Method for maintaining a digital representation of a physical system

Abstract

A computer implemented method for maintaining a digital representation of a physical system, the physical system comprising a set of one or more physical devices associated with an installation location, the set of one or more physical devices including a gateway device for communicatively coupling the set of one or more physical devices to a remote data processing system, the digital representation including system data indicative of the set of one or more physical devices; wherein the gateway device comprises a gateway identifier obtainable from said gateway device by a maintenance operator and / or by a user device of said maintenance operator, when the maintenance operator and / or the user device is in a proximity of the gateway device, the gateway identifier identifying the gateway device; wherein the method comprises: selectively allowing one or more authorized users access to the system data and to alter the system data, wherein said maintenance operator is different from the one or more authorized users; receiving, from the user device of the maintenance operator, an access request for limited access, the access request being indicative of a target gateway identifier; granting the maintenance operator selective access limited to predetermined data processing functionality associated with system data of a target set of one more physical devices, the target set including a target gateway device identified by said target gateway identifier, wherein the predetermined functionality prevents the maintenance operator from altering the system data.

Description

[0001]METHOD FOR MAINTAINING A DIGITAL REPRESENTATION OF A PHYSICAL SYSTEM TECHNICAL FIELD The present invention relates to methods and systems for maintaining a digital representation of a physical system. The physical system comprises a set of one or more physical devices associated with an installation location, including a gateway device for communicatively coupling the set of one or more physical devices to a remote data processing system. BACKGROUND Physical systems that include a plurality of physical devices are used for a variety of applications. For example, many fluid systems include a variety of physical devices, such as pumps, valves, sensors, control cabinets and / or other physical devices. Some fluid systems are relatively small installations with few physical devices, such as domestic heating or HVAC systems. Other examples may be considerably larger and include many physical devices, e.g. heating or HVAC systems of large industrial sites, airports, hotels, large apartment complexes etc. Other examples of physical systems having a plurality of physical devices include manufacturing systems, which may comprise a plurality of machines, conveyors, sensors, and / or other physical devices. Many physical systems include one or more gateway devices configured to provide communicative connectivity between the physical system and a remote data processing system, e.g. via the internet or another suitable computer or communications network. In many situations, it is desirable to maintain a digital representation of a physical system, which represents system data including data associated with individual physical devices of the physical system, e.g. data representing how the devices are linked to each other, data indicative of the makes and models of the individual devices, and / or other data. Digital representations of a physical system can be useful for a variety of purposes, e.g. for the planning of system maintenance, system control, system diagnostics and / or other purposes. In order for the digital representation of a physical system to be useful in practice, it is generally desirable that the digital representation accurately reflects the physical system. In particular, it is desirable that changes to the physical system can efficiently and accurately be reflected by corresponding changes to the digital representation. At the same time, it is often desirable that at least some aspects of a digital representation of a physical system are only accessible to authorized users, e.g. in order to ensure confidentiality of sensitive system information and / or to ensure integrity of the digital interpretation. For example, for an owner of a physical system it is often desirable to ensure that the digital representation of the physical system is protected against unauthorized tampering. At the same time, it is often desirable that actual modifications to the physical system can accurately and efficiently be reflected by corresponding updates to the digital representation. Modifications to the physical system are typically performed by maintenance personnel who do not have access to the computer implemented system that maintains the digital representation. For example, the maintenance personnel may be persons outside of the system owner´s organization and the maintenance personnel may frequently change, thereby making it difficult for the system owner to efficiently and securely manage access to the digital representation. On the other hand, involving authorized users in all systemmaintenance work that may involve updates of the digital representation is costly and inefficient. In particular, such systemmaintenance may in some cases be time critical in order to ensure uninterrupted and proper operation of the physical system. Accordingly, it is desirable to provide methods and systems for maintaining a digital representation of a physical system that is efficient, reliable and provides a relatively high level of security, e.g. when commissioning or recommissioning physical devices or when otherwise making changes to the physical system. In particular, it is desirable that maintenance operators can perform system maintenance efficiently, without the need for repeated visits to the physical location where the physical system is installed. Moreover, it is desirable that the maintenance operator can perform the maintenance task independently, without the owner of the system having to be physically present at the installation location and with little administrative burden for the owner. Yet further, it is desirable to provide a system that provides a reasonably high level of security against unauthorized access to the digital representation. SUMMARY In view of the foregoing, it remains desirable to provide methods and systems that solve one or more of the above problems and / or that have other benefits, or that at least provide an alternative to existing solutions. According to one aspect, disclosed herein are embodiments of a computer implemented method for maintaining a digital representation of a physical system. The physical system comprises a set of one or more physical devices that are associated with an installation location. The set of one or more physical devices includes a gateway device for communicatively coupling the set of one or more physical devices to a remote data processing system, in particular the data processing system executing the method disclosed herein. The digital representation includes system data indicative of the set of one or more physical devices. The gateway device comprises a gateway identifier obtainable from said gateway device by a maintenance operator and / or by a user device of said maintenance operator, when the maintenance operator and / or the user device is in a proximity of the gateway device. The gateway identifier identifies the gateway device. Embodiments of the method, which may be executed completely or in part by the remote data processing system, comprise: selectively allowing one or more authorized users access to the system data and to alter the system data, wherein said maintenance operator is different from the one or more authorized users; receiving, from the user device of the maintenance operator, an access request for limited access, the access request being indicative of a target gateway identifier; granting the maintenance operator selective access limited to predetermined data processing functionality associated with system data of a target set of one more physical devices, the target set including a target gateway device identified by said target gateway identifier, wherein the predetermined functionality prevents the maintenance operator from altering the system data. Accordingly, a maintenance operator may be granted selective access to limited functionality associated with the digital representation, without the maintenance operator having to be set up as an authorized user of the system that manages the digital representation and without the need for such an authorized user to participate in the actual modification of the physical system or even to perform actions at the same time as the maintenance operator makes changes to the physical system. In particular, the maintenance operator may perform commissioning, recommissioning or other system maintenance work without the need for the owner of the system to be physically present, as the maintenance operator can obtain selective access to relevant functionality associated with the system data of the system on which maintenance is being performed. The owner may not even need to access the data processing system that maintains digital representation while the maintenance operator performs the maintenance. The maintenance operator may nevertheless perform the maintenance operations in an efficient manner. Since the maintenance operator can obtain limited access to the system data while being on site, the maintenance operator may immediately verify the correctness of the installation or propose changes to the digital representation, thus avoiding the need for repeated visits. As the maintenance operator can gain the selective access to system data of a given target device by providing the corresponding target gateway identifier of the corresponding target gateway device, the owner of the system does not need to be present or set up the maintenance operator as a regular, authorized user of the system. Maintenance work can thus be efficiently performed by different maintenance operators. Nevertheless, a high level of data security is maintained, since the maintenance operator is prevented from making changes to the digital representation, since the selective access is granted by the system only responsive to entering a gateway identifier and since the selective access is limited to predetermined data processing functionality associated with system data of the target set of one more physical devices associated with the entered target gateway identifier. For example, the maintenance operator may have read access to selected system data that facilitates the actual system update. Accordingly, the systemmaintenance may be performed efficiently and less error prone. At the same time, the maintenance operator is prevented from altering the digital representation. Moreover, even the access to said limited functionality is limited to persons having access to the gateway identifier. Obtaining the gateway identifier typically involves having physical access to the gateway device. This, in turn, typically requires physical access to the installation location in order to obtain the gateway identifier of a gateway device installed at said installation location. Accordingly, only persons having physical access to an installation location can obtain meaningful system data about the physical system installed at said installation location. Hence, the method provides an efficient yet reasonably secure maintenance of the digital representation. For the purpose of the present description, the maintenance operator will also be referred to as the installer, since embodiments of the method and system described herein are particularly, though not exclusively, useful in connection with the installation of physical devices during commissioning and re commissioning. Various embodiments of the method may by executed by a data processing system, in particular by said remote data processing system, to which the gateway device communicatively couples the set of one or more physical devices. It will be appreciated that the gateway device may be coupled directly or indirectly to the data processing system configured to execute an embodiment of the method disclosed herein, e.g. via one or more intermediate data processing systems and / or one or more other nodes of a communication network. Accordingly, in some embodiments, the acts of the method are performed by said data processing system, in particular by said remote data processing system, which may be remote from the gateway device and / or from the installation location. In particular, receiving the access request may comprise receiving the access request at the data processing system, in particular at the remote data processing system, which executes the method disclosed herein. Granting the maintenance operator selective access is performed by the data processing system automatically, responsive to in particular responsive only to the data processing system receiving the target gateway identifier, i.e. when the maintenance operator requests access with a target gateway identifier, access is automatically and immediately granted by the data processing system, but the access is selective, in particular only to data relating to the entered target gateway identifier, and the access is only to limited functionality. The limited functionality is a subset of the functionality available to an authorized user of the system and does not include functionality for making changes to the digital representation. For the purpose of the present disclosure, the term ^physical device^ refers to any device that is physically installed or to be installed at a physical installation location, e.g. as opposed to a virtual device, which only exists as a digital representation. Examples of physical devices include machines, such as pumps, motors, actuators, valves, etc. that can impart motion, pressure, force, torque or the like. Other examples of physical devices include sensors for measuring physical quantities such as pressure, force, acceleration, torque, temperature, electrical current, electrical voltage, magnetic field strength, sensors for measuring flow, vibration, energy consumption, fluid consumption such as water consumption, etc. Yet further examples include electronic devices, such as switches, inductors, transformers, control units, data processing devices, communications devices, etc. A physical system including a plurality of physical devices will also be referred to as an installation. Typically, the physical devices of a physical system are linked together in a system topology, e.g. a daisy chain, a ring network, a mesh network, a hierarchical topology defining parent child relations between device, a network topology defining communications links between devices and / or another type of system topology defining relationships between individual physical devices of the physical system. In particular, an installation may be defined as a set of physical devices linked together in a topology at an installation location. A digital representation may represent a logical representation of the installation; the digital representation being maintained by a data processing system. The digital representation may represent the topology of the physical system as well as the characteristics of the individual physical devices. A digital representation of a physical system is sometimes also referred to as a digital device hierarchy. A digital representation of individual physical devices of the system are sometimes also referred to as a shadow device or device twin of the physical device. However, other terminologies are also used. The target gateway identifier identifies a target gateway device for which access to the corresponding system data is requested, typically because the maintenance operator has performed or is about to perform maintenance work on said target gateway device or on devices connected to said target gateway device. Typically, the target gateway identifier identifies a gateway device that is already installed at the installation location or that is to be installed or changed but where the physical installation has not yet been performed. Accordingly, the gateway target identifier may be indicative of an already installed gateway device, i.e. of a gateway device that is already part of the physical system. Alternatively, the target gateway identifier may be indicative of a different gateway device, in particular a new gateway device that has not yet been installed as part of the physical system or that has recently been installed but not yet registered with the digital representation of the physical system. Similarly, the target set of physical devices may be the entire set of physical devices of the physical system or a subset of the set of physical devices of the physical system. Alternatively, the target set of physical devices may be a set of one or more physical devices that are yet to be installed as part of the physical system or that have recently been installed but for which no system data has yet been registered with the digital representation of the physical system. Yet alternatively, the target set may include a mix of devices that are already installed and devices that are yet to be installed. Accordingly, the target gateway identifier may be a gateway identifier already known to the data processing systemmaintaining the digital representation, or it may be a new, yet unknown gateway identifier. It will be appreciated that the limited functionality available in respect of a target gateway identifier depends on whether the target gateway identifier matches a known gateway identifier: For example, the process can normally not display any system data associated with an unknown target gateway identifier. Nevertheless, some embodiments of the system may register change proposals associated with a yet unknown target gateway identifier, as will be described in greater detail below. A gateway device may be any device that can be configured to communicatively couple the set of one or more physical devices to a remote data processing system. The gateway device may be embodied as a separate gateway device or it may be integrated with a physical device that performs another function, e.g. with a sensor, a pump, a control box for controlling one or more other device, and / or the like. Generally, the digital representation may include data associated with physical devices that are installed at the installation location and, optionally, data associated with physical devices that are to be installed, but that have not necessarily yet been installed at the installation location. Accordingly, the physical system associated with the installation location may include or even consist of physical devices that are installed at the installation location; optionally, the physical system associated with a physical location may include physical devices that are to be installed, but that have not necessarily yet been installed at the installation location. The access request may include the target gateway identifier or another data item from which the data processing system may derive the target gateway identifier. Each gateway device may include its gateway identifier in human readable form and / or in machine readable form. Accordingly, the maintenance operator may read a human readable gateway identifier from a gateway device and manually enter the read gateway identifier as a target gateway identifier into a user device. Alternatively, the gateway identifier is a machine readable identifier, machine readable by the user device when the user device is in a predetermined proximity of the gateway device. Accordingly, the maintenance operator may use the user device, or a reader device coupled to the user device, to read the machine readable gateway identifier from a gateway device and cause the user device to send an access request indicative of the thus read gateway identifier as target gateway identifier. Examples of a machine readable identifiers include gateway identifiers embodied as an RFID tag, a QR code, a barcode, or in another suitable machine readable manner. Preferably, the machine readable identifier is configured to be readable only when the reading device is in a predetermined proximity of the gateway device, e.g. by requiring line of site or by employing a short range communication technology. In some embodiments, the gateway identifier is a unique identifier uniquely identifying the gateway device. In some embodiments, the digital representation includes ownership data associating respective groups of one or more of the authorized users with gateway identifiers of respective gateway devices; and wherein the method comprises: receiving an ownership request from an authorized user of a requesting group of one or more authorized users, the ownership request being indicative of a requested gateway identifier; responsive to the received ownership request, amending the ownership data to associate the requesting group with the requested gateway identifier. Accordingly, an entity, e.g. a company, may set up a group of one or more authorized users that are authorized to access and, in particular, change the system data associated with a physical system owned or otherwise administered by the entity. Accordingly, as used herein, the term ownership is intended to indicate which entity is authorized to administer the physical device(s) associated with a gateway identifier. For the purpose of the present disclosure, said entity will also be referred as the owner. When a new gateway device is added to a physical system, the process thus provides a secure mechanism for an entity to claim ownership of the newly commissioned device. The owner does not need to have physical access to the gateway device in order to be able to claim ownership, i.e. the owner does not need to be physically present at the installation location. In some embodiments, the system may provide functionality for claiming ownership of gateway devices only. In some embodiments, the system may further provide functionality for claiming ownership of other physical devices, other than gateway devices. Nevertheless, in some embodiments, ownership of physical devices other than gateway devices may be set by the system automatically based on the ownership of the gateway device to which the physical device is connected. In particular, associating a newly added gateway device with an entity, i.e. with a corresponding group of authorized users, requires an action by one of said group of authorized users. In some embodiments, this also applies to other physical devices. In some embodiments, a newly added gateway device cannot be registered by an (unauthorized) maintenance operator. It will be appreciated that, in some embodiments, amending the ownership data comprises amending the ownership data subject to at least one additional criterion, e.g. an additional approval, in addition to the received ownership request. For example, if the requested gateway identifier is already associated to a current group of one or more authorized users, i.e. to a different owner, an amendment of the ownership data may, in some embodiments, be made subject to approval by the current group, i.e. by the current owner. In some embodiments, the systemmay provide one or more mechanisms for supporting a transfer ownership from one entity to another. For example, the systemmay provide a mechanism to remove ownership data associated with a gateway device, e.g. responsive to a resetting of the gateway device. This may e.g. be useful when a house or other property has been bought an the previous owner has not handed over ownership of devices belonging to the house to the new owner. The predetermined data processing functionality associated with system data of a target set of one more digital devices may include a viewing function for presenting a subset of the system data to the maintenance operator for viewing, in particular a subset related to the target gateway identifier. In particular, the viewing function may provide functionality for viewing existing system data associated with the target set, in particular if the target gateway identifier identifies a gateway device that is already part of the physical system and if the digital representation already includes system data pertaining to the gateway device identified by said target gateway identifier. In some embodiments, the subset of the system data only includes system data of the target set identified by the target gateway identifier. Accordingly, the maintenance operator is only able to view system data associated with a gateway device to which the maintenance operator has physical access such that the maintenance operator can obtain its gateway identifier. Alternatively or additionally, the predetermined data processing functionality associated with system data of a target set of one more digital devices may include a proposal function allowing the maintenance operator to submit a proposal to edit one or more data items of the system data of said target set, the proposal being indicative of the target gateway identifier; the method may thus comprise receiving, in particular by the data processing system, e.g. the remote data processing system, performing the method, the submitted proposal. Accordingly, the maintenance operator may propose additions to, or amendments of, the system data of the target set, e.g. to propose the addition of system data relating to a newly commissioned gateway device or a gateway device that is to be commissioned but has not yet been installed as part of the system. In particular, in some embodiments, the method further comprises: presenting the received proposal to an authorized user for approval; subject to approval by the authorized user, altering the system data of said target set according to the received proposal. In embodiments where the digital representation includes ownership data associating respective groups of one or more of the authorized users with gateway identifiers of respective gateway devices, the method may comprise altering the system data according to the received proposal subject to approval by at least one authorized user of the group of authorized users associated with the target gateway identifier. Accordingly, the method prevents unauthorized amendments to the system data but provides an efficient mechanism to amend the system data, e.g. during commissioning or re commissioning. In particular, the authorized user, e.g. the owner of the physical system, does not need to be present or otherwise take action at the time the changes to the physical system are implemented. The maintenance operator can record the affected changes as a proposal for later approval by the authorized user. The proposal is associated with the associated target gateway identifier, thereby avoiding the risk that implemented changes are not recorded properly and timely, while reducing the risk of unauthorized or erroneous tampering with the system data. The maintenance operator may be authorized to implement a change of the physical system, the change involving one or more physical devices; and the submitted proposal includes a proposed alteration of the system data to cause the altered system data to reflect the implemented change. As the maintenance operator needs to have access to the gateway identifier in order to make a proposal, the risk of erroneous proposals is reduced. Access to the gateway identifier typically implies that the maintenance operator has physical access to the installation location where the gateway device is installed or stored. In some embodiments, the method further comprises receiving, from the gateway device, change data indicative of auto discoverable changes implemented by the maintenance operator, the auto discoverable changes involving one or more of the one or more physical devices. To this end, the gateway device, when installed as part of the physical system, may be communicatively coupled to the remote data processing system, e.g. via a suitable communications network, e.g. the internet. Auto discoverable changes may e.g. include information about a newly installed gateway device. To this end the gateway device may, e.g. upon being powered up and / or being connected to the communications network, send one or more messages to the remote data processing system. The one or more messages may include the gateway identifier of the gateway device and, optionally, additional data. The additional data may include information about physical devices communicatively coupled to the gateway device, geolocation information about the installation location at which the gateway device is installed, topology information about at least a part of the physical system to which the gateway device is connected, and / or the like. It will be appreciated that the type and amount of additional data that may automatically be detected may depend on the type and capabilities of the particular gateway device and / or of the physical devices connected to the gateway device. It will be appreciated that the communication between the gateway device and the remote data processing system may be performed in a variety of ways. For example, the gateway device may send periodic update messages and / or update messages triggered by change events, and / or response messages responsive to receiving information requests from the remote data processing system and / or the like. Some embodiments may apply auto discovered changes of the physical system automatically to the digital representation. Other embodiments may provide functionality for an authorized user to approve some or even all types of such changes. In some embodiments, some or all of the physical devices of the set of one or more physical devices are communicatively coupled to a gateway device of the physical system. Accordingly, a set of physical devices may be defined by a gateway device and include, in particular consist of, the physical devices communicatively coupled to the gateway device. It will be appreciated that a physical system may include one or more gateway devices and, hence one or more associated sets of physical devices. The physical devices of a set may be communicatively coupled to the corresponding gateway device in a variety of ways, e.g. by respective and separate point to point wired or wireless connections, by a bus or network structure or otherwise. In some embodiments, the set of one or more physical devices is configured to be communicatively coupled with each other via a local communications network. The local communications network may be a wired network, e.g. a wired local area network. Alternatively, the local communications network may be a wireless network, e.g. using Bluetooth, wifi or another suitable wireless communications technology. Various embodiments of the method disclosed herein allow the implementation of a variety of mechanisms facilitating the commissioning or re commissioning of gateway devices and / or other physical devices of the physical system, e.g. mechanisms for claiming ownership of new devices, in particular new gateway devices, before or after their installment, mechanisms for making change proposals involving gateway identifiers of gateway devices that have not yet been installed and / or mechanisms allowing a maintenance operator to verify changes made to the system without the need for involving the system owner, etc. In particular, some embodiments of the method may further comprise one or more of: responsive to a received ownership request from an authorized user of a requesting group of one or more authorized users, amending the ownership data to associate the requesting group with a new gateway identifier of a new gateway device, the new gateway device having been installed, or to be installed, at the installation location; receiving, and storing for subsequent approval, a proposal submitted by the maintenance operator, the submitted proposal being indicative of the new gateway identifier of said new gateway device; the submitted proposal may include a proposal to add system to data the digital representation, or to amend system data of the digital representation, the added or amended system data being associated with said new gateway device; upon installing the new gateway device at the installation location and upon receiving the new gateway identifier of the new gateway device from the new gateway device via a communications network, and responsive to receiving an access request from the user device of the maintenance operator, the access request being indicative of a target gateway identifier matching the new gateway identifier of the new gateway device, presenting a subset of the system data for viewing on the user device, the subset including system data associated with the new gateway device. The present disclosure relates to different aspects including the method described above and in the following, corresponding apparatus, systems, methods, and / or products, each yielding one or more of the benefits and advantages described in connection with one or more of the other aspects, and each having one or more embodiments corresponding to the embodiments described in connection with one or more of the other aspects and / or disclosed in the appended claims. In particular, embodiments of the method disclosed herein is computer implemented. Accordingly, further disclosed herein are embodiments of a data processing system configured to perform the steps of the method described herein. In particular, the data processing system may have stored thereon program code adapted to cause, when executed by the data processing system, the data processing system to perform the steps of the method described herein. Embodiments of the data processing system may be embodied as a single computer or as a distributed system including multiple computers and / or other data processing devices, e.g. a client server system, a cloud based system, etc. The data processing system may include one or more data storage device for storing the computer program and / or the digital representation. The data processing system may include a communications interface for communicating with local client devices and / or gateway devices via a suitable wired or wireless communicative connection, e.g. via a suitable communications network. Examples of client devices include the user device of the maintenance operator, a client terminal of the owner, etc. Another aspect disclosed herein relates to a system, e.g. a fluid system, the system comprising one or more physical devices and a data processing system as disclosed above and in the following. Generally, embodiments of the various aspects disclosed herein may be used in connection with a variety of systems, such as fluid systems. Accordingly, in some embodiments, the system is a fluid system and the one or more physical devices include one or more of the following devices: a pump, a valve, a pressure sensor, a flow sensor, an energy consumption sensor, a fluid consumption sensor. Similarly, some embodiments of the method disclosed herein are embodiments of embodiments of a computer implemented method for maintaining a digital representation of a fluid system wherein the one or more physical devices include one or more of the following devices: a pump, a valve, a pressure sensor, a flow sensor, an energy consumption sensor, a fluid consumption sensor. Examples of fluid systems include, but are not limited, to one or more of the following fluid systems: a wastewater system, a district heating system, an industrial pump system, an agricultural fluid system, such as an agricultural irrigation system, a clean water / drinking water system, a system of sump pumps, etc. Yet another aspect disclosed herein relates to embodiments of a computer program configured to cause a data processing system to perform the acts of the method described above and in the following. A computer program may comprise program code means adapted to cause a data processing system to perform the acts of the method disclosed above and in the following when the program code means are executed on the data processing system. The computer programmay be stored on a computer readable storage medium, in particular a non transient storage medium, or embodied as a data signal. The non transient storage medium may comprise any suitable circuitry or device for storing data, such as a RAM, a ROM, an EPROM, EEPROM, flash memory, magnetic or optical storage device, such as a CD ROM, a DVD, a hard disk, and / or the like. BRIEF DESCRIPTION OF THE DRAWINGS Preferred embodiments will be described in more detail in connection with the appended drawings, where FIGs.1 and 2 schematically illustrate an embodiment of a physical system and a data processing system as disclosed herein. FIG.3 schematically illustrate an embodiment of a method for maintaining a digital representation of a physical system as disclosed herein. DETAILED DESCRIPTION FIGs.1 and 2 schematically illustrate an embodiment of a physical system and a data processing system as disclosed herein. FIG.1 shows a schematic block diagram of a system, generally designated by reference numeral 1, that includes a physical system 10 and a host system 40. The system 1 further comprises a user device 20 operated by a maintenance operator 70, also referred to as an installer, and a user device 30 operated by the owner 60 of the physical system 10. As used herein, the term owner refers to an entity authorized to administer the physical device(s) associated with a gateway identifier or a person authorized by said entity. The physical system 10 includes a plurality of physical devices 11, 12A C. The physical devices include a gateway device 11. In the example illustrated in FIG.1, the physical system 10 further includes physical devices 12A C in addition to the gateway device 11. However it will be appreciated that other examples of physical systemsmay include a different number of physical devices. For example, the gateway device 11 may be the only physical device of a physical system, or the physical system may include one or more additional physical devices. Examples of physical devices 12A C include machines, pumps, valves, etc., control units for controlling machines, pumps, valves, etc., sensors and / or other types of physical devices. The gateway device 110 carries a gateway identifier 110 in machine readable and / or human readable form. The physical devices may define a system topology which may represent a physical topology of the devices, a network topology and / or the like. The topology may define how the devices are physically or logically interconnected or otherwise interrelated. The gateway device 11 and the user devices 20 and 30 are communicatively connectable to the host system 40. In the example of FIG.1 they are each connected to the host system via a communications network 50, e.g. via the internet, a cellular communications network and / or the like. It will be appreciated, however, that the gateway device 11 and the user devices 20 and 30 may be connectable to the host system 40 via respective communications links, e.g. via different communications networks. The host system 40 may be implemented by any suitably programmed data processing system, e.g. by a single computer, such as a server computer, by a plurality of computers, e.g. by a distributed computation architecture, in particular a cloud computing architecture. The physical devices 12A C may be communicatively connected to the gateway device 11, e.g. via wired and / or wireless connections. The physical devices may be directly or indirectly be connected to the gateway device. For example, in the example of FIG.1, physical device 12C is connected to physical device 12B, which in turn is connected to gateway device 11. Generally, physical devices may be directly or indirectly connected to a gateway via e.g. a point to point wired or wireless connection or via a communications network, in particular a local communications network. The latter example is illustrated in FIG.1 by local communications network 13, which may e.g. be a LAN, Wifi, Bluetooth network, etc. Accordingly, the gateway device 11 operates as a gateway of the physical system 10 and communicatively couples the physical devices 12A C to the host system 40. The physical devices may define a system topology, e.g. defining parent and child nodes or otherwise. In the example of FIG.1, physical device 12B may be regarded as a parent node of physical device 12C. It will be appreciated, however, that the physical devise may define a variety of topologies and the system may include a variety of different numbers and / or types of physical devices. Each of the user devices 20 and 30 may be implemented by a suitably programmed data processing system, e.g. by a suitably programmed data processing device such as a smartphone, a tablet computer, a laptop computer or the like. The user devices 20 and 30 provide their users access to functionality of the host system 40 as described herein, e.g. via a browser providing a web interface, an app, a client of a client server architecture, etc. The user device 20 is operated by a maintenance operator performing commissioning, re commissioning, maintenance, repair or similar operations involving changes to the physical system. In particular, examples of such operations may include installing a new physical device, replacing an existing physical device with a replacement device, removing a physical device from the system, performing a maintenance or repair operation involving one or more of the physical devices, changing the physical topology defined by the physical devices, and / or the like. Even though FIG.1 only illustrates a single user device 20 operated by a maintenance operator 70, a single user device 30 operated by the owner 60, and a single physical system 10, it will be appreciated that other embodiments of a system may include a plurality of physical systems, which may be owned by the same or by different owners. Similarly, other examples may include a plurality of user devices 30 operated by respective owners and / or a plurality of user devices 20 operated by respective maintenance operators. In the following, the maintenance operator 70 will also be referred to as the installer, and the physical system will also be referred to as an installation. FIG.2 illustrates another view of components of the system 1, including a more detailed view of the host system 40. As illustrated in FIG.2, the host system 40 comprises a database module 41 or other data repository for storing a digital representation 411 of the physical system 10. The digital representation 411 includes system data representing the physical system 10, in particular digital representations of the gateway device 11 and the other physical devices 12A C, optionally including a representation of a topology of the system. There are several challenges today when it comes to commissioning and re commissioning of devices in an installation. The work is quite often divided between two persons or roles: the installer and the owner of the installation, respectively. It will be appreciated that each role may be fulfilled by one person or by a group of persons. Embodiments of the method and system disclosed herein facilitate that persons with these two roles do not both have to be present at the same time to fix changes in the setup or work in sync. Instead, the work can be done in sequence. Typically, the installer performs an initial task in connection with affecting the changes to the physical system; afterwards the owner takes over and finishes the task, as will be described in greater detail below. The owner 60 is, or is represented by, a known and authorized user of the host system 40. Accordingly, the host system 40 can implement authentication and authorization, so the owner can securely make modifications to the digital representation 411 maintained by the host system 40. The installer 70 has typically been granted physical access to the installation by the owner 60, but the installer 70 is typically not a known or authorized user of the host system 40. Hence, the installer 70 can make modifications to the physical system 10, which typically requires physical access, but the installer 70 cannot make modifications to the digital representation 411 of the installation maintained by the host system 40. Various embodiments of the method and system disclosed herein provide functionality that allows the installer 70 to view the digital representation of the part of an Installation to which the installer 70 has been granted physical access. However, any changes to the digital representation 411 suggested by the installer 70 need to be approved by the owner 60. To this end, the host system 40 may comprise a system interface module 44, a limited access module 42 and an extended access module 43. The various functional modules of the host system may be implemented by one or more suitable software modules. It will be appreciated that the various functions implemented by the host systemmay be implemented in a different manner, in particular divided into functional modules in a different manner or even implemented by a single functional module. The system interface module 44 provides functionality for communicating with the gateway device 11, in particular for receiving information from the gateway device 11 about the gateway identifier 110 of the gateway device 11 and / or information about the physical devices 12A C and / or about the system topology of the physical system 10. The system interface module 44 may thus be configured to automatically detect certain changes in the physical system based on messages received from the gateway device 11. The extended access module 43 provides functionality that allows an authorized user, in particular the owner 60, to access the digital representation 411 of the physical system 10 as maintained by the host system 40. The extended access module 43 may further provide functionality allowing an authorized user to edit or otherwise alter the digital representation 411, to claim ownership of gateway devices, etc. The host system 40 may also provide functionality allowing the authorized user 60 to change system settings of the physical system, such as set points, etc., thereby affecting the control of the physical system 10. Such system settings may be communicated to the physical system via the system interface module 44. To this end, the extended access module 43 may provide user authentication functionality configured to selectively allow access only to authorized users, subject to successful user authentication, e.g. subject to a user entering valid user credentials. The extended access module 43 may grant an authorized user selective access to a digital representation (or parts thereof) for which the user is authorized. Accordingly, the owner 60 of a physical system may manage access rights for a group of one or more authorized users that are authorized to access and alter the digital representation of the physical system owned by the owner. The limited access module 42 is configured to selectively provide access to only a limited functionality, e.g. a read only access to the digital representation 411 or even only to a selected part of the digital representation 411. However, at least in some embodiments, the limited access is not subject to any user authentication, but merely subject to the entering or receipt of a gateway identifier as described herein. Accordingly, a maintenance operator 70 may obtain limited access without having to be an authorized user and without assistance from the owner 60 of the physical system 10. As will be described in greater detail below, the limited access module 42 may also provide functionality allowing the owner 60 access to limited functionality to system data associated with those physical devices for which the ownership by the owner 60 has not yet been registered in the host system 40. An example of the operation of the system 1 will now be described with reference to FIG.3 and with continued reference to FIG.s 1 and 2. Generally, the digital representation 411 maintained by the host system 40 is updated whenever changes are done to the actual physical system 10 represented by the digital representation 411. When the installer 70 has made physical changes to the installation 10, the host system 40 is able to auto discover some, if not most of the changes, because the gateway device 11 communicates with the system interface 44 of the host system 40. However, not all changes can be auto discovered and there is a need for manually entering the remaining changes to the digital representation 411. The present system allows the installer 70 to propose such changes via the limited access module 42. Those remaining changes may then be approved by the owner 60 of the Installation, e.g. using functionality of the extended access module 43 and / or of the limited access module 42. Preferably, the limited access module 42 does not provide functionality for making changes directly to the digital representation 411, at least not by an unauthorized user. The above functionality utilizes the fact that the physical system 10 includes a gateway device 11 that connects the physical system 10 to the host system 40. The gateway device has a, preferably globally unique, gateway ID 110. The gateway ID can be read from the gateway device 11, e.g. as a serial number or similar human readable identifier, and / or as a machine readable identifier such as a QR code, and RFID, or an identifier readable via a BLE connection, which may expose the gateway identifier via a suitable API. Knowledge of the gateway ID gives access to the limited access module 42 associated with the digital representation 411 of the physical system that includes the identified gateway device 11. Because this is a relatively weak access control for access to the limited access module, and since the attack vector may be the internet, the functionality provided by the limited access module is preferably very limited, e.g. restricted to viewing a part of the digital representation associated with the identified gateway device and / or restricted to making change proposals involving the parts of the digital representation associated with the identified gateway device. In some embodiments, the limited access module 42 may: provide read access to the digital representation 411 showing the current logical representation of the physical system 10, or at least of the part of the physical system associated with a particular gateway ID. provide write access to a proposal repository 412 for storing proposals for changes to the digital representation 411. The proposal repository may be maintained by the database module 41, by the limited access module or otherwise. These proposals are visible to the owner 60 of the Installation and the owner can review the proposals. In particular, the owner 60 may reject or select proposals. The host system discards the rejected proposals and moves the selected proposals into the digital representation 411, so the accepted changes to the installation will be applied. The host system 40 also provides functionality that facilitates installation of a new gateway device, e.g. during an initial commissioning of a physical system. When the installer is done with an initial commissioning of an installation, in particular the installation of a new gateway device, the installer 70 may send the gateway ID of the newly installed gateway device to the owner 60 via a suitable communications channel, e.g. by e mail, SMS or in any other suitable manner (as indicated by dashed line 71 in FIG.2). The owner 60 may then claim ownership of the newly installed gateway device in the host system by using the received gateway ID. The host system 40 will detect the newly installed gateway device, including its gateway ID, when the newly installed gateway device is communicatively connected to the host system 40 via system interface 44. FIG.3 schematically illustrate an embodiment of a method for maintaining a digital representation of a physical system as disclosed herein. In initial step S1, the installer or maintenance operator 70 obtains the gateway ID of a gateway device 11 to be installed. To this end, the user may read the gateway ID off the gateway device 11 or use a user device 20 to read a QR code or RFID or to otherwise receive the gateway ID from the gateway device 11. In step S2, the installer 70 physically installs the gateway device 11 as part of a physical installation at a physical installation location to which the installer has been granted access. In step S3, the installer communicates the gateway identifier to the owner 60 of the physical installation, e.g. using the user device 20 or otherwise. In some embodiments, the installer may communicate only the gateway ID while, in other embodiments, the installer may communicate the gateway ID along with additional information, e.g. information about the installation location (e.g. address or other geolocation), etc. In step S4, the owner 60, using a user device 30, e.g. a computer, may access the host system 40 to claim / request ownership of the gateway device, using the gateway ID received from the installer. In step S5, the host system 40 assigns ownership of the identified gateway device to the requesting owner. It will be appreciated that the host systemmay optionally assign the requested ownership subject to certain conditions, e.g. that no other entity has previously requested ownership of said gateway device. Once the ownership is assigned to the owner, a corresponding group of authorized users has access to the digital representation of the gateway device and of a physical system associated with the gateway device. The group of authorized users may be users authorized by the owner. In step S6, e.g. when the newly installed gateway device 11 communicatively connects to the host system 40 for the first time, the newly installed gateway device is registered with the host system 40. In particular, in step S7, the host system may amend the system data of the owner^s 60 physical system with system data based on information received from the newly installed gateway device 11. That system data may include information about the gateway device itself and, optionally, information about other physical devices connected to the gateway device 11. Accordingly, the host system may amend the digital representation maintained by it based on information it can auto discover based on the information received from the gateway device 11. In step S8, the installer, using the user device 20 of the installer, may request access to system data of the digital representation associated with the newly installed gateway device 11. To this end, the user device may send the gateway ID obtained from the gateway device 11 as target gateway ID to the host system 40. In response to the received request, in step S9, the host system 40 provides system data associated with the target gateway ID to the user device 20 for viewing, provided the target gateway ID is known to the host system 40. Accordingly, the installer 70 may review the system data automatically discovered by the host system and verify the correctness of the installation and / or its digital representation. For example, the installer 70 may verify that the digital representation includes the correct devices and in the correct topology. The installer may further verify information about the individual installed physical devices, e.g. their software version, calibration etc. The installer may, in some embodiments, even be able to view test or calibration data from installed sensors or the like, to allow the installer to verify device settings, calibrations, scaling and / or the like. In some embodiments, this viewing function may be available regardless of whether the owner 60 already has claimed ownership of the corresponding gateway device 11, thereby allowing the installer 70 to immediately perform the verification of the installation. In step S10, the installer, using user device 20, may submit a proposal for changes to the digital representation to the host system 40, e.g. to supplement the system data with information the host system has not been able to (correctly) auto discover. The submitted proposal includes the gateway ID obtained from the gateway device 11 as target gateway ID and is thus associated with the specific physical installation to which the installer has access. Examples of proposed changes may include the addition of data which has not been auto discovered, for example the geolocation, e.g. street address, building information, GPS coordinates of the installed device, administrative data of the entity owning the installation, the name and / or id of the installer, a name of the installation, topology information (e.g. inlet or outlet pressure / temperature / flow sensor or the like), etc. Other examples may include proposed device settings, e.g. proposed set points, comments on the specific maintenance work being performed, proposed additions or changes to the device topology that cannot be auto discovered, etc. In step S11, the host system records the submitted proposal in a proposal repository 412 for review. The submitted proposals are recorded with their associated target gateway IDs so as to allow the host system to present them to an appropriate authorized user associated with the owner of the corresponding gateway device. Steps S8 S11 may be facilitated by the limited access module 42 of the host system 40 as described above, or otherwise. In step S12, the owner 60 reviews and approves or rejects the submitted proposal. It will be appreciated that each owner is only presented with proposals associated with gateway identifiers of gateway devices for which the owner is actually registered as owner in the host system. In step S13, subject to approval by the owner 60, the host system amends the system data based on the submitted and approved proposal. It will be appreciated that the order of the steps involved in installing the new gateway device may vary. For example, the installer may initially install the gateway device and then obtain the gateway ID, or the installer may obtain the gateway ID and communicate it to the owner prior to actually installing the gateway device. In some embodiments, the owner may even be able to claim ownership of a new gateway device prior to the gateway device actually being physically installed, thereby allowing the host system to correctly amend the digital representation of the owner´s physical system upon initial connection of the new gateway device. Yet further, as mentioned above, the functionality provided to the installer for viewing system data and for submitting proposals may be available prior to any owner having claimed ownership of a newly installed gateway device. It will be appreciated that, when reference is made to actions taken by the owner, these actions may be taken by an authorized user associated with the entity owning the corresponding physical system, and using any suitable user device communicatively coupled to the host system, e.g. via a suitable web interface provided by the extended access module of the host system. In some embodiments, prior to having registered ownership of a gateway device, the owner may have access to a gateway device only via the limited access module. It will further be appreciated that variations of the process may be performed, e.g. when an installer performs changes to a previously installed system. For example, in such a situation, steps S3 S5 may be omitted and step S2 may involve making changes to the physical system without installation of a new gateway device. Some or all of the remaining steps may then be performed as described above, i.e. the installer 70 may view system data and / or make change proposals for later review and approval by the owner. Some embodiments of the various aspects disclosed herein may be summarized as follows: Embodiment 1: A computer implemented method for maintaining a digital representation of a physical system, the physical system comprising a set of one or more physical devices associated with an installation location, the set of one or more physical devices including a gateway device for communicatively coupling the set of one or more physical devices to a remote data processing system, the digital representation including system data indicative of the set of one or more physical devices; wherein the gateway device comprises a gateway identifier obtainable from said gateway device by a maintenance operator and / or by a user device of said maintenance operator, when the maintenance operator and / or the user device is in a proximity of the gateway device, the gateway identifier identifying the gateway device; wherein the method comprises: selectively allowing one or more authorized users access to the system data and to alter the system data, wherein said maintenance operator is different from the one or more authorized users; receiving, from the user device of the maintenance operator, an access request for limited access, the access request being indicative of a target gateway identifier; granting the maintenance operator selective access limited to predetermined data processing functionality associated with system data of a target set of one more physical devices, the target set including a target gateway device identified by said target gateway identifier, wherein the predetermined functionality prevents the maintenance operator from altering the system data. Embodiment 2: The method according to embodiment 1, wherein the digital representation includes ownership data associating respective groups of one or more of the authorized users with gateway identifiers of respective gateway devices; and wherein the method comprises: receiving an ownership request from an authorized user of a requesting group of one or more authorized users, the ownership request being indicative of a requested gateway identifier; responsive to the received ownership request, amending the ownership data to associate the requesting group with the requested gateway identifier. Embodiment 3: The method according to embodiment 2, wherein amending the ownership data comprises amending the ownership data subject to at least one additional criterion. Embodiment 4: The method according to any one of the preceding embodiments, wherein the predetermined functionality comprises a proposal function allowing the maintenance operator to submit a proposal to edit one or more data items of the system data of said target set, the proposal being indicative of the target gateway identifier, and wherein the method comprises receiving the submitted proposal. Embodiment 5: The method according to embodiment 4, further comprising: presenting the received proposal to an authorized user for approval; subject to approval by the authorized user, altering the system data of said target set according to the received proposal. Embodiment 6: The method according to embodiment 5, wherein the digital representation includes ownership data associating respective groups of one or more of the authorized users with gateway identifiers of respective gateway devices; and wherein the method comprises altering the system data according to the received proposal subject to approval by at least one authorized user of the group of authorized users associated with the target gateway identifier. Embodiment 7: The method according to any one of embodiments 4 through 6, wherein the maintenance operator is authorized to implement a change of the physical system, the change involving one or more physical devices; and wherein the submitted proposal includes a proposed alteration of the system data to cause the altered system data to reflect the implemented change. Embodiment 8: The method according to any one of the preceding embodiments, wherein the predetermined functionality comprises a viewing function for presenting a subset of the system data to the maintenance operator for viewing. Embodiment 9: The method according to embodiment 8, wherein the subset of the system data only includes system data of the target set identified by the target gateway identifier. Embodiment 10: The method according to any one of the preceding embodiments, wherein the gateway identifier is a unique identifier uniquely identifying the gateway device. Embodiment 11: The method according to any one of the preceding embodiments, wherein the gateway identifier is a machine readable identifier, machine readable by the user device when the user device is in a predetermined proximity of the gateway device. Embodiment 12: The method according to any one of the preceding embodiments, further comprising receiving, from the gateway device, change data indicative of auto discoverable changes implemented by the maintenance operator, the auto discoverable changes involving one or more of the one or more physical devices. Embodiment 13: The method according to any one of the preceding embodiments, wherein the set of one or more physical devices is configured to be communicatively coupled with each other via a local communications network. Embodiment 14. The method according to any one of the preceding embodiments, further comprising one or more of: responsive to a received ownership request from an authorized user of a requesting group of one or more authorized users, amending the ownership data to associate the requesting group with a new gateway identifier of a new gateway device, the new gateway device having been installed, or to be installed, at the installation location; receiving, and storing for subsequent approval, a proposal submitted by the maintenance operator, the submitted proposal being indicative of the new gateway identifier of said new gateway device; upon installing the new gateway device at the installation location and upon receiving the new gateway identifier of the new gateway device from the new gateway device via a communications network, and responsive to receiving an access request from the user device of the maintenance operator, the access request being indicative of a target gateway identifier matching the new gateway identifier of the new gateway device, presenting a subset of the system data for viewing on the user device, the subset including system data associated with the new gateway device. Embodiment 15: A computer program comprising program code configured to cause, when executed by a data processing system, said data processing system to perform the method according to any one of the preceding embodiments. Embodiment 16: A data processing system configured to perform the method according to any one of embodiments 1 through 14. Embodiment 17: The data processing system according to embodiment 16, wherein the data processing system is implemented as a cloud computing data processing architecture. Embodiment 18: A system comprising one or more physical devices and the data processing system of any one of embodiments 16 through 17.

Claims

CLAIMS 1. A computer implemented method for maintaining a digital representation of a physical system, the physical system comprising a set of one or more physical devices associated with an installation location, the set of one or more physical devices including a gateway device for communicatively coupling the set of one or more physical devices to a remote data processing system, the digital representation including system data indicative of the set of one or more physical devices; wherein the gateway device comprises a gateway identifier obtainable from said gateway device by a maintenance operator and / or by a user device of said maintenance operator, when the maintenance operator and / or the user device is in a proximity of the gateway device, the gateway identifier identifying the gateway device; wherein the method comprises: selectively allowing one or more authorized users access to the system data and to alter the system data, wherein said maintenance operator is different from the one or more authorized users; receiving, from the user device of the maintenance operator, an access request for limited access, the access request being indicative of a target gateway identifier; granting the maintenance operator selective access limited to predetermined data processing functionality associated with system data of a target set of one more physical devices, the target set including a target gateway device identified by said target gateway identifier, wherein the predetermined functionality prevents the maintenance operator from altering the system data.

2. The method according to claim 1, wherein the digital representation includes ownership data associating respective groups of one or more of the authorized users with gateway identifiers of respective gateway devices; and wherein the method comprises: receiving an ownership request from an authorized user of a requesting group of one or more authorized users, the ownership request being indicative of a requested gateway identifier; responsive to the received ownership request, amending the ownership data to associate the requesting group with the requested gateway identifier.

3. The method according to any one of the preceding claims, wherein the predetermined functionality comprises a proposal function allowing the maintenance operator to submit a proposal to edit one or more data items of the system data of said target set, the proposal being indicative of the target gateway identifier, and wherein the method comprises receiving the submitted proposal.

4. The method according to claim 3, further comprising: presenting the received proposal to an authorized user for approval; subject to approval by the authorized user, altering the system data of said target set according to the received proposal.

5. The method according to claim 4, wherein the digital representation includes ownership data associating respective groups of one or more of the authorized users with gateway identifiers of respective gateway devices; and wherein the method comprises altering the system data according to the received proposal subject to approval by at least one authorized user of the group of authorized users associated with the target gateway identifier.

6. The method according to any one of claims 4 through 5, wherein the maintenance operator is authorized to implement a change of the physical system, the change involving one or more physical devices; and wherein the submitted proposal includes a proposed alteration of the system data to cause the altered system data to reflect the implemented change.

7. The method according to any one of the preceding claims, wherein the predetermined functionality comprises a viewing function for presenting a subset of the system data to the maintenance operator for viewing.

8. The method according to any one of the preceding claims, wherein the gateway identifier is a machine readable identifier, machine readable by the user device when the user device is in a predetermined proximity of the gateway device.

9. The method according to any one of the preceding claims, further comprising receiving, from the gateway device, change data indicative of auto discoverable changes implemented by the maintenance operator, the auto discoverable changes involving one or more of the one or more physical devices.

10. The method according to any one of the preceding claims, further comprising one or more of: responsive to a received ownership request from an authorized user of a requesting group of one or more authorized users, amending the ownership data to associate the requesting group with a new gateway identifier of a new gateway device, the new gateway device having been installed, or to be installed, at the installation location; receiving, and storing for subsequent approval, a proposal submitted by the maintenance operator, the submitted proposal being indicative of the new gateway identifier of said new gateway device; upon installing the new gateway device at the installation location and upon receiving the new gateway identifier of the new gateway device from the new gateway device via a communications network, and responsive to receiving an access request from the user device of the maintenance operator, the access request being indicative of a target gateway identifier matching the new gateway identifier of the new gateway device, presenting a subset of the system data for viewing on the user device, the subset including system data associated with the new gateway device.

Images