We allow Select access, due to the fact that we do not have every point on
graphics. At one time we used protection classes everywhere to limit some
access, but this got unwieldy very quickly, and the weakness of this
security model (access control from every graphic/faceplate/detail display
rather than at the controller) disturbs me. We have now started "locking"
parameters we don't want changed, either via loopback connections or
connections to other blocks. This is a PITA (I wish there was at least a
shorthand for "this block", like "self" in some object-oriented computer
languages), but it is the most foolproof way.
That said, we also do not rely on the DCS as a lockout/tagout mechanism.
We use physical isolation/removal of energy sources wherever possible.
Corey Clingo
BASF Corp.
"Weiss, Andreas" <andreas.weiss@xxxxxxxxxxxx>
Sent by: foxboro-bounce@xxxxxxxxxxxxx
08/24/2005 01:19 PM
Please respond to foxboro
To: foxboro
cc:
Subject: Re: [foxboro] Locking / Disabling equipment
> However, anyone with access to SELECT (or any=20
> other way to get
> block default display) also has access to the DISABLE=20
> parameter.
Access to Select including block default display in combination with
"dmcmd omsets enabled" is only allowed for a special group of people.
Andreas
_______________________________________________________________________
This mailing list is neither sponsored nor endorsed by Invensys Process
Systems (formerly The Foxboro Company). Use the info you obtain here at
your own risks. Read http://www.thecassandraproject.org/disclaimer.html
foxboro mailing list: http://www.freelists.org/list/foxboro
to subscribe: mailto:foxboro-request@xxxxxxxxxxxxx?subject=join
to unsubscribe: mailto:foxboro-request@xxxxxxxxxxxxx?subject=leave