Scada Seminar Report 4m6i22

VISVESVARAYA TECHNOLOGICAL UNIVERSITY BELGAUM - 590018

A SEMINAR REPORT ON

SUPERVISORY CONTROL AND DATA ACQUISITION NISHANT KUMAR 8th Semester USN: 4BD11EC066 Department Of E&C Engineering, BIET, Davangere

Under the guidance of: PROJECT GUIDE Mr. D. S. BABU

1

Table of Contents CONTENTS

Page no.

1. Abstract………………………………………………………….. 3 2. Introduction…………………………………………………..….. 4 3. Overview of SCADA system……………………………………. 5 4. SCADA system concepts………………………………………... 7 5. Functions of SCADA system……………………………………. 9 6. Elements of SCADA system…………………………………….. 12 7. Evolution of SCADA system…………………………………….. 16 8. SCADA communication protocols……………………………….. 20 9. Deploying SCADA systems: Communication media……………. 21 10.Security concerns of SCADA systems…………………………… 24 11.Advantages and disadvantages…………………………………… 25 12.Conclusion………………………………………………………... 26 13.References………………………………………………………… 27

2

ABSTRACT

SCADA is an acronym for Supervisory Control and Data Acquisition, which is a computer system for gathering and analysing real-time data. Such systems were first used in the 1960s. The SCADA industry was essentially born out of a need for a -friendly front-end to a control system containing PLCs (programmable logic controllers). SCADA networks allow remote monitoring and control of an amazing variety of industrial devices, such as water and gas pumps, track switches, and traffic signals. One of the key processes of SCADA is the ability to monitor an entire system in real time. This is facilitated by data acquisitions. These include meter reading and checking statuses of sensors. These data points are communicated at standard intervals depending on the system. Besides the data being used by the RTU, it is also displayed to a human. The human is able to interface with the system to override settings or make changes when needed. SCADA can also be seen as a system with many data elements called points. Each point is a monitor or sensor and these points can be either hard or soft. A hard data point can be an actual monitor; a soft point can be viewed upon as an application or software calculation. Data elements from hard and soft points are usually always stored and logged to create a time stamp or history. In essence, a SCADA application has two elements. They are: 1. The process/system/machinery you want to monitor and control. This can take the form of a power plant, a water system, a network, or a system of traffic lights. 2. A network of intelligent devices that interfaces with the first system through sensors and control outputs. This network, which is the SCADA system, gives you the capability to measure and control specific elements of the first system. Throughout this report, we will be looking into the various aspect of implementing a SCADA system and also discussing other concepts related to the application of this system. 3

INTRODUCTION SCADA (supervisory control and data acquisition) is a system operating with coded signals over communication channels so as to provide control of remote equipment (using typically one communication channel per remote station). The control system may be combined with a data acquisition system by adding the use of coded signals over communication channels to acquire information about the status of the remote equipment for display or for recording functions. It is a type of industrial control system (ICS). Industrial control systems are computer-based systems that monitor and control industrial processes that exist in the physical world. SCADA systems historically distinguish themselves from other ICS systems by being large-scale processes that can include multiple sites, and large distances. These processes include industrial, infrastructure, and facility-based processes, as described below:

 Industrial processes include those of manufacturing, production, power generation, fabrication, and refining, and may run in continuous, batch, repetitive, or discrete modes.  Infrastructure processes may be public or private, and include water treatment and distribution, wastewater collection and treatment, oil and gas pipelines, electrical power transmission and distribution, wind farms, civil defence siren systems, and large communication systems.  Facility processes occur both in public facilities and private ones, including buildings, airports, ships, and space stations. They monitor and control heating, ventilation, and air conditioning systems (HVAC), access, and energy consumption.

4

Overview of SCADA systems A typical SCADA system can be shown as in the figure below:

Fig1: A typical SCADA system A SCADA system usually consists of the following subsystems:  Remote terminal units (RTUs) connect to sensors in the process and convert sensor signals to digital data. They have telemetry hardware capable of sending digital data to the supervisory system, as well as receiving digital commands from the supervisory system. RTUs often have embedded control capabilities such as ladder logic in order to accomplish Boolean logic operations.  Programmable logic controller (PLCs) connect to sensors in the process and converting sensor signals to digital data. PLCs have more sophisticated embedded control capabilities, typically one or more IEC 61131-3 programming languages, than RTUs. PLCs do not have telemetry hardware, although this functionality is typically installed alongside them. PLCs are sometimes used in place of RTUs as field devices because they are more economical, versatile, flexible, and configurable. 5

 A telemetry system is typically used to connect PLCs and RTUs with control centres, data warehouses, and the enterprise. Examples of wired telemetry media used in SCADA systems include leased telephone lines and WAN circuits. Examples of wireless telemetry media used in SCADA systems include satellite (VSAT), licensed and unlicensed radio, cellular and microwave.  A data acquisition server is a software service which uses industrial protocols to connect software services, via telemetry, with field devices such as RTUs and PLCs. It allows clients to access data from these field devices using standard protocols.  A human–machine interface or HMI is the apparatus or device which presents processed data to a human operator, and through this, the human operator monitors and interacts with the process. The HMI is a client that requests data from a data acquisition server.  A Historian is a software service which accumulates time-stamped data, Boolean events, and Boolean alarms in a database which can be queried or used to populate graphic trends in the HMI. The historian is a client that requests data from a data acquisition server.  A supervisory (computer) system, gathering (acquiring) data on the process and sending commands (control) to the SCADA system.  Communication infrastructure connecting the supervisory system to the remote terminal units.  Various process and analytical instrumentation.

6

SCADA system concepts The term SCADA (Supervisory Control and Data Acquisition) usually refers to centralized systems which monitor and control entire sites, or complexes of systems spread out over large areas (anything from an industrial plant to a nation). Most control actions are performed automatically by RTUs or by PLCs. Host control functions are usually restricted to basic overriding or supervisory level intervention. For example, a PLC may control the flow of cooling water through part of an industrial process, but the SCADA system may allow operators to change the set points for the flow, and enable alarm conditions, such as loss of flow and high temperature, to be displayed and recorded. The control loop es through the RTU or PLC, while the SCADA system monitors the overall performance of the loop.

Fig2: A SCADA’s schematic overview

Data acquisition begins at the RTU or PLC level and includes meter readings and equipment status reports that are communicated to SCADA as required. Data is then compiled and formatted in such a way that a control room operator using the HMI can make supervisory decisions to adjust or override normal RTU (PLC) controls. Data may also be fed to a Historian, often built on a commodity Database Management System, to allow trending and other analytical auditing. 7

SCADA systems typically implement a distributed database, commonly referred to as a tag database, which contains data elements called tags or points. A point represents a single input or output value monitored or controlled by the system. Points can be either "hard" or "soft". A hard point represents an actual input or output within the system, while a soft point results from logic and math operations applied to other points. (Most implementations conceptually remove the distinction by making every property a "soft" point expression, which may, in the simplest case, equal a single hard point.) Points are normally stored as value-timestamp pairs: a value, and the timestamp when it was recorded or calculated. A series of value-timestamp pairs gives the history of that point. It is also common to store additional metadata with tags, such as the path to a field device or PLC , design time comments, and alarm information.

8

Functions of a SCADA System

1. A SCADA system performs four functions: 1.1 Data Acquisition: SCADA system needs to monitor hundreds or thousands of sensors. Sensors measure: 1. Inputs and outputs e.g. water flowing into a reservoir (input), valve pressure as water is released from the reservoir (output). 2. Discrete inputs (or digital input) e.g. whether equipment is on or off, or tripwire alarms, like a power failure at a critical facility. 3. Anaputs where exact measurement is important e.g. to detect continuous changes in a voltage or current input, to track fluid levels in tanks, voltage levels in batteries, temperature and other factors that can be measured in a continuous range of input. • For most analogue factors, there is a normal range defined by a bottom and top level e.g. temperature in a server room between 15 and 25 degrees Centigrade. If the temperature goes outside this range, it will trigger a threshold alarm. • In more advanced systems, there are four threshold alarms for analogue sensors, defining  Major Under, Minor Under, Minor Over and Major Over alarms.

1.2 Networked Data Communication: A communications network is required to monitor multiple systems from a central location. • TREND: Put SCADA data on Ethernet and IP over SONET. • SECURITY: Keeping data on closed LAN/WANs without exposing sensitive data to the open Internet. • Encode data in protocol format (use open, standard protocols and protocol mediation) • Sensors and control relays can’t generate or interpret protocol communication - a remote telemetry unit (RTU) is needed to provide an interface between the sensors and the SCADA network. 9

•

RTU encodes sensor inputs into protocol format and forwards them to the SCADA master. • RTU receives control commands in protocol format from the master and transmits electrical signals to the appropriate control relays.

1.3 Data Presentation SCADA systems report to human operators over a master station, HMI (Human-Machine Interface) or HCI (Human-Computer Interface). SCADA master station has several different functions: • • • • •

Continuously monitors all sensors and alerts the operator when there is an “alarm”. Presents a comprehensive view of the entire managed system. Presents more detail in response to requests. Performs data processing on information gathered from sensors. Maintains report logs and summarizes historical trends.

1.4 Control The control mechanism in a SCADA system is handled by a number of equipments such as the Remote Terminal Units (RTU), Programmable Logic Controllers (PLC), switchgears, etc. which work autonomously by means of a dedicated communication network such as LAN or WAN that carries signals toand-from these devices. The LAN and WAN form the backbone of the control system. The SCADA master station computer system plays an important role in this context. It channelizes the signals between the and the various field components in real-time and displays the inputs and outputs generated through a human-machine interface (HMI). An important part of most SCADA control implementations is alarm handling. The system monitors whether certain alarm conditions are satisfied, to determine when an alarm event has occurred. Once an alarm event has been detected, one or more actions are taken (such as the activation of one or more alarm indicators, and perhaps the generation of email or text messages so that management or remote SCADA operators are informed). In many cases, a SCADA operator may have to acknowledge the alarm event; this may deactivate some alarm indicators, whereas other indicators remain active until the alarm conditions are cleared. Alarm conditions can be explicit—for example, an alarm point is a digital status point that has either the value 10

NORMAL or ALARM that is calculated by a formula based on the values in other analogue and digital points—or implicit: the SCADA system might automatically monitor whether the value in an analogue point lies outside high and low- limit values associated with that point. Examples of alarm indicators include a siren, a pop-up box on a screen, or a coloured or flashing area on a screen (that might act in a similar way to the "fuel tank empty" light in a car); in each case, the role of the alarm indicator is to draw the operator's attention to the part of the system 'in alarm' so that appropriate action can be taken.

11

Elements of SCADA system 1. SCADA Master Station Computer Systems:

Fig3: SCADA master station computer system It is the repository of the real-time or near real-time reported data collected from the remote terminal units connected to it. The back end SCADA software must be able to repeatedly poll the RTUs for data values, should have software for their retrieval, storage and processing. The processing may include unit conversion, cataloguing into tables etc.

2. Human-Machine Interface:

Fig4: A typical human-machine interface 12

This is the part on the host station. The values that have been stored in the host computers are presented to the human operator in an understandable and comprehensible form using HMIs. These may provide trending, diagnostic or management information and detailed schematics and animations representing the current states of the machines under its control. Pictorial representation being more understandable to humans is the preferred form in SCADA HMIs.

3. Remote Terminal Units (RTUs):

Fig5: A remote terminal unit

An RTU is a normally a transducer or a sensor which allows the electrical circuitry to interface with the process instrumentation and control equipment. The physical parameter like pressure, temperature etc. are measured through a change in electrical property of some component in the transducer which is indicative of the physical change. A single RTU may measure many different types of parameters. Depending on the values of the measurements, the input/output circuitry of a RTU can be Analog or digital. Analog corresponds to measurements with a numeric range of continuous values which are later converted using an ADC, like a temperature scale, while digital have limited number of states (generally two) mainly used for flagging. Specific signals can be generated to control process 13

equipment. These days, RTUs are microprocessor based devices and these conversions are primarily internal to them.

4. Programmable Logic Controllers:

Fig6: Programmable logic controller The use of microprocessors on RTUs has helped RTUs become smarter with increased functionality. PLCs have been built around the philosophy of automation. Re-programmability being the biggest asset, PLC based RTUs can be debugged and fixed on the field itself along with adding new features like for multiple polling, exception reporting, time-tagging etc. This also enables them to execute simple logical processes without involving the master station. Standardization of protocols and languages for RTUs too, for example the standardized control programming language, IEC 61131-3.These languages require very less training and are based on intuitive approach unlike procedural languages like C and FORTRAN.

14

5. SCADA Communication

Fig7: SCADA communication system

The conveying of data from an RTU to the master station and commands from the host to the RTU need to be done over a communication system since a SCADA system might not be localized to just a single plant. The vastness of the network also has to be catered to along with speed, accuracy, security and performance being among other important issues. SCADA systems have also embraced LANs and WANs for seamless integration with everyday office computer networks. This has an advantage for the corporate s that they would not need a separate parallel network for SCADA systems.

15

Evolution of SCADA systems The SCADA system evolution can be classified into 4 generations.  First generation : Monolithic SCADA

Fig8: Monolithic SCADA system Early SCADA system computing was done by large minicomputers. Common network services did not exist at the time SCADA was developed. Thus SCADA systems were independent systems with no connectivity to other systems. The communication protocols used were strictly proprietary at that time. The first-generation SCADA system redundancy was achieved using a back-up mainframe system connected to all the Remote Terminal Unit sites and was used in the event of failure of the primary mainframe system.

16

 Second generation : Distributed SCADA

Fig9: Distributed SCADA system SCADA information and command processing was distributed across multiple stations which were connected through a LAN. Information was shared in near real time. Each station was responsible for a particular task thus making the size and cost of each station less than the one used in First Generation. The network protocols used were still not standardized. Since the protocols were proprietary, very few people beyond the developers knew enough to determine how secure a SCADA installation was. Security of the SCADA installation was usually overlooked.

17

 Third generation : Networked SCADA

Fig10: Networked SCADA system Similar to a distributed architecture, any complex SCADA can be reduced to simplest components and connected through communication protocols. In the case of a networked design, the system may be spread across more than one LAN network called a process control network (PCN) and separated geographically. Several distributed architecture SCADAs running in parallel, with a single supervisor and historian, could be considered a network architecture. This allows for a more cost effective solution in very large scale systems.

18

 Fourth generation : Cloud-based SCADA

Fig11: Cloud-based SCADA system With the commercial availability of cloud computing, SCADA systems have increasingly adopted Internet of Things technology to significantly reduce infrastructure costs and increase ease of maintenance and integration. As a result SCADA systems can now report state in near real-time and use the horizontal scale available in cloud environments to implement more complex control algorithms than are practically feasible to implement on traditional programmable logic controllers. Further, the use of open network protocols such as TLS inherent in the ‘Internet of Things’ technology, provides a more readily comprehensible and manageable security boundary than the heterogeneous mix of proprietary network protocols typical of many decentralized SCADA implementations. One such example of this technology is an innovative approach to rainwater harvesting through the implementation of real time controls (RTC).

19

SCADA Communication Protocols The communication protocols used in SCADA systems operate at different layers as shown in the figure:

Typical features of the SCADA networking protocols are:  SCADA protocols are designed to be very compact. Many are designed to send information only when the master station polls the RTU.  Typical legacy SCADA protocols include Modbus RTU, RP-570, Profibus and Conitel. These communication protocols are all SCADAvendor specific but are widely adopted and used. Standard protocols are IEC 60870-5-101 or 104, IEC 61850 and DNP3.  These communication protocols are standardized and recognized by all major SCADA vendors. Many of these protocols now contain extensions to operate over T/IP.

20

Deploying SCADA systems: Communication media The various communication media used in SCADA systems are: 1. Twisted-Pair Metallic Cable:

Fig12: Twisted-pair cable 2. Coaxial Metallic Cable:

Fig13: Coaxial cable

21

3. Fiber Optic Cable:

Fig14: Fiber-optic cable 4. Power Line Carrier:

Fig15: Power cable

22

5. Satellites

Fig16: Satellite Link 6. Leased Telephone Lines

Fig17: Leased telephone line

7. Very High Frequency Radio 8. Ultra High Frequency Radio

23

Security Concerns of SCADA system SCADA systems that tie together decentralized facilities such as power, oil, and gas pipelines and water distribution and wastewater collection systems were designed to be open, robust, and easily operated and repaired, but not necessarily secure. The security of these SCADA systems is important because compromise or destruction of these systems would impact multiple areas of society far removed from the original compromise. For example, a blackout caused by a compromised electrical SCADA system would cause financial losses to all the customers that received electricity from that source. The move from proprietary technologies to more standardized and open solutions together with the increased number of connections between SCADA systems, office networks, and the Internet has made them more vulnerable to types of network attacks that are relatively common in computer security.  For example, United States Computer Emergency Readiness Team (US-CERT) released a vulnerability advisory that allowed unauthenticated s to sensitive configuration information including hashes on an Inductive Automation Ignition system utilizing a standard attack type leveraging access to the Tomcat Embedded Web server.  In June 2010, anti-virus security company VirusBlokAda reported the first detection of malware that attacks SCADA systems (Siemens' WinCC/PCS 7 systems) running on Windows operating systems. The malware is called Stuxnet and uses four zero-day attacks to install a rootkit which in turn logs into the SCADA's database and steals design and control files. The malware is also capable of changing the control system and hiding those changes. The malware was found on 14 systems, the majority of which were located in Iran.  In October 2013 National Geographic released a docudrama titled, "American Blackout" which dealt with a large-scale cyber-attack on SCADA and the United States' electrical grid.

24

Advantages & Disadvantages of SCADA systems

Increased efficiency

Maximized safety

Advantages

Maximized profitability

Vulnerable to cyber threats such as hacking and cyberterrorism. Disadvantages Vulnerable to EMP (electro-magnetic pulse)

25

CONCLUSION SCADA is a step towards automation of the modern day industries irrespective of its domain, whereby the need for human supervision and interference will be minimum. Moreover, the vital key factors such as safety, profitability and efficiency can be enhanced, thereby reducing lags and losses caused due to human errors. SCADA will lead to the diversification of the modern industries in of goods, services and geographical aspects with an ability of real-time troubleshooting, analysis and control. Security being the major concern of the modern SCADA systems, many vendors of SCADA and control products have begun to address the risks posed by unauthorized access by developing lines of specialized industrial firewall and VPN solutions for T/IP-based SCADA networks as well as external SCADA monitoring and recording equipment. The International Society of Automation (ISA) started formalizing SCADA security requirements in 2007 with a working group, WG4. WG4 "deals specifically with unique technical requirements, measurements, and other features required to evaluate and assure security resilience and performance of industrial automation and control systems devices". Hence, the future of SCADA systems is towards a safer and reliable deployment of operations with the exploitation of trending services such as cloud services which are yet to be explored to its fullest.

26

REFERENCES

 Wikipedia page on SCADA: http://en.wikipedia.org/wiki/SCADA  “SCADA systems: April 2014” (http://www.engineersgarage.com/article/scada-systems)  Introduction to Industrial Control Networks” (http://www.rfidblog.org.uk/Preprint-Galloway-HanckeIndustrialControlSurvey.pdf)  Basic SCADA Animations (http://www.integraxor.com/screens.html?utm_content=en&utm_sou rce=wk)

27