Sometimes we need to query for more than one alarm group using the AlmDbViewCtrl ActiveX control in Wonderware InTouch. The AlmDbViewCtrl uses a SQL query to query the Alarm DB Logger's SQL database, and it does not automatically display alarms and events belonging to subgroups of the current alarm group configured in the GroupName parameter.
Under most circumstances, I would not recommend SQL Injection as a programming method for SCADA. To be perfectly clear, SQL injection is a vulnerability hack generally used to maliciously modify or gain unauthorized access to a database or computer. On a secured SCADA system, however, this method will allow us to query the alarms and events database for the information we want to see.
I'd really love to see Wonderware add a method to this ActiveX control to handle multiple alarm groups in a similar fashion across all their Alarm Viewer ActiveX controls, but until that day comes, here's how to inject some SQL tidbits into the ActiveX controls SQL query to display alarms from all the groups we'd like to see.
In the following InTouch script, I'm using the AlarmTreeViewerCtrl control on my alarm history window to display my alarm groups. When I click on an alarm group, I update the AlmDbViewCtrl control to display the active alarm group's alarm history.
This is a simplified version of the actual SQL query the AlmDbViewCtrl is using to get data from the WWALMDB database when the GroupName property is set to "RTUs". Using SQL injection, we can append more Area = " statements just after the word RTUs and before the last single-quote.
We can modify our injected SQL to query for the PS1 alarm group alarms as in addition to RTUs and Tank1 alarms.
By replacing the unique part of each alarm group with the % symbol, the resulting SQL query will return alarms from all areas the begin with "Tank" or "PS".
The biggest drawback to using the SLQ injection method is InTouch's 131-character string limit. The GroupName property string is limited to 131 characters and will be truncated if the property string is longer than 131 characters. However, by strategically naming or prefixing child alarm groups, we can use the SQL injection method to easily query for many combinations of alarm groups.
Check back in a couple weeks for Part 2 where we will dive into modifying the AlarmFavorites file at runtime as another method to display multiple alarm groups in the AlmDbViewCtrl control in InTouch.