The DeltaV security model design provides control by granting users the ability to use the Batch subsystem on an individual function level. These functions are associated with a specific lock to which a key is granted on a group or user level. Additionally, user defined locks can be created and the batch functions assigned to the new locks. Keys are assigned to the locks as determined by your overall security scheme. By default, the batch functions are associated with the locks as shown in the following table.
Certain batch functions are area specific, that is, if the key is granted, it must be granted for the specific area effected or be granted for all areas. Assigning a key in Area_A (the default DeltaV area) grants that key site wide as does assigning <Sitewide>. Refer to the following table for a complete list of batch functions, their individual function, the default associated lock, and whether or not the batch function is area specific.
The area-specific keys must be granted for the areas in which the recipe runs. Therefore, if a recipe only uses units in AREA_TANKS, then granting a key for the area, AREA_TANKS, allows the operator to run the recipe. However, if the recipe runs on units in both AREA_TANKS and AREA_REACTORS, the operator must have the keys assigned for both AREA_TANKS and AREA_REACTORS, or have the key assigned using <Sitewide>.
Because many functions are assigned to the Batch Operate lock, it may be necessary to reassign some functions to a user-created lock to secure those functions to a specific area while keeping the other functions as site wide. For example, if a group of operators need to run recipes in AREA_TANKS and AREA_REACTORS, but not in any other areas, create a lock for those operators and assign the appropriate operations, such as BATCH_ADD to that new lock. In this way, you can keep the site wide functions (see table below) separate. That group of operators can now run the recipes in the specified areas only and also can launch the Batch Operator Interface (a site wide function).
The Batch Executive uses the Administrator account when writing unit and phase parameters in the controller. By default, this account is explicitly given the Sitewide key for all the standard DeltaV locks, but it is not granted the keys for the ten user-defined locks. Therefore, if moving functions or parameters to new locks, be sure that the Administrator account has the key to those locks. This is especially true when moving parameters to different locks. For example, the CREATE_PHASE parameter belongs to the Restricted Control lock by default. If you move the CREATE_PHASE parameter to another lock (User Lock 2) you must give Administrator the key to User Lock 2.