SCADA Systems: A Practical Guide

SCADA systems are supervisory control and data acquisition installations: a master station polls remote terminal units and PLCs across wide-area links, keeps a live tag database, lets operators issue checked commands, and time-stamps every event so a shift team can rebuild a trip sequence later.

The supervisory layer sits above the devices that do the work. Relays trip breakers on their own, PLCs run interlocks in milliseconds, and the telecontrol link (IEC 60870-5-104:2006+AMD1:2016 on TCP/IP networks, IEEE 1815-2012 for DNP3 utilities) watches both and reports.

Commands travel more slowly than faults, by design.

Two boundaries matter up front. A trip decision belongs to the protection relay per IEC 60255-1:2022 and the device numbers in ANSI/IEEE C37.2-2022; the supervisory layer only observes and commands within an operator’s authority. And where a single machine needs local control alone, a PLC with a small panel costs less than any master station.

The sections below follow that order.

At a Glance: Facts That Decide a Project

• Supervisory control and data acquisition: one master station polls hundreds of remote units over wide-area links and keeps a live tag database.
• Scan cycles run 1 to 15 s for process values; protection tripping never waits for the scan and stays hardwired or local.
• Four layers: field devices, RTU or PLC, communication network, master station with operator screens.
• Protocols in practice: Modbus at device level, IEEE 1815-2012 (DNP3) for utilities, IEC 60870-5-104 for TCP/IP telecontrol, IEC 61850-8-1 inside substations.
• Time-stamped events at 1 ms resolution let a team reconstruct a trip sequence after the fact.
• Security follows IEC 62443-3-3: zones, conduits, no direct internet path, one account per person, patched gateways.
• Availability targets of 99.9% are bought with redundant servers, dual LANs and UPS-backed sites.
• A control command uses select-before-operate with a 2 s checkback window; without the checkback, the command aborts.

What Are SCADA Systems and What Do They Supervise?

Supervision answers four questions continuously: what is the equipment doing now, has anything crossed a limit, who changed what and when, and what happened during the last fault. Field instruments measure, protection relays decide, and the supervisory layer keeps the record and hands humans the controls.

Supervise is the operative word. The master station does not replace the relay or the PLC; it watches them, flags what they report, and issues commands that local logic then executes or rejects.

Nothing here runs itself.

Scale varies more than newcomers expect. A pumping station with 150 points runs happily on a gateway and one screen. A regional utility aggregates 20,000 or more tags from a hundred substations, and the interesting problems stop being electrical and become data problems: naming, deadbands, alarm floods. The physics is identical at both sizes. What changes is how much discipline the tag database needs.

Supervision also means watching the watchers. Battery voltages on the DC supply, relay self-diagnostic flags, RTU watchdog states and communication heartbeat counters all belong in the point list. A system that measures the process but not its own infrastructure fails quietly, and the first symptom is an operator who trusts a screen that stopped updating an hour ago.

Mature SCADA systems report on their own health before anyone asks.

Heartbeats cost nothing to configure.

Supervisory Control and Data Acquisition SCADA Systems: Four Layers from Sensor to Screen

The acronym expands to supervisory control and data acquisition, and each word carries weight. Supervisory distinguishes the layer from direct control: commands are issued, checked and logged, not fired at the equipment. Control covers setpoints and switch positions that operators legitimately make. Data acquisition covers measurement, status and events.

Pronounced SKAY-duh, the term dates from master stations of the 1970s, when telemetry over leased lines replaced telephone calls to switchmen.

The word attracts misuse. A dashboard that only displays a handful of values is visualization, not supervision. A plant-wide process control system is a DCS, a different animal with a different pedigree. And MES sits above it all, translating production plans into orders. Vendors blur these lines on purpose, which is why the sections below keep them separate.

When a specification says “SCADA system”, the buyer should insist on four things: remote units, a network, a master with a tag database, and operator screens with alarms.

Four layers. Nothing less.

Every working system decomposes into the same four layers, and every outage decomposes into one of them failing. The table below pairs each layer with its first symptom in operation, which is how commissioning engineers actually diagnose trouble.

Table 1. Four layers of a supervisory installation and the symptom that shows first when each one fails.

Between the remote unit and the master sits the gateway, and on real projects it is the part worth arguing about. A gateway that speaks Modbus downstream and IEC 60870-5-104 upstream, buffers events during link outages, and stores its own time stamps turns a fragile collection of devices into a site that survives a fiber cut without losing history. The ATN-400 communication gateway is built for exactly that role, buffering several thousand events while the uplink is down.

How SCADA Systems Work: Poll, Tag, Command, Log

Four motions repeat forever. Polling: the master asks each remote unit for fresh values on a cycle of 1 to 15 s, while the unit itself scans its inputs every 10 to 100 ms and reports changes immediately between polls. Tagging: every value lands in the master’s database with a name, an engineering unit, a quality flag and a time stamp.

Commanding is the motion outsiders underestimate: an operator selects a point, the remote unit checks the context and returns a checkback within a 2 s window, and only a matching execution completes the operation.

Logging closes the loop.

State changes, alarms and commands are written with millisecond time stamps, which is what makes a post-mortem possible at all.

Sequence-of-event recording deserves its own sentence. A breaker that changes state at 14:03:07.214 and an alarm that arrives at 14:03:09.500 are two facts; only the first tells an engineer anything. Remote units time-stamp changes against a synchronized clock at 1 ms resolution, so the master can order events across fifty sites into one causal chain. Systems that time-stamp on arrival produce an ordered list of network delays instead, and fault investigations stall.

Clock synchronization is therefore infrastructure, not an accessory. Sites in one substation usually discipline themselves from a GPS or BeiDou receiver feeding IRIG-B into every relay and RTU. Wide-area systems add an NTP or PTP source at the master so that the control room clock and the field clocks agree.

A common shortcut stamps events at the master from poll arrival times, and it survives until the first multi-site disturbance, when the reconstructed sequence reads as noise and the protection engineers rebuild the timeline from relay event files by hand.

Inside the SCADA Server: Polling, Historian and Failover

A SCADA server is the machine that runs the four motions: a polling engine driving every remote link, a real-time database holding the current value of each tag, an alarm processor, and a historian writing the time series to disk. Small SCADA systems put all four on one box. Utilities split them, because a historian writing 20,000 tags at 1 s resolution will starve a polling engine sharing the same disk.

Splitting is about contention, not fashion.

Sizing follows tag count and scan rate rather than the licence tier. A working rule: 5,000 tags polled at 1 s with 1 min historian storage needs two cores and 16 GB of RAM per server, and a redundant pair doubles that. Solid-state storage matters more than clock speed once the history passes a billion rows.

Failover is where cheap designs fail. Hot standby keeps the standby database synchronised continuously and switches in seconds. Cold standby saves money and costs an operator an hour of blind running. Ask which one the offer includes, and ask how long the switchover takes on real hardware.

Virtualization is normal now, with a caveat. Running the master on virtual machines is fine as long as the hypervisor host is not also the file server, the clock source is a physical GPS or NTP appliance, and the storage backing the historian is not thin-provisioned.

The server also defines the security boundary. Per IEC 62443-3-3:2013 it belongs in the control zone, reachable from the operator workstations through a defined conduit, and never directly from the office network or the internet.

RTU vs PLC: Which Device Sits at the Remote End

Both devices scan inputs, hold outputs and survive in cabinets.

The difference is conversation, not capability.

Modern RTUs can be programmed like PLCs, and modern PLCs speak utility protocols, so the choice is now a checklist rather than a doctrine. The table below is the checklist engineers actually argue from.

Table 2. RTU against PLC on the six questions that decide a remote site.

Two selection rules follow. Where a site must report events after a communication outage and run on solar power, an RTU wins. Where an interlock must trip a motor in under 20 ms or a latching circuit must hold state, a PLC wins, and the supervisory layer reads it as just another remote unit.

Mixed sites are the norm: a PLC for the machine, an RTU for the telecontrol link, a cable between them.

A pair of field examples makes the trade concrete. A mountain reservoir with no grid supply runs its gate logic in a compact PLC and hands status to an RTU that draws 4 W from a solar panel, buffering a week of events in case the radio link dies. A factory hall does the opposite: the PLC owns a short-circuit-prone machine with contactors and inrush to manage, and a wall-mounted screen replaces the radio entirely. Neither site needed the other’s architecture, and both were cheaper for it.

Protocols: Modbus, DNP3, IEC 60870-5-104 and IEC 61850

Protocol choice is determined less by merit than by geography and installed base.

The four that matter in power work, with the trap each one carries, are worth a table.

Table 3. The four protocols that carry power telemetry, and the trap each one hides.

Metering deserves a caution. Revenue accuracy is defined by IEC 62053-22:2020 for class 0.2S and 0.5S meters, and a telecontrol link has no accuracy class at all. Report energy from the meter; report energy from the gateway only for non-revenue monitoring.

Bandwidth and media shape the choice as much as features do. A 9600 bps serial link carries a few hundred points polled every 10 s with room to spare, and the same link collapses under a full change-of-state stream from a substation.

Modbus over RS-485 chains a dozen devices cheaply but inherits the slowest device on the wire. Wherever fiber or LTE reaches the site, report-by-exception protocols pay for themselves: the network carries events when they happen and silence when nothing changes, which is also what makes the link easy to secure and to monitor.

SCADA Systems vs DCS vs HMI: Where the Boundaries Sit

The three terms describe different answers to geography and speed. A local HMI is one screen next to one machine. A DCS owns a continuous process inside one fence and controls it through the second. SCADA systems own geography: many sites, one control room, long links, slow commands.

Table 4. Three architectures separated by reach, loop speed and what breaks first.

The practical consequence for buyers is scope discipline. If the vendor’s offer puts closed-loop control of a continuous process in the master station, the offer has quietly become a DCS bid at supervisory-layer prices.

Ask which layer owns each control loop, in writing.

What the System Monitors in an Electrical Substation

In power work the point list has a recognizable shape. Analogue values arrive from transducers or directly over IEC 61850: busbar voltage, feeder current, active and reactive power, transformer winding and oil temperatures, tap position, DC battery voltage at 110 V or 220 V, and room conditions. Status points follow the primary plant: breaker open/closed with an intermediate flag, disconnector and earthing switch positions, relay operation flags, and communication equipment health.

The protection layer reports upward in two qualities. Instantaneous flags and measurements flow to the operator; full event records and waveform files stay in the relay and the digital fault recorder until someone asks for them. The division of labor matters: how a digital fault recorder works explains why COMTRADE waveforms are captured locally at kilohertz rates, while the ANSI device function numbers tell the master which function operated. The supervisory layer consumes both but replays neither.

Data quality gets its own budget in a serious point list. Every analogue point needs a deadband, a scaling check and a plausibility range, because a failed transducer usually reports the worst thing possible: a number that looks healthy.

A feeder current stuck at 412 A for six hours is frozen, not steady; a busbar voltage that jumps from 10.4 kV to 23.5 kV in one poll is a scaling error, not a grid event. The tag database should carry quality flags from the remote unit, and the screens should render bad quality as a visible state, never as zero.

Alarms and Event Records Worth Acting On

An alarm is a promise that someone will act. IEC 62682:2022 formalizes the lifecycle: each alarm is justified, assigned a priority and a consequence, and reviewed against operator workload. The industry benchmark is roughly 10 alarms per operator per 10 minutes in steady operation and no more than a handful during a major upset; plants that ignore the benchmark produce alarm floods in which the one significant alarm drowns.

Three practices separate usable systems from noisy ones. First, deadbands: report a busbar voltage at 0.5% change, not on every flutter. Second, naming: a tag scheme such as voltage level, bay, device, quantity keeps a thousand points readable, and a renaming campaign after commissioning costs more than doing it first. Third, event discipline: command logs record who did what, so the morning report writes itself.

Two more practices earn their keep during disturbances. First-out indication identifies the single alarm that started a cascade, and a scheme without it makes ten operators argue about cause and effect while the plant waits. Shelving is the second: an operator must be able to park a known-bad point for a shift, with a note and an expiry, instead of acknowledging the same broken transducer forty times a day. Both behaviors are configuration work on the master, and both belong in the acceptance tests rather than in a promise.

Redundancy and Availability: What Duplicated Hardware Buys

An availability target of 99.9% allows 8.8 hours of downtime per year, and the target is met with structure rather than heroics. Redundant master servers in hot standby cut over in seconds. Dual LANs per IEC 62439-3, either PRP or HSR, remove the single switch that takes down a substation. UPS capacity of 30 minutes covers most grid disturbances. What redundancy does not do is fix a bad point list or an unrationalized alarm scheme; duplication amplifies whatever exists, including mistakes.

Redundancy also has a budget, and it belongs where the cost of loss is highest. Duplicating a master server is proportionate for a hundred substations. Duplicating the RTU of a station that is visited weekly is usually not; a buffered gateway and a spares contract are cheaper than the second unit.

Availability math belongs in the specification, not in a brochure. Downtime comes from three sources in practice: planned maintenance windows, unplanned hardware failure, and slow failure detection. A maintenance window of one night per quarter costs about 0.4% availability by itself, so a 99.9% target forces the windows to be short and the spares to be on the shelf.

Detection is the cheapest improvement of all.

Security: IEC 62443 Zones, Conduits and the Password List

IEC 62443-3-3:2013 gives the system design its vocabulary: zones of trusted equipment joined by conduits with defined security levels, and a target security level chosen per zone rather than per fantasy.

In practice the checklist is short and unforgiving. The control network has no direct route to the internet; remote access passes a jump host with recorded sessions. Every account belongs to one named person, because shared accounts make an audit trail worthless. Default passwords are changed before commissioning day, not after the first audit. Gateways and servers run a documented firmware level with a patch window.

Component-level requirements live in IEC 62443-4-2:2019, and procurement can simply demand a conformance claim in the RFQ. The cheapest hardening is still architectural: a DMZ between office and control networks, one-way data flow where reports only leave, and encrypted telecontrol sessions on any link that leaves the utility’s own fiber.

What Belongs in the Specification

A specification that names the four layers, the protocols and the acceptance tests will collect comparable bids.

The items that decide the outcome:

• Point list by type and count: analogue, status, control, accumulator, with per-bay breakdown.
• Reporting: poll cycles, change-of-state deadbands, SOE resolution of 1 ms where post-mortem analysis matters.
• Protocols per interface, including which end is master and which is slave.
• Redundancy and availability: server mode, LAN scheme, UPS autonomy, and the numbers behind the 99.9% claim.
• Historian retention: 1 s data for 30 days and 1 min data for 5 years is a common starting pair.
• Security baseline: zone diagram, account policy, firmware level, and an IEC 62443-4-2 conformance claim.
• Acceptance: FAT with a point-to-point test on real hardware, then SAT on site, with the test sheets attached.
• Spares and support: which boards are stocked, for how long, at what response time.

Cabinet integration is where the specification meets the workshop. A power monitoring SCADA cabinet arrives with the gateway, the transducers, the terminal blocks and the wiring already point-tested, which removes the classic interface argument between the panel builder and the integrator. The same logic applies to the measurement and control devices inside protection panels: their points belong in the same database from day one, not in a parallel spreadsheet.

Acceptance testing deserves more than a line item. A factory acceptance test runs every point end to end on real hardware: inject a signal at the transducer terminal, watch the value arrive on the operator screen with the right scaling and time stamp, then command a real output and watch the contact close.

A hundred-point sample is typical on large projects, with the remainder tested on site during SAT. Test sheets signed per point are the deliverable that prevents the most expensive sentence in this industry: the system was accepted, but nobody verified the scaling.

When SCADA Systems Are the Wrong Choice

Honest specifications list what the system must not do.

Six boundaries come up on nearly every project:

• Protection tripping. Fault clearing runs through the trip coil on hardwired paths sized per IEC 60255-1:2022; no operator command loop belongs in that chain, at any latency.
• Sub-100 ms interlocking. Logic that must outrun a contactor or catch an inrush event lives in the PLC or the relay, not in a polled master.
• Single-machine local control. One pump, one panel, twenty points: a local HMI costs a fraction of a master station and needs no annual license.
• Revenue metering. Billing needs an IEC 62053-22:2020 class 0.2S or 0.5S meter; a telecontrol point has no accuracy class.
• Safety instrumented functions. Emergency stops and interlocks demanding a defined safety level are engineered and certified separately; a supervisory command is not a safety function.
• Asset analytics. Condition trending, thermography archives and maintenance planning belong to a historian or CMMS that reads from the telecontrol layer, not to the operator’s screen.

Where a requirement crosses one of these lines, the fix is to add the right component, not to stretch the supervisory layer. Most integration disasters in this field are stretched-layer disasters.

Frequently Asked Questions

What does SCADA stand for?

Supervisory control and data acquisition. Pronounced SKAY-duh, the name describes a master station that acquires data from remote sites and supervises equipment through checked operator commands.

How often does the master station poll a remote site?

Typical poll cycles run 1 to 15 seconds for analogue values, while change-of-state events report immediately. A remote unit scans its own inputs every 10 to 100 milliseconds, so the site data is fresher than the poll interval.

Can the operator trip a breaker from the control centre?

Yes, through select-before-operate: the master selects the point, the remote unit checks the context and returns a checkback within a 2 second window, and only then executes. Tripping for faults stays with the protection relay, which acts in cycles rather than seconds.

What is the shortest SCADA definition?

A telemetry system with operator control: it measures, watches, records and commands equipment across distances that make manual operation impractical.

Which protocol suits a utility with mixed old and new sites?

Expect IEC 60870-5-104 on TCP/IP backbones, DNP3 where the incumbent fleet already speaks it, and Modbus at the device level. A protocol gateway at each site removes the need to standardize everything at once.

How is the operator interface kept secure?

Follow IEC 62443-3-3:2013 zones and conduits, keep the control network off the internet, use one account per person, change every default password, and log each command with its user name.

What point count justifies a full master station?

Small sites live comfortably on a gateway with 100 to 500 points. Once several substations push 5,000 or more tags, alarm rationalization and a historian become the reasons a dedicated master station pays for itself.

What hardware does a SCADA server need?

Two cores and 16 GB of RAM per server cover roughly 5,000 tags polled at 1 s with 1 min historian storage. Solid-state storage matters more than clock speed once the historian passes a billion rows, and a redundant pair doubles the whole budget.

Conclusion

SCADA systems succeed when their scope is supervisory and their point list is honest: a master that watches and commands within limits, remote units that time-stamp what happened, a network that is engineered rather than assumed, and alarms that a person can actually answer. Get the boundaries right, specify the layers separately, and the installation becomes the quiet part of the plant, which is the highest compliment this layer of equipment ever earns.

Related Reading

• Pump station automation and control: a worked application of the four-layer architecture at water and sewage sites.
• How to select a digital fault recorder for the waveform records that the supervisory layer links to but never replaces.
• ANSI device function numbers explained, the naming scheme behind every status flag the master receives.
• Measurement and control devices in protection relays, the source of most analogue points on the screen.

Technical References

Table 5. Standards cited in this guide, with the edition in force at the time of writing.

Written by Leon Zhang, Protection Application Engineer · Technical review by Li Ming, Electrical Engineer · Last reviewed 2026-10-22