Parameter, field, and function security

Locks assigned to functions

Locks are assigned to various user functions, such as downloading, uploading, changing the configuration database, and so on. Functions are assigned to default locks initially. Use the DeltaV Explorer to change the lock associated with a function. Batch functions, Campaign Manager, Continuous Historian, and Event History have their own locks.

Refer to the following table for a list of the function locks, the default function to which each lock is assigned, and descriptions of the tasks that users with a key to the lock can perform:

Table: Locks and associated functions
Function Default associated lock Operation function Can apply to specific area or node?

ACTION_VERIFY

Restricted Control

Verify an action in Control Studio online and DeltaV Operate which requires a verifier's Electronic Signature. (Usually supervisors are granted the key to the lock associated with this operation.)

AREA

ADMIN_CONFIG_DB

System Admin

Use the database administrator tools to create, copy, and rename databases.

No

ALARM_HELP_DOWNLOAD

Can Download

Download non-SIS alarm help to the DeltaV run-time system from the Alarm Help View and Edit application.

No

ALARM_HELP_EDIT_COI

Can Configure

Modify the Consequence of Inaction field in the Alarm Help View and Edit application.

No

ALARM_HELP_EDIT_TEXT1

Can Configure

Modify the upper text box in the Alarm Help View and Edit application.

No

ALARM_HELP_EDIT_TEXT2

Can Configure

Modify the middle text box in the Alarm Help View and Edit application.

No

ALARM_HELP_EDIT_TEXT3

Can Configure

Modify the lower text box in the Alarm Help View and Edit application.

No

ALARM_HELP_EDIT_TTR

Can Configure

Modify the Time to Respond field in the Alarm Help View and Edit application.

No

CHANGE_CONFIG_DB

Can Configure

Make changes to the configuration database, access a module in debug mode.

No 

CHANGE_DEVICE_DB

Can Calibrate

Use AMS Device Manager device configuration and calibration features. An appropriate AMS Device Manager license is required to access calibration.

No 

CHART_SAVE

Can Configure

Save Process History View configuration.

No 

DIAGNOSTIC_DATA_CLEAR

Diagnostic

Reset all communication, port, and device statistics; clear integrity history.

No 

DIAGNOSTIC_SWITCHOVER

Diagnostic

Initiate a manual switchover of a redundant controller or an Application Station running redundant subsystems (such as, DeltaV OPC Data Access Server (with or without OPC Mirror), DeltaV Connect, or Batch (including Campaign Manager).

Note: Users must have the key to the Control lock to perform a manual switchover.

No 

DOWNLOAD_CONFIG

Can Download

Download configuration and setup data to system nodes.

No 

EDIT_DOWNLOAD_MODULES

Can Edit

Permits the following actions for modules assigned to the nodes that have the Can Edit lock:
  • Edit modules
  • Download the modules
  • Upload changes to the modules
  • VCAT for module checkout/checkin
  • VCAT for download of checked out module

NODE

EDIT_IO_AND_SETUP_DEVICES

Can Setup Devices

Permits the following actions for modules assigned to the nodes that have the Can Setup Devices lock:
  • Edit IO properties, channel and CHARM
  • Autosense CHARMs if the node is CIOC
  • Assign CHARM to controller (if there is currently no assignment)
  • Autosense devices
  • Reconcile device
  • AMS Device Manager
    • Change the AMS Device Manager database
    • Send reconciled data to the device
    • Send the command to start bulk transfer
    • Open the device in AMS Device Manager and editing device information
  • Lock/unlock Hart 7 devices using Hart Command
  • Replace fieldbus devices
  • Decommission/Commission fieldbus devices
  • Download fieldbus device and port
  • Modify fieldbus resource and transducer blocks
  • Modify fieldbus device properties
  • Change device database for fieldbus
  • List/sense wireless devices
  • Commission wireless devices
  • Edit device placeholder properties on CIOC, CSLS, and WIOC
  • Download card
  • Download CHARM
  • Lock or unlock a node
  • Download the CIOC
  • VCAT for checkout/checkin device

  • VCAT for download if device is checked out

NODE

HMI_CONFIG_GRAPHICS

Can Configure

Modify graphics configurations in the Graphics Studio/Graphics Explorer pane (Layouts, Displays, Contextual Displays, Display Sets).

Import graphics configurations, languages, themes, and library items in Graphics Studio.

No

HMI_CONFIG_LIBRARIES

Can Configure

Create, modify, or delete languages, themes, configuration libraries, and library items in Graphics Studio.

Import graphics libraries, library items, languages, and themes in Graphics Studio.

No

HMI_CONFIG_PUBLISH

Can Configure

Publish and un-publish (remove from online) graphics configurations and components in Graphics Studio.

No

HMI_CONFIG_WORKSTATION

Can Configure

Modify the configuration for DeltaV Live-enabled workstations and remote client sessions.

Import the configuration for DeltaV Live-enabled workstations and remote client sessions.

No

HMI_DATABASE_ADMIN

SystemAdmin

Permits the following functions in DeltaV Live Administration:
  • Copy Database
  • Create Database
  • Delete Database
  • Export Database
  • Import Database
  • Rename Database
  • Switch Database

No

HMI_OP_SWITCH_DISPLAYSET

Restricted Control

Switch the active Display Set in use.

AREA

HMI_OP_SWITCH_LANGUAGE

Restricted Control

Switch the current application's and/or database's (content) language.

AREA

HMI_OP_SWITCH_THEME

Restricted Control

Switch the current theme.

AREA

HMI_OP_WINDOW_MODE

Restricted Control

Permits the user to leave the full desktop display mode.

AREA

INSPECT_TUNE

Tuning

Within Inspect: change the Enabled/Disable flag for a areas, modules and blocks. Change the alarming flag for a block. To set items, click View → Options. Set the limits.

AREA

LOCK_UNLOCK_DEVICE

Can Calibrate

Lock and unlock HART devices from Diagnostics.

No

REPLACE_DEVICE

Can Calibrate

Make changes to the fieldbus device in the configuration database. This key allows the user to:
  • Replace FF device
  • Decommission FF device
  • Commission FF device
  • Download FF device
  • Download FF port
  • Modify resource and transducer blocks
  • Modify device properties

This key is not needed if the user already can CHANGE_CONFIG_DB.

No

UPDATE_FIRMWARE

System Admin

Use the DeltaV Controller and I/O Upgrade Utility to upgrade firmware for controllers, I/O cards, and other devices.

No 

UPLOAD_CONFIG

Can Configure

Upload configuration, setup data to system nodes.

No 

USER_SECURITY_ATTACH_LOCKS

Can Configure

Attach functions to locks in DeltaV Explorer.

No 

USER_SECURITY_USERMANAGER

Can Configure

Make changes in the User Manager.

No 

VC_ADMINISTRATOR

System Admin

Undo the check out of items checked out by other users.

No 

VC_CHECKOUT_CHECKIN

Can Configure

Check items in and out of a version control database.

No 

VC_DEVICE_CHECKOUT_CHECKIN

Can Calibrate

Check fieldbus device in and out of a version control database. Not needed if the user already has VC_CHECKOUT_CHECKIN.

No

VC_DOWNLOAD_CHECKEDOUT

System Admin

Download items that have been checked out of the version control database.

No 

VC_DOWNLOAD_UNAUTHORIZED

System Admin

Download recipes that are not authorized.

No 

VC_PURGE_RECOVER_ITEMS

System Admin

Use the DeltaV Explorer to purge and recover items from the version control database.

No 

VC_ROLLBACK_ITEMS

System Admin

Use the DeltaV Explorer to rollback to a previous version.

No 

VC_SET_LABEL

Can Configure

Label items in the version control database.

No 

WIRELESS_PROVISIONING

Wireless Provisioning

Make changes to a Wireless HART I/O card (WIOC) in the configuration database. This key allows the user to:

  • Enable Active Advertising
  • Rotate the Network Key Now
  • Create or import a new WIOC into DeltaV Explorer
  • View or modify the WIOC's Join Key
  • Modify the WIOC's network ID

No

Related information