13. Can information entering or leaving a WACS server be “tapped”?

Although electronic eavesdropping is possible, it is “unlikely” thanks to encryption techniques available with server software, Raymond Rae, vice president of marketing for Delta Controls Inc., said.

“Those eavesdropping on the LAN or at the ISP will have a very difficult job in making sense of any snooped data,” Donlon and Kamal of Computrols said.

Even if they can make sense of it, Ehrlich of Trane said, it will be “pretty mundane information, such as temperatures, pressures, and setpoints.” “We aren’t talking about account numbers, financials, or the score of Tomorrow’s big game,” Ehrlich said.

Encryption “also prevents active attacks where unwanted parties try to actively make changes in the BAS system,” Donlon and Kamal said. “This is because ... encryption algorithms also (can) employ authentication techniques.”

In the case of wireless WACS, communications are encoded, Kevin Duffy, vice president of sales and marketing for Notifact Corp., said.

“Packets of information are sent over secure wireless channels in milliseconds at random times and are unintelligible to virtually anyone,” Duffy said. “This is a distinct advantage over phone systems, which have a continuous data stream.”

14. What features do most WACS share?

WACS share an “ability to provide control-system data in a format that can be viewed and edited through a Web browser,” Tom of Automated Logic said. “Beyond that, the features vary widely.”

Bob Schultz, PE, director of applications services for TAC-Americas, said all WACS provide the first level of Web interaction--monitoring, which involves “the remote access of data, the ability to see what is going on in a facility”--while the second level--control, “the ability to override automatic control or to invoke different modes of operation”--is available only in select products. As for the third and final level of Web interaction--editing, “the ability to change the logic of control”--Schultz said he does not see it “as an offering of browser-based access.”

Sophie Vandebroek, vice president of technology for Carrier Corp., was more specific, saying that, “Most WACS share a translator or transcoder to decipher the multi-equipment protocols and provide a common management interface and access to an Internet Service Provider or WAN,Ó while Duffy of Notifact said most WACS are Òphone-line-based.”

15. What distinguishes WACS products from each other, and how can they be compared?

“You could easily fill an entire article or a series of articles with this question alone,” Tom of Automated Logic said. Still, that did not stop Dennis Tuft, vice president of marketing for Tridium Inc., from identifying three primary distinguishing features of WACS:

• Where the information lies (in a central server or in servers at every site).
• What can be connected (only the manufacturer’s products, only “one-technology” open products, or a multitude of different manufacturers’ products and different communication protocols).
• Whether a Web interface is merely tacked onto existing heavy-client BAS software or the WACS truly uses Web technologies and provides access from “zero-client” Web browsers.

Rae of Delta Controls said WACS products can be distinguished from one another by comparing: cost vs. functionality, graphic/Web-page creation, data access from enterprise-management systems, ease of use, flexibility, and scalability.

Above all else, Nations of Johnson Controls said, it is important “that the buyer of a system understand the distinction between the features the Web access provides and the features the BAS provides.”

“Web access is a small component of the overall operation of a facility,” Nations said. “The most significant thing it offers is remote access via paths and devices common to the IT infrastructure.”

16. Does a WACS track who is using it and when, and how are access limitations achieved?

To the question regarding a WACS’ ability to track who is using it and when, responses ranged from “yes” (Notifact, Delta Controls, Liebert, Carrier, and engineers Bruce L. Billedeaux of Armstrong Service Inc. and Gordon V.R. Holness, PE, of Albert Kahn Associates Inc.) to “varies by vendor” (Invensys, Alerton Technologies, Tridium, Siemens) to "not typically" (Trane).

Tracking “is not an inherent feature of WACS, but it’s a feature every WACS should have,” Tom of Automated Logic said. “Ideally, the WACS not only should track who logs in and out, but record any changes they make to the system.”

Tom said access limitations typically are achieved by means of the operator’s login.

“Some operators can only view data,” Tom said. “Others can edit set-points, schedules, and other day-to-day operating parameters. Fewer typically will be authorized to edit the control programs themselves or to make major changes to the system configuration. The ability to silence, acknowledge, and delete alarms is another privilege that can be given to selected individuals.”

These privileges may be global or regional, Tom continued.

“By this, I mean an operator may have the authorization to view and edit parameters across the entire system or only in a certain building, on a certain floor, or in a certain room within the system,” Tom said. “With ‘fine-grained’ access control, privileges can differ from area to area. This means a user may be able to view the entire system and have fairly extensive editing privileges within one specific area of the building and more limited editing privileges in other areas.”

Acceptable Use Policy blog comments powered by Disqus