SCADA

SCADA is the acronym for Supervisory Control And Data Acquisition. The term is used
differently in North America than in the rest of the world:

• In North America; SCADA refers to a large-scale, distributed measurement and

control system.
• In the rest of the world; SCADA is any system that performs Supervisory Control
And Data Acquisition, independent of its size or geographical distribution.

SCADA systems are typically used to perform data collection and control at the supervisory
level. Some SCADA systems only monitor without doing control, these systems are still
referred to as SCADA systems.

The supervisory control system is a system that is placed on top of a real-time control system
to control a process that is external to the SCADA system (i.e. a computer, by itself, is not a
SCADA system even though it controls its own power consumption and cooling). This
implies that the system is not critical to control the process in real-time, as there is a separate
or integrated real-time automated control system that can respond quickly enough to
compensate for process changes within the time-constants of the process. The process can be
industrial, infrastructure or facility based as described below:

• Industrial processes include: manufacturing/production/power

generation/fabrication/refining - continuous, batch, repetitive or discrete.
• Infrastructure processes may be public or private and include: water treatment and
distribution, wastewater collection and wastewater treatment, oil & gas pipelines,
electrical power transmission and distribution and large communication systems.
• Facility processes in private or public facilities including: buildings, airports, ships or
space stations in order to monitor and control: HVAC, access control, energy
consumption management

The SCADA systems for these applications all perform Supervisory Control And Data
Acquisition, even though the use of the systems are very different.

Systems concepts
A SCADA system includes input/output signal hardware, controllers, HMI, networks,
communication, database and software. It mainly comes in the branch of Instrumentation
Engineering.

The term SCADA usually refers to a central system that monitors and controls a complete
site or a system spread out over a long distance (kilometres/miles). The bulk of the site
control is actually performed automatically by a Remote Terminal Unit (RTU) or by a
Programmable Logic Controller (PLC). Host control functions are almost always restricted to
basic site over-ride or supervisory level capability. For example, a PLC may control the flow
of cooling water through part of an industrial process, but the SCADA system may allow an
operator to change the control set point for the flow, and will allow any alarm conditions
1 of 6 (amp)
such as loss of flow or high temperature to be recorded and displayed. The feedback control
loop is closed through the RTU or PLC; the SCADA system monitors the overall
performance of that loop.

Data acquisition begins at the RTU or PLC level and includes meter readings and equipment
statuses that are communicated to SCADA as required. Data is then compiled and formatted
in such a way that a control room operator using the HMI can make appropriate supervisory
decisions that may be required to adjust or over-ride normal RTU (PLC) controls. Data may
also be collected in to a Historian, often built on a commodity Database Management
System, to allow trending and other analytical work.

SCADA systems typically implement a distributed database, commonly referred to as a tag

database, which contains data elements called tags or points. A point represents a single
input or output value monitored or controlled by the system. Points can be either "hard" or
"soft". A hard point is representative of an actual input or output connected to the system,
while a soft point represents the result of logic and math operations applied to other hard and
soft points. Most implementations conceptually remove this distinction by making every
property a "soft" point (expression) that can equal a single "hard" point in the simplest case.
Point values are normally stored as value-timestamp combinations; the value and the
timestamp when the value was recorded or calculated. A series of value-timestamp
combinations is the history of that point. It's also common to store additional metadata with
tags such as: path to field device and PLC register, design time comments, and even alarming
information.

It is possible to purchase a SCADA system, or Distributed Control System (DCS) from a

single supplier. It is more common to assemble a SCADA system from hardware and
software components like Telvent, Allen-Bradley, ABB, Siemens, DirectLogic or GE PLCs,
2 of 6 (amp)
HMI packages from Adroit, Wonderware, Iconics, Rockwell Automation, Inductive
Automation, Citect, or GE. Communication typically happens over ethernet.

Human Machine Interface

A Human-Machine Interface or HMI is the apparatus which presents process data to a human
operator, and through which the human operator controls the process.

The HMI industry was essentially born out of a need for a standardized way to monitor and
to control multiple remote controllers, PLCs and other control devices. While a PLC does
provide automated, pre-programmed control over a process, they are usually distributed
across a plant, making it difficult to gather data from them manually. Historically PLCs had
no standardized way to present information to an operator. The SCADA system gathers
information from the PLCs and other controllers via some form of network, and combines
and formats the information. An HMI may also be linked to a database, to provide trending,
diagnostic data, and management information such as scheduled maintenance procedures,
logistic information, detailed schematics for a particular sensor or machine, and expert-
system troubleshooting guides. Since about 1998, virtually all major PLC manufacturers
have offered integrated HMI/SCADA systems, many of them using open and non-proprietary
communications protocols. Numerous specialized third-party HMI/SCADA packages,
offering built-in compatibility with most major PLCs, have also entered the market, allowing
mechanical engineers, electrical engineers and technicians to configure HMIs themselves,
without the need for a custom-made program written by a software developer.

SCADA is popular, due to its compatibility and reliability. It is used in small applications,
like controlling the temperature of a room, to large applications, such as the control of
nuclear power plants.

Hardware solutions
SCADA solutions often have Distributed Control System (DCS) components. Use of "smart"
RTUs or PLCs, which are capable of autonomously executing simple logic processes without
involving the master computer, is increasing. A functional block programming language, IEC
61131-3, is frequently used to create programs which run on these RTUs and PLCs. Unlike a
procedural language such as the C programming language or FORTRAN, IEC 61131-3 has
minimal training requirements by virtue of resembling historic physical control arrays. This
allows SCADA system engineers to perform both the design and implementation of a
program to be executed on a RTU or PLC.

System components
The three components of a SCADA system are:

1. Multiple Remote Terminal Units (also known as RTUs or Outstations).

2. Master Station and HMI Computer(s).
3. Communication infrastructure

3 of 6 (amp)
Remote Terminal Unit (RTU)

The RTU connects to physical equipment, and reads status data such as the open/closed
status from a switch or a valve, reads measurements such as pressure, flow, voltage or
current. By sending signals to equipment the RTU can control equipment, such as opening or
closing a switch or a valve, or setting the speed of a pump.

The RTU can read digital status data or analogue measurement data, and send out digital
commands or analogue setpoints.

An important part of most SCADA implementations are alarms. An alarm is a digital status
point that has either the value NORMAL or ALARM. Alarms can be created in such a way
that when their requirements are met, they are activated. An example of an alarm is the "fuel
tank empty" light in a car. The SCADA operator's attention is drawn to the part of the system
requiring attention by the alarm. Emails and text messages are often sent along with an alarm
activation alerting managers along with the SCADA operator.

Master Station

The term "Master Station" refers to the servers and software responsible for communicating
with the field equipment (RTUs, PLCs, etc), and then to the HMI software running on
workstations in the control room, or elsewhere. In smaller SCADA systems, the master
station may be composed of a single PC. In larger SCADA systems, the master station may
include multiple servers, distributed software applications, and disaster recovery sites

The SCADA system usually presents the information to the operating personnel graphically,
in the form of a mimic diagram. This means that the operator can see a schematic
representation of the plant being controlled. For example, a picture of a pump connected to a
pipe can show the operator that the pump is running and how much fluid it is pumping
through the pipe at the moment. The operator can then switch the pump off. The HMI
software will show the flow rate of the fluid in the pipe decrease in real time. Mimic
diagrams may consist of line graphics and schematic symbols to represent process elements,
or may consist of digital photographs of the process equipment overlain with animated
symbols.

The HMI package for the SCADA system typically includes a drawing program that the
operators or system maintenance personnel use to change the way these points are
represented in the interface. These representations can be as simple as an on-screen traffic
light, which represents the state of an actual traffic light in the field, or as complex as a multi-
projector display representing the position of all of the elevators in a skyscraper or all of the
trains on a railway. Initially, more "open" platforms such as Linux were not as widely used
due to the highly dynamic development environment and because a SCADA customer that
was able to afford the field hardware and devices to be controlled could usually also purchase
UNIX or OpenVMS licenses. Today, all major operating systems are used for both master
station servers and HMI workstations.

4 of 6 (amp)
Operational philosophy
Instead of relying on operator intervention, or master station automation, RTUs may now be
required to operate on their own to control tunnel fires or perform other safety-related tasks.
The master station software is required to do more analysis of data before presenting it to
operators including historical analysis and analysis associated with particular industry
requirements. Safety requirements are now being applied to the system as a whole and even
master station software must meet stringent safety standards for some markets.

For some installations, the costs that would result from the control system failing is
extremely high. Possibly even lives could be lost. Hardware for SCADA systems is generally
ruggedized to withstand temperature, vibration, and voltage extremes, but in these
installations reliability is enhanced by having redundant hardware and communications
channels. A failing part can be quickly identified and its functionality automatically taken
over by backup hardware. A failed part can often be replaced without interrupting the
process. The reliability of such systems can be calculated statistically and is stated as the
mean time to failure, which is a variant of mean time between failures. The calculated mean
time to failure of such high reliability systems can be in the centuries.

Communication infrastructure and methods

SCADA systems have traditionally used combinations of radio and direct serial or modem
connections to meet communication requirements, although Ethernet and IP over SONET is
also frequently used at large sites such as railways and power stations.

This has also come under threat with some customers wanting SCADA data to travel over
their pre-established corporate networks or to share the network with other applications. The
legacy of the early low-bandwidth protocols remains, though. SCADA protocols are
designed to be very compact and many are designed to send information to the master station
only when the master station polls the RTU. Typical legacy SCADA protocols include
Modbus, RP-570 and Conitel. These communication protocols are all SCADA-vendor
specific. Standard protocols are IEC 60870-5-101 or 104, Profibus and DNP3. These
communication protocols are standardized and recognized by all major SCADA vendors.
Many of these protocols now contain extensions to operate over TCP/IP, although it is good
security engineering practice to avoid connecting SCADA systems to the Internet so the
attack surface is reduced.

RTUs and other automatic controller devices were being developed before the advent of
industry wide standards for interoperability. The result is that developers and their
management created a multitude of control protocols. Among the larger vendors, there was
also the incentive to create their own protocol to "lock in" their customer base. A list of
automation protocols is being compiled here.

In latest days, the OPC or "OLE for Process Control" has become a wide an accepted
solution for intercomunicating differente hardware and software, allowing communication
even between devices originally not intended to be part of an industrial network.

5 of 6 (amp)
There are also other protocols like Modbus TPC/IP that became widely accepted and are now
the standard for many hardware manufacturers.

Future trends in SCADA

The trend is for PLC and HMI/SCADA software to be more "mix-and-match". In the mid
1990s, the typical DAQ I/O manufacturer offered their own proprietary communications
protocols over a suitable-distance carrier like RS-485. Towards the late 1990s, the shift
towards open communications continued with I/O manufacturers offering support of open
message structures like Modicon MODBUS over RS-485, and by 2000 most I/O makers
offered completely open interfacing such as Modicon MODBUS over TCP/IP. The primary
barriers of Ethernet TCP/IP's entrance into industrial automation (determinism,
synchronization, protocol selection, environment suitability) are still a concern to a few
extremely specialized applications, but for the vast majority of HMI/SCADA markets these
barriers have been broken.

Security issues
Recently, the security of SCADA-based systems has come into question as they are
increasingly seen as extremely vulnerable to cyberwarfare/cyberterrorism attacks on several
fronts.

In particular, security researchers are concerned about:

• the lack of concern about security and authentication in the design, deployment and
operation of existing SCADA networks
• the mistaken belief that SCADA systems have the benefit of security by obscurity
through the use of specialized protocols and proprietary interfaces
• the mistaken belief that SCADA networks are secure because they are supposedly
physically secured
• the mistaken belief that SCADA networks are secure because they are supposedly
disconnected from the Internet

The mission critical nature of a large number of SCADA systems, such attacks could, in a
worst case scenario, cause massive financial losses through loss of data or actual physical
destruction, misuse or theft, even loss of life, either directly or indirectly. Whether such
concerns will cause a move away from the use of existing SCADA systems for mission
critical applications towards more secure architectures and configurations remains to be seen,
given that at least some influential people in corporate and governmental circles believe that
the benefits and lower initial costs of SCADA based systems still outweigh potential costs
and risks. Recently, multiple security vendors, such as Check Point and Innominate have
begun to address these risks by developing lines of specialized industrial firewall and VPN
solutions for TCP/IP-based SCADA networks.

6 of 6 (amp)