Industrial control systems are complicated.
Imagine any industrial process: running electric grids, keeping wastewater facilities safely running, ensuring trains leave and arrive on time. Now, imagine what it takes to power these processes. These are industrial control systems (ICS) and they are responsible for making sure all the systems do what they’re meant to be doing.
One type of industrial control system is the SCADA system. (Sometimes, the terms ICS and SCADA are used interchangeably, though technically that’s incorrect.) SCADA systems help organizations to better control, monitor, and analyze their industrial devices and industrial processes.
Let’s take a look at how SCADA systems work.
Supervisory Control and Data Acquisition (SCADA) is one type of industrial control system. It is considered a “supervisory-level” control system because it refers to a high-level layer of control and management process commonly used in industrial process applications, especially those that power critical infrastructure for countries around the world.
Basically, you can use SCADA to help with a variety of activities necessary in end-to-end industrial processes:
The goal of SCADA systems is to simplify the control and automation of large-scale and complex industrial processes.
(Related reading: security for industrial control systems.)
SCADA systems have evolved over time, through four generations:
Early versions monitored and automated monolithic systems, then eventually moved to more complex distributed network systems. Overtime, SCADA systems were incorporated in both local- and wide-area networking (LAN and WAN). The current generation of most industrial processes rely on IoT connected edge-computing systems.
Though the models have changed, the basic principles and functionality of the SCADA operating networks remain largely the same. SCADA works as a standardized mechanism to control industrial processes, particularly in industries such as:
In a SCADA system, individual control modules communicate with each other and the backend control systems over a distributed network environment. At the highest level, there are two primary functions:
This is different from a real-time direct control system that may operate autonomously.
SCADA systems — the one’s we’re discussing here in this article — have evolved over time. As the wise Wikipedia community describes:
The SCADA concept was developed to be a universal means of remote-access to a variety of local control modules, which could be from different manufacturers and allow access through standard automation protocols. In practice, large SCADA systems have grown to become similar to distributed control systems in function, while using multiple means of interfacing with the plant. They can control large-scale processes that can span multiple sites, and work over large distances.
Despite its name, SCADA International did not invent SCADA systems. Based in Denmark, SCADA International is an industrial software and hardware provider.
As you may imagine, SCADA systems are critical in many areas and industries.
We would be nowhere without water. And, arguably, we would be in a much worse state without SCADA systems to:
SCADA systems monitor power plants, substations and the transmission lines that move energy and power, collecting data and automating controls to prevent blackouts and overloads. As smart grids become more common, SCADA integrates with IoT sensors for real-time power distribution and load balancing optimization.
As more renewable energy sources are developed, SCADA can support solar farms, wind turbines, and hydroelectric plants to maximize uptime and efficiency.
(Related reading: IoT monitoring and sustainable technology.)
Of course, our lives rely on a variety of services in the physical world. Here’s a few more places where SCADA systems play a quiet but critical role:
So, how do SCADA systems do it?
Though SCADA systems are complex, we can break down the common components of a SCADA system:
The Human machine interface (HMI) and the supervisory system together make up the client end of the SCADA system.
This client end compiles and presents monitoring and control information to a human supervisor. With this information, the supervisor can:
The HMI software may operate on local on-site servers or private cloud environments that also host large databases collecting and storing alert information in real-time. The supervisory functionality is integrated with the HMI.
Once the data is collected from field devices, the logs are processed and stored in the storage database. Then, it’s the supervisory (human) level that executes and automated control policies and rules. Like any interface, the HMI displays the real-time monitoring information and high-level control commands sent to the controllers and actuators in the network.
Think of Remote Terminal Units, RTUs, as intermediaries. RTUs are the control systems that interface the distributed sensors in the field to a backend SCADA monitoring and supervisory system. RTUs serve as intermediaries between field sensors/actuators and the central SCADA system.
The general purpose of the RTU is to acquire and communicate data remotely over various networks. It works by:
Limited preprocessing and control logic may include:
Programmable logic controllers are among the most essential components of the SCADA systems. That’s because the PLCs execute the logic controls and automation tasks.
PLCs include dedicated low-powered computing systems and communication modules for data transmission. Though the computational capacity is limited, PLCs are optimized to efficiently execute pre-defined control algorithms — that’s their main purpose: to establish local process control with advanced logic programming.
PLCs also processes and transmits monitoring information to the HMI.
The devices that act upon the control logic and generate information are called sensors and actuators. These actions these devices take may include:
Sensors measure the physical phenomena — what’s happening — and transmit data about that. Actuators perform control actions.
Sensors and actuators typically include a transducer — this converts measurements into an analog signal by detecting the physical phenomenon. An analog measurement may also be converted into discrete digital logs. The signal may be conditioned, filtered, and preprocessed before transmitting it via RTU.
When executing a control action, sensors and actuators interact with PLCs, converting the electrical signal into mechanical actions (such as switching).
The primary role of the network in a SCADA system is threefold:
This is achieved in three layers of communication networks.
The Field Layer handles data communications between sensors, actuators, PLCs and RTUs. The network may be wired or wireless, using common protocols such as Modbus and Profibus.
At the Supervisory Layer, the control network connects the RTUs and PLCs with the backend control systems using terminals such as PROFINET or Ethernet/IP. Fast and secure connectivity is typically achieved using fiber optic cables.
Long distance communication takes place over the Wide Area Network (WAN) using cellular (4G/5G) and satellite communication networks. This is typically used for external enterprise applications using TCP/IP protocols.
SCADA projects are typically high CapEx investments that tend to suffer from vertical scalability challenges such as:
For example, the programmability of PLCs is limited in flexibility — that’s because of the prevalent use of proprietary languages based on Ladder Logic or Functional Block Diagrams.
However, considering the standardization and maturity of SCADA technologies, scaling these systems horizontally — such as increasing the number of sensor endpoints — is limited only by cost.
Of course, another challenge has to do with outsiders: cyberattacks on these systems that can cause real, serious harm: both to the immediate physical environment and to the many people who rely on these systems for services.
SCADA systems are increasingly targeted by cyber threats due to their critical role in infrastructure. Tools like Splunk help mitigate these risks.
As the world grows increasingly aware of what digital attacks can do, we can’t forget that digital events can have serious consequences in the real world.
Monitoring must be built-in to these industrial systems to ensure their success and reliability. Splunk provides the engine that helps in monitoring, searching, analyzing, and visualizing large amounts of energy and utility data at scale. Learn more about Operational Technology (OT) Security Add-on for Splunk.
See an error or have a suggestion? Please let us know by emailing ssg-blogs@splunk.com.
This posting does not necessarily represent Splunk's position, strategies or opinion.
The Splunk platform removes the barriers between data and action, empowering observability, IT and security teams to ensure their organizations are secure, resilient and innovative.
Founded in 2003, Splunk is a global company — with over 7,500 employees, Splunkers have received over 1,020 patents to date and availability in 21 regions around the world — and offers an open, extensible data platform that supports shared data across any environment so that all teams in an organization can get end-to-end visibility, with context, for every interaction and business process. Build a strong data foundation with Splunk.