Introduction

Access to WinCC OA software and licenses needs to be regulated following the License Agreement signed between CERN and ETM professional control (100% owned subsidiary of Siemens AG), the vendor of WinCC OA.

The agreement allows to use WinCC Open Architecture to develop control systems needed by CERN and its on-site experiments. It also allows to run production systems on CERN premises for a vast set of use cases, notably for the LHC and fixed-targer Experiments, Accelerator and the technical infrastructure.

Access to WinCC OA downloads (software, documentation) as well as to licenses required to run it needs to be granted explicitly to every user (WinCC OA developer, control system engineer) through the process of getting registered as an Authorized WinCC OA User described below.

Depending on the way in which WinCC OA will be used, there are different procedures to follow in order to get registered. In particular, for research institutes of universities collaborating with CERN, the access may be granted through a Sublicense Agreement signed between CERN and the Institute.

Getting registered as an Authorized WinCC OA  User

The process of getting registered as an authorize WinCC OA user is sketched in the diagram below.
In essence, provided that a valid Sublicense Agreement already exists, the user needs to get in touch with the Technical Contact, who in turn requests the registration at the CERN WinCC OA Service:

A user cannot request a registration her/himself and always needs to get in touch with the Technical Contact person (see the procedure below on how to find the Technical Contact) and ask to be accepted as a new user/developer of WinCC OA in the scope of a particular project.

Then the Technical Contact, provided he accepts to take the legal responsibility for the use of WinCC OA by the new user, gets in touch with the CERN WinCC OA Service and asks for the registration of the person as a new Authorized WinCC OA User.
The request needs to specify details such as the user's full name, email, nationalities, country of residence, affiliation to other reasearch institutes and the purpose for the use of WinCC OA that needs to be related to CERN activities.

The information related to the nationalities, the country of residence and affiliations to the research institute are required due to CERN obligations related to export control regulations and international embargos, made mandatory by the main license agreement signed by CERN.
Following the CERN data privacy policies, it should state that the new user's nationality/residence (or one of affiliation) is not of one of the countries under the European or American embargo (details should always be checked  with WinCC OA Service by the Technical Contact.
As of this writing the international embargos affect North Korea, Cuba, Syria and the Crimea region of Russia.

The Technical Contact's responsibiliity is to ensure that the information provided to the CERN WinCC OA Service is complete and correct, and needs to update it as necessary.

The email address communicated by the Technical Contact in the request will be used to authenticate users to WinCC OA web pages.
For all users holding CERN accounts, it is the CERN email address that should be used. Otherwise, the email address needs to be registered as a CERN Lighweight account as explained below. 

Once the request is received and validated by the administrative team at CERN WinCC OA Service, the user is registered in the database of Authorized WinCC OA users, and the access to WinCC OA downloads page is granted, and the user may request WinCC OA licenses.
This process usually takes no more than a few hours.

Rules and obligations of users

The use of WinCC OA must strictly adhere to the WinCC OA license/sublicense agreements signed by CERN and their home institutes. In any doubt, one should consult with the Technical Contact, who may inquire the CERN WinCC OA Service about the detail.

Notably (a non-exhaustive list):

• one must respect all the closes of the WinCC OA End User Sublicense Agreement and by installing WinCC OA assumes the acceptance of the rules stated therein. Notably, the clauses related to the Export Control Regulations must be observed.
• one may use WinCC OA solely for the professional/research purposes covered by the sublicense agreement (e.g. development of a control system for subdetector X or the experiment Y at the LHC). 
• one must not use WinCC OA (and its license) to develop (or run) projects unrelated to the declared "purpose". 
• one must not use WinCC OA and its development licence to develop any project unrelated to CERN activities.
• one must not make the installation available to any other person who is not registered as an authorized user
• one must not request WinCC OA development licenses on behalf of other persons who are not registered as an authorized user
• except for Control Coordinators, members of the Central DCS Teams and persons explicitly authorized by WinCC OA Service, users may not request production licences for their systems (only time-limited development licenses are granted).
• one must cease the use of WinCC OA, uninstall it from the computer and destroy the license as soon as the legitimate use registered as the "purpose" ends (e.g. collaboration in a project), or e.g. a person's association with the home insitute ends
• one must stop using WinCC OA as soon as the sublicense agreement of the home institute becomes invalid or suspended. In this case, one must uninstall WinCC OA from all the computers and destroy the licenses.
• one is obliged to have the user-registration explicitly prolongued each year, through the Technical Contact person
• if one needs to use WinCC OA for the CERN-related purposes other than originally expressed during the registration (e.g. to develop control systems for another LHC detector), the Technical Contact responsible for the new use must be contacted, and the registration with CERN WinCC OA Service must be updated!

Finding the Technical Contact Person:

• if the new person has a CERN TECH, DOCT, GRAD or STAF contract (ie. employed by CERN)
  • for the development of Detector/Experiment Control Systems (for the LHC as well as fixed-target experiments): please contact your Experiment's Controls Coordinator who acts as a Technical Contact
  • for the development for the Accelerators or Technical Infrastructure: please contact your CERN Group or Project Leader who acts as a Technical Contact
  • if you are a member of the CERN BE-ICS group, you should already be registered as an authorized user
• if the person is a CERN USER (ie. other types of CERN contracts) and is going to use WinCC OA at CERN
  • her/his Home Institute must have a sublicense agreement signed with CERN
  • It is the technical contact of the Home Institute that needs to be contacted to request the registration
  • to find if a sub-license has already been signed and to get the name of the Technical Contact person, you may want to contact us at icecontrols.support@CERN.CH , specifying the name of the institute and the purpose of the use of WinCC OA (or the project for which it will be used).
  • if a sublicense agreement has not yet been signed, then the institute will firstly need to have it signed (see the procedure), nominate the Technical Contact person, and then this person may request the registrations of other users. The procedure gets more complex in this case.
• if the person is going to use WinCC OA in her/his Home Institute
  • the use of WinCC OA is strictly restricted to the projects done in collaboration with CERN, notably for the development of Control Systems for the Experiments that are run on CERN premises
  • as above, it is the Home Institute that must have a sublicense agreement signed with CERN
  • It is the technical contact of the Home Institute that needs to be contacted to request the registration
  • to find if a sub-license has already been signed and to get the name of the Technical Contact person, you may want to contact us at icecontrols.support@CERN.CH , specifying the name of the institute and the purpose of the use of WinCC OA (or the project for which it will be used).
  • if a sublicense agreement has not yet been signed, then the institute will firstly need to have it signed (see the procedure), nominate the Technical Contact person, and then this person may request the registrations of other users. The procedure gets more complex in this case.

• if WinCC OA is going to be used for development of a control system not located on CERN premises  or not related  to CERN, then it is not possible to use WinCC OA through the CERN-ETM License Agreement, and a separate arrangement needs to be found.
  There are already dedicated procedures in place for such cases - do not hesitate to contact us at icecontrols.support@CERN.CH for details.

Email and CERN Lightweight Account

This step is only necessary for persons not having a CERN account (and email address); in all other cases the CERN email address of a new user should be used for the registration.

If the person being registered  has not  a CERN account and email address (e.g. for users in collaborating institutes) then s/he needs to apply for a "CERN lightweight account". This account registers the email address with CERN, and associates a password with it. To apply for a CERN lightweight account (or reset its password, etc) please use the CERN Lightweight Account portal.

Once set up the email address could (and the password) may be used to log in to a number of CERN web sites, and notably to the WinCC OA downloads pages and to the WinCC OA License Request form.

It is important that the same email address that got associated with the lightweight account is then communicated to the Technical Contact so it is used when requesting the registration.

Log in once to CERN Jira instance

Following the registration as an authorized WinCC OA user, new users need to also log in to the CERN central Jira web portal https://its.cern.ch (unless they used it before).
We use the Jira service to handle all requests related to WinCC OA, and this initial login to the https://its.cern.ch Jira portal will ensure that

1. the user may properly authenticate to CERN login pages
2. the emails sent by the user to our support line, are properly identified and atrributed

This way we ensure that user requests are handled in the most efficient way and minimal delays.

Examples

A new WinCC OA User affiliated to an external institute (External Users and CERN Associated Members of Personnel)

 "My name is Jane Doe, I'm a student at University of X working on my thesis related to ATLAS ITK detector upgrade; I have never been at CERN and I was told by my supervisor that I will need WinCC OA for this thesis. How do I proceed?

• you send an email to our support line: icecontrols.support@CERN.CH asking whether the University of X has the WinCC OA sublicense agreement signed with CERN, and who is the technical contact
• assuming that the University already has the agreement, you will get a response telling you that this is John Y
• you contact John Y explaining why you need to access WinCC OA in context of your thesis related to CERN and ask him to get you registered as Authorized WinCC OA User at CERN; you also provide him with your email address e.g. jane.doe@gmail.com
• John, being recognized as Technical Contact Person for University of X contacts the CERN WinCC OA service and asks to get you registered, and informs you once this is done
• in the CERN Lightweight Account portal you complete the online registration form, validate your account and set the password following the instructions provided
• you may proceed to the WinCC OA Downloads pages and try to download the WinCC OA distribution. When you click on the download link, you will be redirected to the CERN Login page - you may want to use the "Login as guest" button at the bottom-right corner.
• note that it may take up a bit of time between you get registered and everything gets activated - if things don't work immediately, be patient and retry to log in after a few hours."

Please, note that this example is also applicable to CERN Associated Member of Personnel (MPAs) holding statuses like USER, COAS, VISITOR, etc. regardless where the person is located. WinCC OA, like many other software products used at CERN, is protected by International Export Control Regulations and CERN strives to ensure due diligence.  In the case of CERN MPEs, even if physically located at the Organisation premises, a sub-license agreement with the affiliation institute is also required as this is consider a case of "deemed export". 

A CERN Employed Member of personnel (MPE)

The following example illustrates the case where a CERN  Employed Member of personnel (MPE) like TECH, DOCT, GRAD, STAFF needs to develop using WinCC OA.

"I'm joining the LHCb experiment at CERN as a GRAD to work on detector control system and need to use WinCC OA on my office PC . How do I proceed?

• It is likely that you already know your Experiment's Controls Coordinator, who would likely supervise your job somehow anyway - she is your Technical Contact; for LHCb it is Clara G. If not sure, ask us at icecontrols.support@CERN.CH to tell you the name of your Technical Contact person - see also how to find my Technical Contact Person.
• You ask Clara to get you registered as an authorized WinCC OA user, telling her your CERN email address; once this is done, 
• You already have a CERN account, which you will use to log in to downloads pages, etc - no hassle wit getting a lightweight account, etc
• Try to proceed to WinCC OA Downloads page - this should all work (after a bit of time it takes for the accounts and access rights to get propagated)"

{"enableNumbering":false}