Information management apparatus, information management method, and information management program

Abstract

To properly execute access control on information which is used in common in an environment in which a plurality of systems coexist.SOLUTION: A server device 10 is configured to: store project information including project common information to be used in common by a plurality of control systems, and system individual information to be used individually by the control systems; store identification information each identifying the control systems, and access authorities of control system administrators E set for each of a plurality of memory regions obtained by dividing the project common information, in association with each other; receive access requests to the project information from control system administrator terminals 20 (20A, 20B); and execute access control on each of the memory regions accessed by the control system administrators E, on the basis of identification information specified by the access requests and access authorities stored in association with the identification information.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information management device, an information management method, and an information management program. [Background technology]

[0002] A multi-project integration is utilized to integrally operate and monitor projects that are multiple plant or process control systems (referred to as "control systems" as appropriate). By using the multi-project integration, control systems defined as lower projects can be simultaneously operated and monitored from a monitoring device such as a HIS (Human Interface Station) of a control system defined as a higher-level project.

[0003] Furthermore, when higher-level projects and lower-level projects coexist in the same project (referred to as a "combined project" as appropriate) that has been combined through multiple project combination, engineering on a station-by-station basis, which is a unit of equipment or a group of equipment that makes up each control system, can be exclusively controlled between the administrators of each control system, such as engineers and operators (referred to as a "control system administrator" as appropriate), by using the access restriction function. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Yokogawa Electric Corporation, Yokogawa Solution Services Corporation: “CENTUM VP”, [online], [Retrieved May 12, 2023], Internet <https: / / www.yokogawa.co.jp / solutions / products-and-services / control / control-and-safety-system / distributed-control-systems-dcs / centum-vp / > Summary of the Invention [Problem to be solved by the invention]

[0005] However, project-common information (sometimes referred to as "common information") such as alarm status strings that set alarm displays and block status strings that set function blocks must be used with some of the settings divided among the control systems. This means that the control system administrator for a higher-level project can edit the parts that should be handled by a lower-level project. Similarly, the control system administrator for a lower-level project can edit the parts that should be handled by the higher-level project.

[0006] The present invention has been made in consideration of the above, and has an object to appropriately restrict access to information that is commonly used in a mixed environment in which a plurality of systems exist. [Means for solving the problem]

[0007] The present invention provides an information management device comprising: a first memory unit that stores setting information including common information in which information commonly used by a plurality of systems is set, and individual information in which information individually used by each of the plurality of systems is set; a second memory unit that stores, in association with each identification information that identifies each of the plurality of systems, and the access rights of users of each system that are set in each of a plurality of memory areas into which the common information is divided; a reception unit that receives an access request to the setting information from a terminal used by the user; and an execution unit that executes access control by the user to each of the plurality of memory areas based on the identification information identified from the access request and the access rights stored in the second memory unit in association with the identification information.

[0008] The present invention also provides an information management method that executes processing in which a computer holds setting information including common information in which information commonly used by a plurality of systems is set, and individual information in which information individually used by each of the plurality of systems is set, holds each identification information that identifies each of the plurality of systems in association with the access rights of users of each system that are set in each of a plurality of storage areas into which the common information is divided, accepts an access request to the setting information from a terminal used by the user, and controls access by the user to each of the plurality of storage areas based on the identification information identified from the access request and the access rights held in association with the identification information.

[0009] The present invention also provides an information management program that causes a computer to execute a process that stores setting information including common information in which information commonly used by a plurality of systems is set, and individual information in which information individually used by each of the plurality of systems is set, stores each identification information that identifies each of the plurality of systems in association with the access rights of users of each system that are set in each of a plurality of storage areas into which the common information is divided, accepts an access request to the setting information from a terminal used by the user, and controls access by the user to each of the plurality of storage areas based on the identification information identified from the access request and the access rights stored in association with the identification information. Effect of the Invention

[0010] According to the present invention, it is possible to appropriately restrict access to information that is commonly used in a mixed environment in which a plurality of systems exist. [Brief description of the drawings]

[0011] [Figure 1] 1 is a diagram illustrating a configuration example and a processing example of an access control system according to an embodiment; [Diagram 2] FIG. 1 is a diagram illustrating an example of a multiple project combination according to an embodiment. [Diagram 3] FIG. 13 is a diagram illustrating an access restriction according to a reference technique. [Figure 4] FIG. 11 is a diagram illustrating an example of access restriction according to the embodiment. [Diagram 5] 2 is a block diagram showing an example of the configuration of each device of the access control system according to the embodiment. FIG. [Figure 6] FIG. 4 is a diagram illustrating a project information storage unit of the server device according to the embodiment. [Figure 7] FIG. 4 is a diagram illustrating an administrator registration information storage unit of the server device according to the embodiment. [Figure 8] FIG. 2 is a diagram showing a specific example 1 of a display screen of a control system manager terminal according to the embodiment. [Figure 9] FIG. 11 is a diagram showing a specific example 2 of a display screen of the control system manager terminal according to the embodiment. [Figure 10] FIG. 11 is a diagram showing a specific example 3 of a display screen of the control system manager terminal according to the embodiment. [Figure 11] 10 is a flowchart showing an example of a processing flow of the access restriction system according to the embodiment. [Figure 12] FIG. 2 is a diagram illustrating an example of a hardware configuration according to an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] An information management device, an information management method, and an information management program according to an embodiment of the present invention will be described in detail below with reference to the drawings. Note that the present invention is not limited to the embodiment described below.

[0013] [Embodiment] The configuration and processing of the access control system 100 according to the embodiment, the configuration and processing of each device of the access control system 100, and the processing flow of the access control system 100 will be described below in that order, and finally the effects of the embodiment will be described.

[0014] 1. Configuration and Processing of Access Control System 100 The configuration and processing of the access control system 100 according to the embodiment will be described in detail with reference to Figs. 1 and 2. Fig. 1 is a diagram showing an example of the configuration and processing of the access control system 100 according to the embodiment. Fig. 2 is a diagram showing an example of a combination of multiple projects according to the embodiment. Below, an example of the configuration of the entire access control system 100, an example of a combination of multiple projects, an example of project information, an example of processing of the access control system 100, and problems with the access control system 100P of the reference technology will be described in order, and finally, the effects of the access control system 100 will be described. Note that in the embodiment, factory production remote monitoring using plant equipment, which is a device installed in a plant, will be described as an example, but the device and field of use are not limited, and the present invention can also be applied to environmental measurement remote monitoring such as power monitors, wind power generation, water and sewage monitors, and river monitors.

[0015] (1-1. Example of the overall configuration of the access control system 100) An example of the overall configuration of an access control system 100 will be described with reference to Fig. 1. The access control system 100 has a server device 10, a control system administrator terminal 20, and a control system device 30. Here, the server device 10, the control system administrator terminal 20, and the control system device 30 are connected to each other via a predetermined communication network (not shown) so as to be able to communicate with each other by wire or wirelessly. Note that the predetermined communication network can be any of various communication networks such as the Internet or a dedicated line.

[0016] (1-1-1. Server device 10) The server device 10 is an information management device that manages a combined project that combines multiple projects, which are multiple plants or control systems. In the example of Fig. 1, the server device 10 manages a combined project that combines a basic control system and a dedicated control system.

[0017] Here, the basic control system is a control system that controls all plant equipment involved in the plant process, and the dedicated control system is a control system that controls specific plant equipment involved in the plant process, such as a compressor control system.

[0018] 1 may include a plurality of server devices 10. The server device 10 may be realized as an on-premise or cloud system.

[0019] (1-1-2. Control system administrator terminal 20) The control system administrator terminal 20 is used by a control system administrator E who manages the control system. In the example of Fig. 1, the control system administrator terminals 20 are a basic control system administrator terminal 20A used by a basic control system administrator EA who manages the basic control system, and a dedicated control system administrator terminal 20B used by a dedicated control system administrator EB who manages the dedicated control system.

[0020] (1-1-3. Control system equipment 30) The control system devices 30 are plant devices constituting a control system. In the example of Fig. 1, the control system devices 30 are basic control system devices 30A (control devices 31A, communication devices 32A, monitoring devices 33A) which are plant devices constituting a basic control system, and dedicated control system devices 30B (control devices 31B, communication devices 32B, monitoring devices 33B) which are plant devices constituting a dedicated control system.

[0021] (1-2. An example of combining multiple projects) The combination of multiple projects will be described with reference to Fig. 2. In the combined project shown in Fig. 2, multiple projects are combined with a basic control system as a higher-level project and a dedicated control system as a lower-level project. Here, the basic control system, which is the higher-level project, can operate and monitor the dedicated control system, which is the lower-level project, via monitoring devices 33A (33A-1, 33A-2, 33A-3).

[0022] 2 shows an example in which the basic control system is an upper project and the dedicated control system is a lower project as a combined project, but the dedicated control system may be an upper project and the basic control system may be a lower project. Also, two or more different basic control systems may be combined as a combined project, or two or more different dedicated control systems may be combined as a combined project.

[0023] (1-3. Example of project information) Here, the project information, which is setting information of the combined project, will be described. The project information is, for example, information held by the server device 10, and includes project common information and system individual information.

[0024] (1-3-1. Project common information) The project common information is information that can be commonly used in the combined projects, such as a unit list, alarm importance, alarm status character string, block status character string, etc. The project common information is stored in a different memory area for each division.

[0025] (1-3-2. System Specific Information) The system-specific information is information used individually in multiple projects, that is, in each control system, and is, for example, setting information of the control system devices 30 (control device 31, communication device 32, monitoring device 33) that constitute each control system.

[0026] (1-4. Example of overall processing of the access control system 100) An example of the overall processing of the access control system 100 will be described with reference to Fig. 1. Note that the processing of steps S1 to S4 below may be executed in a different order. Also, some of the processing of steps S1 to S4 below may be omitted.

[0027] (1-4-1. Administrator registration information setting process) First, the server device 10 sets administrator registration information (step S1). For example, the server device 10 receives and stores the administrator registration information from the basic control system administrator terminal 20A of the basic control system, which is a higher-level project.

[0028] Here, the administrator registration information is information regarding the access rights of the control system administrator E of each control system included in the integrated project, and is, for example, information that corresponds to the identification information of the control system, the type of access rights, the setting range of the access rights, etc.

[0029] (1-4-2. Login information reception process) Second, the server device 10 accepts the login information of the basic control system administrator EA from the basic control system administrator terminal 20A (step S2). Third, the server device 10 accepts the login information of the dedicated control system administrator EB from the dedicated control system administrator terminal 20B (step S3).

[0030] Here, login information refers to information regarding logging in to the control system administrator terminal 20 of each control system, and includes, for example, identification information of the control system, identification information of the control system administrator E, login start time, login end time, etc.

[0031] (1-4-3. Access control execution process) Fourth, the server device 10 executes access control (step S4). For example, the server device 10 refers to the administrator registration information corresponding to the identification information of the control system included in the login information, and executes access control to the project common information of the control system administrator E who has logged in based on the access authority indicated by the administrator registration information. At this time, the server device 10 determines whether editing is permitted or not set for each storage area of ​​the project common information, and permits editing by the control system administrator E who is permitted to edit, and prohibits editing by the control system administrator E who is not permitted to edit.

[0032] (1-5. Effects of the access control system 100) In the following, the background of the multiple project integration, the outline and problems of the access control system 100P according to the reference technology will be described, and then the effects of the access control system 100 will be described.

[0033] (1-5-1. Background of merging multiple projects) The multiple project integration is a function for integrated operation and monitoring of projects, which are multiple plants or control systems. By using the monitoring device 33A of the basic control system defined as the upper project, the dedicated control system defined as the lower project can be simultaneously operated and monitored.

[0034] In principle, the basic control system and the dedicated control system are divided into separate projects and operated in a multi-project combination. However, from the viewpoint of cost, there is also a demand to operate the basic control system and the dedicated control system in the same project.

[0035] (1-5-2. Problems with the Access Control System 100P) In the access control system 100P, when a basic control system and a dedicated control system are mixed in the same project, the access restriction function allows for exclusive control between the basic control system administrator EA and the dedicated control system administrator EB for engineering on a device or station basis. However, project common information such as alarm status strings and block status strings must be partially used separately for each control system. This means that the basic control system administrator EA can edit the parts that should be handled by the dedicated control system, and the dedicated control system administrator EB can edit the parts that should be handled by the basic control system.

[0036] The access restrictions according to the reference technology will be described with reference to Fig. 3. Fig. 3 is a diagram for explaining the access restrictions according to the reference technology. In the example of Fig. 3, the solid arrow indicates that it is editable, and the dotted arrow indicates that it is read-only. Furthermore, the plain rectangular parts of the project common information and system individual information in the project information are information that should be edited by the basic control system administrator EA. On the other hand, the diagonal-lined rectangular parts of the project common information and system individual information in the project information are information that should be edited by the dedicated control system administrator EB.

[0037] As shown in FIG. 3, in the access control system 100P of the reference technique, information that should not be edited in the project common information can be edited by other users (see the thick arrow in FIG. 3).

[0038] (1-5-3. Overview of the access control system 100) First, the server device 10 sets administrator registration information regarding the access authority of the control system administrator E of each control system included in the combined project. At this time, the server device 10 stores project common information such as alarm status strings and block status strings that can be commonly used in the combined project in different storage areas for each category. Second, the server device 10 accepts login information of the control system administrator E from the control system administrator terminal 20. Third, the server device 10 refers to the administrator registration information corresponding to the identification information of the control system included in the login information, and executes access control to the project common information of the logged-in control system administrator E based on the access authority indicated by the administrator registration information.

[0039] (1-5-4. Effects of the access control system 100) The effect of the access control system 100 will be described with reference to FIG. 4. FIG. 4 is a diagram showing an example of access restriction according to the embodiment. In the example of FIG. 4, similar to the example of FIG. 3, the solid arrow indicates that it is editable, and the dotted arrow indicates that it is read-only. Furthermore, the plain rectangular parts of the project common information and system individual information in the project information are information that should be edited by the basic control system administrator EA. On the other hand, the diagonal-lined rectangular parts of the project common information and system individual information in the project information are information that should be edited by the dedicated control system administrator EB.

[0040] As shown in FIG. 4, the access control system 100 of the embodiment makes it possible to restrict access to information that should not be edited in project common information (see the dotted arrow in FIG. 4).

[0041] Furthermore, the access control system 100 allows detailed access restrictions to be specified for each storage area of ​​project common information, thereby enabling separation of the basic control system administrator EA and the dedicated control system administrator EB.

[0042] 2. Configuration and Processing of Each Device in the Access Control System 100 The configuration and processing of the server device 10 included in the access control system 100 shown in Fig. 1 will be described with reference to Fig. 5. Fig. 5 is a block diagram showing an example of the configuration of each device of the access control system 100 according to the embodiment. In the following, an example of the configuration of the entire access control system 100 according to the embodiment will be described, and then an example of the configuration and processing of the server device 10, the control system administrator terminal 20, and the control system device 30 will be described in detail.

[0043] (2-1. Example of the overall configuration of the access control system 100) An example of the overall configuration of the access control system 100 shown in Fig. 1 will be described with reference to Fig. 5. As shown in Fig. 5, the access control system 100 has a server device 10, a control system administrator terminal 20, and a control system device 30. The server device 10 is communicatively connected to the control system administrator terminal 20 and the control system device 30 via a communication network N realized by the Internet, a dedicated line, or the like.

[0044] (2-2. Configuration and Processing Examples of Server Device 10) A configuration example and a processing example of the server device 10 will be described with reference to Fig. 5. The server device 10 has a communication unit 11, a storage unit 12, and a control unit 13. The server device 10 may have an input unit (e.g., a keyboard, a mouse, etc.) that accepts various operations from a control system administrator E who is an administrator of the server device 10, and a display unit (e.g., a liquid crystal display, etc.) that displays various information.

[0045] (2-2-1. Communications Department 11) The communication unit 11 manages data communication with other devices. For example, the communication unit 11 performs data communication with each communication device via a router, etc. The communication unit 11 can also perform data communication with an operator's terminal (not shown).

[0046] (2-2-2. Storage section 12) The storage unit 12 stores various information referenced when the control unit 13 operates and various information acquired when the control unit 13 operates. The storage unit 12 has a project information storage unit 12a, which is a first storage unit, and an administrator registration information storage unit 12b, which is a second storage unit. Here, the storage unit 12 can be realized by, for example, a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. In the example of FIG. 5, the storage unit 12 is installed inside the server device 10, but may be installed outside the server device 10, or multiple storage units may be installed.

[0047] The storage unit 12 stores setting information including common information (project common information) in which information commonly used by a plurality of systems is set, and individual information (system individual information) in which information individually used by each of a plurality of systems is set. For example, the storage unit 12 stores an alarm status string that defines the state of an alarm in the system as the common information. Here, the alarm status string is a definition item of a string commonly used in a project, and is a string related to the state of an alarm arbitrarily defined for a faceplate block, an SFC block, and a unit instrument. The storage unit 12 also stores a block status string that defines the state of a function block in the system as the common information. Here, the block status string is a definition item of a string commonly used in a project, and is a string related to the state of a function block arbitrarily defined for a faceplate block and a unit instrument.

[0048] The storage unit 12 stores, in association with each of the identification information for identifying each of the multiple systems, the access authority of the user of each system set in each of the multiple storage areas into which the common information is divided. For example, the storage unit 12 stores, in association with each of the identification information set by the user, the location information of the multiple storage areas, and the type of the user's access authority to the storage areas. In addition, the access authority is, for example, permission or prohibition of editing of the common information stored in the storage area.

[0049] Here, the multiple systems are a basic control system located in a higher-level system that controls all of the devices that make up the system, and a dedicated control system located in a lower-level system controlled by the basic control system that controls specific devices that make up the system. The multiple systems are also process control systems that control the plant process. The multiple systems are also a basic process control system that controls all of the plant equipment that makes up the plant, and a compressor control system that controls the compressors that make up the plant.

[0050] That is, the storage unit 12 stores setting information including common information in which information commonly used by a basic control system such as a basic process control system and a dedicated control system such as a compressor control system is set, and individual information in which information individually used by a basic control system such as a basic process control system and a dedicated control system such as a compressor control system is set. The storage unit 12 also stores, in association with each piece of identification information for identifying each of the basic control system such as the basic process control system and the dedicated control system such as a compressor control system, and the access authority of the user of each system, which is set in each of a plurality of storage areas into which the common information is divided.

[0051] (2-2-2-1. Project information storage unit 12a) The project information storage unit 12a stores project information. For example, the project information storage unit 12a stores project information received by a receiving unit 13a of the control unit 13 described later. An example of data stored in the project information storage unit 12a will be described with reference to FIG. 6. FIG. 6 is a diagram showing an example of the project information storage unit 12a of the server device 10 according to the embodiment. In the example of FIG. 6, the project information storage unit 12a has items such as "project," "control system," "project common information," and "system individual information."

[0052] "Project" refers to identification information for identifying the combined project, such as an identification number or identification symbol of the combined project. "Control system" refers to identification information for identifying the process control systems included in the combined project, such as an identification number or identification symbol of the process control system. "Project common information" refers to information that can be commonly used by the process control systems included in the combined project, such as a unit list, alarm severity, alarm status string, block status string, etc. "System individual information" refers to information that is used individually by each process control system included in the combined project, such as setting information for the plant equipment that makes up the process control system.

[0053] That is, Figure 6 shows an example in which, for a combined project identified by "project PJT001", the control systems are {"control system CS001-A", "control system CS001-B", "control system CS001-C", ...}, the project common information is {unit list: "unit list UL001", alarm importance: "alarm importance AP001", alarm status string: "alarm status AS001", block status string: "block status BS001", ...}, and the system individual information is {"system individual information PGP001-A", "system individual information PGP001-B", "system individual information PGP001-C", ...} are stored in the project information storage unit 12a.

[0054] (2-2-2-2. Administrator registration information storage unit 12b) The administrator registration information storage unit 12b stores the administrator registration information. For example, the administrator registration information storage unit 12b stores the administrator registration information received by the receiving unit 13a of the control unit 13 described later. Here, an example of data stored in the administrator registration information storage unit 12b will be described with reference to FIG. 7. FIG. 7 is a diagram showing an example of the administrator registration information storage unit 12b of the server device 10 according to the embodiment. In the example of FIG. 7, the administrator registration information storage unit 12b has items such as "project", "control system", "access authority", "control system device", and "setting range".

[0055] "Project" refers to identification information for identifying the combined project, such as an identification number or identification symbol of the combined project. "Control system" refers to identification information for identifying a process control system included in the combined project, such as an identification number or identification symbol of the process control system. "Access rights" refers to the access rights of the user, control system administrator E, such as the ability to edit, view, etc. the project common information. "Control system equipment" refers to identification information for identifying plant equipment that constitutes the process control system, or a station that is a group of plant equipment, such as an identification number or identification symbol of the plant equipment or station to which access rights are granted. "Setting range" refers to identification information for identifying a storage area of ​​the project common information, such as an identification number or identification symbol of the storage area to which access rights are granted.

[0056] That is, in Fig. 7, for the combined project identified by "Project PJT001", {Control system: "Control system CS001-A", Access permission "Editable", Control system equipment: "Control equipment CT001-A" / "Communication equipment CD001-A" / "Monitoring equipment MD001-A" / ···, Setting range: "Setting range DB001 SF101~SF199",···}, {Control system: "Control system CS001-B", Access permission "Editable", Control system equipment: "Control equipment CT001-B" / "Communication equipment CD001-B" / "Monitoring equipment MD001-B" / ···, Setting range: "Setting range DB001 SF101~SF199",···}, SF201 to SF299", ···}, {Control system: "Control system CS001-C", Access permission "Cannot edit", Control system equipment: "Control equipment CT001-C" / "Communication equipment CD001-C" / "Monitoring equipment MD001-C" / ···, Setting range: "Setting range DB001 SF101 to SF299", ···} is shown as an example stored in the administrator registration information storage unit 12b.

[0057] (2-2-3. Control unit 13) The control unit 13 controls the entire server device 10. The control unit 13 includes a receiving unit 13a, an accepting unit 13b, and an executing unit 13c. Here, the control unit 13 can be realized by, for example, an electronic circuit such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0058] (2-2-3-1. Receiving unit 13a) The receiving unit 13a receives various types of information. The receiving unit 13a may store the received various types of information in the storage unit 12. For example, the receiving unit 13a receives project information from the control system manager terminal 20 and stores it in the project information storage unit 12a. The receiving unit 13a also receives manager registration information from the control system manager terminal 20 and stores it in the manager registration information storage unit 12b.

[0059] A specific example of project information will be described. The receiver 13a receives project common information {unit list: "unit list UL001", alarm importance: "alarm importance AP001", alarm status character string: "alarm status AS001", block status character string: "block status BS001", ...} input by the control system administrator E (basic control system administrator EA, dedicated control system administrator EB) on the project information setting screen of the control system administrator terminal 20 (basic control system administrator terminal 20A, dedicated control system administrator terminal 20B), and stores it in the project information storage unit 12a. In addition, the receiver 13a receives system individual information "system individual information PGP001-A" input by the basic control system administrator EA on the administrator registration information setting screen of the basic control system administrator terminal 20A for the basic control system identified by "control system CS001-A", and stores it in the project information storage unit 12a. In addition, the receiving unit 13a receives system individual information such as "system individual information PGP001-B" entered by the dedicated control system administrator EB on the administrator registration information setting screen of the dedicated control system administrator terminal 20B for the dedicated control system identified by "control system CS001-B", and stores it in the project information memory unit 12a.

[0060] A specific example of the administrator registration information will be described. The receiving unit 13a receives the administrator registration information {control system: "control system CS001-A", access authority "editable", control system equipment: "control equipment CT001-A" / "communication equipment CD001-A" / "monitoring equipment MD001-A" / ···, setting range: "setting range DB001 SF101 to SF199",···}, {control system: "control system CS001-B", access authority "editable", control system equipment: "control equipment CT001-B" / "communication equipment CD001-B" / "monitoring equipment MD001-B" / ···, setting range: "setting range DB001 SF101 to SF199",···}, {control system: "control system CS001-B", access authority "editable", control system equipment: "control equipment CT001-B" / "communication equipment CD001-B" / "monitoring equipment MD001-B" / ···, setting range: "setting range DB001 SF101 to SF199",···}, SF201 to SF299", ···}, {Control system: "Control system CS001-C", access authority "Cannot edit", control system equipment: "Control equipment CT001-C" / "Communications equipment CD001-C" / "Monitoring equipment MD001-C" / ···, setting range: "Setting range DB001 SF101 to SF299", ···} and store them in the administrator registration information memory unit 12b.

[0061] (2-2-3-2. Reception section 13b) The reception unit 13b receives various types of information. The reception unit 13b may store the received various types of information in the storage unit 12. For example, the reception unit 13b receives an access request to project information, which is setting information, from a control system administrator terminal 20 used by a control system administrator E, who is a user. At this time, the reception unit 13b receives access requests from a basic control system administrator EA, who is a user of the basic control system, and a dedicated control system administrator EB, who is a user of the dedicated control system. Furthermore, the reception unit 13b identifies, from the received access request, identification information included in the login information for the control system administrator terminal 20 used by the control system administrator E.

[0062] To explain a specific example, when the reception unit 13b receives a request to access project information stored in "setting range DB001 SF101-SF199" by the basic control system administrator EA on the project information setting screen of the basic control system administrator terminal 20A for the combined project identified by "project PJT001", the reception unit 13b identifies "control system CS001-A" as the identification information of the control system from the login information {control system: "control system CS001-A", control system administrator: "control system CS001-A ENG01", login start time: "10:30", login end time "-",...} of the basic control system administrator terminal 20A. At this time, the reception unit 13b may further identify "control system CS001-A ENG01" as the identification information of the control system administrator E.

[0063] (2-2-3-3. Executive Section 13c) The execution unit 13c executes various processes. The execution unit 13c acquires various pieces of information stored in the storage unit 12. The execution unit 13c also acquires various pieces of information accepted by the acceptance unit 13b.

[0064] For example, the execution unit 13c controls access by the control system administrator E to each of the multiple storage areas based on the identification information specified from the access request and the access authority stored in the administrator registration information storage unit 12b in association with the identification information. At this time, the execution unit 13c controls access by the control system administrator E to each of the multiple storage areas by referring to the location information and the type of access authority associated with the identification information included in the login information to the control system administrator terminal 20 of the control system administrator E from which the access request was accepted. Furthermore, when the execution unit 13c accepts an access request from the basic control system administrator EA of the basic control system, it controls access by the basic control system administrator EA to the project common information, and when the execution unit 13c accepts an access request from the dedicated control system administrator EB of the dedicated control system, it controls access by the dedicated control system administrator EB to the project common information.

[0065] To explain a specific example, when the execution unit 13c receives a request for access to project information stored in "setting range DB001 SF101 to SF199" by the basic control system administrator EA for the combined project identified by "project PJT001", the execution unit 13c specifies "control system CS001-A" as the identification information of the control system from the login information of the basic control system administrator terminal 20A, and refers to the administrator registration information {control system: "control system CS001-A", access authority "editable", control system device: "control device CT001-A" / "communication device CD001-A" / "monitoring device MD001-A" / ···, setting range: "setting range DB001 SF101 to SF199",···}, and specifies the control system "control system CS001-A", the setting range "setting range DB001 Since the access authority corresponding to "SF101 to SF199" is "editable", editing of the project information related to the access request of the basic control system administrator EA is permitted.

[0066] (2-3. Configuration and Processing Examples of the Control System Manager Terminal 20) An example of the configuration and processing of the control system administrator terminal 20 will be described with reference to Fig. 5. The control system administrator terminal 20 is a terminal used by a control system administrator E who manages the control system, and includes an input / output unit 21, a transmission / reception unit 22, and a communication unit 23.

[0067] (2-3-1. Input / output section 21) The input / output unit 21 is responsible for inputting various types of information to the control system administrator terminal 20. For example, the input / output unit 21 is realized by a mouse, a keyboard, a touch panel, or the like, and accepts input of setting information and the like to the control system administrator terminal 20. The input / output unit 21 also displays various types of information from the control system administrator terminal 20. For example, the input / output unit 21 is realized by a display, or the like, and displays setting information and the like stored in the control system administrator terminal 20.

[0068] The input / output unit 21 displays a project information setting screen for setting project information in the server device 10. Details of the project information setting screen will be described later in (2-3-4. Specific example 1 of display screen of control system administrator terminal 20) and (2-3-5. Specific example 2 of display screen of control system administrator terminal 20). The input / output unit 21 displays an administrator registration information setting screen for setting administrator registration information in the server device 10. Details of the administrator registration information setting screen will be described later in (2-3-6. Specific example 3 of display screen of control system administrator terminal 20).

[0069] (2-3-2. Transmitter / receiver 22) The transmitting / receiving unit 22 transmits various information. For example, the transmitting / receiving unit 22 transmits project information such as project common information and system individual information input by the control system administrator E on the project information setting screen to the server device 10. In addition, the transmitting / receiving unit 22 transmits administrator registration information such as access authority input by the control system administrator E on the administrator registration information setting screen to the server device 10. In addition, the transmitting / receiving unit 22 receives various information. For example, the transmitting / receiving unit 22 receives from the server device 10 a permission notice or a denial notice for the access request from the control system administrator E.

[0070] (2-3-3. Communications Department 23) The communication unit 23 manages data communication with other devices. For example, the communication unit 23 performs data communication with each communication device via a router, etc. The communication unit 23 can also perform data communication with an operator's terminal (not shown).

[0071] (2-3-4. Specific Example 1 of the Display Screen of the Control System Manager Terminal 20) Here, a specific example 1 of a display screen output by the input / output unit 21 of the control system administrator terminal 20 will be described with reference to Fig. 8. Fig. 8 is a diagram showing a specific example 1 of a display screen of the control system administrator terminal 20 according to the embodiment. In the following, the "alarm status" displayed on the "project information setting screen - definition status information -" will be described, and then the access restriction of the alarm status character string will be described.

[0072] (2-3-4-1.Alarm status) As shown in the example of Fig. 8, the control system administrator terminal 20 displays "alarm status" for setting an alarm status character string that defines the state of an alarm in a system for each plant or process control system. In the example of Fig. 8, the control system administrator terminal 20 displays the alarm status, which is project information of a dedicated control system, for each alarm category in "USER12", "USER13", and "USER14", which are position information in the input columns. At this time, the control system administrator E can execute an access request to edit the alarm status to the server device 10 by clicking on any cell in the input columns "USER12", "USER13", and "USER14".

[0073] (2-3-4-2. Access restrictions for alarm status strings) When the control system administrator terminal 20 executes an access request to edit the alarm status character string to the server device 10, the control system administrator terminal 20 displays whether the control system administrator E has access authority. For example, when the control system administrator E has access authority to edit the alarm status character strings of the input columns "USER12", "USER13", and "USER14", the control system administrator terminal 20 displays a message such as "Editing is possible" based on the response of the server device 10 and accepts input by the control system administrator E. On the other hand, when the control system administrator E does not have access authority to edit the alarm status character strings of the input columns "USER12", "USER13", and "USER14", the control system administrator terminal 20 displays a message such as "Editing is not possible" based on the response of the server device 10. In the example of FIG. 8, the access authority to edit the alarm status character strings of the input columns "USER12", "USER13", and "USER14" is granted to the dedicated control system, so the dedicated control system administrator EB can edit them, but the basic control system administrator EA cannot edit them.

[0074] (2-3-5. Specific Example 2 of the Display Screen of the Control System Manager Terminal 20) Here, a specific example 2 of a display screen output by the input / output unit 21 of the control system administrator terminal 20 will be described with reference to Fig. 9. Fig. 9 is a diagram showing a specific example 2 of a display screen of the control system administrator terminal 20 according to the embodiment. In the following, the "Block Status" displayed on the "Project Information Setting Screen - Definition Status Information" will be described, and then the access restriction of the block status character string will be described.

[0075] (2-3-5-1. Block status) As shown in the example of Fig. 9, the control system administrator terminal 20 displays "Block Status" for setting a block status character string that defines the state of a functional block of a system for each plant or process control system. In the example of Fig. 9, the control system administrator terminal 20 displays the block status, which is project information of a dedicated control system, for each functional block division in "USER4", "USER5", "USER6", and "USER7", which are position information in the input columns. At this time, the control system administrator E can execute an access request to edit the block status to the server device 10 by clicking any cell in the input columns "USER4", "USER5", "USER6", and "USER7".

[0076] (2-3-5-2. Access restrictions for block status strings) When the control system administrator terminal 20 executes an access request to edit the block status strings to the server device 10, the control system administrator terminal 20 displays whether the control system administrator E has access authority. For example, when the control system administrator E has access authority to edit the block status strings of the input strings "USER4", "USER5", "USER6", and "USER7", the control system administrator terminal 20 displays a message such as "Editing is possible" based on the response from the server device 10 and accepts input from the control system administrator E. On the other hand, when the control system administrator E does not have access authority to edit the block status strings of the input strings "USER4", "USER5", "USER6", and "USER7", the control system administrator terminal 20 displays a message such as "Editing is not possible" based on the response from the server device 10. In the example of FIG. 9, the access authority to edit the block status strings of the input strings "USER4", "USER5", "USER6", and "USER7" is granted to the dedicated control system, so the dedicated control system administrator EB can edit them, but the basic control system administrator EA cannot edit them.

[0077] (2-3-6. Specific Example 3 of the Display Screen of the Control System Manager Terminal 20) Here, a specific example 3 of a display screen output by the input / output unit 21 of the control system administrator terminal 20 will be described with reference to Fig. 10. Fig. 10 is a diagram showing a specific example 3 of a display screen of the control system administrator terminal 20 according to the embodiment. The following describes "Group name", "Authority", "PJT range", "STN range", and "Alarm status range" displayed on the "Administrator registration information setting screen".

[0078] (2-3-6-1. Group name) As shown in the example of Fig. 10, the control system administrator terminal 20 displays the "group name", which is the identification information of the control system, as the administrator registration information. In the example of Fig. 10, the control system administrator terminal 20 displays the control system group name "DFEGRP" in "No.1" and "No.2", the control system group name "NONEGRP" in "No.3" and "No.4", the basic control system group name "PCSENG" in "No.5", and the dedicated control system group name "CCSENG" in "No.6". At this time, the control system administrator terminal 20 may further display the identification information of the control system administrator E as the administrator registration information.

[0079] (2-3-6-2. Authority) As shown in the example of FIG. 10, the control system administrator terminal 20 displays "authority", which is an access authority, as administrator registration information. In the example of FIG. 10, the control system administrator terminal 20 displays the access authority "WRITE" for editing project information for "No. 1", "No. 3", "No. 5", and "No. 6", and displays the access authority "CREATE" for creating new project information for "No. 2" and "No. 4". That is, in the example of FIG. 10, the dedicated control system administrator EB of the dedicated control system can edit project common information in the corresponding "STN range" and "alarm status range". On the other hand, the basic control system administrator EA of the basic control system can view but cannot edit project common information in the corresponding "STN range" and "alarm status range".

[0080] At this time, the control system administrator terminal 20 may display the access authority "READ" for viewing the project information as the administrator registration information. The control system administrator terminal 20 may also display the access authority for prohibiting access such as prohibiting new creation of project information, prohibiting editing, and prohibiting viewing of project information as the administrator registration information.

[0081] (2-3-6-3. PJT range) As shown in the example of Fig. 10, the control system administrator terminal 20 displays "PJT range" indicating the combined project as the administrator registration information. In the example of Fig. 10, the control system administrator terminal 20 displays that the control systems classified as "DFEGRP", "PCSENG", and "CCSENG" are the same project. At this time, the control system administrator terminal 20 may further display identification information such as the name of the combined project as the administrator registration information.

[0082] (2-3-6-4.STN range) As shown in the example of Fig. 10, the control system administrator terminal 20 displays "STN range", which is identification information of plant equipment and stations, as administrator registration information. In the example of Fig. 10, the control system administrator terminal 20 displays station "FCS0101" of "PCSENG" and station "FCS0201" of "CCSENG". At this time, the control system administrator terminal 20 may further display identification information of plant equipment belonging to the station as "STN or lower range" as administrator registration information.

[0083] (2-3-6-5. Alarm status range) As shown in the example of Fig. 10, the control system administrator terminal 20 displays "alarm status range", which is position information of the storage area of ​​the alarm status character string, as the administrator registration information. In the example of Fig. 10, the control system administrator terminal 20 displays the project information input columns "USER12", "USER13", and "USER14" for the group name "CCSENG" of the dedicated control system "No. 6". In this case, the control system administrator terminal 20 may display the project information input columns "USER4", "USER5", "USER6", and "USER7" as the "alarm status range", which is position information of the storage area of ​​the block status character string, as the administrator registration information.

[0084] (2-3-6-6.Others) The control system administrator E can set the administrator registration information on the above-mentioned "Administrator Registration Information Setting Screen." Here, the control system administrator E who sets the above-mentioned administrator registration information is preferably, but is not limited to, the basic control system administrator EA who manages the basic control system, which is the upper project. Furthermore, the control system administrator E can set, on the "Administrator Registration Information Setting Screen," the "PJT Exclusion Range," which is the excluded range of access authority in the combined project, the "STN Exclusion Range," which is the excluded range of access authority in the station, and the "STN and below Exclusion Range," which is the excluded range of access authority in the plant equipment belonging to the station.

[0085] (2-4. Configuration and Processing Examples of the Control System Device 30) An example of the configuration and processing of the control system device 30 will be described with reference to Fig. 5. The control system device 30 includes, for example, a control device 31, a communication device 32, a monitoring device 33, and the like.

[0086] (2-4-1. Control equipment 31) The control device 31 is, for example, a controller constituting a distributed control system (DCS) or a compressor control system (CCS), and collects process values ​​such as temperature data, pressure data, and flow data in a plant from sensor devices such as temperature sensors, pressure sensors, and flow sensors. The control device 31 also generates an alarm when a process value exceeds a threshold. The control device 31 also generates an operation signal to be sent to an actuator or the like when a process value exceeds a threshold.

[0087] (2-4-2. Communication equipment 32) The communication device 32 is, for example, an L3 switch, and transmits and receives process values, such as temperature data, pressure data, and flow data, in the plant from sensor devices, such as a temperature sensor, a pressure sensor, and a flow sensor. The communication device 32 also transmits and receives alarms generated by the control device 31. The communication device 32 also transmits and receives operation signals generated by the control device 31.

[0088] (2-4-3. Monitoring equipment 33) The monitoring device 33 is, for example, an information processing device constituting the HIS, and displays process values ​​such as temperature data, pressure data, flow rate data, etc. in the plant. The monitoring device 33 also displays alarms generated by the control device 31.

[0089] 3. Flow of each process in the access control system 100 The overall processing flow of the access control system 100 according to the embodiment will be described with reference to Fig. 11. Fig. 11 is a flowchart showing an example of the processing flow of the access control system 100 according to the embodiment. Note that the processing of steps S101 to S103 below may be executed in a different order. Also, some of the processing of steps S101 to S103 below may be omitted.

[0090] (3-1. Administrator registration information setting process) First, the server device 10 executes an administrator registration information setting process (step S101). For example, the server device 10 receives administrator registration information that associates identification information of a control system, a type of access authority, a setting range of access authority, and the like, from the basic control system administrator terminal 20A of the basic control system, which is an upper project, and stores the information.

[0091] (3-2. Login information reception process) Secondly, the server device 10 executes a login information reception process (step S102). For example, the server device 10 receives login information of the basic control system administrator EA, including identification information of the basic control system, identification information of the basic control system administrator EA, login start time, login end time, etc., from the basic control system administrator terminal 20A. The server device 10 also receives login information of the dedicated control system administrator EB, including identification information of the dedicated control system, identification information of the dedicated control system administrator EB, login start time, login end time, etc., from the dedicated control system administrator terminal 20B.

[0092] (3-3. Access restriction execution process) Thirdly, the server device 10 executes an access restriction execution process (step S103). For example, the server device 10 refers to the administrator registration information corresponding to the identification information of the control system included in the login information, and determines whether or not editing is permitted for each storage area of ​​the project common information of the logged-in control system administrator E based on the access authority indicated by the administrator registration information, and permits editing by the control system administrator E who is permitted to edit, and prohibits editing by the control system administrator E who is not permitted to edit.

[0093] 4. Effects of the embodiment Finally, effects of the embodiment will be described below: Effects 1 to 8 corresponding to the processing according to the embodiment will be described below.

[0094] (4-1. Effect 1) First, in the process according to the embodiment described above, the server device 10 stores project information including project common information commonly used by a plurality of systems and system individual information individually used by each of the plurality of systems, stores identification information for identifying each of the plurality of systems in association with the access authority of the user of each system set in each of the plurality of storage areas into which the project common information is divided, receives an access request to the project information from a terminal used by the user, and controls the user's access to each of the plurality of storage areas based on the identification information specified from the access request and the access authority stored in association with the identification information. Therefore, in this process, it is possible to appropriately restrict access to information commonly used in a mixed environment in which a plurality of systems exist.

[0095] (4-2. Effect 2) Secondly, in the process according to the embodiment described above, the identification information set by the user for identifying each of the multiple systems, the location information of the multiple storage areas, and the type of the user's access authority to the storage areas are stored in association with each other, and the access control of the user to each of the multiple storage areas is performed by referring to the location information and the type of access authority associated with the identification information included in the login information of the user's terminal where the access request was accepted. Therefore, in this process, by granting detailed access authority to each storage area of ​​project common information, it is possible to appropriately restrict access to information commonly used in a mixed environment where multiple systems exist.

[0096] (4-3. Effect 3) Thirdly, in the process according to the embodiment described above, the access authority is to permit or prohibit editing of the project common information stored in the storage area. Therefore, in this process, by granting access authority regarding whether or not editing is allowed for each storage area of ​​the project common information, it is possible to appropriately restrict access to information commonly used in a mixed environment in which multiple systems exist.

[0097] (4-4. Effect 4) Fourth, in the processing according to the embodiment described above, the server device 10 stores project information including project common information used in common by the basic control system and the dedicated control system, and system individual information used individually by each of the basic control system and the dedicated control system, stores each identification information identifying each of the basic control system and the dedicated control system, and the access authority of the user of each system set in each of the multiple storage areas into which the project common information is divided, receives access requests from the basic control system administrator EA and the dedicated control system administrator EB, and when an access request is received from the basic control system administrator EA, executes access control to the project common information by the basic control system administrator EA, and when an access request is received from the dedicated control system administrator EB, executes access control to the project common information by the dedicated control system administrator EB. Therefore, in this process, by granting detailed access rights for the higher-level system, the basic control system, and the lower-level system, the dedicated control system, for each storage area of ​​the project common information, it is possible to appropriately restrict access to information that is commonly used in a mixed environment where multiple systems exist.

[0098] (4-5. Effect 5) Fifth, in the process according to the embodiment described above, the server device 10 stores, as project common information, an alarm status string that defines the state of an alarm in a system. Therefore, in this process, by granting access authority to each alarm status string in the project common information, it is possible to appropriately restrict access to information commonly used in a mixed environment in which multiple systems exist.

[0099] (4-6. Effect 6) Sixth, in the process according to the embodiment described above, the server device 10 stores, as project common information, block status strings that define the status of the functional blocks of the system. Therefore, in this process, by granting access authority to each block status string among the project common information, it is possible to appropriately restrict access to information commonly used in a mixed environment in which multiple systems exist.

[0100] (4-7. Effect 7) Seventh, in the process according to the embodiment described above, the multiple systems are process control systems that control processes in a plant. Therefore, in the process, in the plant process control system where safety is particularly required, it is possible to appropriately restrict access to information that is commonly used in a mixed environment where multiple systems exist.

[0101] (4-8. Effect 8) Eighth, in the process according to the embodiment described above, the multiple systems are a basic process control system that controls all the plant equipment that constitutes the plant, and a compressor control system that controls the compressor that constitutes the plant. Therefore, in this process, it is possible to appropriately restrict access to information that is commonly used in a mixed environment in which the basic process control system and the compressor control system exist.

[0102] 〔system〕 The information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed arbitrarily unless otherwise specified.

[0103] In addition, each component of each device shown in the figure is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure. In other words, all or part of them can be functionally or physically distributed and integrated in any unit according to various loads, usage conditions, etc.

[0104] Furthermore, each processing function performed by each device may be realized, in whole or in part, by a CPU and a program analyzed and executed by the CPU, or may be realized as hardware using wired logic.

[0105] [Hardware] Next, a hardware configuration example of the server device 10, which is an alarm information management device, will be described. Note that other devices may have a similar hardware configuration. FIG. 12 is a diagram for explaining a hardware configuration example according to an embodiment. As shown in FIG. 12, the server device 10 has a communication device 10a, a HDD (Hard Disk Drive) 10b, a memory 10c, and a processor 10d. Furthermore, each unit shown in FIG. 12 is connected to each other via a bus or the like.

[0106] The communication device 10a is a network interface card or the like, and communicates with other servers. The HDD 10b stores programs and databases that operate the functions shown in FIG.

[0107] The processor 10d reads out a program that executes the same processes as the respective processing units shown in FIG. 5 from the HDD 10b etc. and loads it in the memory 10c, thereby operating a process that executes the respective functions described in FIG. 5 etc. For example, this process executes the same functions as the respective processing units possessed by the server device 10. Specifically, the processor 10d reads out a program having the same functions as the receiving unit 13a, the accepting unit 13b, the executing unit 13c etc. from the HDD 10b etc. Then, the processor 10d executes a process that executes the same processes as the receiving unit 13a, the accepting unit 13b, the executing unit 13c etc.

[0108] In this way, the server device 10 operates as a device that executes various processing methods by reading and executing the programs. The server device 10 can also realize functions similar to those of the above-mentioned embodiment by reading the programs from a recording medium using a media reading device and executing the read programs. Note that the programs in these other embodiments are not limited to being executed by the server device 10. For example, the present invention can be similarly applied to cases where other computers or servers execute the programs, or where these execute the programs in cooperation with each other.

[0109] This program can be distributed via a network such as the Internet. This program can also be recorded on a computer-readable recording medium such as a hard disk, a flexible disk (FD), a CD-ROM, a magneto-optical disk (MO), or a digital versatile disk (DVD), and can be executed by being read out from the recording medium by a computer.

[0110] 〔others〕 Some examples of combinations of the disclosed technical features are set out below.

[0111] (1) An information management device comprising: a first memory unit that stores setting information including common information in which information commonly used by a plurality of systems is set, and individual information in which information individually used by each of the plurality of systems is set; a second memory unit that stores, in association with each other, identification information that identifies each of the plurality of systems and the access authority of a user of each system that is set in each of a plurality of memory areas into which the common information is divided; a reception unit that receives an access request to the setting information from a terminal used by the user; and an execution unit that executes access control to each of the plurality of memory areas by the user based on the identification information identified from the access request and the access authority stored in the second memory unit in association with the identification information.

[0112] (2) The information management device described in (1), wherein the second memory unit stores each identification information, location information of the multiple storage areas, and the type of access authority of the user to the storage areas in association with each other, and the execution unit executes access control of the user to each of the multiple storage areas by referring to the location information and the type of access authority associated with the identification information included in login information for the terminal of the user where the access request was accepted.

[0113] (3) The information management device according to (1) or (2), wherein the access authority is permission or prohibition of editing of the common information stored in the memory area.

[0114] (4) The information management device according to any one of (1) to (3), wherein the multiple systems are a basic control system located in a higher-level system that controls all of the devices that constitute the system, and a dedicated control system located in a lower-level system controlled by the basic control system, and that controls specific devices that constitute the system; the first memory unit stores the setting information including common information in which information commonly used by the basic control system and the dedicated control system is set, and individual information in which information individually used by the basic control system and the dedicated control system is set; the second memory unit stores each identification information that identifies the basic control system and the dedicated control system, and the access authority of the user of each system that is set in each of a plurality of memory areas into which the common information is divided, in association with each other; the reception unit receives access requests from the user of the basic control system and the user of the dedicated control system; and the execution unit, when receiving an access request from the user of the basic control system, executes the access control to the common information by the user of the basic control system, and when receiving an access request from the user of the dedicated control system, executes the access control to the common information by the user of the dedicated control system.

[0115] (5) The information management device according to any one of (1) to (4), wherein the first storage unit stores, as the common information, an alarm status character string that defines an alarm state of a system.

[0116] (6) The information management device according to any one of (1) to (5), wherein the first storage unit stores, as the common information, a block status character string that defines a state of a functional block of a system.

[0117] (7) The information management device according to any one of (1) to (6), wherein the plurality of systems are process control systems that control a process in a plant.

[0118] (8) The information management device according to (7), wherein the plurality of systems are a basic process control system that controls all plant equipment that constitutes the plant, and a compressor control system that controls a compressor that constitutes the plant.

[0119] (9) An information management method in which a computer stores setting information including common information in which information commonly used by multiple systems is set, and individual information in which information individually used by each of the multiple systems is set, stores identification information that identifies each of the multiple systems in association with the access rights of users of each system that are set for each of multiple storage areas into which the common information is divided, accepts an access request to the setting information from a terminal used by the user, and controls access to each of the multiple storage areas by the user based on the identification information identified from the access request and the access rights stored in association with the identification information.

[0120] (10) An information management program that causes a computer to execute a process of storing setting information including common information in which information commonly used by multiple systems is set, and individual information in which information individually used by each of the multiple systems is set, storing each identification information that identifies each of the multiple systems in association with the access rights of users of each system that are set in each of multiple storage areas into which the common information is divided, accepting an access request to the setting information from a terminal used by the user, and controlling access by the user to each of the multiple storage areas based on the identification information identified from the access request and the access rights stored in association with the identification information. [Explanation of symbols]

[0121] 10. Server equipment 11 Communications Department 12 Storage section 12a Project information storage section 12b Administrator registration information storage section 13 Control section 13a Receiving section 13b Reception 13c Executive Department 20 Control system administrator terminal 21 Input / output section 22 Transmitter / receiver 23 Communications Department 30 Control system equipment 100 Access Control System

Claims

1. a first storage unit that stores setting information including common information in which information commonly used by a plurality of systems is set, and individual information in which information individually used by each of the plurality of systems is set; a second storage unit that stores, in association with each other, identification information for identifying each of the plurality of systems and an access authority of a user of each system that is set in each of a plurality of storage areas into which the common information is divided; a reception unit that receives an access request to the setting information from a terminal used by the user; an execution unit that executes access control for the user to each of the plurality of storage areas based on the identification information specified from the access request and the access authority stored in the second storage unit in association with the identification information; An information management device comprising:

2. The second storage unit is storing each of the identification information, location information of the plurality of storage areas, and a type of access authority of the user to the storage areas in association with each other; The execution unit is executing access control for the user to each of the plurality of storage areas by referring to the location information and the type of access authority associated with the identification information included in login information for the terminal of the user for which the access request has been accepted; The information management device according to claim 1 .

3. The access authority is permission or prohibition of editing of the common information stored in the storage area. The information management device according to claim 1 .

4. The plurality of systems are a basic control system located in a higher-level system that controls all of the devices constituting the system, and a dedicated control system located in a lower-level system controlled by the basic control system that controls specific devices constituting the system, The first storage unit is storing the setting information including common information in which information commonly used by the basic control system and the dedicated control system is set, and individual information in which information individually used by the basic control system and the dedicated control system is set; The second storage unit is storing, in association with each other, identification information for identifying each of the basic control system and the dedicated control system, and an access authority of a user of each system, which is set in each of a plurality of storage areas into which the common information is divided; The reception unit is receiving access requests from users of the basic control system and users of the dedicated control system; The execution unit is when an access request is received from a user of the basic control system, the access control unit 100 executes the access control to the common information by the user of the basic control system, and when an access request is received from a user of the dedicated control system, the access control unit 100 executes the access control to the common information by the user of the dedicated control system. The information management device according to claim 1 .

5. The first storage unit is storing, as the common information, an alarm status string defining an alarm state of the system; The information management device according to claim 1 .

6. The first storage unit is storing, as the common information, a block status string defining a state of a functional block of the system; The information management device according to claim 1 .

7. The plurality of systems are process control systems for controlling a process of a plant. The information management device according to claim 1 .

8. The plurality of systems are a basic process control system that controls all plant equipment constituting the plant, and a compressor control system that controls a compressor constituting the plant. The information management device according to claim 7.

9. The computer Holding setting information including common information in which information commonly used by a plurality of systems is set, and individual information in which information individually used by each of the plurality of systems is set, storing, in association with each other, identification information for identifying each of the plurality of systems and an access authority of a user of each of the systems, which is set in each of a plurality of storage areas into which the common information is divided; receiving a request to access the setting information from a terminal used by the user; executing access control for the user to each of the plurality of storage areas based on the identification information specified from the access request and the access authority stored in association with the identification information; Information management methods that perform processing.

10. On the computer, Holding setting information including common information in which information commonly used by a plurality of systems is set, and individual information in which information individually used by each of the plurality of systems is set, storing, in association with each other, identification information for identifying each of the plurality of systems and an access authority of a user of each of the systems, which is set in each of a plurality of storage areas into which the common information is divided; receiving a request to access the setting information from a terminal used by the user; executing access control for the user to each of the plurality of storage areas based on the identification information specified from the access request and the access authority stored in association with the identification information; An information management program that executes the processing.

Images