JP2010015419A - Plant information processing system and plant information processing method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a plant information processing system and a plant information processing method capable of appropriately restricting access to data. <P>SOLUTION: A data server 5 comprise a data storage means 51 for storing data collected from a data source of a plant, and an access right setting means 52 for setting access right for each accessing person for each data stored in the data storage means 51. An operation monitoring station 3 comprises an access acceptance means 31 for permitting access to the data stored in the data storage means 51 according to the access right set by the access right setting means 52. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a plant information processing system and a plant information processing method for accepting access to data collected from a plant data source.

As a method for restricting operations on data collected from a data source of a plant, a method for uniformly defining a restriction range according to the role of a user such as an engineer or an operator is used. In this case, if the role is the same, the same data can be accessed equally between different users.
JP 2007-317056 A

  However, in the conventional system, an access right can be set only for an operation, and only a uniform restriction can be made according to the role of the user. For this reason, normally, an operator can perform operations on all data, and since it is left to the operation which of a large number of operation data is used, there is a risk of erroneous operation. In addition, engineering can be performed for all data, and erroneous operations on data may lead to malfunctions. Furthermore, since the access right is limited to operations and data browsing is not limited, there is a risk of leaking information.

  An object of the present invention is to provide a plant information processing system and a plant information processing method capable of appropriately restricting access to data.

A plant information processing system according to the present invention is a plant information processing system that accepts access to data collected from a plant data source. The data storage means stores data collected from a plant data source; and the data storage means Access right defining means for defining an access right including a read right for each accessor for each of the data stored in the data, and an access receiving means for permitting access to the data stored in the data storage means according to the access right; It is characterized by providing.
According to this plant information processing system, the access right including the read right is defined for each accessor for each stored data, so that access to the data can be appropriately restricted.

  As the access right, a read right and a write right may be individually settable.

  An execution right of information processing using data to be accessed may be provided as the access right.

The plant information processing method of the present invention is a plant information processing method for accepting access to data collected from a plant data source, the step of storing data collected from the plant data source, and the step of storing the data A step of defining an access right including a read right for each accessor for each of the data stored by the step, and a step of permitting access to the stored data according to the step of storing the stored data according to the access right It is characterized by providing.
According to this plant information processing method, the access right including the read right is defined for each accessor for each stored data, so that access to the data can be appropriately restricted.

  As the access right, a read right and a write right may be individually settable.

  According to the plant information processing system of the present invention, the access right including the read right is defined for each accessor for each stored data, so that access to the data can be appropriately restricted.

  According to the plant information processing method of the present invention, the access right including the read right is defined for each accessor for each stored data, so that access to the data can be appropriately restricted.

  Hereinafter, with reference to FIGS. 1-4, one Embodiment of the plant information processing system by this invention is described.

  FIG. 1 is a block diagram showing the configuration of a field control system that constitutes the plant information processing system of the present embodiment.

  As shown in FIG. 1, the field control system includes control stations 1, 1,... Distributed in the plant, and field devices 2, 2,. And an operation monitoring station 3 that performs integrated operation and monitoring. Further, a data server 5 that collects data from various data sources in the field control system is connected to the network 4 that connects the control stations 1, 1,...

  As shown in FIG. 1, the data server 5 defines data access means 51 for storing data collected from the data source of the plant and access rights for each accessor for each of the data stored in the data storage means 51. And an access right defining means 52. Further, the operation monitoring station 3 constitutes an access receiving means 31 that permits access to data stored in the data storage means 51 in accordance with the access right defined by the access right defining means 52.

  FIG. 2 is a diagram showing a data structure of the plant. As shown in FIG. 2, the plant is expressed in a hierarchical tree structure in order by factories, areas, series, etc., for example, as data of pumps 21 or tanks 22 as field devices 2 belonging to series X, There are opening, flow rate, power consumption, efficiency, etc. The data server 5 collects these data from the respective data sources and stores them in the data storage means 51.

  FIG. 3 is a diagram showing an access right setting state defined by the access right defining means 52.

  FIG. 3A shows an access right setting state for the pump 21. In this example, with respect to the opening degree, flow rate, power consumption, and efficiency, which are data of the pump 21, only a read right is given to a user belonging to the A group, and a read right, a write right and an execution right are given to the user belonging to the B group. The user X is given a read right and a write right.

  On the other hand, FIG. 3B shows the setting status of the access right for the tank 22. In this example, with respect to the opening degree, flow rate, power consumption, and efficiency, which are data of the tank 22, the user belonging to the A group has the read right, the write right and the execute right, and the user belonging to the B group has only the read right. The user X is only given the read right.

  Here, the read right is an access right necessary to read the corresponding data from the data storage unit 51, and the write right is an access right necessary to write (change) the corresponding data to the data storage unit 51. . The execution right is an access right necessary for executing an operation script or the like using the data for analysis or the like.

  Thus, in the plant information processing system of this embodiment, the access right can be individually set for each user accessor and field device. In addition, as an access right, a read right, a write right, and an execution right can be individually set.

  FIG. 4 is a flowchart showing the operation when the user requests access to the data stored in the data storage means 51 via the operation monitoring station 3.

  In step S <b> 1 of FIG. 4, the access receiving unit 31 executes the user authentication process.

  Next, in step S2, the access receiving unit 31 receives an access request from the user. The access request includes the data to be accessed and the form of access (read, write, execute).

  Next, in step S3, the access right setting status defined by the access right defining means 52 is referred to determine whether or not the access request accepted in step S2 should be permitted (whether there is an access right). If YES is determined, the process proceeds to step S4. If the determination is negative, the process proceeds to step S5.

  In step S4, the access accepting means 31 allows the user's access (access to the data specified by the access request in the access form specified by the access request), and ends the process.

  On the other hand, in step S5, the access receiving means 31 prohibits the user's access and executes an error display, and the process ends.

  As described above, in the plant information processing system of the present embodiment, information leakage can be effectively prevented by restricting access to data including reading. In addition to subdividing user roles, access rights are individually set according to the types of devices such as pumps and tanks. For this reason, it is possible to finely set a user who is allowed access to each device, and it is possible to effectively prevent an erroneous operation or malfunction. For example, even for the same operator, erroneous operation can be prevented by distinguishing the setting range of the access right between an operator having a role of operating the pump and an operator having a role of operating the tank.

  In addition, as the type of access right, a read right, a write right, an execution right, and the like can be set for each data. For this reason, for example, by associating a user who can perform engineering for each data with a setting range of the write right, the range in which engineering can be performed can be set finely.

  Also, unauthorized access can be found by leaving a data access request and access history as a log in the data server 5 or the like. Further, for example, by analyzing the log when the operation of the plant becomes unstable, it becomes possible to quickly find the cause of the instability.

  The scope of application of the present invention is not limited to the above embodiment. The present invention can be widely applied to a plant information processing system and a plant information processing method that accept access to data collected from a plant data source.

The block diagram which shows the structure of the field control system which comprises the plant information processing system of one Embodiment. The figure which shows the data structure of a plant. The figure which shows the setting condition of the access right prescribed | regulated by the access right regulation means. The flowchart which shows operation | movement when a user requests | requires access to the data stored in the data storage means.

Explanation of symbols

31 Access accepting means 51 Data storage means 52 Access right defining means

Claims (5)

In a plant information processing system that accepts access to data collected from plant data sources,
Data storage means for storing data collected from plant data sources;
Access right defining means for defining access rights including read rights for each accessor for each of the data stored in the data storage means;
Access accepting means for permitting access to data stored in the data storage means according to the access right;
A plant information processing system comprising: The plant information processing system according to claim 1, wherein a read right and a write right can be individually set as the access right. The plant information processing system according to claim 2, wherein an execution right of information processing using data to be accessed is provided as the access right. In a plant information processing method that accepts access to data collected from a plant data source,
Storing data collected from a plant data source;
Defining access rights including read rights for each accessor for each of the data stored by the step of storing the data;
Granting access to the stored data according to the access rights by storing the stored data;
A plant information processing method comprising: The plant information processing method according to claim 4, wherein a read right and a write right can be individually set as the access right.

Images