IN SCADA & PROGRAMMABLE LOGIC CONTROLLER

SUMMER TRAINING FROM: 03.06.09 TO18.07.09

ACADEMIC SESSION 2007-2011 Prepared by:-Manish Choudhary
Pushkar Bajpayee Pramesh Panwar

Guided by: -

M

B. Tech (2nd -year) Roll No. 0719321031 Electrical & Electronics Engg. (EEE) U.C.E.R, Knowledge Park-2 Greater Noida (U.P.)

M

1

Acknowledgement
I would like to thank SOFCON INDIA PVT. LIMITED, DELHI for providing me exposure to the whole Scada & PLCs Systeam. I’d also like to thank Mr. Pushkar Bajpayee and Mr. Baghwan singh, for their enduring support and guidance throughout the training. I am very grateful to the whole Control and Instrumentation Department for their support and guidance. I am also very thankful to the workers and employees near the machineries and the library in charge for their support to my training.

You’re sincerely (MANISH CHOUDHARY) TECH, 2
nd

B.

year (EEE)

ROLL NO. 0719321031

2

CERTIFICATE

This training report is a genuine works by Mr. Manish Choudhary, B-Tech 2nd yr, Electrical & Electronics Engg. The report was made under my supervision, and I express my delight on it successful completion. I am also very happy to have offered him guidance whenever it was required. I wish him success in all his future endeavors.

(Mr. Pushkar Bajpayee) Branch Manager Sofcon India Pvt. Ltd. Pitampura, Delhi

3

Preface
An industrial SCADA & PLCs system is used for the development of the controls of machinery. This paper describes the SCADA & PLCs systems in terms of their architecture, their interface to the process hardware, the functionality and the application development facilities they provide. Some attention is also paid to the industrial standards to which they abide their planned evolution as well as the potential benefits of their use.

4

Common System Component • 9. Application Development • 13.3 Communication Infrastructure and Methods 11.3 Human Machine Interface • 9. PLC compared with other control systems 4.2 System Concept • 9.Contents               1. Trends In SCADA 12.1 Supervisory Station • 10.1 Example of a Simple Ladder Logic Program • 6. Introduction 2.1 Example 5 Programming 6. Architecture 9. Features of PLCs 3. Evolution 5 . Security Issues 13.2 Operational Philosophy • 10.2 Development Tools 14. Remote Terminal Unit • 10.1 Supervision VS Control • 9.1 Configuration • 13.2Program for Start/Stop of Motor 7. Ladder Logic • 6.4 Hardware Control 10. Meaning of SCADA 8. Digital and analog signals • 4.

Conclusion 18. SCADA systems are now also penetrating the experimental physics laboratories for the controls of ancillary systems such as cooling. power distribution. 6 . or Programmable Controller is a digital computer used for automation of industrial processes. PLC and Programmable Logic Controller are registered trademarks of the Allen-Bradley Company. More recently they were also applied for the controls of smaller size particle detectors such as the L3 moon detector and the NA48 experiment. A PLC is an example of a real time system since output results must be produced in response to input conditions within a bounded time. such as control of machinery on factory assembly lines. Unlike general-purpose computers. Introduction A Programmable Logic Controller. Potential benefits of SCADA 17. and resistance to vibration and impact. to name just two examples at CERN. . the PLC is designed for multiple inputs and output arrangements. immunity to electrical noise. otherwise unintended operation will result. extended temperature ranges.    15. etc. performance and openness such that they are an alternative to in house development even for very demanding and complex control systems as those of physics experiments. SCADA is Widely used in industry for Supervisory Control and Data Acquisition of industrial processes. Engineering 16. scalability. PLC. References  1. SCADA systems have made substantial progress over the recent years in terms of functionality. Programs to control machine operation are typically stored in battery-backed or non-volatile memory. ventilation.

Fit into a control cabinet. analog process variables (such as temperature and pressure). especially considering the equivalent space that would be needed by electromechanical relays to perform the same functions: The main difference from other computers is that PLC is armored for severe condition (dust. pneumatic or hydraulic cylinders. PLCs read limit switches. magnetic relays or solenoids. With each module having sixteen "points" of either input or output. this PLC has the ability to monitor and control dozens of devices. PLCs operate electric motors. or analog 7 . etc) and has the facility for extensive input/output (I/O) arrangements. These connect the PLC to sensors and actuators. On the actuator side. moisture. a PLC takes up little room.2. and the positions of complex positioning systems. cold. Features of PLCs Photograph showing several input and output modules of a single Allen-Bradley PLC. heat. Some even use machine vision.

processing power and communication capabilities of some modern PLCs are approximately equivalent to desktop computers. based on a stack-based logic solver. distributed control systems and networking. or the PLC may have external I/O modules attached to a computer network that plugs into the PLC. process control. This program notation was chosen to reduce training demands for the existing technicians. The data handling. storage. Other early PLCs used a form of instruction list programming.outputs. motion control. The electricians were quite able to trace out circuit problems with schematic diagrams using ladder logic. Many of the earliest PLCs expressed all decision making logic in simple ladder logic which appeared similar to electrical schematic diagrams. 8 . The input/output arrangements may be built into a simple PLC. The functionality of the PLC has evolved over the years to include sequential relay control.

 Wiring In a PLC • Block diagram of a PLC 9 .

• Generation of Input Signal Inside the PLC housing. is an opto-isolator device (Light-Emitting Diode) that provides an electrically isolated "high" Logic signal to the computer's circuitry (a photo-transistor interprets the LED's light) when there is 120 VAC power applied between the respective input terminal and the Common terminal. An indicating LED on the front panel of the PLC gives visual indication of an "energized" input : Diagram Showing Energized input terminal X1 10 . connected between each input terminal and the Common terminal.

Diagram Showing Energized Output Y1 11 . there are no actual switch contacts or relay coils operating inside the PLC to create the logical relationships between input and output. The actual logic of the control system is established inside the PLC by means of a computer program. These are imaginary contacts and coils. As with each output. correspondingly.• Generation of Output Signal Output signals are generated by the PLC's computer circuitry activating a switching device (transistor. or even an electromechanical relay). the PLC is able to interface with real-world devices such as switches and solenoids. The "Source" terminal. an indicating LED on the front panel of the PLC gives visual indication of an "energized" output In this way. is usually connected to the L1 side of the 120 VAC power source. This program indicates which output gets energized under which input conditions. if you will. Although the program itself appears to be a ladder logic diagram. with switch and relay symbols. TRIAC. connecting the "Source" terminal to any of the "Y-" labeled output terminals. The program is entered and viewed via a personal computer connected to the PLC's programming port.

integral. Historically PLCs were usually configured with only a few analog control loops. However.3. little electrical design is required. because the volumes are low and the development cost would be uneconomic PLCs may include logic for single-variable feedback analog control loop. For high volume or very simple fixed automation tasks. for example. and the design problem centers on expressing the desired sequence of operations in ladder logic (or function chart) notation. the boundary between DCS and PLC applications has become less clear-cut. PLCs contain input and output devices compatible with industrial pilot devices and controls. some specialty vehicles such as transit busses economically use PLCs instead of custom-designed controls. Automotive applications are an example. where processes required hundreds or thousands of loops. and where changes to the system would be expected during its operational life. 12 . A microcontroller-based design would be appropriate where hundreds or thousands of units will be produced and so the development cost (design of power supplies and input/output hardware) can be spread over many sales. as PLCs have become more powerful. derivative" or "PID controller. These are typically industrial processes in manufacturing where the cost of developing and maintaining the automation system is high relative to the total cost of the automation. PLC compared with other control systems PLCs are well-adapted to a certain range of automation tasks." A PID loop could be used to control the temperature of a manufacturing process. a "proportional. and where the end-user would not need to alter the control. millions of units are built each year. different techniques are used. PLC applications are typically highly customized systems so the cost of a packaged PLC is low compared to the cost of a specific custom-built controller design. and very few end-users alter the programming of these controllers. However. a distributed control system (DCS) would instead be used.

the integer values are limited between -32. PLCs had only discrete I/O.767. with values above 22 V DC representing On. Digital and analog signals Digital or discrete signals behave as binary switches. yielding simply an On or Off signal (1 or 0. a PLC might use 24 V DC I/O. Current inputs are less sensitive to electrical noise (i. limit switches.1 Example As an example. and weight are often represented by analog signals. These are typically interpreted as integer values (counts) by the PLC. with a range of values between zero and fullscale.10 V input would be converted into an integer value of 0 . For example. Pushbuttons. and our example system must manage the water level in the tank. temperature. values below 24 V DC representing Off. As PLCs typically use 16-bit signed binary processors. True or False. respectively). For example. an analog 4-20 mA or 0 .32767. 13 . with various ranges of accuracy depending on the device and the number of bits available to store the data.4.768 and +32.e. Pressure. and intermediate values undefined. where a specific range is designated as On and another as Off. flow. say the facility needs to store water in a tank. 4. Analog signals are like volume controls. and photoelectric sensors are examples of devices providing a discrete signal. as needed. Discrete signals are sent using either voltage or current. from welders or electric motor starts) than voltage inputs. Analog signals can use voltage or current with a magnitude proportional to the value of the process signal. The water is drawn from the tank by another system. Initially.

were programmed using proprietary programming panels or special-purpose programming terminals. and so on. If water is only dripping out of the tank. If both float switches are off (down) or only the 'tank empty' switch is on. causing the system to wear out faster. which often had dedicated function keys representing the various logical elements of PLC programs. something is wrong because once the water reaches a float switch. the PLC will automatically shut the inlet to stop the water from overflowing. More recently. PLC programs are typically written in a 14 . Programming Early PLCs. the switch will stay on because it is floating. the valve can be opened wide. up to the mid-1980s. An analog system might use a load cell (scale) that weighs the tank. The PLC uses a digital output to open and close the inlet valve into the tank. 5. A real system might combine both approaches. the tank is full. The load cell is connected to an analog input and the valve is connected to an analog output. Facilities for printing and documentation were very minimal due to lack of memory capacity. This system fills the tank faster when there is less water in the tank. The PLC could use a PID feedback loop to control the valve opening. Once the 'tank full' switch is on. when both float switches are on.Using only digital signals. and an adjustable (throttling) valve. Backup and maintenance methods can make a real system very complicated. the valve adjusts to slowly drip water back into the tank. Two float switches are used to prevent a 'flutter' (a ripple or a wave) condition where any water usage activates the pump for a very short time and then deactivates for a short time. using float switches and simple valves to prevent spills. the PLC will open the valve to let more water in. If only the 'tank full' switch is on. the PLC has two digital inputs from float switches (tank empty and tank full). thus. Programs were stored on cassette tape cartridges. If the water level drops rapidly. and a rate sensor and rate valve to optimize refill rates.

Modern PLCs can be programmed in a variety of ways. An argument that aided the initial adoption of ladder logic was that a wide variety of engineers and technicians would be able to understand and use it without much additional training.special application on a personal computer. Ladder logic Ladder logic is a method of drawing electrical logic schematics. The very oldest PLCs used non-volatile magnetic core memory but now the program is stored in the PLC either in battery-backed-up RAM or some other non-volatile flash memory. Another method is State Logic. also called a ladder diagram. from ladder logic to more traditional programming languages such as BASIC and C. It is now a graphical language very popular for programming Programmable Logic Controllers (PLCs). (This argument has become less relevant given that most ladder logic programmers have a 15 . The name is based on the observation that programs in this language resemble ladders.  6. with two vertical "rails" and a series of horizontal "rungs" between them. These PLCs were programmed in "ladder logic". It was originally invented to describe logic made from relays. which strongly resembles a schematic diagram of relay logic. is similar to a schematic for a set of relay circuits. because of the resemblance to familiar hardware systems. Early PLCs were designed to be used by electricians who would learn PLC programming on the job. A program in ladder logic. then downloaded by a direct-connection cable or over a network to the PLC. a Very High Level Programming Language designed to program PLCs based on State Transition Diagrams.

By executing the loop fast enough. the rung is true and the output coil storage bit is asserted (1) or true. the rules are typically executed sequentially by software. In this way it is similar to other rule-based languages. 16 . However. 6. typically many times per second. rather than a procedural language. equivalent to a relay with an indefinitely large number of contacts. When implemented with relays and other electromechanical devices. and in practice implementations of ladder logic have characteristics — such as sequential execution and support for control flow features — that make the analogy to hardware somewhat imprecise. The analogy between logical propositions and relay contact status is due to Claude Shannon. through asserted (true or "closed") contacts. Ladder logic can be thought of as a rule-based language. Unlike electromechanical relays." Each coil or contact corresponds to the status of a single bit in the programmable controller's memory.1 Example of a simple ladder logic program The language itself can be seen as a set of connections between logical checkers (relay contacts) and actuators (coils). A "rung" in the ladder represents a rule. in a loop. proper use of programmable controllers requires understanding the limitations of the execution order of rungs. If a path can be traced between the left side of the rung and the output. a ladder program can refer any number of times to the status of a single bit. When implemented in a programmable logic controller.) Ladder logic is widely used to program PLCs.software background in more conventional programming languages. then the output is false (0) and the "coil" by analogy to electromechanical relays is considered "de-energized". Ladder logic is useful for simple but critical control systems. where sequential control of a process or manufacturing operation is required. like spreadsheets or SQL. or for reworking old hardwired relay circuits. As programmable logic controllers became more sophisticated it has also been used in very complex automation systems. If no path can be traced. the effect of simultaneous and immediate execution is obtained. Ladder logic has "contacts" that "make" or "break" "circuits" to control "coils. the various rules "execute" simultaneously and immediately.

false when its rung is true --[ ]-. or may represent the status of internal storage bits which may be generated elsewhere in the program. 6. false when its coil is true (normally true) The "coil" (output of a rung) may represent a physical output which operates some device connected to the programmable controller. Some manufacturers may allow more than one output coil on a rung.So-called "contacts" may refer to inputs to the programmable controller from physical devices such as pushbuttons and limit switches.A "not" contact/close contact.a "not" coil. true when its rung is true --(\)-.This Instruction is Called XIC or Examine If Closed. If a NC switch is actuated then only this instruction will be true. If a NC switch is actuated then this instruction will not be true and hence output will not be generated. or may represent an internal storage bit for use elsewhere in the program. --[\]-- This Instruction is Called XIO or Examine If Open ie.A regular open contact. ie.a regular coil. --( )-. If a NC switch is actuated then this instruction will not be true and hence output will not be generated. 17 . true when its coil is true (normally false) --[\]-.2Generally Used Instructions & symbol For PLC Programming Input Instruction --[ ]-. Each rung of ladder language typically has one coil at the far right. If a NO switch is actuated then only this instruction will be true.

Rung Rung is a simple line on which instruction are placed and logics are created E. In a complex system there will be many "rungs" on a ladder.g. 1.[ ]----[ ] -------------------( )-S X T 2. For example 1. which are numbered in order of evaluation. ---. ----[ ]-----------|---[ ]---|----( )-X | Y | S | | |---[ ]---| Z 2. ----[ ]---------|--[ ]--|------( )-X | Y | S | | |--[ ]--| Z The above realises the function: S = X AND (Y OR Z) Typically.Output Instruction --( )-- This Instruction Shows the States of Output. --------------------------------------------Here is an example of what one rung in a ladder logic program might look like. complex ladder logic is 'read' left to right and top to bottom. there may be hundreds or thousands of rungs.. Due to high output a 24 volt signal is generated from PLC processor. ie. In real life. T = S AND X where S is equivalent to #1. above 18 . As each of the lines (or rungs) are evaluated the output coil of a rung may feed into the next stage of the ladder as an input. If any instruction either XIO or XIC is true then output will be high.

This is a logical AND. as X is already a 'AND' function of S from the 1st rung. which is then evaluated and the output coil T could be fed into an output device (buzzer. Example-2 Often we have a little green "start" button to turn on a motor. 19 .This represents a slightly more complex system for rung 2. light etc. and we want to turn it off with a big red "Stop" button. After the first line has been evaluated.) This system allows very complex logic designs to be broken down and evaluated. electricity is able to flow to the motor which opens the door. (Note that the contact X on the 2nd rung serves no useful purpose.) or into rung 3 on the ladder. • more practical examples Example-1 ------[ ]--------------[ ]----------------O--Key Switch 1 Key Switch 2 Door Motor This circuit shows two key switches that security guards might use to activate an electric motor on a bank vault door.. When the normally open contacts of both switches close. the output coil (S) is fed into rung 2.

--+----[ ]--+----[\]----( )--| start | stop run | | +----[ ]--+ run -------[ ]--------------( )--run motor • Example With PLC Consider the following circuit and PLC program: -------[ ]--------------( )--run motor 20 .

Any and all X1 contacts appearing in the program will assume the actuated (non-normal) state." the real Y1 output will become energized. When the Y1coilof the program "energizes. lighting up the lamp connected to it: Lamp Glows when at Input Switch is Actuated 21 ." sending "power" to the Y1 coil.When the pushbutton switch is unactuated (unpressed). the PLC's Y1 output remains de-energized. and the indicator lamp connected to it remains dark. which shows a normally-open X1 contact in series with a Y1 coil. no "power" will be sent to the Y1 coil. as though they were relay contacts actuated by the energizing of a relay coil named "X1". Thus. If the pushbutton switch is pressed. energizing the X1 input will cause the normally-open X1 contact will "close. no power is sent to the X1 input of the PLC. power will be sent to the PLC's X1 input. Following the program. In this case. however.

It must be understood that the X1 contact. the personal computer may be unplugged from the PLC. For example. in aiding to understand the relationship between real-life conditions (switch closure and lamp status) and the program's status ("power" through virtual contacts and virtual coils). Equally important to understand is that the personal computer used to display and edit the PLC's program is not necessary for the PLC's continued operation. Once a program has been loaded to the PLC from the personal computer. They exist as commands in a computer program -. The true power and versatility of a PLC is revealed when we want to alter the behavior of a control system. They do not exist as real electrical components. and "power" appearing in the personal computer's display are all virtual. The "software" solution is much easier: just alter the program so that contact X1 is normally-closed rather than normally-open. I include the personal computer display in these illustrations for your sake only. Y1 coil. 22 . suppose we wanted to make this switch-and-lamp circuit function in an inverted fashion: push the button to make the lamp turn off. connecting wires.that just happens to resemble a real relay schematic diagram. we can alter its behavior by changing the commands we give it. The "hardware" solution would require that a normally-closed pushbutton switch be substituted for the normallyopen switch currently in place. and release it to make it turn on. and the PLC will continue to follow the programmed commands. without having to reconfigure the electrical components connected to it. Since the PLC is a programmable device.a piece of software only -.

--+----[ ]--+----[\]----( )--| start | stop run | | +----[ ]--+ run 23 . and we want to turn it off with a big red "Stop" button.Programming For Start/Stop of Motor by PLC Often we have a little green "start" button to turn on a motor.

showing that it is in a closed ("electrically conducting") state." Another contact in the program. The parallel Y1 contact will also "close. uses the output coil status as a seal-in contact. directly.The pushbutton switch connected to input X1 serves as the "Start" switch." thus latching the "circuit" in an energized state: 24 . input X1 would energize. sending "power" to the Y1 "coil." energizing the Y1 output and applying 120 volt AC power to the real motor contactor coil. so that the motor contactor will continue to be energized after the "Start" pushbutton switch is released. thus "closing" the X1 contact in the program. You can see the normallyclosed contact X2 appear in a colored block. • Starting of Motor If we were to press the "Start" button. named Y1. while the switch connected to input X2 serves as the "Stop.

thus keeping the Y1 output energized: 25 . the normally-open X1 "contact" will return to its "open" state.• Logic for Continous Running of motor When Start Button is Released Now. but the motor will continue to run because the Y1 seal-in "contact" continues to provide "continuity" to "power" coil Y1. if we release the "Start" pushbutton.

which will energize the X2 input and "open" the normally-closed "contact. we must momentarily press the "Stop" pushbutton.• To Stop the Motor To stop the motor." breaking continuity to the Y1 "coil:" 26 .

will not start again until the "Start" pushbutton is actuated. returning "contact" X2 to its normal. because the "seal-in" of Y1 has been lost: 7. chemistry. The size of such plants range from a few 1000 to several 10 thousands input/output (I/O) channels. SCADA systems are used not only in industrial processes: e. Meaning of SCADA SCADA stands for Supervisory Control and Data Acquisition. or other commercial hardware modules. input X2 will de-energize. but rather focuses on the supervisory level. However. As such. "closed" state.When the "Stop" pushbutton is released. but also in some experimental facilities such as nuclear fusion. The motor. As the name indicates. SCADA systems 27 .g. in general via Programmable Logic Controllers (PLCs). however. it is not a full control system. power generation (conventional and nuclear) and distribution. steel making. it is a purely software package that is positioned on top of hardware to which it is interfaced.

g. Siemens H1). in recent years all SCADA vendors have moved to NT and some also to Linux. or non-proprietary (e.g. • 8.1 Hardware Architecture One distinguishes two basic layers in a SCADA system: the "client layer" which caters for the man machine interaction and the "data server layer" which handles most of the process data control activities. [2]. The data servers communicate with devices in the field through process controllers. 8. VMS and UNIX. SCADA systems used to run on DOS. are connected to the data servers either directly or via networks or field buses that are proprietary (e. Architecture This section describes the common features of the SCADA products that have been evaluated at CERN in view of their possible application to the control systems of the LHC detectors [1]. e. Data servers are connected to each other and to 28 . Profibus). Process controllers.evolve rapidly and are now penetrating the market of plants with a number of I/O channels of several 100 K: we know of two cases of near to 1 M I/O channels currently under development.g. PLCs.

OPC has been evaluated by the CERN-IT-CO group [4]. The data servers and client stations are NT platforms but for many products the client stations may also be W95 machines. The controllers pass the requested parameters to the data servers. A single data server can support multiple communications protocols: it can generally support as many such protocols as it has slots for interface cards. but this improves rapidly as most of the producers of controllers are actively involved in the development of this standard.client stations via an Ethernet LAN. e.e.2 Communications Internal Communication Server-client and server-server communication is in general on a publish-subscribe and event-driven basis and uses a TCP/IP protocol. Some of the drivers are based on third party products (e. The polling rate may be different for different parameters. The effort required to develop new drivers is typically in the range of 2-6 weeks depending on the complexity and similarity with existing drivers. Applicom cards) and therefore have additional cost associated with them...g. VME on the other hand is generally not supported. • 8. Modbus. • 8. Access to Devices The data servers poll the controllers at a user defined polling rate. 29 . . which provide OPC server software..3 Interfacing The provision of OPC client functionality for SCADA to access devices in an open and standard manner is developing. and a driver development toolkit is provided for this. There still seems to be a lack of devices/controllers. Of the three fieldbuses that are recommended at CERN. a client application subscribes to a parameter which is owned by a particular server application and only changes to that parameter are then communicated to the client application.g. Time stamping of the process parameters is typically performed in the controllers and this time-stamp is taken over by the data server. The products provide communication drivers for most of the common PLCs and widely used field-buses. i. If the controller and communication protocol used support unsolicited data transfer then the products will support this too. both Profibus and World flip are supported but CANbus often not [3].

The products achieve scalability by having multiple data servers connected to multiple controllers.g. • 8.g. and Visual Basic (VB) to access data in the RTDB. logs and archive.The products also provide • • • An Open Data Base Connectivity (ODBC) interface to the data in the archive/logs. Each data server has its own configuration database and RTDB and is responsible for the handling of a sub-set of the process variables (acquisition. to visualize data dynamically in an EXCEL spreadsheet. The archive and logging format is usually also proprietary for performance reasons. The configuration data are stored in a database that is logically centralized but physically distributed and that is generally of a proprietary format. Dynamic Link Library (DLL) and Object Linking and Embedding (OLE). trending. the RTDB resides in the memory of the servers and is also of proprietary format. A library of APIs supporting C. The PC products provide support for the Microsoft standards such as Dynamic Data Exchange (DDE) which allows e. Common system components 30 . C++. but some products do support logging to a Relational Data Base Management System (RDBMS) at a slower rate either directly or via an ODBC interface. • 8. alarm handling. which is normally transparent to the user.4 Scalability Scalability is understood as the possibility to extend the SCADA based control system by adding more process variables.5 Redundancy The products often have built in software redundancy at a server level. but not to the configuration database. archiving). more specialized servers (e. An ASCII import/export facility for configuration data. The API often does not provide access to the product's internal features such as alarm handling. 9. etc. Many of the products also provide more complete redundancy solutions if required. for alarm handling) or more clients. reporting. For performance reasons.

to be displayed and recorded. Host control functions are usually restricted to basic overriding or supervisory level intervention. gathering (acquiring) data on the process and sending commands (control) to the process. while the SCADA system monitors the overall performance of the loop. The feedback control loop passes through the RTU or PLC. and through this. enabling reliable. 9.  Remote Terminal Units (RTUs) connecting to sensors in the process. converting sensor signals to digital data and sending digital data to the supervisory system. flexible.1 Supervision vs. such as loss of flow and high temperature. considerable confusion over the differences between SCADA systems and Distributed control systems (DCS). a PLC may control the flow of cooling water through part of an industrial process. For example.2 Systems concepts The term SCADA usually refers to centralized systems which monitor and control entire sites. The discussion on real-time control is muddied somewhat by newer telecommunications technology.  A supervisory (computer) system.  Programmable Logic Controller (PLCs) used as field devices because they are more economical. but the SCADA system may allow operators to change the set points for the flow. Generally speaking. Most differences between SCADA and DCS are culturally determined and can usually be ignored.A SCADA System usually consists of the following subsystems: A Human-Machine Interface or HMI is the apparatus which presents process data to a human operator.and enable alarm conditions. Most control actions are performed automatically by remote terminal units ("RTUs") or by programmable logic controllers ("PLCs").  Communication infrastructure connecting the supervisory system to the Remote Terminal Units  9. high speed communications over wide areas. and configurable than special-purpose RTUs. versatile. low latency. or complexes of systems spread out over large areas (anything between an industrial plant and a country). but does not control processes in real time. the difference between SCADA and DCS will fade. a SCADA system usually refers to a system that coordinates. As communication infrastructures with higher capacity become available. 31 . in several industries. control There is. the human operator monitors and controls the process.

to allow trending and other analytical auditing. and the timestamp when it was recorded or calculated.Data acquisition begins at the RTU or PLC level and includes meter readings and equipment status reports that are communicated to SCADA as required. design time comments. It's also common to store additional metadata with tags. which contains data elements called tags or points. and alarm information. 9. Data is then compiled and formatted in such a way that a control room operator using the HMI can make supervisory decisions to adjust or override normal RTU (PLC) controls. Points can be either "hard" or "soft". Data may also be fed to a Historian. A point represents a single input or output value monitored or controlled by the system. A series of value-timestamp pairs gives the history of that point. equal a single hard point.3 Human Machine Interface 32 . which may. often built on a commodity Database Management System. SCADA systems typically implement a distributed database. commonly referred to as a tag database. in the simplest case. while a soft point results from logic and math operations applied to other points. (Most implementations conceptually remove the distinction by making every property a "soft" point expression. A hard point represents an actual input or output within the system. such as the path to a field device or PLC register.) Points are normally stored as value-timestamp pairs: a value.

a picture of a pump connected to a pipe can show the operator that the pump is running and how much fluid it is pumping through the pipe at the moment. and management information such as scheduled maintenance procedures. An important part of most SCADA implementations are alarms. to provide trending. These representations can be as simple as an on-screen traffic light. and expert-system troubleshooting guides. The HMI software will show the flow rate of the fluid in the pipe decrease in real time. diagnostic data. An HMI is usually linked to the SCADA system's databases and software programs. and through which the human operator controls the process. An alarm is a digital status point that has either the value NORMAL or ALARM. in the form of a mimic diagram. This means that the operator can see a schematic representation of the plant being controlled. Mimic diagrams may consist of line graphics and schematic symbols to represent process elements. or as complex as a multi-projector display representing the position of all of the elevators in a skyscraper or all of the trains on a railway. The HMI package for the SCADA system typically includes a drawing program that the operators or system maintenance personnel use to change the way these points are represented in the interface. Alarms can be created in 33 .Typical Basic SCADA Animations [1] A Human-Machine Interface or HMI is the apparatus which presents process data to a human operator. The HMI system usually presents the information to the operating personnel graphically. detailed schematics for a particular sensor or machine. For example. which represents the state of an actual traffic light in the field. logistic information. The operator can then switch the pump off. or may consist of digital photographs of the process equipment overlain with animated symbols.

which are capable of autonomously executing simple logic processes without involving the master computer. The SCADA operator's attention is drawn to the part of the system requiring attention by the alarm. or measurements such as pressure. IEC 61131-3 has minimal training requirements by virtue of resembling historic physical control arrays. they are activated. virtually all major PLC manufacturers have offered integrated HMI/SCADA systems. 34 . A functional block programming language. is increasing. A Programmable automation controller (PAC) is a compact controller that combines the features and capabilities of a PC-based control system with that of a typical PLC.4 Hardware solutions SCADA solutions often have Distributed Control System (DCS) components. Use of "smart" RTUs or PLCs. This allows SCADA system engineers to perform both the design and implementation of a program to be executed on an RTU or PLC. allowing mechanical engineers. Emails and text messages are often sent along with an alarm activation alerting managers along with the SCADA operator. and communicate with the SCADA master in lieu of a traditional RTU. "distributed RTUs" use information processors or station computers to communicate with protective relays.such a way that when their requirements are met. Typically. In many electrical substation SCADA applications. flow. electrical engineers and technicians to configure HMIs themselves. and other devices for I/O. An example of an alarm is the "fuel tank empty" light in a car. without the need for a custom-made program written by a software developer. voltage or current. 9. is frequently used to create programs which run on these RTUs and PLCs. many of them using open and non-proprietary communications protocols. 10. Since about 1998. PACS. PACs are deployed in SCADA systems to provide RTU and PLC functions. IEC 61131-3 (Ladder Logic). Remote Terminal Unit (RTU) The RTU connects to physical equipment. an RTU converts the electrical signals from the equipment to digital values such as the open/closed status from a switch or a valve. or setting the speed of a pump. such as opening or closing a switch or a valve. have also entered the market. Numerous specialized third-party HMI/SCADA packages. By converting and sending these electrical signals out to equipment the RTU can control equipment. offering built-in compatibility with most major PLCs. Unlike a procedural language such as the C programming language or FORTRAN.

35 .10. up to the point of having multiple fully equipped control centres. which is a variant of mean time between failures. but in most critical installations reliability is enhanced by having redundant hardware and communications channels. etc). The remote management or monitoring function of a SCADA system is often referred to as telemetry. A failing part can be quickly identified and its functionality automatically taken over by backup hardware. Possibly even lives could be lost. A failed part can often be replaced without interrupting the process. the master station may be composed of a single PC. more "open" platforms such as Linux were not as widely used due to the highly dynamic development environment and because a SCADA customer that was able to afford the field hardware and devices to be controlled could usually also purchase UNIX or OpenVMS licenses. and voltage extremes. 10. and disaster recovery sites. distributed software applications. PLCs. This has also come under threat with some customers wanting SCADA data to travel over their pre-established corporate networks or to share the network with other applications. the master station may include multiple servers. vibration. Today.3 Communication infrastructure and methods SCADA systems have traditionally used combinations of radio and direct serial or modem connections to meet communication requirements. The calculated mean time to failure of such high reliability systems can be on the order of centuries. The reliability of such systems can be calculated statistically and is stated as the mean time to failure.1 Supervisory Station The term "Supervisory Station" refers to the servers and software responsible for communicating with the field equipment (RTUs. In smaller SCADA systems. all major operating systems are used for both master station servers and HMI workstations. To increase the integrity of the system the multiple servers will often be configured in a dual-redundant or hot-standby formation providing continuous control and monitoring in the event of a server failure.2 Operational philosophy For some installations. or elsewhere. and then to the HMI software running on workstations in the control room. In larger SCADA systems. Hardware for some SCADA systems is ruggedized to withstand temperature. the costs that would result from the control system failing are extremely high. although Ethernet and IP over SONET / SDH is also frequently used at large sites such as railways and power stations. 10. Initially.

Towards the late 1990s.g.The legacy of the early low-bandwidth protocols remains. though. These communication protocols are standardized and recognized by all major SCADA vendors. The result is that developers and their management created a multitude of control protocols. RP-570. there was also the incentive to create their own protocol to "lock in" their customer base. Recently. IEC 61850 and DNP3. End users who invested in a particular vendor's hardware solution often found themselves restricted to a limited choice of equipment when requirements changed (e. A list of automation protocols is being compiled here. SCADA protocols are designed to be very compact and many are designed to send information to the master station only when the master station polls the RTU. Trends in SCADA There is a trend for plc and HMI/SCADA software to be more "mix-and-match". the shift towards open communications continued with individual I/O manufacturers as well. who adopted open message structures such as Modbus RTU and Modbus ASCII (originally both developed by Modicon) over RS-485. In the mid 1990s. Profibus and Conitel. allowing communication even between devices originally not intended to be part of an industrial network. system expansions or performance improvement). OLE for Process Control (OPC) has become a widely accepted solution for intercommunicating different hardware and software. DNP3 serial. Typical legacy SCADA protocols include Modbus RTU. Open architecture SCADA systems enabled users to mix-and-match products from different vendors to develop solutions that were better than those that could be achieved when restricted to a single vendor's product offering. Standard protocols are IEC 60870-5-101 or 104. It is good security engineering practice to avoid connecting SCADA systems to the Internet so the attack surface is reduced. open communication protocols such as IEC870-5-101/104. These communication protocols are all SCADA-vendor specific but are widely adopted and used. 36 . and DNP3 LAN/WAN became increasingly popular among SCADA equipment manufacturers and solution providers alike. the typical DAQ I/O manufacturer supplied equipment that communicated using proprietary protocols over a suitable-distance carrier like RS-485. 11. RTUs and other automatic controller devices were being developed before the advent of industry wide standards for interoperability. To mitigate such problems. Many of these protocols now contain extensions to operate over TCP/IP. Among the larger vendors.

SCADA systems are coming in line with standard networking technologies. protocol selection. 12. environment suitability) have restricted the adoption of Ethernet in a few specialized applications. Electrical system SCADA systems provide this Sequence of events recorder function. the vast majority of markets have accepted Ethernet networks for HMI/SCADA. synchronization. Consequently. and latency. security researchers are concerned about: 37 . Thin clients. SCADA systems are becoming increasingly ubiquitous. While these considerations are already considered solved in other sectors of internet services. With the emergence of software as a service in the broader software industry. using Radio clocks to synchronize the RTU or distributed RTU clocks. This removes the need to install and commission systems at the end-user's facility and takes advantage of security features already available in Internet technology. and web based products are gaining popularity with most major vendors. Some concerns include security. most I/O makers offered completely open interfacing such as Modbus TCP over Ethernet and IP. Internet connection reliability. the security of SCADA-based systems has come into question as they are increasingly seen as extremely vulnerable to cyber warfare/cyber terrorism attacks.see references. VPNs and SSL. not all entities responsible for deploying SCADA systems have understood the changes in accessibility and threat scope implicit in connecting a system to the internet. Although certain characteristics of frame-based network communication technology (determinism. a few vendors have begun offering application specific SCADA systems hosted on remote platforms over the Internet. Ethernet and TCP/IP based protocols are replacing the older proprietary standards. In particular. The increased convenience of end users viewing their processes remotely introduces security considerations.By 2000. The North American Electric Reliability Corporation (NERC) has specified that electrical system data should be time-tagged to the nearest millisecond. web portals. Security issues The move from proprietary technologies to more standardized and open solutions together with the increased number of connections between SCADA systems and office networks and the Internet has made them more vulnerable to attacks .

Additionally. Many vendors of SCADA and control products have begun to address these risks in a basic sense by developing lines of specialized industrial firewall and VPN solutions for TCP/IP-based SCADA networks. How security will affect legacy SCADA and new deployments remains to be seen. examples of which are transmission of electricity. In many cases. deployment and operation of existing SCADA networks  the mistaken belief that SCADA systems have the benefit of security through obscurity through the use of specialized protocols and proprietary interfaces  the mistaken belief that SCADA networks are secure because they are purportedly physically secured  the mistaken belief that SCADA networks are secure because they are supposedly disconnected from the Internet  SCADA systems are used to control and monitor physical processes. For example. there is rudimentary or no security on the actual packet control protocol. a blackout caused by a compromised electrical SCADA system would cause financial losses to all the customers that received electricity from that source. application white listing solutions are being implemented because of their ability to prevent malware and unauthorized 38 . Second is the threat of packet access to the network segments hosting SCADA devices. traffic lights. In many cases SCADA users assume that a VPN is sufficient protection and are unaware that physical access to SCADA-related network jacks and switches provides the ability to totally bypass all security on the control software and fully control those SCADA networks. water distribution. First is the threat of unauthorized access to the control software. whether it be human access or changes induced intentionally or accidentally by virus infections and other software threats residing on the control host machine. transportation of gas and oil in pipelines. so anyone who can send packets to the SCADA device can control it. There are two distinct threats to a modern SCADA system. The security of these SCADA systems is important because compromise or destruction of these systems would impact multiple areas of society far removed from the original compromise.the lack of concern about security and authentication in the design. These kinds of physical access attacks bypass firewall and VPN security and are best addressed by endpoint-to-endpoint authentication and authorization such as are commonly provided in the non-SCADA world by in-device SSL or other cryptographic techniques. and other systems used as the basis of modern society.

application changes without the performance impacts of traditional antivirus scans Also. In electric and gas utility SCADA systems. standards being defined by ISA99 WG4 will supersede the initial industry consortia efforts. the ISA Security Compliance Institute (ISCI) is emerging to formalize SCADA security testing starting as soon as 2009. the vulnerability of the large installed base of wired and wireless serial communications links is addressed in some cases by applying bump-in-the-wire devices that employ authentication and Advanced Encryption Standard encryption rather than replacing all existing nodes. 13. ISCI is conceptually similar to private testing and certification that has been performed by vendors since 2007. but probably not before 2011 . The increased interest in SCADA vulnerabilities has resulted in vulnerability researchers discovering vulnerabilities in commercial SCADA software and more general offensive SCADA techniques presented to the general security community. Application Development 39 . Eventually.

The facilities provided by the products for configuring very large numbers of parameters are not very strong. many of the PC tools now have a Windows Explorer type development studio. The products also provide an ASCII Export/Import facility for the configuration data (parameter definitions). this has not really been an issue so far for most of the products to-date. 40 . relating to alarm conditions) are defined through some sort of parameter definition template and then the graphics. The developer then works with a number of folders. and linked where appropriate to the process parameters.• 13. However. First the process parameters and associated information (e. which enables large numbers of parameters to be configured in a more efficient manner using an external editor such as Excel and then importing the data into the configuration database.1 Configuration The development of the applications is typically done in two stages. which each contains a different aspect of the configuration. However. including the graphics. as large applications are typically about 50K I/O points and database population from within an ASCII editor such as Excel is still a workable option.g. including trending and alarm displays are developed.

VB The following development tools are provided as standard: • • • • 14. These products evolve thus very rapidly so as to take advantage of new market opportunities. OPC as a means for communicating internally between the client and server modules.g. It is also possible to create links between views so as to ease navigation at run-time. In addition. lines.2 Development Tools A graphics editor. A data base configuration tool (usually through parameter templates). with standard drawing facilities including freehand. This is impractical in the case of very large processes when very large sets of Tags need to be configured. squares circles. the SCADA products are now adopting: • • Web technology. etc. Engineering 41 . they will also support multi-team development. • 13. A scripting language An Application Program Interface (API) supporting C. It should thus be possible to connect OPC compliant third party modules to that SCADA product. C++. Evolution SCADA vendors release one major version and one to two additional minor versions once per year. A library of generic symbols is provided that can be linked dynamically to variables and animated as they change. new SCADA versions are now being designed to handle devices and even entire systems as full entities (classes) that encapsulate all their specific attributes and functionality. etc. As far as new technologies are concerned. to meet new requirements of their customers and to take advantage of new technologies.On-line modifications to the configuration database and the graphics are generally possible with the appropriate level of privileges. etc. It is possible to import pictures in many formats as well as using predefined symbols including e. Java. most of the SCADA products that were evaluated decompose the process in "atomic" parameters to which a Tag-name is associated. ActiveX. It is in general possible to export data in ASCII files so as to be edited through an ASCII editor or Excel. As was already mentioned. As the industrial applications are increasing in size.  15. trending charts.

. . behavior to be adopted in case of specific alarms. a device . graphical interface and associated scripts for animation. that is economical in development and maintenance and that is reliable and robust. e.. The need for proper engineering can not be sufficiently emphasized to reduce development effort and to reach a system that complies with the requirements. instructions on how to control e. alarm levels. alarms. Examples of engineering activities specific to the use of a SCADA system are the definition of: • • • • a library of objects (PLC.Whilst one should rightly anticipate significant development and maintenance savings by adopting a SCADA product for the implementation of a control system.g.. sequences. it does not mean a "no effort" operation. a mechanism to prevent conflicting controls (if not provided with the SCADA).. 42 . device..g. subsystem) complete with standard object behavior (script.). templates for different types of "panels".

especially with suitable engineering. The amount of effort invested in SCADA product amounts to 50 to 100 p-years! The amount of specific development that needs to be performed by the end-user is limited. Technical support and maintenance by the vendor. In addition. These systems are used for mission critical industrial processes where reliability and performance are paramount.16. Reliability and robustness. 43 . Potential benefits of SCADA The benefits one can expect from adopting a SCADA system for the control of experimental physics facilities can be summarized as follows: • • • • A rich functionality and extensive development facilities. specific development is performed within a well-established framework that enhances reliability and robustness.

W. 1999.Daneels. CERN. 1999.Daneels.Salter. [3] G. 18. ITCO/98-08-09. REFERENCES  Note: this article is based on a very similar one that has been published in the Proceedings of the 7th International Conference on Accelerator and Large Experimental Physics Control Systems. this aspect also depends to a significant extent on proper engineering. 17. "Recommendations for the Use of Fieldbuses at CERN in the LHC Era". W. Proceedings of the 1997 International Conference on Accelerator and Large Experimental Physics Control Systems. [4] R. "Selection and Evaluation of Commercial SCADA Systems for the Controls of the CERN LHC Experiments".Salter. Beijing. Proceedings of the 1999 International Conference on Accelerator and Large Experimental Physics Control Systems. [2] A. 1999. Trieste.8 Oct. [1] A.Barillere et al. p.. p. Proceedings of the 1999 International Conference on Accelerator and Large Experimental Physics Control Systems. Geneva 26th Aug 1998. CONCLUSION SCADA is used for the constructive working not for the destructive work using a SCADA system for their controls ensures a common framework not only for the development of the specific applications but also for operating the detectors.285. However. held in Trieste. Trieste.. 44 . "Technology Survey Summary of Study Report". p.353. Operators experience the same "look and feel" whatever part of the experiment they control. 4 . "Results of the OPC Evaluation done within the JCOP for the Control of the LHC Experiments".511. Italy.Baribaud et al. 1997.

45 .

Sign up to vote on this title
UsefulNot useful