Unfortunately, the potential threats to building occupants are varied and increasing. To adapt properly, let’s look at the culture change needed in the design process. Commissioning, recommissioning, and preventive maintenance are further pieces of a strategy to assure ongoing safety.                            

Not a daily newscast ends without at least one story about a tragedy inside a building, adjacent to a building, or the potential threat made toward a building or its occupants. Like it or not, this is the environment the world is in, and so the building industry needs to wake up and recognize security must be an integral part of any building program. Indeed it is part of every design professional’s oath to protect the health, safety, and welfare of the public. So it should be considered “good engineering practice” to document the security basis of design (BofD) into the overall building program basis of design.

With the advancement of BAS and remote access to these BAS via the internet it is now possible to breach a building or company’s computer system by gaining access to its HVAC BAS. Other outside issues of concern can be a toxic rail car spill and its vapors drawn into a building via the HVAC air systems to mention one scenario. Inside the building there can be a premeditated HVAC security infraction or one of many potential accidents that compromise the HVAC system, the building’s occupants, and the building itself.

For this article we are going to focus on HVAC security by quoting the first sentence in the 2015 ASHRAE Handbook chapter 59, HVAC Security:

This chapter is intended to be an overview of HVAC security considerations relative to natural events, accidents, terrorism, and national threats, as well as addressing chemical, biological, radiological, and explosive (CBRE) incidents that do not cause major structural damage to the building or its infrastructure.

Since the beginning of HVAC in laboratories and industrial facilities there has always been the threat of an accidental CBRE incident, but seldom has there been documentation written into the projects’ basis-of-design to solidify the action-reaction solutions to such incidents. Today, CBRE may not be accidental and certainly natural events and CBRE incidents outside the building, e.g., hurricane Katrina, have now raised awareness to the importance of a HVAC security design, location of primary mechanical and electrical equipment, construction, operation, and maintenance of a building.

HVAC security and remote access now has to be scrutinized. In addition, a stringent yet flexible HVAC security commissioning and recommissioning process are needed based on the level of security design provided and the sustainability for the security measures to reliably work when needed year after year.

The beginning of addressing these issues and concerns noted above must start with the concept of a building program, documented in the owner’s project requirements, enhanced documentation in the writing of the basis-of-design, commissioned, and then continuously commissioned and maintained to assure occupant environmental health and safety.

A Culture Change for Owner’s Project Requirements and Basis-of-Design

Once a decision is made to fund a building program, the Owner’s Project Requirements (OPR) begins to take shape. In the past, it is safe to say HVAC security was not an integral part of the OPR documentation. Sure, if it was a government sensitive project the government would come along during the design phase to inject their security needs and/or after the design is completed to confidentially interject their needed provisions. Who knows if these security agencies provide continuous commissioning or routine maintenance due to the secrecy of the installation? Documentation could become the Achilles Heel of the HVAC security performance when required to function. The double-edge sword to HVAC security is to be assured that the process is reliable and continuously working, but yet not the weak link in this process.

It is our opinion that once the core issues of the OPR are defined then it is time for the design team to come to the table and draft an HVAC security basis-of-design. Ideally, the addition of a proactive construction management (CM) firm and/or an integrated project delivery (IPD) team would certainly bring added experience to the writing of the BofD. We do not believe the antiquated design-bid-build project delivery method will work and assure a successful HVAC security installation and sustainable performance. Figure 1, “coming to the table,” shows the core group of authors of the OPR and the BofD along with other resources to be considered.

In preparing the OPR there should be a risk management assessment (Figure 2) to evaluate the potential risks to the occupants. Tough decisions may need to be made based on project constraints so that some risks will not be considered while other risks will be assessed. This team effort will define the risks that will be considered and other risks that will be added to the “Do Not Address” category.

Once the OPR and risk assessment are completed then the HVAC design engineer or someone else, e.g., security consultant, will be assigned the lead in developing the BofD. This document may be as brief as stating, “security provisions, training, operation, and maintenance shall be performed by a government agency or third-party firm” and keep this portion of the OPR kept confidential. But if not that, then it is up to the design team and more specifically the HVAC design engineer to draft the basis-of-design with input from the owner’s representative(s) and others on the team. For more on developing the OPR as well as BofD, read 2015 ASHRAE HVAC Application Handbook chapter 59, HVAC Security.

The basis-of-design document is one of the fundamental steps in the building commissioning process and is an ideal location to place the HVAC security document. It inherently lends itself to the eventual commissioning of the security system functional performance tests. The HVAC engineer must document the security design criteria and it is recommended to also document those risk management concerns that were chosen to not be part of the design criteria.

Entering into the conceptual/schematic phase of the design, the HVAC engineer will incorporate the agreed upon security features into the sequence of operation. The sequence may be as simple as shutting the central air system off and setting off an alarm. Whatever the security sequence will become, the owner’s O&M staff should be introduced to preliminary O&M training in the design phase. When the owner takes possession of the building it is imperative that all the work that went into preparing the HVAC security design documents be well understood by those who will operate and maintain the system(s) on a day-to-day basis. The upfront Division 1 portion of the contract document specifications should outline the required training, O&M manuals, and emergency action plan including the first responder’s role and post remediation plans. During the construction phase the training using the O&M manuals and emergency plans are to be fine-tuned by the commissioning engineer and the owner’s management group.

Commissioning, Recommissioning & Preventive Maintenance — Assuring Safety

For an HVAC security system to successfully function, and continuously be operational over the life of the system and its associated emergency plans this system should be commissioned. Based on how sophisticated this system and plans are, the commissioning engineer may require the team’s security consultant to play an important role in the commissioning functional performance test (FPT). Working with the O&M staff, the commissioning will include any emergency plan demonstration in sync with the HVAC system demonstration.

When completed the FPT documents must be updated based on any field changes that improved the commissioning process. This revised document will become the re-commissioning document used by the O&M staff at agreed upon future times to assure the security system and the emergency plans continue to function as designed.

Integral with re-commissioning is the need to have a detailed preventive maintenance work order system in place. Ideally, it would be better if the security system was a predictive, real-time maintenance plan to assure system reliability, but at a minimum a planned maintenance system must be in place.

It is important to mention that certain portions of the contract documents, commissioning, preventive/predictive maintenance, and emergency plans may be confidential from the project’s initial OPR phase of the job. If so, this does not eliminate the need to commission, maintain, and re-commission and/or continuously commission the HVAC security system.

Summary

Natural events, accidents, terrorism, and national threats, as well as chemical, biological, radiological, and explosive incidents are a daily occurrence somewhere in the world. The internet can be one of the best building management tools and it can also be the weak link in the building’s security. Building owners must be prepared by having a well thought out and well documented security system, emergency plan, and remediation plan based on an approved risk management document.

No matter what the project application may be (K-12 school, office building, mission critical facility, etc.), HVAC security must be discussed beginning at the OPR phase of the project. Following a risk management study the level of security will be determined and the job can move forward into the basis-of-design phase of the work. It is at this point that the HVAC engineer and other resources must provide a detailed overview of the security goals.

Who takes the lead as the security facilitator will be determined at the OPR phase when a preliminary roundtable discussion will define the level of effort the building owner is prepared to choose based on discussions with the design team and other contributors to the talks.

The2015 ASHRAE Handbook chapter 59 (HVAC Security) provides a preliminary guide to determine the project’s acceptable vulnerability plan. Based on the intensity of the need for security, public health, safety, and welfare, further work will be required and specialists in security will take the lead to shape an HVAC security design. Organizations such as the U.S. Department of Defense have guidelines that are considered highly confidential and are only shared with others on an as-needed basis. This more intense design will most likely be confidential through all phases of the project including the owner’s occupancy and day-to-day building management.

Whether confidential or not, the success of the HVAC security system will rely solely on the system(s) being commissioned, the O&M personnel being well trained, O&M emergency plan and remediation plan documents, and drills practiced, preventive/predictive maintenance work order system in use, and recommissioning completed on a regular basis or continuous commissioning in place.

To read more about security, visit www.securitymagazine.com website for BNP Media’s security solution publication. ES