope of Functions 13 This certificate withdrawal check can be deactivated in the advanced settings for the Java Control Panels. You must explicitly allow execution of "Web-Visu" if certificate validation is not performed. If you also mark the option "Do not show again for applications from this provider and from this location" in the dialog window that is displayed, the certificate is saved and no further confirmation is required the next time you start "Web-Visu" Using JPEG Images JPEG images may contain so-called metadata (e.g., date created). These metadata may potentially contain executable code; therefore, JPEG images which are not signed are seen as "mixed code", along with the signed codes of the Java applets. If this occurs, the following security warning is displayed: "Block execution of potentially non-secure components?". This warning message can be deactivated in the advanced settings for the Java Control Panels. Explanation of settings: Activate Hide warning message and execute with protection: This option suppresses the display of the warning dialog window. The code will be executed as if the user has clicked "No" in the warning dialog window. Activate Hide warning message and do not execute untrusted code: This option suppresses the display of the warning dialog window and executes the action as if the user has clicked "Yes" in the warning dialog window Validity period of the electronic certificate The validity of certificates is limited by default. The certificate used for signing of the Web Visu basic files (RIA) is contained in the webvisu.jar and minml.jar files. When this time period expires, "Web- Visu" must be updated as described in Section Validity with expiry date of

14 14 Scope of Functions Application Note A A certificate that is valid until is contained in the webvisu.jar and minml.jar files V The JAVA Applets (webvisu.jar and minml.jar) must be updated for the respective control system in order to continue working with Web visualization after February 2016 Validity without expiry date (LongTermSignature) A certificate without an expiry date is included in the webvisu.jar and minml.jar files starting from Version V Determining the current version of the JAVA Applets In the Java control panel go to the Advanced menu and select Show console under Java Console. When Web visualization is started, the current version is shown in the Java Console. A further option for determining the version is described in the appendix. Checking the certificate in the menu Security using Details will show an expiry data The expiry data is not helpful and should be ignored.

15 Application Note A Scope of Functions 15 Checking the LongTermSignature may be done by: jarsigner -verify -verbose -certs minml.jar jarsigner -verify -verbose -certs webvisu.jar The program jarsigner is part of the jdk (may need to be installed additional) Central Distribution of JAVA Settings In larger corporate networks, individual users are not permitted to make changes to the settings using the Java Control Panel.

16 16 Scope of Functions Application Note A To ensure that "Web-Visu" can still be started without any problems, the required settings can be specified and distributed by the central corporate IT unit. Distribution of these settings can be controlled using a "Deployment Rule Set". This "Deployment Rule Set" is generated as an XML file and must also be digitally signed. A more-detailed description is given at Importing Certificates Besides using this "Deployment Rule Set" the certificate can also be imported into the certificate buffer. When imported, the certificate can be classified as trusted both for the provider and for the storage location (URL) of the "Web-Visu" basic files (RIA). If the certificate is imported as a trusted certificate, "Web-Visu" starts without any warning prompt, either with or without an Internet connection. An import must be performed for each individual storage location. The import is executed using the the "keytool" command line software, which is installed automatically with the Java runtime environment. The call-up must be writted with all of the transfer parameters on one line (line breaks and multiple spaces used here only to provide a clear overview in the documentation): [JRE]\keytool.exe -importcert -alias "deploymentusercert$tsflag$loc= [URL]:[Port]##docbase: [URL]:[Port]" -file "Webvisu.csr" -keystore "[Zertifikatsspeicher]\trusted.certs" -storepass "" -trustcacerts -noprompt Explanation of transfer parameters: [JRE] path for the installed Java runtime environment [URL]:[Port] address and port for the storage location "Webvisu.csr" electronic certificate [Zertifikatsspeicher] location of the certificate buffer Example of a 32-bit JRE under Windows 7 and a device with the address "c:\program Files (x86)\java\jre7\bin\keytool.exe" importcert - alias "deploymentusercert$tsflag$loc=http// :80##docbase:http // :80" file "Webvisu.csr" keystore "%userprofile%\appdata\locallow\sun\java\deployment\security\trust ed.certs" storepass "" trustcacerts noprompt

17 Application Note A Adaptations for the JVM-7 Update Example of a 32-bit JRE under Windows XP with the address http// : "c:\programme\java\jre7\bin\keytool.exe" importcert -alias "deploymentusercert$tsflag$loc=http// :80##docbase:http // :80" file "Webvisu.csr" keystore "%userprofile%\anwendungsdaten\sun\java\deployment\security\truste d.certs" storepass "" trustcacerts noprompt 3.5 Software components Manufacturer Type webvisu.jar 3S jar file minml.jar 3S jar file Webvisu.csr 3S Certificate CODESYS (build ) WAGO Development environment 4 Adaptations for the JVM-7 Update 51 Adaptation of Web visualization for WAGO control systems and controllers, WAGO-PERSPECTO panels and IPCs only involves loading the two files webvisu.jar and minml.jar to these devices. These files must either be copied in to the /PLC or /home/codesys or into the \Flashdisk\PLCWinCE directory. There a number of ways to do this. 4.1 Loading using FTP You can use any FTP client to load these files to the following folders on WAGO devices. /PLC \Flashdisk\PLCWinCE for controllers for the PERSPECTO panels /home/codesys for IPCs x 4.2 Using CODESYS V CODESYS V Starting from Version V (release planned for the spring of 2016), the validity of the JAVA Applet will be unlimited. Additional the possibility to run the visualization in a window of its own is integrated. Manual updating of the files webvisu.jar and minml.jar in the CODESYS installation directory under \Visu is then no longer required.

18 18 Current Browser Application Note A CODESYS V to V Starting with Version V (build ), the files webvisu.jar and minml.jar are loaded automatically to the controller when you download a Web- Visu project program. You must still ensure that the correct webvisu.jar and minml.jar files ( V recommended) are available in the CODESYS installation directory under \Visu, i.e., manual updating may be required CODESYS V and older If you are using an older version of CODESYS, the two files webvisu.jar and minml.jar must be stored in the CODESYS installation directory under \Visu. The program must then be recompiled. In the course of the subsequent download, the files will be loaded to the device in the background. As a further alternative, you can load the two *.jar files using the command "Write file to controller" once you have established an on-line connection to the device. In this case the project does not have to be recompiled. You must also copy the files to the \Visu directory to ensure that they are loaded for a later, newly compiled program download, and not the older *.jar files. 4.3 Using WAGOupload with Controllers Using the WAGOupload tool (available in the WAGO download area) you can load the files to the controller both via the Service interface and via ETHERNET. When using this tool with the ETHERNET interface you can conduct a download to several devices simultaneously. This tool is not for use with PERSPECTO devices and IPCs. 5 Current Browser It may not be possible to display Web visualization in the future with PC-based Internet browsers. The browser providers have decided to remove the plug-in interface for program extensions. Both Google and Mozilla have stated that this decision is based on user studies and security considerations. To have Web visualization displayed in a browser with the aid of the JAVA Applet, the JAVA Virtual Machine (JVM) is addressed via a plug-in interface of the browser. This required plug-in interface (ActiveX with Microsoft and Netscape API (NPAPI) for other manufacturers) may likewise no longer be supported by browser providers in the future.

19 Application Note A Current Browser 19 The table below presents the current, known status of different Windows-based browsers. The problem of having different version numbers and shutdown times is also present for browsers for other operating systems. Browser Plug-in Date Comment Interface (starting when) Chrome 42 NPAPI April 2015 Click to Play and later Chrome 45 NPAPI Sept Can no longer be used and later Firefox 26 NPAPI Dec Click to Play Opera 20 NPAPI March 2014 Support will be depreciated Internet Explorer 11 ActiveX Today Will not be developed further, supplied with Windows 10 Microsoft Edge None Today Supplied with Windows 10 Click to Play is currently possible Firefox and Chrome, but is not set as a default. Firefox users must therefore change the setting plugins.click_to_play in about:config ; with Chrome, this setting can be found under the content settings. A runtime environment is required on the client site (screen page) to use Web visualization in CODESYS-2.3 projects. CODESYS-2.3 Web visualization can be used with one of the following alternatives. 1: Compatible Browser Use a browser that supports the NPAPI or ActiveX plug-in interface. Advantage: Familiar functions are retained. Disadvantage: If the latest browser version is not used, security aspects and updates from the browser provider must then be taken into account. WAGO recommends using only the latest versions of browsers in systems with unrestricted access. 2: JAVA Virtual Machine (JVM) Start the JAVA Applet directly with the JVM. For this, the files webvisu.jar, minml.jar and webclient_conf.ini must be saved to the Client PC.

20 20 Current Browser Application Note A The file webclient_conf.ini must be edited. For each connection appropriate settings (URL,SIZE, STARTVISU, USEURLCONNECTION) must be inserted. Call up Web visualization in the command line (select the directory containing the files cited above as the root directory) with the following command: C:\Program Files (x86)\java\jre1.8.0_60\bin\java -classpath.; C:\Program Files (x86)\java\jre1.8.0_60\lib\rt.jar ;minml.jar;webvisu.jar webvisu.webvisuframe This command is for convenient reason available by the webvisu.bat file. The exact designation for the Java path must match that of the Java version that is installed. This path can be displayed in the Java Control Panel in the menu Java. Advantage: When machines and systems have already been configured, it is not necessary to update the JAVA files on the controllers being used. Only three files must be maintained (webclient_conf.ini, webvisu.jar and minml.jar) on a central computer. Disadvantage: The files must be copied to the Client PC. Use of any CODESYS input configuration by the programmer with internal commands ( INTERN LINK <URL>, INTERN CONNECT_TO <PLC, or the like) is not supported. A console window must be active at all times.

21 Application Note A Current Browser 21 3: Using Java Web Start with the *.jnlp file The Java Applet can be started in a dedicated window using a *.jnlp file. For this, a current version of the two files webvisu.jar and minml.jar must be located on the controller. Two files are required on the Client PC. webclient_conf.ini and a *.jnlp file. Example, Wago.jnlp: Web visualization for a controller with the IP address is to be displayed. <?xml version="1.0" encoding="utf-8"?> <jnlp spec="1.0+" codebase=" <security> <all-permissions/> </security> <resources> <j2se href=" version="1.6+"/> <jar href=" <jar href=" </resources> #<application-desc main-class="webvisu.webvisuframe"/> <applet-desc documentbase=" name="webvisu" main-class="webvisu.webvisuframe"> </applet-desc> </jnlp> This example expects at least Java version 1.6 on the client computer. If for security reason a newer version should be used, the *.jnlp file must be modified. The default position and size of the window can be specified using the file webclient_conf.ini. URL= SIZE=300,300,1000,800 STARTVISU=PLC_VISU USEURLCONNECTION=TRUE The Size parameter defines the left top corner of the window in the first two parameters and the height of the window using the following parameters.

22 22 Current Browser Application Note A Advantage: Easy configuration and simple call-up Disadvantage: A current version of the two files webvisu.jar and minml.jar must be located on the controller. Use of any CODESYS input configuration by the programmer with internal commands ( INTERN LINK <URL>, INTERN CONNECT_TO <PLC, or the like) is not supported.

23 Application Note A Appendix 23 6 Appendix 6.1 Product Relevance This information applies to the following WAGO products which use a "WebVisu" user interface: Item number /xxx-xxx /xxx-xxx /xxx-xxx /xxx-xxx /xxx-xxx /xxx-xxx /xxx-xxx /xxx-xxx /xxx-xxx /xxx-xxx Short description I/O-IPC-G2 (all versions) I/O-IPC-C6 (all versions) I/O-IPC-C10E (all versions) I/O-IPC-P14 (all versions) PERSPECTO CP 35 QVGA TV (all versions) PERSPECTO CP 57 QVGA TV (all versions) PERSPECTO CP 104 VGA TV (all versions) PERSPECTO CP 121 SVGA TV (all versions) PERSPECTO CP 150 XGA TV (all versions) Programmable Fieldbus Controller ETHERNET TCP/IP (all versions) Programmable Fieldbus Controller KNX IP Programmable Fieldbus Controller BACnet/IP Programmable Fieldbus Controller BACnet/IP Programmable Fieldbus Controller ETHERNET TCP/IP, 2 Ports (all versions) Programmable Fieldbus Controller TELECONTROL (all versions) Programmable Fieldbus Controller ETHERNET TCP/IP, RS Programmable Fieldbus Controller ETHERNET TCP/IP, SD Card (all versions) Programmable Fieldbus Controller ETHERNET TCP/IP (all versions) Programmable MR Fieldbus Controller ETHERNET TCP/IP Application Controller BA; flexroom Application (all versions) Programmable MR Fieldbus Controller ETHERNET TCP/IP, SD Card (all versions) PFC 200 (all versions) x/0xx-00x PFC 200 (all versions) WAGO-I/O-PRO, Programming Tool IEC , Version 2.3 (all versions)

24 24 Appendix Application Note A Determining Your JAVA Applet Version Open the file webvisu.jar, e.g., using PowerArchiver or any other compatible program to view the packed files. Then, open the file Web-Visu.class and look for Version.

25 WAGO Kontakttechnik GmbH & Co. KG Postfach 2880 D Minden Hansastraße 27 D Minden Telefon: +49 (0) 571/ Telefax: +49 (0) 571/ info@wago.com Internet: