1

VISVESVARAYA TECHNOLOGICAL UNIVERSITY

BELGAUM - 590018

A SEMINAR REPORT

ON

SUPERVISORY CONTROL AND DATA ACQUISITION

NISHANT KUMAR

8th Semester

USN: 4BD11EC066

Department Of E&C Engineering,

BIET, Davangere

Under the guidance of:

PROJECT GUIDE

Mr. D. S. BABU

2

Table of Contents

CONTENTS Page no.

1. Abstract.. 3

2. Introduction.... 4

3. Overview of SCADA system. 5

4. SCADA system concepts... 7

5. Functions of SCADA system. 9

6. Elements of SCADA system.. 12

7. Evolution of SCADA system.. 16

8. SCADA communication protocols.. 20

9. Deploying SCADA systems: Communication media. 21

10. Security concerns of SCADA systems 24

11. Advantages and disadvantages 25

12. Conclusion... 26

13. References 27

3

ABSTRACT

SCADA is an acronym for Supervisory Control and Data Acquisition, which is

a computer system for gathering and analysing real-time data. Such systems

were first used in the 1960s.

The SCADA industry was essentially born out of a need for a user-friendly

front-end to a control system containing PLCs (programmable logic

controllers). SCADA networks allow remote monitoring and control of an

amazing variety of industrial devices, such as water and gas pumps, track

switches, and traffic signals.

One of the key processes of SCADA is the ability to monitor an entire system in

real time. This is facilitated by data acquisitions. These include meter reading

and checking statuses of sensors. These data points are communicated at

standard intervals depending on the system. Besides the data being used by the

RTU, it is also displayed to a human. The human is able to interface with the

system to override settings or make changes when needed.

SCADA can also be seen as a system with many data elements called points.

Each point is a monitor or sensor and these points can be either hard or soft. A

hard data point can be an actual monitor; a soft point can be viewed upon as an

application or software calculation. Data elements from hard and soft points are

usually always stored and logged to create a time stamp or history.

In essence, a SCADA application has two elements. They are:

1. The process/system/machinery you want to monitor and control. This can take the form of a power plant, a water system, a network, or a system of

traffic lights.

2. A network of intelligent devices that interfaces with the first system through sensors and control outputs. This network, which is the SCADA

system, gives you the capability to measure and control specific elements

of the first system.

Throughout this report, we will be looking into the various aspect of

implementing a SCADA system and also discussing other concepts related to

the application of this system.

http://www.dpstele.com/scada/system.php

4

INTRODUCTION

SCADA (supervisory control and data acquisition) is a system operating

with coded signals over communication channels so as to provide control of

remote equipment (using typically one communication channel per remote

station). The control system may be combined with a data acquisition system by

adding the use of coded signals over communication channels to acquire

information about the status of the remote equipment for display or for

recording functions. It is a type of industrial control system (ICS). Industrial

control systems are computer-based systems that monitor and control industrial

processes that exist in the physical world. SCADA systems historically

distinguish themselves from other ICS systems by being large-scale processes

that can include multiple sites, and large distances. These processes include

industrial, infrastructure, and facility-based processes, as described below:

Industrial processes include those of manufacturing, production, power

generation, fabrication, and refining, and may run in continuous, batch,

repetitive, or discrete modes.

Infrastructure processes may be public or private, and include water

treatment and distribution, wastewater collection and treatment, oil and

gas pipelines, electrical power transmission and distribution, wind farms,

civil defence siren systems, and large communication systems.

Facility processes occur both in public facilities and private ones,

including buildings, airports, ships, and space stations. They monitor and

control heating, ventilation, and air conditioning systems (HVAC),

access, and energy consumption.

http://en.wikipedia.org/wiki/Industrial_control_systemhttp://en.wikipedia.org/wiki/Computerhttp://en.wikipedia.org/wiki/Industrial_processhttp://en.wikipedia.org/wiki/Power_generationhttp://en.wikipedia.org/wiki/Power_generationhttp://en.wikipedia.org/wiki/Fabrication_%28metal%29http://en.wikipedia.org/wiki/Infrastructurehttp://en.wikipedia.org/wiki/Water_treatmenthttp://en.wikipedia.org/wiki/Water_treatmenthttp://en.wikipedia.org/wiki/Waste_water_treatmenthttp://en.wikipedia.org/wiki/Pipeline_transport#For_oil_or_natural_gashttp://en.wikipedia.org/wiki/Pipeline_transport#For_oil_or_natural_gashttp://en.wikipedia.org/wiki/Electrical_power_transmissionhttp://en.wikipedia.org/wiki/Electric_power_distributionhttp://en.wikipedia.org/wiki/Wind_farmhttp://en.wikipedia.org/wiki/Civil_defense_sirenhttp://en.wikipedia.org/wiki/Airporthttp://en.wikipedia.org/wiki/Ship#Todayhttp://en.wikipedia.org/wiki/Space_stationhttp://en.wikipedia.org/wiki/Heating,_ventilation,_and_air_conditioninghttp://en.wikipedia.org/wiki/Access_controlhttp://en.wikipedia.org/wiki/Efficient_energy_use

5

Overview of SCADA systems

A typical SCADA system can be shown as in the figure below:

Fig1: A typical SCADA system

A SCADA system usually consists of the following subsystems:

Remote terminal units (RTUs) connect to sensors in the process

and convert sensor signals to digital data. They have telemetry

hardware capable of sending digital data to the supervisory system,

as well as receiving digital commands from the supervisory

system. RTUs often have embedded control capabilities such as

ladder logic in order to accomplish Boolean logic operations.

Programmable logic controller (PLCs) connect to sensors in the

process and converting sensor signals to digital data. PLCs have

more sophisticated embedded control capabilities, typically one or

more IEC 61131-3 programming languages, than RTUs. PLCs do

not have telemetry hardware, although this functionality is

typically installed alongside them. PLCs are sometimes used in

place of RTUs as field devices because they are more economical,

versatile, flexible, and configurable.

http://en.wikipedia.org/wiki/Remote_Terminal_Unithttp://en.wikipedia.org/wiki/Data_acquisitionhttp://en.wikipedia.org/wiki/Ladder_logichttp://en.wikipedia.org/wiki/Boolean_expressionhttp://en.wikipedia.org/wiki/Programmable_logic_controllerhttp://en.wikipedia.org/wiki/Data_acquisitionhttp://en.wikipedia.org/wiki/IEC_61131-3

6

A telemetry system is typically used to connect PLCs and RTUs

with control centres, data warehouses, and the enterprise. Examples

of wired telemetry media used in SCADA systems include leased

telephone lines and WAN circuits. Examples of wireless telemetry

media used in SCADA systems include satellite (VSAT), licensed

and unlicensed radio, cellular and microwave.

A data acquisition server is a software service which uses industrial

protocols to connect software services, via telemetry, with field

devices such as RTUs and PLCs. It allows clients to access data

from these field devices using standard protocols.

A humanmachine interface or HMI is the apparatus or device

which presents processed data to a human operator, and through

this, the human operator monitors and interacts with the process.

The HMI is a client that requests data from a data acquisition

server.

A Historian is a software service which accumulates time-stamped

data, Boolean events, and Boolean alarms in a database which can

be queried or used to populate graphic trends in the HMI. The

historian is a client that requests data from a data acquisition

server.

A supervisory (computer) system, gathering (acquiring) data on the

process and sending commands (control) to the SCADA system.

Communication infrastructure connecting the supervisory system to the remote terminal units.

Various process and analytical instrumentation.

http://en.wikipedia.org/wiki/Telemetryhttp://en.wikipedia.org/wiki/User_interfacehttp://en.wikipedia.org/wiki/Boolean_value

7

SCADA system concepts

The term SCADA (Supervisory Control and Data Acquisition) usually refers to

centralized systems which monitor and control entire sites, or complexes of

systems spread out over large areas (anything from an industrial plant to a

nation). Most control actions are performed automatically by RTUs or by PLCs.

Host control functions are usually restricted to basic overriding or supervisory

level intervention. For example, a PLC may control the flow of cooling water

through part of an industrial process, but the SCADA system may allow

operators to change the set points for the flow, and enable alarm conditions,

such as loss of flow and high temperature, to be displayed and recorded. The

feedback control loop passes through the RTU or PLC, while the SCADA

system monitors the overall performance of the loop.

Fig2: A SCADAs schematic overview

Data acquisition begins at the RTU or PLC level and includes meter readings

and equipment status reports that are communicated to SCADA as required.

Data is then compiled and formatted in such a way that a control room operator

using the HMI can make supervisory decisions to adjust or override normal

RTU (PLC) controls. Data may also be fed to a Historian, often built on a

commodity Database Management System, to allow trending and other

analytical auditing.

http://en.wikipedia.org/wiki/Data_acquisitionhttp://en.wikipedia.org/wiki/Operational_historianhttp://en.wikipedia.org/wiki/Database_Management_System

8

SCADA systems typically implement a distributed database, commonly referred

to as a tag database, which contains data elements called tags or points. A point

represents a single input or output value monitored or controlled by the system.

Points can be either "hard" or "soft". A hard point represents an actual input or

output within the system, while a soft point results from logic and math

operations applied to other points. (Most implementations conceptually remove

the distinction by making every property a "soft" point expression, which may,

in the simplest case, equal a single hard point.) Points are normally stored as

value-timestamp pairs: a value, and the timestamp when it was recorded or

calculated. A series of value-timestamp pairs gives the history of that point. It is

also common to store additional metadata with tags, such as the path to a field

device or PLC register, design time comments, and alarm information.

http://en.wikipedia.org/wiki/Distributed_databasehttp://en.wikipedia.org/wiki/Timestamp

9

Functions of a SCADA System

1. A SCADA system performs four functions:

1.1 Data Acquisition:

SCADA system needs to monitor hundreds or thousands of sensors.

Sensors measure:

1. Inputs and outputs e.g. water flowing into a reservoir (input), valve

pressure as water is released from the reservoir (output).

2. Discrete inputs (or digital input) e.g. whether equipment is on or off, or

tripwire alarms, like a power failure at a critical facility.

3. Analog inputs where exact measurement is important e.g. to detect

continuous changes in a voltage or current input, to track fluid levels in

tanks, voltage levels in batteries, temperature and other factors that can be

measured in a continuous range of input.

For most analogue factors, there is a normal range defined by a bottom

and top level e.g. temperature in a server room between 15 and 25

degrees Centigrade. If the temperature goes outside this range, it will

trigger a threshold alarm.

In more advanced systems, there are four threshold alarms for analogue

sensors, defining Major Under, Minor Under, Minor Over and Major

Over alarms.

1.2 Networked Data Communication: A communications network is required to monitor multiple systems from a

central location.

TREND: Put SCADA data on Ethernet and IP over SONET. SECURITY: Keeping data on closed LAN/WANs without exposing

sensitive data to the open Internet.

Encode data in protocol format (use open, standard protocols and protocol mediation)

Sensors and control relays cant generate or interpret protocol communication - a remote telemetry unit (RTU) is needed to provide an

interface between the sensors and the SCADA network.

10

RTU encodes sensor inputs into protocol format and forwards them to the SCADA master.

RTU receives control commands in protocol format from the master and transmits electrical signals to the appropriate control relays.

1.3 Data Presentation SCADA systems report to human operators over a master station, HMI

(Human-Machine Interface) or HCI (Human-Computer Interface).

SCADA master station has several different functions:

Continuously monitors all sensors and alerts the operator when there is an alarm.

Presents a comprehensive view of the entire managed system. Presents more detail in response to user requests. Performs data processing on information gathered from sensors. Maintains report logs and summarizes historical trends.

1.4 Control

The control mechanism in a SCADA system is handled by a number of

equipments such as the Remote Terminal Units (RTU), Programmable Logic

Controllers (PLC), switchgears, etc. which work autonomously by means of a

dedicated communication network such as LAN or WAN that carries signals to-

and-from these devices. The LAN and WAN form the backbone of the control

system. The SCADA master station computer system plays an important role in

this context. It channelizes the signals between the administrator and the various

field components in real-time and displays the inputs and outputs generated

through a human-machine interface (HMI).

An important part of most SCADA control implementations is alarm handling.

The system monitors whether certain alarm conditions are satisfied, to

determine when an alarm event has occurred. Once an alarm event has been

detected, one or more actions are taken (such as the activation of one or more

alarm indicators, and perhaps the generation of email or text messages so that

management or remote SCADA operators are informed). In many cases, a

SCADA operator may have to acknowledge the alarm event; this may

deactivate some alarm indicators, whereas other indicators remain active until

the alarm conditions are cleared. Alarm conditions can be explicitfor

example, an alarm point is a digital status point that has either the value

http://en.wikipedia.org/wiki/Alarm_management

11

NORMAL or ALARM that is calculated by a formula based on the values in

other analogue and digital pointsor implicit: the SCADA system might

automatically monitor whether the value in an analogue point lies outside high

and low- limit values associated with that point. Examples of alarm indicators

include a siren, a pop-up box on a screen, or a coloured or flashing area on a

screen (that might act in a similar way to the "fuel tank empty" light in a car); in

each case, the role of the alarm indicator is to draw the operator's attention to

the part of the system 'in alarm' so that appropriate action can be taken.

12

Elements of SCADA system

1. SCADA Master Station Computer Systems:

Fig3: SCADA master station computer system

It is the repository of the real-time or near real-time reported data collected

from the remote terminal units connected to it. The back end SCADA

software must be able to repeatedly poll the RTUs for data values, should

have software for their retrieval, storage and processing. The processing may

include unit conversion, cataloguing into tables etc.

2. Human-Machine Interface:

Fig4: A typical human-machine interface

13

This is the part on the host station. The values that have been stored in the

host computers are presented to the human operator in an understandable and

comprehensible form using HMIs.

These may provide trending, diagnostic or management information and

detailed schematics and animations representing the current states of the

machines under its control. Pictorial representation being more

understandable to humans is the preferred form in SCADA HMIs.

3. Remote Terminal Units (RTUs):

Fig5: A remote terminal unit

An RTU is a normally a transducer or a sensor which allows the electrical

circuitry to interface with the process instrumentation and control

equipment. The physical parameter like pressure, temperature etc. are

measured through a change in electrical property of some component in

the transducer which is indicative of the physical change.

A single RTU may measure many different types of parameters.

Depending on the values of the measurements, the input/output circuitry

of a RTU can be Analog or digital.

Analog corresponds to measurements with a numeric range of continuous

values which are later converted using an ADC, like a temperature scale,

while digital have limited number of states (generally two) mainly used

for flagging. Specific signals can be generated to control process

14

equipment. These days, RTUs are microprocessor based devices and

these conversions are primarily internal to them.

4. Programmable Logic Controllers:

Fig6: Programmable logic controller

The use of microprocessors on RTUs has helped RTUs become smarter

with increased functionality. PLCs have been built around the philosophy

of automation.

Re-programmability being the biggest asset, PLC based RTUs can be

debugged and fixed on the field itself along with adding new features like

support for multiple polling, exception reporting, time-tagging etc.

This also enables them to execute simple logical processes without

involving the master station.

Standardization of protocols and languages for RTUs too, for example the

standardized control programming language, IEC 61131-3.These

languages require very less training and are based on intuitive approach

unlike procedural languages like C and FORTRAN.

15

5. SCADA Communication

Fig7: SCADA communication system

The conveying of data from an RTU to the master station and commands

from the host to the RTU need to be done over a communication system

since a SCADA system might not be localized to just a single plant.

The vastness of the network also has to be catered to along with speed,

accuracy, security and performance being among other important issues.

SCADA systems have also embraced LANs and WANs for seamless

integration with everyday office computer networks. This has an

advantage for the corporate users that they would not need a separate

parallel network for SCADA systems.

16

Evolution of SCADA systems

The SCADA system evolution can be classified into 4 generations.

First generation : Monolithic SCADA

Fig8: Monolithic SCADA system

Early SCADA system computing was done by large minicomputers.

Common network services did not exist at the time SCADA was

developed. Thus SCADA systems were independent systems with no

connectivity to other systems. The communication protocols used were

strictly proprietary at that time. The first-generation SCADA system

redundancy was achieved using a back-up mainframe system connected

to all the Remote Terminal Unit sites and was used in the event of failure

of the primary mainframe system.

http://en.wikipedia.org/wiki/Minicomputershttp://en.wikipedia.org/wiki/Remote_Terminal_Unit

17

Second generation : Distributed SCADA

Fig9: Distributed SCADA system

SCADA information and command processing was distributed across multiple

stations which were connected through a LAN. Information was shared in near

real time. Each station was responsible for a particular task thus making the size

and cost of each station less than the one used in First Generation. The network

protocols used were still not standardized. Since the protocols were proprietary,

very few people beyond the developers knew enough to determine how secure a

SCADA installation was. Security of the SCADA installation was usually

overlooked.

18

Third generation : Networked SCADA

Fig10: Networked SCADA system

Similar to a distributed architecture, any complex SCADA can be reduced to

simplest components and connected through communication protocols. In the

case of a networked design, the system may be spread across more than one

LAN network called a process control network (PCN) and separated

geographically. Several distributed architecture SCADAs running in parallel,

with a single supervisor and historian, could be considered a network

architecture. This allows for a more cost effective solution in very large scale

systems.

http://en.wikipedia.org/wiki/Process_control_network

19

Fourth generation : Cloud-based SCADA

Fig11: Cloud-based SCADA system

With the commercial availability of cloud computing, SCADA systems have

increasingly adopted Internet of Things technology to significantly reduce

infrastructure costs and increase ease of maintenance and integration. As a

result SCADA systems can now report state in near real-time and use the

horizontal scale available in cloud environments to implement more complex

control algorithms than are practically feasible to implement on traditional

programmable logic controllers. Further, the use of open network protocols

such as TLS inherent in the Internet of Things technology, provides a more

readily comprehensible and manageable security boundary than the

heterogeneous mix of proprietary network protocols typical of many

decentralized SCADA implementations. One such example of this

technology is an innovative approach to rainwater harvesting through the

implementation of real time controls (RTC).

http://en.wikipedia.org/wiki/Cloud_computinghttp://en.wikipedia.org/wiki/Internet_of_Thingshttp://en.wikipedia.org/wiki/Programmable_logic_controllerhttp://en.wikipedia.org/wiki/Transport_Layer_Securityhttp://en.wikipedia.org/wiki/Rainwater_harvesting

20

SCADA Communication Protocols

The communication protocols used in SCADA systems operate at different

layers as shown in the figure:

Typical features of the SCADA networking protocols are:

SCADA protocols are designed to be very compact. Many are designed to send information only when the master station polls the RTU.

Typical legacy SCADA protocols include Modbus RTU, RP-570, Profibus and Conitel. These communication protocols are all SCADA-

vendor specific but are widely adopted and used. Standard protocols are

IEC 60870-5-101 or 104, IEC 61850 and DNP3.

These communication protocols are standardized and recognized by all major SCADA vendors. Many of these protocols now contain extensions

to operate over TCP/IP.

21

Deploying SCADA systems: Communication media

The various communication media used in SCADA systems are:

1. Twisted-Pair Metallic Cable:

Fig12: Twisted-pair cable

2. Coaxial Metallic Cable:

Fig13: Coaxial cable

22

3. Fiber Optic Cable:

Fig14: Fiber-optic cable

4. Power Line Carrier:

Fig15: Power cable

23

5. Satellites

Fig16: Satellite Link

6. Leased Telephone Lines

Fig17: Leased telephone line

7. Very High Frequency Radio

8. Ultra High Frequency Radio

24

Security Concerns of SCADA system

SCADA systems that tie together decentralized facilities such as power,

oil, and gas pipelines and water distribution and wastewater collection

systems were designed to be open, robust, and easily operated and

repaired, but not necessarily secure. The security of these SCADA

systems is important because compromise or destruction of these systems

would impact multiple areas of society far removed from the original

compromise. For example, a blackout caused by a compromised electrical

SCADA system would cause financial losses to all the customers that

received electricity from that source.

The move from proprietary technologies to more standardized and open

solutions together with the increased number of connections between

SCADA systems, office networks, and the Internet has made them more

vulnerable to types of network attacks that are relatively common in

computer security.

For example, United States Computer Emergency Readiness Team (US-CERT) released a vulnerability advisory that allowed

unauthenticated users to download sensitive configuration

information including password hashes on an Inductive

Automation Ignition system utilizing a standard attack type

leveraging access to the Tomcat Embedded Web server.

In June 2010, anti-virus security company VirusBlokAda reported the first detection of malware that attacks SCADA systems

(Siemens' WinCC/PCS 7 systems) running on Windows

operating systems. The malware is called Stuxnet and uses four

zero-day attacks to install a rootkit which in turn logs into the

SCADA's database and steals design and control files. The

malware is also capable of changing the control system and hiding

those changes. The malware was found on 14 systems, the majority

of which were located in Iran.

In October 2013 National Geographic released a docudrama titled, "American Blackout" which dealt with a large-scale cyber-attack

on SCADA and the United States' electrical grid.

http://en.wikipedia.org/wiki/Internethttp://en.wikipedia.org/wiki/Attack_%28computing%29#Types_of_attackshttp://en.wikipedia.org/wiki/Computer_securityhttp://en.wikipedia.org/wiki/ICS-CERThttp://en.wikipedia.org/wiki/ICS-CERThttp://en.wikipedia.org/wiki/Cryptographic_hash_function#File_or_data_identifierhttp://en.wikipedia.org/wiki/Inductive_automationhttp://en.wikipedia.org/wiki/Inductive_automationhttp://en.wikipedia.org/wiki/Ignition_SCADAhttp://en.wikipedia.org/wiki/Semantic_URL_attackhttp://en.wikipedia.org/wiki/Apache_Tomcathttp://en.wikipedia.org/wiki/Embedded_Web_serverhttp://en.wikipedia.org/wiki/VirusBlokAdahttp://en.wikipedia.org/wiki/WinCChttp://en.wikipedia.org/wiki/Stuxnethttp://en.wikipedia.org/wiki/Zero-day_attackhttp://en.wikipedia.org/wiki/Rootkit

25

Advantages & Disadvantages of SCADA systems

Advantages

Increased efficiency

Maximized safety

Maximized profitability

Disadvantages

Vulnerable to cyber threats such as hacking and cyber-

terrorism.

Vulnerable to EMP (electro-magnetic pulse)

26

CONCLUSION

SCADA is a step towards automation of the modern day industries

irrespective of its domain, whereby the need for human supervision

and interference will be minimum. Moreover, the vital key factors

such as safety, profitability and efficiency can be enhanced, thereby

reducing lags and losses caused due to human errors. SCADA will

lead to the diversification of the modern industries in terms of goods,

services and geographical aspects with an ability of real-time

troubleshooting, analysis and control.

Security being the major concern of the modern SCADA systems,

many vendors of SCADA and control products have begun to address

the risks posed by unauthorized access by developing lines of

specialized industrial firewall and VPN solutions for TCP/IP-based

SCADA networks as well as external SCADA monitoring and

recording equipment. The International Society of Automation

(ISA) started formalizing SCADA security requirements in 2007 with

a working group, WG4. WG4 "deals specifically with unique

technical requirements, measurements, and other features required to

evaluate and assure security resilience and performance of industrial

automation and control systems devices".

Hence, the future of SCADA systems is towards a safer and reliable

deployment of operations with the exploitation of trending services

such as cloud services which are yet to be explored to its fullest.

http://en.wikipedia.org/wiki/Firewall_%28computing%29http://en.wikipedia.org/wiki/VPNhttp://en.wikipedia.org/wiki/International_Society_of_Automation

27

REFERENCES

Wikipedia page on SCADA: http://en.wikipedia.org/wiki/SCADA

SCADA systems: April 2014

(http://www.engineersgarage.com/article/scada-systems)

Introduction to Industrial Control Networks

(http://www.rfidblog.org.uk/Preprint-Galloway-Hancke-

IndustrialControlSurvey.pdf)

Basic SCADA Animations

(http://www.integraxor.com/screens.html?utm_content=en&utm_sou

rce=wk)

http://en.wikipedia.org/wiki/SCADAhttp://www.engineersgarage.com/article/scada-systemshttp://www.rfidblog.org.uk/Preprint-Galloway-Hancke-IndustrialControlSurvey.pdfhttp://www.rfidblog.org.uk/Preprint-Galloway-Hancke-IndustrialControlSurvey.pdfhttp://www.integraxor.com/screens.html?utm_content=en&utm_source=wkhttp://www.integraxor.com/screens.html?utm_content=en&utm_source=wk