Certificate

This is to certify that a seminar report on summer training taken at SOFCON INDIA
PVT. LTD. JAIPUR on PLC & SCADA is submitted by MUNIRAM BAIRAWA student
of final year (7thsemester) in Electrical & Electronics Engineering of Rajasthan Technical
University, Kota during the academic year 2014-2015. The report has been found
satisfactory and is approved for submission.

Seminar Coordinator:

Seminar Coordinator:

Mr. Ajay Patidar

Ms. Vicky Jain

(H.O.D of EEE)

(Assistant Professor)

Preface

An industrial SCADA & PLCs system is used for the development of the controls of
machinery. This paper describes the SCADA & PLCs systems in terms of their
architecture, their interface to the process hardware, the functionality and the
application development facilities they provide. Some attention is also paid to the
industrial standards to which they abide their planned evolution as well as the
potential benefits of their use.

The objective or main motive of this practical training is to getting a true practical
knowledge about the industries, that how their industrial setups are held, how these are
protected, and their communication techniques used in industry technologies to be
made or used in the environment. This report is presented on the basis of practical
training acquired in SOFCON INDIA PVT LTD. JAIPUR. This report is on with
relevant diagrams & by their proper description & explanation.

Acknowledgement

I would like to thank SOFCON INDIA PVT. LIMITED, JAIPUR for providing me
exposure to the whole SCADA & PLCs System. Id also like to thank Mr.
Pushkar Bajpayee (Branch Manager) and Mr. Prem singh (Training
Engineer), for their enduring support and guidance throughout the training. I am
very grateful to the whole Control and Instrumentation Department for their support
and guidance.
I am also very thankful to the workers and employees near the machineries and the
library in charge for their support to my training.
I am also thankful to Mr. Ajay Patidar (H.O.D. of Electrical & Electronics
Engineering) and other faculty members because he encouraged me throughout the
practical training and helped to understood correctly.

Youre sincerely
Muniram Bairawa
B. TECH, Final year (EEE)
ROLL NO: 11ESNEX024

Abstract

According to the rules of Rajasthan Technical University, I have done my 45 days

practical training at SOFCON INDIA PVT LTD., JAIPUR which is incorporated in the
syllabus for 4 year B. Tech. Course. The training report hereby submitted outlines the
course of work during my training in an oriented manner over a period of 45 days for
electrical & electronics engineering branch.

With the completion of this training, I am now aware of the PLC SCADA. I have worked
for six complete weeks in the Automation systems. I have worked almost as an engineer
to the extent of my technical capabilities. Doing all these, I have acquired a lot of
knowledge about the working of programmable Logic Controller With SCADA and its
Softwares (Allen Breadlly, Siemens and Intouch Scada).
I was the part of one of the most happening and demanding field of automaton i.e. plc and
scada and spending six weeks into it really proved very useful to me and I have gained a
lot out of it :
1. I got the knowledge of automation system.
2. I worked practically on the plc (Allen breadlly and Siemens) and scada (Intouch).
3. I worked practically which helped me in being more familiar to the interfacing of
different display devices which I am supposed to do in the long run.
4. I learned basic concepts of automation which helped me to understand more.
5. Training helped me increasing my working skills and the knowledge in this field and
also showed me the atmosphere that we have to join after completion of the degree
program.

Finally, the main advantage of this training was that it has now enabled me to explore
myself in the Industrial automation.

(MUNIRAM BAIRAWA)

Contents

Certificate

Preface

ii

Acknowledgement

iii

Abstract

iv

1. Introduction 1
2. Features of PLC ..2
3. PLC compared with other control system ..5
4. Digital and Analog signals ..6
5. Programming ..8
6. Ladder Logic ..8
6.1. Example of simple ladder program .9
6.2. Generally Used Instructions & symbol For PLC
Programming...10
7. Supervisory Control and Data Acquisition .....20
8. Architecture ..21
8.1. Hardware Architecture ...22
8.2. Communication ..23
8.3. Interfacing ...25
8.4. Scalability ...25
8.5. Redundancy ....26
9. Common system component 26
9.1. Supervision vs. Control...27
5

9.2. Systems Concepts...27

9.3. Human Machine Interface...29
9.4. Hardware Solution..30
10.Remote Terminal (RTU)...31
10.1.

Supervisory Station.31

10.2.

Operational Philosophy..32

10.3.

Communication infrastructure and methods.32

11.Trend in SCADA....33
12.Security issues.35
13.Application Development.37
13.1.

Configuration..37

13.2.

Development Tools.....38

14.Evolution...39
15.Engineering...39
16.Potential benefits of SCADA....40
17.Conclusion....42
18.Reference...42

List of Figures

1. PLC Panel ..1

2. Wiring in PLC ...2
3. Showing Energized input terminal X1..3
4. Showing Energized output terminal Y14
5. (A) Start/Stop of Motor....10
(B) Lamp Glows when at Input Switch is Actuated...11
(C)Energized X2..13
(D)Motor is Energized14
(E)Input is released..15
(F) Motor is stop..16
6. SCADA17
7. SCADA Architecture...18
8. Hardware Architecture18
9. Communication...19
10.Supervision and control room.22
11.Systems concepts23
12.Typical basic SCADA Animation...24
13.Oil and gas scada installation..31
14.Tower...33
15.Maintenance34

Chapter 1
Introduction

A PLC or Programmable Logic Controller, or Programmable Controller is a

solid state device or mini industrial computer that perform discrete or sequential
logics in a factory environment. It was originally development to replace mechanical
relay, counter, PLCs are successfully used to execute complicated control system.
A PLC is a digital computer used for automation of industrial processes, such as
control of machinery on factory assembly lines. Unlike general-purpose computers,
the PLC is designed for multiple inputs and output arrangements, extended
temperature ranges, immunity to electrical noise, and resistance to vibration and
impact. Programs to control machine operation are typically stored in battery-backed
or non-volatile memory. A PLC is an example of a real time system since output
results must be produced in response to input conditions within a bounded time,
otherwise unintended operation will result.
PLC and Programmable Logic Controller are registered trademarks of the AllenBradley Company.
SCADA is industrial software. By using scada software we can see pictorial
view/animation form of any plant. Scada is widely used in industry for Supervisory
Control and Data Acquisition of industrial processes, SCADA systems are now
also penetrating the experimental physics laboratories for the controls of ancillary
systems such as cooling, ventilation, power distribution, etc. More recently they
were also applied for the controls of smaller size particle detectors such as the L3
moon detector and the NA48 experiment, to name just two examples at CERN.
SCADA systems have made substantial progress over the recent years in terms of
functionality, scalability, performance and openness such that they are an alternative
to in house development even for very demanding and complex control systems as
those of physics experiments.

Fig1 : PLC panel

Chapter 2
Features of PLC
High reliability, strong anti-interference ability The MTBF of PLC can generally
reach 30000 to 50000 hours. And it can easily adapt to the environments. That it can
work reliably under the industrial environment. 2 easily program. The commonly
used programming language is ladder diagram language, which is magic and can be
easily mastered. When the working process need to be changed, the program can be
changed on spot, which is convenient and flexible. 3Third, small volume and
compact structure and it is easy to install and maintain.
Many of the earliest PLCs expressed all decision making logic in simple ladder logic
which appeared similar to electrical schematic diagrams. The electricians were quite
able to trace out circuit problems with schematic diagrams using ladder logic. This
program notation was chosen to reduce training demands for the existing
technicians. Other early PLCs used a form of instruction list programming, based on
a stack-based logic solver.
The functionality of the PLC has evolved over the years to include sequential relay
control, motion control, process control, distributed control systems and networking.

The data handling, storage, processing power and communication capabilities of

some modern. PLCs are approximately equivalent to desktop computers.

Fig2 : Wiring in PLC

Generation of Input Signal

Inside the PLC housing, connected between each input terminal and the Common
terminal, is an opto-isolator device (Light-Emitting Diode) that provides an
electrically isolated "high" Logic signal to the computer's circuitry (a phototransistor interprets the LED's light) when there is 120 VAC power applied between
the respective input terminal and the Common terminal. An indicating LED on the
front panel of the PLC gives visual indication of an "energized" input.

10

Fig 3 :Showing Energized input terminal X1

Generation of Output signal

Output signals are generated by the PLC's computer circuitry activating a

switching device (transistor, TRIAC, or even an electromechanical relay),
connecting the "Source" terminal to any of the "Y-" labeled output terminals.
The "Source" terminal, correspondingly, is usually connected to the L1 side of
the 120 VAC power source. As with each output, an indicating LED on the
front panel of the PLC gives visual indication of an "energized" output.
In this way, the PLC is able to interface with real-world devices such as swithes
and solenoids.
The actual logic of the control system is established inside the PLC by means of
a computer program. This program indicates which output gets energized under
which input conditions. Although the program itself appears to be a ladder logic
diagram, with switch and relay symbols, there are no actual switch contacts or
relay coils operating inside the PLC to create the logical relationships between
input and output. These are imaginary contacts and coils, if you will. The
11

program is entered and viewed via a personal computer connected to the PLC's
programming port.

Fig 4 :Diagram Showing Energized Output Y1

Chapter 3
PLC compared with other control systems
PLCs are well-adapted to a certain range of automation tasks. These are typically
industrial processes in manufacturing where the cost of developing and maintaining
the automation system is high relative to the total cost of the automation, and where
changes to the system would be expected during its operational life. PLCs contain
input and output devices compatible with industrial pilot devices and controls; little
electrical design is required, and the design problem centers on expressing the
desired sequence of operations in ladder logic (or function chart) notation. PLC
applications are typically highly customized systems so the cost of a packaged PLC
is low compared to the cost of a specific custom-built controller design. For high
volume or very simple fixed automation tasks, different techniques are used.
A microcontroller-based design would be appropriate where hundreds or thousands
of units will be produced and so the development cost (design of power supplies and
12

input/output hardware) can be spread over many sales, and where the end-user
would not need to alter the control. Automotive applications are an example;
millions of units are built each year, and very few end-users alter the programming
of these controllers. However, some specialty vehicles such as transit busses
economically use PLCs instead of custom-designed controls, because the volumes
are low and the development cost would be uneconomic.
PLCs may include logic for single-variable feedback analog control loop, a
"proportional, integral, derivative" or "PID controller." A PID loop could be used to
control the temperature of a manufacturing process, for example. Historically PLCs
were usually configured with only a few analog control loops; where processes
required hundreds or thousands of loops, a distributed control system (DCS) would
instead be used. However, as PLCs have become more powerful, the boundary
between DCS and PLC applications has become less clear-cut.

Chapter 4
Digital and analog signals

Digital or discrete signals behave as binary switches, yielding simply an On or

Off signal (1 or 0, True or False, respectively). Pushbuttons, limit switches, and
photoelectric sensors are examples of devices providing a discrete signal. Discrete
signals are sent using either voltage or current, where a specific range is designated as
On and another as Off. For example, a PLC might use 24 V DC I/O, with values
above 22 V DC representing On, values below 24 V DC representing Off, and
intermediate values undefined. Initially, PLCs had only discrete I/O.
Analog signals are like volume controls, with a range of values between zero and fullscale. These are typically interpreted as integer values (counts) by the PLC, with
various ranges of accuracy depending on the device and the number of bits available
to store the data. As PLCs typically use 16-bit signed binary processors, the integer
values are limited between -32,768 and +32,767. Pressure, temperature, flow, and
weight are often represented by analog signals. Analog signals can use voltage or
current with a magnitude proportional to the value of the process signal. For example,
13

an analog 4-20 mA or 0 - 10 V input would be converted into an integer value of 0 32767.

Current inputs are less sensitive to electrical noise (i.e. from welders or electric motor
starts) than voltage inputs.

Example

As an example, say the facility needs to store water in a tank. The water is drawn
from the tank by another system, as needed, and our example system must manage the
water level in the tank.
Using only digital signals, the PLC has two digital inputs from float switches (tank
empty and tank full). The PLC uses a digital output to open and close the inlet valve
into the tank.
If both float switches are off (down) or only the 'tank empty' switch is on, the PLC
will open the valve to let more water in. Once the 'tank full' switch is on, the PLC will
automatically shut the inlet to stop the water from overflowing. If only the 'tank full'
switch is on, something is wrong because once the water reaches a float switch, the
switch will stay on because it is floating, thus, when both float switches are on, the
tank is full. Two float switches are used to prevent a 'flutter' (a ripple or a wave)
condition where any water usage activates the pump for a very short time and then
deactivates for a short time, and so on, causing the system to wear out faster.
An analog system might use a load cell (scale) that weighs the tank, and an adjustable
(throttling) valve. The PLC could use a PID feedback loop to control the valve
opening. The load cell is connected to an analog input and the valve is connected to
an analog output. This system fills the tank faster when there is less water in the tank.
If the water level drops rapidly, the valve can be opened wide. If water is only
dripping out of the tank, the valve adjusts to slowly drip water back into the tank.
A real system might combine both approaches, using float switches and simple valves
to prevent spills, and a rate sensor and rate valve to optimize refill rates. Backup and
maintenance methods can make a real system very complicated.

14

Chapter 5
Programming

Early PLCs, up to the mid-1980s, were programmed using proprietary programming

panels or special-purpose programming terminals, which often had dedicated
function keys representing the various logical elements of PLC programs. Programs
were stored on cassette tape cartridges. Facilities for printing and documentation
were very minimal due to lack of memory capacity. More recently, PLC programs
are typically written in a special application on a personal computer, then
downloaded by a direct-connection cable or over a network to the PLC. The very
oldest PLCs used non-volatile magnetic core memory but now the program is stored
in the PLC either in battery-backed-up RAM or some other non-volatile flash
memory.
Early PLCs were designed to be used by electricians who would learn PLC
programming on the job. These PLCs were programmed in "ladder logic", which
strongly resembles a schematic diagram of relay logic. Modern PLCs can be
programmed in a variety of ways, from ladder logic to more traditional
programming languages such as BASIC and C. Another method is State Logic, a
Very High Level Programming Language designed to program PLCs based on State
Transition Diagrams.

Chapter 6

Ladder Logic
Ladder logic is a method of drawing electrical logic schematics. It is now a graphical
language very popular for programming Programmable Logic Controllers (PLCs). It
was originally invented to describe logic made from relays. The name is based on the
observation that programs in this language resemble ladders, with two vertical "rails"
and a series of horizontal "rungs" between them.

15

A program in ladder logic, also called a ladder diagram, is similar to a schematic for a
set of relaycircuits. An argument that aided the initial adoption of ladder logic was
that a wide variety of engineers and technicians would be able to understand and use
it without much additional training, because of the resemblance to familiar hardware
systems. (This argument has become less relevant given that most ladder logic
programmers have a software background in more conventional programming
languages, and in practice implementations of ladder logic have characteristics
such as sequential execution and support for control flow features that make the
analogy to hardware somewhat imprecise).
Ladder logic is widely used to program PLCs, where sequential control of a process
or manufacturing operation is required. Ladder logic is useful for simple but critical
control systems, or for reworking old hardwired relay circuits. As programmable logic
controllers became more sophisticated it has also been used in very complex
automation systems.
Ladder logic can be thought of as a rule-based language, rather than a procedural
language. A "rung" in the ladder represents a rule. When implemented with relays and
other electromechanical devices, the various rules "execute" simultaneously and
immediately. When implemented in a programmable logic controller, the rules are
typically executed sequentially by software, in a loop. By executing the loop fast
enough, typically many times per second, the effect of simultaneous and immediate
execution is obtained. In this way it is similar to other rule-based languages, like
spreadsheets or SQL. However, proper use of programmable controllers requires
understanding the limitations of the execution order of rungs.

6.1 Example of a simple ladder logic program

The language itself can be seen as a set of connections between logical checkers
(relay contacts) and actuators (coils). If a path can be traced between the left side of
the rung and the output, through asserted (true or "closed") contacts, the rung is true
and the output coil storage bit is asserted (1) or true. If no path can be traced, then the
output is false (0) and the "coil" by analogy to electromechanical relays is considered
16

"de-energized". The analogy between logical propositions and relay contact status is
due to Claude Shannon.
Ladder logic has "contacts" that "make" or "break" "circuits" to control "coils." Each
coil or contact corresponds to the status of a single bit in the programmable
controller's memory. Unlike electromechanical relays, a ladder program can refer any
number of times to the status of a single bit, equivalent to a relay with an indefinitely
large number of contacts.
So-called "contacts" may refer to inputs to the programmable controller from physical
devices such as pushbuttons and limit switches, or may represent the status of internal
storage bits which may be generated elsewhere in the program.
Each rung of ladder language typically has one coil at the far right. Some
manufacturers may allow more than one output coil on a rung.
--( )-- a regular coil, true when its rung is true
--(\)-- a "not" coil, false when its rung is true
--[ ]-- A regular open contact, true when its coil is true (normally false)
--[\]-- A "not" contact/close contact, false when its coil is true (normally true)
The "coil" (output of a rung) may represent a physical output which operates some
device connected to the programmable controller, or may represent an internal storage
bit for use elsewhere in the program.

6.2Generally Used Instructions & symbol For PLC Programming

a) Input Instruction--[ ]-- This Instruction is Called XIC or Examine If Closed.

17

i.e.; if a NO switch is actuated then only this instruction will be true. If a NC

switch is actuated then this instruction will not be true and hence output will not be
generated.

--[\]--This Instruction is Called XIO or Examine If Open

i.e.; If a NC switch is actuated then only this instruction will be true. If a NC
switch is actuated then this instruction will not be true and hence output will not be
generated.
b) Output Instruction--( )-- This Instruction Shows the States of Output.
i.e.; if any instruction either XIO or XIC is true then output will be high.
Due to high output a 24 volt signal is generated from PLC processor.
c) RungRung is a simple line on which instruction are placed and logics are created
E.g.;--------------------------------------------Here is an example of what one rung in a ladder logic program might look like. In real
life, there may be hundreds or thousands of rungs.
For example
1. ----[ ]---------|--[ ]--|------( )-X

| Y |
|

|--[ ]--|
Z
The above realizes the function: S = X AND (Y OR Z)
Typically, complex ladder logic is 'read' left to right and top to bottom. As each of the
lines (or rungs) are evaluated the output coil of a rung may feed into the next stage of
the ladder as an input. In a complex system there will be many "rungs" on a ladder,
which are numbered in order of evaluation.
1. ----[ ]-----------|---[ ]---|----( )-X

| Y

S
18

|---[ ]---|
Z
2. ---- [ ]----[ ] -------------------( )-S

2. T = S AND X where S is equivalent to #1. Above

This represents a slightly more complex system for rung 2. After the first line has
been evaluated, the output coil (S) is fed into rung 2, which is then evaluated and the
output coil T could be fed into an output device (buzzer, light etc...) or into rung 3 on
the ladder. (Note that the contact X on the 2nd rung serves no useful purpose, as X is
already a 'AND' function of S from the 1st rung.)
This system allows very complex logic designs to be broken down and evaluated.

more practical examples

Example-1

------[ ]--------------[ ]----------------O--Key Switch 1

Key Switch 2

Door Motor

This circuit shows two key switches that security guards might use to activate an
electric motor on a bank vault door. When the normally open contacts of both
switches close, electricity is able to flow to the motor which opens the door. This is a
logical AND.

19

Example-2
Often we have a little green "start" button to turn on a motor, and we want to turn it
off with a big red "Stop" button.

--+----[ ]--+----[\]----( )--| start | stop run

+----[ ]--+
run

-------[ ]--------------( )--run

motor

Example With PLC

Consider the following circuit and PLC program:
-------[ ]--------------( )--run

motor

20

Fig 5(A) : Start/Stop of Motor

When the pushbutton switch is unactuated (unpressed), no power is sent to the X1
input of the PLC. Following the program, which shows a normally-open X1 contact
in series with a Y1 coil, no "power" will be sent to the Y1 coil. Thus, the PLC's Y1
output remains de-energized, and the indicator lamp connected to it remains dark.
If the pushbutton switch is pressed, however, power will be sent to the PLC's X1
input. Any and all X1 contacts appearing in the program will assume the actuated
(non-normal) state, as though they were relay contacts actuated by the energizing of
a relay coil named "X1". In this case, energizing the X1 input will cause the
normally-open X1 contact will "close," sending "power" to the Y1 coil. When the
Y1coilof the program "energizes," the real Y1 output will become energized,
lighting up the lamp connected to it:

21

Fig 5(B) :Lamp Glows when at Input Switch is Actuated

It must be understood that the X1 contact, Y1 coil, connecting wires, and "power"
appearing in the personal computer's display are all virtual. They do not exist as real
electrical components. They exist as commands in a computer program -- a piece of
software only -- that just happens to resemble a real relay schematic diagram.
Equally important to understand is that the personal computer used to display and
edit the PLC's program is not necessary for the PLC's continued operation. Once a
program has been loaded to the PLC from the personal computer, the personal
computer may be unplugged from the PLC, and the PLC will continue to follow the
programmed commands. I include the personal computer display in these
illustrations for your sake only, in aiding to understand the relationship between
real-life conditions (switch closure and lamp status) and the program's status
("power" through virtual contacts and virtual coils).
The true power and versatility of a PLC is revealed when we want to alter the
behavior of a control system. Since the PLC is a programmable device, we can alter
its behaviorby changing the commands we give it, without having to reconfigure the

22

electrical components connected to it. For example, suppose we wanted to make this
switch-and-lamp circuit function in an inverted fashion: push the button to make the
lamp turn off, and release it to make it turn on. The "hardware" solution would
require that a normally-closed pushbutton switch be substituted for the normallyopen switch currently in place. The "software" solution is much easier: just alter the
program so that contact X1 is normally-closed rather than normally-open.

Programming For Start/Stop of Motor by PLC

Often we have a little green "start" button to turn on a motor, and we want to turn it
off with a big red "Stop" button.

--+----[ ]--+----[\]----( )--| start | stop run

|

+----[ ]--+
run

23

Fig 5(C) : Start/Stop of Motor

The pushbutton switch connected to input X1 serves as the "Start" switch, while the
switch connected to input X2 serves as the "Stop." Another contact in the program,
named Y1, uses the output coil status as a seal-in contact, directly, so that the motor
contactor will continue to be energized after the "Start" pushbutton switch is
released. You can see the normally-closed contact X2 appear in a colored block,
showing that it is in a closed ("electrically conducting") state.

Starting of Motor

If we were to press the "Start" button, input X1 would energize, thus "closing" the
X1 contact in the program, sending "power" to the Y1 "coil," energizing the Y1
output and applying 120 volt AC power to the real motor contactor coil. The parallel
Y1 contact will also "close," thus latching the "circuit" in an energized state:

Fig 5(D) : Start/Stop of Motor

24

Logic for Continuous Running of motor When Start Button is

Released

Now, if we release the "Start" pushbutton, the normally-open X1 "contact" will

return to its "open" state, but the motor will continue to run because the Y1 seal-in
"contact" continues to provide "continuity" to "power" coil Y1, thus keeping the Y1
output energized:

Fig 5(E) : Start/Stop of Motor

25

To Stop the Motor

To stop the motor, we must momentarily press the "Stop" pushbutton, which will
energize the X2 input and "open" the normally-closed "contact," breaking continuity
to the Y1 "coil:"

Fig 5(F) : Start/Stop of Motor

When the "Stop" pushbutton is released, input X2 will de-energize, returning

"contact" X2 to its normal, "closed" state. The motor, however, will not start again
until the "Start" pushbutton is actuated, because the "seal-in" of Y1 has been lost.

26

Chapter 7

Supervisory Control and Data Acquisition

SCADA stands for Supervisory Control and Data Acquisition. As the

name indicates, it is not a full control system, but rather focuses on the
supervisory level. As such, it is a purely software package that is
positioned on top of hardware to which it is interfaced, in general via
Programmable Logic Controllers (PLCs), or other commercial
hardware modules.
SCADA systems are used not only in industrial processes: e.g. steel making,
power generation (conventional and nuclear) and distribution, chemistry, but
also in some experimental facilities such as nuclear fusion. The size of such
plants range from a few 1000 to several 10 thousands input/output (I/O)
channels. However, SCADA systems evolve rapidly and are now penetrating
the market of plants with a number of I/O channels of several 100 K: we
know of two cases of near to 1 M I/O channels currently under development.
SCADA systems used to run on DOS, VMS and UNIX; in recent years all
SCADA vendors have moved to NT and some also to Linux.

27

Fig 6 : SCADA

Chapter 8

Architecture

This section describes the common features of the SCADA products that have been
evaluated at CERN in view of their possible application to the control systems of the
LHC detectors [1], [2].

28

Fig7 :Scada Architecture

8.1 Hardware Architecture

One distinguishes two basic layers in a SCADA system: the "client layer" which
caters for the man machine interaction and the "data server layer" which handles
most of the process data control activities. The data servers communicate with
devices in the field through process controllers. Process controllers, e.g. PLCs, are
connected to the data servers either directly or via networks or field buses that are
proprietary (e.g. Siemens H1), or non-proprietary (e.g. Profibus). Data servers are
connected to each other and to client stations via an Ethernet LAN. The data servers
and client stations are NT platforms but for many products the client stations may
also be W95 machines.

29

Fig 8 : Hardware Architecture

8.2 Communications

Internal Communication
Server-client and server-server communication is in general on a publish-subscribe
and event-driven basis and uses a TCP/IP protocol, i.e., a client application
subscribes to a parameter which is owned by a particular server application and only
changes to that parameter are then communicated to the client application.
Access to Devices
The data servers poll the controllers at a user defined polling rate. The polling rate
may be different for different parameters. The controllers pass the requested
parameters to the data servers. Time stamping of the process parameters is typically
performed in the controllers and this time-stamp is taken over by the data server. If
the controller and communication protocol used support unsolicited data transfer
then the products will support this too.

30

The products provide communication drivers for most of the common PLCs and
widely used field-buses, e.g., Modbus. Of the three fieldbuses that are recommended
at CERN, both Profibus and World flip are supported but CAN bus often not [3].
Some of the drivers are based on third party products (e.g., Applicom cards) and
therefore have additional cost associated with them. VME on the other hand is
generally not supported.
A single data server can support multiple communications protocols: it can generally
support as many such protocols as it has slots for interface cards.
The effort required to develop new drivers is typically in the range of 2-6 weeks
depending on the complexity and similarity with existing drivers, and a driver
development toolkit is provided for this.

Fig 9 :Commiunicaton

31

8.3 Interfacing

The provision of OPC client functionality for SCADA to access devices in an open
and standard manner is developing. There still seems to be a lack of
devices/controllers, which provide OPC server software, but this improves rapidly as
most of the producers of controllers are actively involved in the development of this
standard. OPC has been evaluated by the CERN-IT-CO group [4].
The products also provide

An Open Data Base Connectivity (ODBC) interface to the data in the

archive/logs, but not to the configuration database,

An ASCII import/export facility for configuration data,

A library of APIs supporting C, C++, and Visual Basic (VB) to access data in the
RTDB, logs and archive. The API often does not provide access to the product's
internal features such as alarm handling, reporting, trending, etc.

The PC products provide support for the Microsoft standards such as Dynamic Data
Exchange (DDE) which allows e.g. to visualize data dynamically in an EXCEL
spreadsheet, Dynamic Link Library (DLL) and Object Linking and Embedding
(OLE).
The configuration data are stored in a database that is logically centralized but
physically distributed and that is generally of a proprietary format.
For performance reasons, the RTDB resides in the memory of the servers and is also
of proprietary format.
The archive and logging format is usually also proprietary for performance reasons,
but some products do support logging to a Relational Data Base Management
System (RDBMS) at a slower rate either directly or via an ODBC interface.

8.4 Scalability

Scalability is understood as the possibility to extend the SCADA based control

system by adding more process variables, more specialized servers (e.g. for alarm
handling) or more clients. The products achieve scalability by having multiple data
32

servers connected to multiple controllers. Each data server has its own configuration
database and RTDB and is responsible for the handling of a sub-set of the process
variables (acquisition, alarm handling, archiving).

8.5 Redundancy

The products often have built in software redundancy at a server level, which is
normally transparent to the user. Many of the products also provide more complete
redundancy solutions if required.

Chapter 9
Common system components

A SCADA System usually consists of the following subsystems:

A Human-Machine Interface or HMI is the apparatus which presents process

data to a human operator, and through this, the human operator monitors and
controls the process.

A supervisory (computer) system, gathering (acquiring) data on the process and

sending commands (control) to the process.

Remote Terminal Units (RTUs) connecting to sensors in the process, converting

sensor signals to digital data and sending digital data to the supervisory system.

Programmable Logic Controller (PLCs) used as field devices because they are
more economical, versatile, flexible, and configurable than special-purpose
RTUs.

Communication infrastructure connecting the supervisory system to the Remote

Terminal Units.

33

9.1 Supervision vs. Control

There is, in several industries, considerable confusion over the differences between
SCADA systems and Distributed control systems (DCS). Generally speaking, a
SCADA system usually refers to a system that coordinates, but does
not control processes in real time. The discussion on real-time control is muddied
somewhat by newer telecommunications technology, enabling reliable, low latency,
high speed communications over wide areas. Most differences between SCADA and
DCS are culturally determined and can usually be ignored. As communication
infrastructures with higher capacity become available, the difference between
SCADA and DCS will fade.

Fig 10 : Supervision and Control room

9.2 Systems Concepts

The term SCADA usually refers to centralized systems which monitor and control
entire sites, or complexes of systems spread out over large areas (anything between
an industrial plant and a country). Most control actions are performed automatically
by remote terminal units ("RTUs") or by programmable logic controllers ("PLCs").
Host control functions are usually restricted to basic overriding or supervisory level
intervention. For example, a PLC may control the flow of cooling water through part
of an industrial process, but the SCADA system may allow operators to change the
34

set points for the flow, and enable alarm conditions, such as loss of flow and high
temperature, to be displayed and recorded. The feedback control loop passes through
the RTU or PLC, while the SCADA system monitors the overall performance of the
loop.

Fig 11 : Systems Concepts

Data acquisition begins at the RTU or PLC level and includes meter readings and
equipment status reports that are communicated to SCADA as required. Data is then
compiled and formatted in such a way that a control room operator using the HMI
can make supervisory decisions to adjust or override normal RTU (PLC) controls.
Data may also be fed to a Historian, often built on a commodity Database
Management System, to allow trending and other analytical auditing.
SCADA systems typically implement a distributed database, commonly referred to
as a tag database, which contains data elements called tags or points. A point
represents a single input or output value monitored or controlled by the system.
Points can be either "hard" or "soft". A hard point represents an actual input or
output within the system, while a soft point results from logic and math operations
applied to other points. (Most implementations conceptually remove the distinction
by making every property a "soft" point expression, which may, in the simplest case,
equal a single hard point.) Points are normally stored as value-timestamp pairs: a
35

value, and the timestamp when it was recorded or calculated. A series of valuetimestamp pairs gives the history of that point. It's also common to store additional
metadata with tags, such as the path to a field device or PLC register, design time
comments, and alarm information.

9.3 Human Machine Interface

Fig 12 :Typical Basic SCADA Animation

A Human-Machine Interface or HMI is the apparatus which presents process data to

a human operator, and through which the human operator controls the process.
An HMI is usually linked to the SCADA system's databases and software programs,
to provide trending, diagnostic data, and management information such as scheduled
maintenance procedures, logistic information, detailed schematics for a particular
sensor or machine, and expert-system troubleshooting guides.
The HMI system usually presents the information to the operating personnel
graphically, in the form of a mimic diagram. This means that the operator can see a

36

schematic representation of the plant being controlled. For example, a picture of a

pump connected to a pipe can show the operator that the pump is running and how
much fluid it is pumping through the pipe at the moment. The operator can then
switch the pump off. The HMI software will show the flow rate of the fluid in the
pipe decrease in real time. Mimic diagrams may consist of line graphics and
schematic symbols to represent process elements, or may consist of digital
photographs of the process equipment overlain with animated symbols.
The HMI package for the SCADA system typically includes a drawing program that
the operators or system maintenance personnel use to change the way these points
are represented in the interface. These representations can be as simple as an onscreen traffic light, which represents the state of an actual traffic light in the field, or
as complex as a multi-projector display representing the position of all of the
elevators in a skyscraper or all of the trains on a railway.
An important part of most SCADA implementations are alarms. An alarm is a digital
status point that has either the value NORMAL or ALARM. Alarms can be created
in such a way that when their requirements are met, they are activated. An example
of an alarm is the "fuel tank empty" light in a car. The SCADA operator's attention
is drawn to the part of the system requiring attention by the alarm. Emails and text
messages are often sent along with an alarm activation alerting managers along with
the SCADA operator.

9.4 Hardware solutions

SCADA solutions often have Distributed Control System (DCS) components. Use of
"smart" RTUs or PLCs, which are capable of autonomously executing simple logic
processes without involving the master computer, is increasing. A functional block
programming language, IEC 61131-3 (Ladder Logic), is frequently used to create
programs which run on these RTUs and PLCs. Unlike a procedural language such as
the C programming language or FORTRAN, IEC 61131-3 has minimal training
requirements by virtue of resembling historic physical control arrays. This allows
SCADA system engineers to perform both the design and implementation of a
program to be executed on an RTU or PLC. A Programmable automation
37

controller (PAC) is a compact controller that combines the features and capabilities
of a PC-based control system with that of a typical PLC. PACs are deployed in
SCADA systems to provide RTU and PLC functions. In many electrical substation
SCADA applications, "distributed RTUs" use information processors or station
computers to communicate with protective relays, PACS, and other devices for I/O,
and communicate with the SCADA master in lieu of a traditional RTU.
Since about 1998, virtually all major PLC manufacturers have offered integrated
HMI/SCADA
communications

systems,

many of

protocols.

them

using

open

and

non-proprietary

Numerous specialized third-party HMI/SCADA

packages, offering built-in compatibility with most major PLCs, have also entered
the market, allowing mechanical engineers, electrical engineers and technicians to
configure HMIs themselves, without the need for a custom-made program written by
a software developer.

Chapter 10
Remote Terminal Unit (RTU)
The RTU connects to physical equipment. Typically, an RTU converts the electrical
signals from the equipment to digital values such as the open/closed status from
a switch or a valve, or measurements such as pressure, flow, voltage or current. By
converting and sending these electrical signals out to equipment the RTU can control
equipment, such as opening or closing a switch or a valve, or setting the speed of
a pump.

10.1 Supervisory Station

The term "Supervisory Station" refers to the servers and software responsible for
communicating with the field equipment (RTUs, PLCs, etc.), and then to the HMI
software running on workstations in the control room, or elsewhere. In smaller
SCADA systems, the master station may be composed of a single PC. In larger
SCADA systems, the master station may include multiple servers, distributed

38

software applications, and disaster recovery sites. To increase the integrity of the
system the multiple servers will often be configured in a dual-redundant or hotstandby formation providing continuous control and monitoring in the event of a
server failure.
Initially, more "open" platforms such as Linux were not as widely used due to the
highly dynamic development environment and because a SCADA customer that was
able to afford the field hardware and devices to be controlled could usually also
purchase UNIX or OpenVMS licenses. Today, all major operating systems are used
for both master station servers and HMI workstations.

10.2 Operational philosophy

For some installations, the costs that would result from the control system failing are
extremely high. Possibly even lives could be lost. Hardware for some SCADA
systems is ruggedized to withstand temperature, vibration, and voltage extremes, but
in most critical installations reliability is enhanced by having redundant hardware
and communications channels, up to the point of having multiple fully equipped
control centres. A failing part can be quickly identified and its functionality
automatically taken over by backup hardware. A failed part can often be replaced
without interrupting the process. The reliability of such systems can be calculated
statistically and is stated as the mean time to failure, which is a variant of mean time
between failures. The calculated mean time to failure of such high reliability systems
can be on the order of centuries.

10.3 Communication infrastructure and methods

SCADA systems have traditionally used combinations of radio and direct serial or
modem connections to meet communication requirements, although Ethernet and IP
over SONET / SDH is also frequently used at large sites such as railways and power
stations. The remote management or monitoring function of a SCADA system is
often referred to as telemetry.
39

This has also come under threat with some customers wanting SCADA data to travel
over their pre-established corporate networks or to share the network with other
applications. The legacy of the early low-bandwidth protocols remains, though.
SCADA protocols are designed to be very compact and many are designed to send
information to the master station only when the master station polls the RTU.
Typical legacy SCADA protocols include Modbus RTU, RP-570, Profibus and
Conitel. These communication protocols are all SCADA-vendor specific but are
widely adopted and used. Standard protocols are IEC 60870-5-101 or 104, IEC
61850 and DNP3. These communication protocols are standardized and recognized
by all major SCADA vendors. Many of these protocols now contain extensions to
operate over TCP/IP. It is good security engineering practice to avoid connecting
SCADA systems to the Internet so the attack surface is reduced.
RTUs and other automatic controller devices were being developed before the
advent of industry wide standards for interoperability. The result is that developers
and their management created a multitude of control protocols. Among the larger
vendors, there was also the incentive to create their own protocol to "lock in" their
customer base. A list of automation protocols is being compiled here.
Recently, OLE for Process Control (OPC) has become a widely accepted solution
for intercommunicating different hardware and software, allowing communication
even between devices originally not intended to be part of an industrial network.

Chapter 11
Trend in SCADA
There is a trend for plc and HMI/SCADA software to be more "mix-and-match". In
the mid-1990s, the typical DAQ I/O manufacturer supplied equipment that
communicated using proprietary protocols over a suitable-distance carrier like RS485. End users who invested in a particular vendor's hardware solution often found
themselves restricted to a limited choice of equipment when requirements changed
(e.g. system expansions or performance improvement). To mitigate such problems,
40

open communication protocols such as IEC870-5-101/104, DNP3 serial, and DNP3

LAN/WAN became increasingly popular among SCADA equipment manufacturers
and solution providers alike. Open architecture SCADA systems enabled users to
mix-and-match products from different vendors to develop solutions that were better
than those that could be achieved when restricted to a single vendor's product
offering.
Towards the late 1990s, the shift towards open communications continued with
individual I/O manufacturers as well, who adopted open message structures such as
Modbus RTU and Modbus ASCII (originally both developed by Modicon) over RS485. By 2000, most I/O makers offered completely open interfacing such as Modbus
TCP over Ethernet and IP.
The North American Electric Reliability Corporation (NERC) has specified that
electrical system data should be time-tagged to the nearest millisecond. Electrical
system SCADA systems provide this Sequence of events recorder function,
using Radio clocks to synchronize the RTU or distributed RTU clocks.
SCADA

systems

are

coming

in

line

with

standard

networking

technologies. Ethernet and TCP/IP based protocols are replacing the older
proprietary standards. Although certain characteristics of frame-based network
communication technology (determinism, synchronization, protocol selection,
environment suitability) have restricted the adoption of Ethernet in a few specialized
applications, the vast majority of markets have accepted Ethernet networks for
HMI/SCADA.
With the emergence of software as a service in the broader software industry, a few
vendors have begun offering application specific SCADA systems hosted on remote
platforms over the Internet. This removes the need to install and commission
systems at the end-user's facility and takes advantage of security features already
available in Internet technology, VPNs and SSL. Some concerns include
security, Internet connection reliability, and latency.
SCADA systems are becoming increasingly ubiquitous. Thin clients, web portals,
and web based products are gaining popularity with most major vendors. The
increased convenience of end users viewing their processes remotely introduces
security considerations. While these considerations are already considered solved in
41

other sectors of internet services, not all entities responsible for deploying SCADA
systems have understood the changes in accessibility and threat scope implicit in
connecting a system to the internet.

Chapter 12
Security issues
The move from proprietary technologies to more standardized and open solutions
together with the increased number of connections between SCADA systems and
office networks and the Internet has made them more vulnerable to attacks - see
references. Consequently, the security of SCADA-based systems has come into
question as they are increasingly seen as extremely vulnerable to cyber
warfare/cyber terrorism attacks.
In particular, security researchers are concerned about:

the lack of concern about security and authentication in the design, deployment
and operation of existing SCADA networks.

the mistaken belief that SCADA systems have the benefit of security through
obscurity through the use of specialized protocols and proprietary interfaces.

the mistaken belief that SCADA networks are secure because they are
purportedly physically secured.

the mistaken belief that SCADA networks are secure because they are
supposedly disconnected from the Internet.

SCADA systems are used to control and monitor physical processes, examples of
which are transmission of electricity, transportation of gas and oil in pipelines, water
distribution, traffic lights, and other systems used as the basis of modern society.
The security of these SCADA systems is important because compromise or
destruction of these systems would impact multiple areas of society far removed
from the original compromise. For example, a blackout caused by a compromised
electrical SCADA system would cause financial losses to all the customers that
42

received electricity from that source. How security will affect legacy SCADA and
new deployments remains to be seen.
There are two distinct threats to a modern SCADA system. First is the threat of
unauthorized access to the control software, whether it be human access or changes
induced intentionally or accidentally by virus infections and other software threats
residing on the control host machine. Second is the threat of packet access to the
network segments hosting SCADA devices. In many cases, there is rudimentary or
no security on the actual packet control protocol, so anyone who can send packets to
the SCADA device can control it. In many cases SCADA users assume that a VPN
is sufficient protection and are unaware that physical access to SCADA-related
network jacks and switches provides the ability to totally bypass all security on the
control software and fully control those SCADA networks. These kinds of physical
access attacks bypass firewall and VPN security and are best addressed by endpointto-endpoint authentication and authorization such as are commonly provided in the
non-SCADA world by in-device SSL or other cryptographic techniques.
Many vendors of SCADA and control products have begun to address these risks in
a

basic

sense

by

developing

industrial firewall and VPN solutions

for

lines

TCP/IP-based

of
SCADA

specialized
networks.

Additionally, application white listing solutions are being implemented because of

their ability to prevent malware and unauthorized application changes without the
performance impacts of traditional antivirus scans Also, the ISA Security
Compliance Institute (ISCI) is emerging to formalize SCADA security testing
starting as soon as 2009. ISCI is conceptually similar to private testing and
certification that has been performed by vendors since 2007. Eventually, standards
being defined by ISA99 WG4 will supersede the initial industry consortia efforts,
but probably not before 2011.
The increased interest in SCADA vulnerabilities has resulted in vulnerability
researchers discovering vulnerabilities in commercial SCADA software and more
general offensive SCADA techniques presented to the general security
community. In electric and gas utility SCADA systems, the vulnerability of the large
installed base of wired and wireless serial communications links is addressed in
some cases by applying bump-in-the-wire devices that employ authentication

43

and Advanced Encryption Standard encryption rather than replacing all existing
nodes.

Chapter 13
Application Development

Fig 13 : Oil and gas scada installation

13.1 Configuration

The development of the applications is typically done in two stages. First the process
parameters and associated information (e.g. relating to alarm conditions) are defined
44

through some sort of parameter definition template and then the graphics, including
trending and alarm displays are developed, and linked where appropriate to the
process parameters. The products also provide an ASCII Export/Import facility for
the configuration data (parameter definitions), which enables large numbers of
parameters to be configured in a more efficient manner using an external editor such
as Excel and then importing the data into the configuration database.
However, many of the PC tools now have a Windows Explorer type development
studio. The developer then works with a number of folders, which each contains a
different aspect of the configuration, including the graphics.
The facilities provided by the products for configuring very large numbers of
parameters are not very strong. However, this has not really been an issue so far for
most of the products to-date, as large applications are typically about 50K I/O points
and database population from within an ASCII editor such as Excel is still a
workable option.
On-line modifications to the configuration database and the graphics are generally
possible with the appropriate level of privileges.

13.2 Development Tools

The following development tools are provided as standard:

A graphics editor, with standard drawing facilities including freehand, lines,

squares circles, etc. It is possible to import pictures in many formats as well as
using predefined symbols including e.g. trending charts, etc. A library of generic
symbols is provided that can be linked dynamically to variables and animated as
they change. It is also possible to create links between views so as to ease
navigation at run-time.

A data base configuration tool (usually through parameter templates). It is in

general possible to export data in ASCII files so as to be edited through an
ASCII editor or Excel.

A scripting language

An Application Program Interface (API) supporting C, C++, VB

45

Chapter 14
Evolution
SCADA vendors release one major version and one to two additional minor versions
once per year. These products evolve thus very rapidly so as to take advantage of
new market opportunities, to meet new requirements of their customers and to take
advantage of new technologies.
As was already mentioned, most of the SCADA products that were evaluated
decompose the process in "atomic" parameters to which a Tag-name is associated.
This is impractical in the case of very large processes when very large sets of Tags
need to be configured. As the industrial applications are increasing in size, new
SCADA versions are now being designed to handle devices and even entire systems
as full entities (classes) that encapsulate all their specific attributes and functionality.
In addition, they will also support multi-team development.
As far as new technologies are concerned, the SCADA products are now adopting:

Web technology, ActiveX, Java, etc.

OPC as a means for communicating internally between the client and server
modules. It should thus be possible to connect OPC compliant third party
modules to that SCADA product.

Chapter 15
Engineering
Whilst one should rightly anticipate significant development and maintenance
savings by adopting a SCADA product for the implementation of a control system, it
does not mean a "no effort" operation. The need for proper engineering cannot be
sufficiently emphasized to reduce development effort and to reach a system that
complies with the requirements, that is economical in development and maintenance
46

and that is reliable and robust. Examples of engineering activities specific to the use
of a SCADA system are the definition of:

a library of objects (PLC, device, subsystem) complete with standard object

behavior (script, sequences, ...), graphical interface and associated scripts for
animation,

templates for different types of "panels", e.g. alarms,

instructions on how to control e.g. a device ...,

A mechanism to prevent conflicting controls (if not provided with the SCADA),
alarm levels, behavior to be adopted in case of specific alarms.

Fig14 : Tower

Chapter 16
Potential benefits of SCADA
The benefits one can expect from adopting a SCADA system for the control of
experimental physics facilities can be summarized as follows:

A rich functionality and extensive development facilities. The amount of effort

invested in SCADA product amounts to 50 to 100 p-years!

47

The amount of specific development that needs to be performed by the end-user

is limited, especially with suitable engineering.

Reliability and robustness. These systems are used for mission critical industrial
processes where reliability and performance are paramount. In addition, specific
development is performed within a well-established framework that enhances
reliability and robustness.

Technical support and maintenance by the vendor.

Fig15 : Maintenance

48

Chapter 17
CONCLUSION

SCADA is used for the constructive working not for the destructive work using a
SCADA system for their controls ensures a common framework not only for the
development of the specific applications but also for operating the detectors.
Operators experience the same "look and feel" whatever part of the experiment
they control. However, this aspect also depends to a Significant extent on proper
engineering.

Chapter 18
REFERENCES

Note: this article is based on a very similar one that has been published in the
Proceedings of the 7th International Conference on Accelerator and Large
Experimental Physics Control Systems, held in Trieste, Italy, 4 - 8 Oct. 1999.
[1] A.Daneels, W.Salter, "Technology Survey Summary of Study Report", ITCO/98-08-09, CERN, Geneva 26th Aug 1998.
[2] A.Daneels, W.Salter, "Selection and Evaluation of Commercial SCADA Systems
for the Controls of the CERN LHC Experiments", Proceedings of the 1999
International Conference on Accelerator and Large Experimental Physics Control
Systems, Trieste, 1999, p.353.
[3] G.Baribaud et al., "Recommendations for the Use of Fieldbuses at CERN in the
LHC Era", Proceedings of the 1997 International Conference on Accelerator and
Large Experimental Physics Control Systems, Beijing, 1997, p.285.
[4] R.Barillere et al., "Results of the OPC Evaluation done within the JCOP for the
Control of the LHC Experiments", Proceedings of the 1999 International Conference
on Accelerator and Large Experimental Physics Control Systems, Trieste, 1999,
p.511.
49