- October 21, 2026
- Posted by: editor
- Category: RECD & Emission Control Devices
An RECD controller looks like a small box on the wall of the DG room, but the numbers stored inside it decide a lot. They decide when an operator is warned about rising back-pressure, when a regeneration cycle may start, what the BMS sees, and what an inspector will find in the event log. If anyone with the default password can change those numbers, the site carries a quiet compliance and reliability risk.
Most sites never make a deliberate decision about who can touch these settings. The installer leaves a technician password on a sticker, the BMS contractor gets full rights “for commissioning”, and a year later nobody can say why an alarm limit was raised or who did it. This guide works through the question role by role, then pulls the answers into a permissions matrix, credential rules, remote access, change approval, audit trail and offboarding. It ends with an illustrative access policy for a mid-sized site.
One point before we start. The filter inside an RECD keeps capturing particulate whether or not anyone is logged in to the controller. The controller mainly handles monitoring, alarms and, in active designs, heater or regeneration control. So access control is not about keeping the filter working today. It is about keeping the monitoring honest, the alarms meaningful and the engine protected over the life of the device.
Why RECD Settings Deserve Access Control
Three things make RECD controller settings more sensitive than they first appear.
They carry engine protection consequences. A back-pressure warning limit set too high means the operator learns late that the filter is loading up, and sustained high back-pressure can harm the engine. Our guide on how exhaust back-pressure affects a DG set explains why the OEM maximum matters. Where a site links any RECD signal to a generator shutdown, that decision belongs to the DG maintainer and the engine maker, not to whoever is logged in. See RECD alarm vs generator trip for how to define that response.
They shape the compliance record. During a pollution control board inspection, the officer may look at whether the device is operating and whether the site keeps records. A record that shows limits drifting without explanation weakens the site’s position even if the hardware is fine.
They are increasingly connected. Once the controller is linked to a BMS, a gateway or a cloud portal, the people who can change settings are no longer only those standing in the DG room. That places RECD controllers alongside other operational technology (OT) on site.
The Standards Worth Borrowing From
You do not need to certify a DG room against an industrial cybersecurity standard, but two references give a sensible vocabulary.
The ISA/IEC 62443 series organises industrial systems into zones and conduits, and asks that each user and system get only the access its job needs (least privilege). It also assigns responsibilities separately to asset owners, integrators and product suppliers, which maps neatly onto the RECD situation: the site owns the asset, the BMS contractor integrates it, and the RECD supplier makes the product.
NIST SP 800-82 Rev. 3, the Guide to OT Security, covers account management, remote access, segmentation and logging for OT, and accepts that many OT devices have limited built-in security. Its core message suits small RECD controllers: where the device cannot enforce good security itself, wrap it in procedures and network controls that do.
Use these as reference points, not line-by-line checklists. A two-generator housing society and a data centre with twelve sets will apply them very differently.
Role by Role: Who Needs What
The cleanest way to decide access is to describe each role’s job, then grant only what that job requires. These seven roles appear on most Indian sites with RECD-fitted DG sets. Small sites may combine roles in one person, which is fine as long as the combination is written down.
1. DG Operator
The job: Starting and stopping sets, watching the panel during runs, responding to alarms, filling in the logbook.
What they need: A clear view of current readings (back-pressure, exhaust temperature, filter and regeneration status), the ability to acknowledge alarms, and sight of the current shift’s alarm history.
What they should not have: Any ability to change alarm limits, delays, regeneration parameters or communication settings. An operator under pressure during a grid outage, with the horn sounding repeatedly, is exactly the person who might be tempted to “just raise the limit a bit”. Removing that option protects the operator as much as the site.
Practical note: If the controller has only one password level, do not give it to operators. Acknowledgement can often be done from a front-panel button or from BMS operator screens. Training should cover what each alarm means and who to call, which is the purpose of an RECD alarm response matrix for operators.
2. Shift Engineer or Facility Engineer
The job: Supervising operators, deciding whether to keep a set running during an alarm, coordinating with the maintainer, signing off logbooks.
What they need: Everything the operator has, plus the ability to view all configured settings (to check them against the approved settings sheet), export logs and, on some sites, adjust alarm delays within a pre-approved band.
What they should not have: Standing rights to change regeneration parameters, firmware or user accounts.
Practical note: The shift engineer is often first to notice nuisance alarms. Give them a route to request a change rather than a means to make it. Our guide to reducing nuisance RECD alerts without hiding real faults covers how to evaluate those requests.
3. DG Maintainer (In-House or AMC Contractor)
The job: Servicing the engine and RECD, cleaning or replacing filter elements, checking sensors, fault-finding.
What they need: View rights, log export, access to any maintenance or test mode, and the ability to reset service counters after completed work. They may need to change sensor scaling after replacing a transmitter, but only against the calibration record.
What they should not have: Alarm limit changes without approval, and no user administration.
Practical note: The maintainer is the main voice on engine protection limits, so any back-pressure limit that could lead to a stop should be agreed with them using the engine maker’s data. Tie their access to the RECD maintenance schedule so it is granted for planned visits rather than held permanently.
4. RECD Supplier Service Engineer
The job: Commissioning, warranty service, firmware updates, deep diagnosis, and changes to regeneration or heater logic.
What they need: The highest technical level, because they understand the product’s internal parameters.
What they should not have: Permanent, unsupervised access. The supplier’s engineer should work under a site permit, with the site engineer present or informed, and every change should come with a written note of before and after values. If the supplier keeps a master password that overrides site accounts, ask for that to be stated in writing, along with how it is protected.
5. BMS or SCADA Contractor
The job: Mapping RECD data into the BMS, building screens and alarm routing, maintaining the communication link.
What they need: Read access to the points they map and, during commissioning only, temporary access to communication settings (device address, baud rate, IP settings). Register maps and scaling are covered in our guide to RECD Modbus data, units and register mapping.
What they should not have: Write access to control or limit registers, unless there is a specific, approved reason. Many Modbus devices accept writes from any connected master with no authentication, so a misconfigured BMS point could change an RECD setting without anyone logging in.
Practical note: Ask the contractor to confirm in writing that the integration is read-only, listing any write points that exist. See integrating RECD monitoring with a BMS for the wider picture.
6. IT / OT Security Team
The job: Network design, firewall rules, remote access gateways, password vaults, security monitoring.
What they need: Rights over the network path to the controller, not over its process settings. They need to know the controller exists, which ports it uses and who connects to it.
Practical note: Smaller sites may have only a general IT vendor. Even then, someone should own the question “what is plugged into the network in the DG room?” Our post on whether an RECD needs internet access helps frame that conversation.
7. Auditor (Internal, EHS or External)
The job: Checking that the device operates, that settings match the approved baseline and that records are complete.
What they need: Read-only access to settings, alarm history and event logs, or exported copies. With good exports they need not log in to the live controller at all. They should never hold write access.
The Permissions Matrix
The table combines the roles above. “Yes” is a standing right. “Temp” is granted for a specific, approved task and then removed. “No” is not granted.
| Function | Operator | Shift engineer | Maintainer | RECD supplier | BMS contractor | IT/OT security | Auditor |
|---|---|---|---|---|---|---|---|
| View live readings | Yes | Yes | Yes | Yes | Mapped points | No | Yes |
| View settings | Limited | Yes | Yes | Yes | Comms only | No | Yes |
| Acknowledge alarms | Yes | Yes | Yes | Yes | No | No | No |
| Export logs | No | Yes | Yes | Yes | No | No | Via engineer |
| Change alarm delays | No | Temp | Temp | Temp | No | No | No |
| Change alarm limits | No | No | Temp | Temp | No | No | No |
| Change regeneration or heater parameters | No | No | No | Temp | No | No | No |
| Change sensor scaling | No | No | Temp | Temp | No | No | No |
| Change communication settings | No | No | No | Temp | Temp | Advise | No |
| Firmware update | No | No | No | Temp | No | Advise | No |
| User administration | No | No | No | No | No | Site admin | No |
| Network path and firewall | No | No | No | No | No | Yes | No |
Two choices are built in. Nobody outside the site holds user administration: a named site admin (often the facility manager) decides who gets accounts. And every change right except network management is temporary, which forces each change through an approval step, where most bad changes get caught.
When the Controller Has Only One or Two Password Levels
Many RECD controllers offer far fewer levels than this matrix assumes. You can still enforce it by combining device levels with procedure:
- Map “user” level to operator and shift engineer, “service” level to maintainer and supplier.
- Keep the service password sealed or in a vault, signed out against a permit.
- Change it after each use by an outside party, if the controller allows.
- Add physical controls: a lockable panel door with the key held by the shift engineer.
- Restrict the network so only the BMS server can reach the controller.
This is the “compensating controls” approach NIST SP 800-82 describes for OT devices with limited built-in security.
Password and Credential Practice
Weak credential practice is the most common gap. A few habits fix most of it.
- Change defaults at commissioning. Default passwords are often printed in freely available manuals. Make “defaults changed” a line item in the commissioning record.
- Use individual accounts where possible. “admin” shared by six people tells you nothing in an audit.
- Log shared credentials. Where only one service password exists, record each issue: who, when, why, and when it was returned or changed.
- No passwords on stickers or in WhatsApp groups. A photo of a panel with a password label can travel far.
- Store credentials centrally. A password manager, or at minimum a sealed register in the facility manager’s safe.
- Review every six months, and immediately after any staff or contractor change.
Remote Access: Useful, but Controlled
Remote access lets a supplier diagnose a fault without travelling, and lets unattended sites send alerts (see remote RECD alerts for unattended sites). Remote write access needs tighter rules:
- Separate read and write paths. Data can flow out through a gateway; settings changes come in only through an approved, monitored route.
- No direct internet exposure. Use a site-controlled VPN or remote access gateway, never a controller reachable from the open internet.
- Session on request. The site engineer enables a session for a set window and disables it afterwards. Avoid “always on” access.
- Someone on site knows. During a remote session that changes settings, a site engineer should be aware, especially if a set may be running.
- Log the session: start, end, who connected and what changed.
Change Approval: A Short, Workable Process
Change control need not be heavy. A one-page change request is enough, provided it is always used. Pharmaceutical sites have the most mature habits, and our guide to RECD change control in pharmaceutical plants shows a fuller version.
A minimal change request records the parameter with its current and proposed values, the reason, a risk check (does it affect engine protection, and has the DG maintainer agreed?), the approver and date, who will make and verify the change, and a rollback value.
Classify changes so routine ones move fast:
| Change class | Examples | Approval needed |
|---|---|---|
| Minor | Alarm delay within approved band, display units | Shift engineer plus record |
| Standard | Alarm limit, sensor scaling after replacement | Facility manager plus DG maintainer |
| Major | Regeneration parameters, firmware, anything affecting a trip | Facility manager, DG maintainer, RECD supplier, engine maker data where relevant |
The Audit Trail
An access policy is only as good as the evidence that it is followed. The trail has two parts.
What the controller records. Some controllers log setting changes with a timestamp and user level. Check what yours actually records during commissioning. Our post on what an RECD event log should record lists the useful fields.
What the site records. A change register, the permit for each service visit, the password issue log, and a dated settings snapshot (exported, or photographed screen by screen). For principles on keeping and reviewing logs, NIST SP 800-92 is a solid reference.
A quarterly comparison of live settings against the last approved snapshot is one of the most effective controls a small site can run. It takes about 20 minutes and reliably catches unrecorded changes.
Offboarding Leavers and Contractors
Access tends to be granted carefully and removed carelessly. Build these triggers into HR and contract processes:
- Staff leaving or changing role: remove named accounts on the last working day and change any shared password they knew.
- AMC contract ending: change the service password, collect keys, revoke remote accounts, and get a written handover of open issues.
- BMS contractor leaving after commissioning: confirm write points are disabled and remove their accounts.
- RECD supplier staff changes: ask the supplier to confirm which of their staff hold credentials for your site.
- Controller replacement: a new unit often arrives with default passwords, so treat it as a fresh commissioning step. Our guide on preserving RECD data when replacing a controller covers the wider swap.
Worked Example: An Access Policy for a Mid-Sized Site (Illustrative)
The following is an illustrative example, not a description of any real site.
Site: A commercial office campus in Gurugram with three DG sets (two of 750 kVA, one of 500 kVA), each with an RECD and controller. RECD data goes to the campus BMS over Modbus. An AMC contractor maintains the sets, and the RECD supplier provides warranty service. GRAP restrictions mean the sets are watched closely from October to February.
People: 6 operators across three shifts, 3 shift engineers, 1 facility manager, a 2-person AMC team visiting monthly, 1 supplier service engineer, a BMS contractor and the corporate IT team.
| Item | Rule |
|---|---|
| Account owner | Facility manager is site admin for all RECD credentials |
| Operators | Front-panel acknowledge only; BMS screens read-only |
| Shift engineers | Controller “user” level; may change alarm delays between 10 and 60 seconds as a logged minor change |
| AMC maintainer | Service password issued per visit against permit, returned at end of visit |
| RECD supplier | On site under permit with shift engineer present; remote sessions via IT’s VPN in 4-hour windows on request |
| BMS contractor | Read-only Modbus mapping; written confirmation of zero write points |
| IT | Controllers on a separate VLAN; only the BMS server and VPN gateway may connect |
| Password change | After every supplier or AMC use, and every 90 days regardless |
| Settings snapshot | Exported monthly by shift engineer; compared quarterly by facility manager |
| Audit | EHS lead reviews register and snapshots before and after GRAP season |
How it plays out: In November, during GRAP Stage III, operators report three high back-pressure warnings in one week on the 500 kVA set, each clearing within a minute of a start. A shift engineer wants to raise the warning limit but, under the policy, cannot. He raises a standard change request instead. The AMC maintainer checks the logs, finds the warnings coincide with cold starts at light load, and confirms steady-state back-pressure is well within the engine maker’s limit. The agreed fix is to extend the warning delay from 20 to 45 seconds (inside the minor band) rather than raise the limit. The change is logged, and the next quarterly snapshot shows the new delay matching the register. The limit that protects the engine was never touched.
The illustrative effort is modest: about 2 hours a month of shift engineer time for snapshots, 1 hour a quarter for the facility manager’s comparison, and an afternoon twice a year for the EHS review.
Frequently Asked Questions
Can experienced operators be trusted with the service password?
The policy is not about distrusting individuals. Limit changes should pass through someone who weighs engine protection and compliance. An experienced operator is the right person to raise a well-evidenced change request, not to make the change alone.
Our RECD controller has no password at all. What should we do?
Rely on physical and network controls: lock the panel, keep the key with the shift engineer, restrict network access to the BMS server, and take regular snapshots so any change is detected. Raise the point with suppliers for future purchases.
Should the BMS ever write to the RECD controller?
Rarely. A read-only integration covers almost every monitoring need. If a write point is genuinely required, such as a remote alarm reset, document it, limit it to that register and put it under change control.
How often should we change the RECD service password?
After every use by an external party, on a fixed cycle (for example, every 90 days) if several people share it, and immediately when a contractor relationship ends.
Who should approve a change that could cause the DG set to stop?
The facility manager and the DG maintainer, using the engine maker’s published limits where engine protection is involved. The RECD supplier can advise on the device but should not decide engine shutdown logic alone.
Get the Device and the Documentation Right
Good access control starts with clear documentation of what each setting does and its approved value. Aceget supplies CPCB type-approved Retrofit Emission Control Devices for DG sets from 25 kVA to 2500 kVA and can talk you through commissioning and handover records for your site. Review our certifications or contact our team to discuss your project.