troubleshooting of scada & data acquisition systems rev4

1

www.eit.edu.au

Nuts and Bolts of

Troubleshooting of SCADA and

Data Acquisition Systemsby

Steve Mackay Dean of Engineering

www.eit.edu.au

Topics

• Background to SCADA

• A Simple SCADA & Data Acquisition

System

• Typical SCADA Communication Structures

• Troubleshooting Techniques for SCADA

Engineering Institute of Technology (EIT)

Troubleshooting of SCADA and Data Acquisition Systems Free Webinar

20/11/2017

2

www.eit.edu.au

EIT Micro-Course Series• Every two weeks we present a 35

to 45 minute interactive course

• Practical, useful with Q & A throughout

• PID loop Tuning / Arc Flash Protection, Functional Safety, Troubleshooting conveyors presented so far

• Upcoming: – Electrical Troubleshooting and

much much more…..

• Go to http://www.eit.edu.au/free-courses

• You get the recording and slides

www.eit.edu.au

Background to SCADA



20/11/2017

3

www.eit.edu.au

SCADA

Supervisory Control And Data Acquisition

– SCADA is not just Software or Hardware

– But a complete control system including

communications systems

www.eit.edu.au

SCADASupervisory Control and Data Acquisition



20/11/2017

4

www.eit.edu.au

Remote Terminal Unit

• The complete assembly of equipment at

an end point of the control system in the

field, factory or industrial site.

• This can be a Programmable Logic

Controller (PLC).

www.eit.edu.au

Typical SCADA System



20/11/2017

5

www.eit.edu.au

Local Area Networks

• High speed access

• Ethernet

• Industrial Ethernet

www.eit.edu.au

SCADA Systems Software

10



20/11/2017

6

www.eit.edu.au

Components of a SCADA System

I/ODatabase

RS-232Trend Server TaskReport Server Task

Input / Output Server Task

In InOut

Analog Digital

Out

Instrumentation& Control

DisplayServer #1

DisplayServer #2

Printer

RadioModem

RadioModem

11

www.eit.edu.au

Key Features• User Interface

• Graphics Displays

• Alarms

• Trends

• RTU (and PLC) Interface

• Scalability

• Access to data

• Database

• Networking

• Fault Tolerance and Redundancy

• Client/Server distributed processing

12



20/11/2017

7

www.eit.edu.au

SCADA Software Package• Centralized

– Central Control Room

– Distance Between RTU’s and Control Room

• Distributed

– De-Centralized Control

– Multiple Operators

• Proprietary

– Produced by a single company

• Open Standard

– Interoperability

13

www.eit.edu.au

Client Server for SCADA Systems

Display Node Display Node Display Node Printer

Local Area Network

Server Node

ProgrammableLogic

Controllers

Bridge

I/ODatabase

Databases

Tasks TaskI/O

Alarms

Alarms

Trends

Trends

Reports

DisplayDatabase

Report Display

14



20/11/2017

8

www.eit.edu.au

Mainframe

Management QualityControl

DisplayClient

DisplayClient

DisplayClient

DisplayClient

AlarmServer

I/OServer

PLC #1 PLC #2 PLC #3

PLC #4 PLC #5 PLC #6

TrendsServer

ReportServer

Bridge

FileServer

Engineering

LAN

LAN

LAN

RadioModem

LAN

RTU#1

RTU#2

15

www.eit.edu.au

Industrial Communications Protocols



20/11/2017

9

www.eit.edu.au

Topics

• EIA-232 Interface Standard

• EIA-485 Interface Standard

• MODBUS Protocol

• DNP 3.0 Protocol

www.eit.edu.au

RS-232 Connections (DB25)



20/11/2017

10

www.eit.edu.au

RS-232 Breakout Box

www.eit.edu.au

Protocol Analyzer Connections

Protocol

Analyzer



20/11/2017

11

www.eit.edu.au

RS-485 Review

www.eit.edu.au

EIA-485 interface standard

• Distances of up to 1200m

• Data Rates of up to 10Mbps

• 32 Line Drivers

• 32 Line Receivers

NOTE : Total of 32 devices on same line



20/11/2017

12

www.eit.edu.au

• RS-485 Is the Most Common Voltage

Standard in Use Today for Multi-drop

Communication Systems.

• This Is Because …

•It Is Very Resistant to Noise•It Can Send Data at High Speeds

•And Can Go Long Distances

RS 485

www.eit.edu.au

Two Wire Multidrop RS-485

R

R

G

GRX RX

TX TX

A A

B B

A A

B B

GWG GWG

Rt Rt

R

G

RX

TX

A

B

A

B

GWG

R

G

RX

TX

A

B

A

B

GWG

- Generator

- Receiver

- Circuit ground orcircuit common

- Protective ground orframe ground

- Green wire ground orpower system ground

G

R

GWG

Note: The RS-485 standard documentation

leaves out the invertes for the receiver

1200M (4000 FT)

TERMINATION RESISTORS AT BOTH ENDS ONLY



20/11/2017

13

www.eit.edu.au

R

R

G

G

RX RX

TX TX

A A

B B

A A

B B

GWG GWG

Master Slave

Rt

Rt

Rt

Rt

R

G

RX

TX

A

B

A

B

GWG

Slave

R

G

RX

TX

A

B

A

B

GWG

Slave- Generator

- Receiver

- Circuit ground orcircuit common

- Protective ground orframe ground

- Green wire ground orpower system ground

G

R

GWG

1200M (4000 FT)

Note: The RS-485 standard documentation

leaves out the invertes for the receiver

Four Wire Network

www.eit.edu.au

Installation of Bias Resistorsto Minimize Noise

B A560Ω 560Ω120Ω

120Ω



20/11/2017

14

www.eit.edu.au

MODBUS

www.eit.edu.au

Modbus Message Format



20/11/2017

15

www.eit.edu.au

Modbus PLC Notation

www.eit.edu.au

Messages & Functions

• Two types of messages:

– Query/response - specific slave addressd

– Broadcast - address 00, no response required

• Function codes specify:

– what the slave is to do

– what section of the memory map to find or deposit the data

• e.g. Coil Status, Input Status, Input Register,

Holding Register



20/11/2017

16

www.eit.edu.au

What is DNP3?

• Distributed Network Protocol Version 3.0

• Defines communications between:

– Master Stations

– Remote Telemetry Units (RTUs)

– Intelligent Electronic Devices (IEDs)

• More than just communications

• Originally developed in Electrical Utility

Industry

www.eit.edu.au

Designed for SCADA

• Features

– Time stamping

– Optimised use of bandwidth

– Reporting by exception

– Variety of operating modes

• Data Structure

– Analogs

– Binary

– Counters



20/11/2017

17

www.eit.edu.au

Why use DNP3?

• It is an open protocol

• It is optimised for SCADA communications

• It provides interoperability between different vendor’s

equipment

• It is supported by a substantial number of SCADA

equipment manufacturers

• It will provide immediate and long-term benefits to

users

www.eit.edu.au

Features of DNP3• Supports time stamped messages for Sequence of Event (SOE)

recording

• Breaks messages into multiple frames to provide optimum error

control and rapid communication sequences

• Allows peer-peer topology as well as master-slave

• Allows multiple master topology

• Provides user definable objects

• Provides for reporting by exception / event without polling by

master

• Provides for ‘changed data’ only responses

• Broadcast messages

• Secure configuration/file transfers

• Addressing for over 65,000 devices on a single link

• Provides Time synchronisation and time-stamped events

• Data link and application layer confirmation



20/11/2017

18

www.eit.edu.au

Troubleshooting and

Maintenance

www.eit.edu.au



20/11/2017

19

www.eit.edu.au

Troubleshooting the telemetry system

• Ensure that components are not removed on line whilst the system is powered up unless the manufacturer specifically indicates that this is permissible.

• Damage to components and modules can occur when removing whilst the system is still powered up.

• Ensure that the antenna system is not disconnected from the system unless a dummy load has been installed, otherwise the radio power amplifier may be damaged.

www.eit.edu.au

The RTU and component modules

Check:

• Analog input modules

• Digital input module

• Interface from RTU to PLC (RS-232 / RS-485)

• Privately owned cable

• Switched telephone line

• Analog or digital data links



20/11/2017

20

www.eit.edu.au

The master sites

• The master sites will generally consist of a more complete telemetry unit and higher quality radio equipment.

• The same troubleshooting techniques can be applied to the master site as are used at the RTUs.

• Additional equipment would include links to other master sites, to the central site and computer control facilities

www.eit.edu.au

The central site

• The operator stations

• The software for the system

• The communications network for the

operator stations



20/11/2017

21

www.eit.edu.au

The operator station and software

There is not much that can be done here if a system fails or has intermittent problems except to systematically replace each connected unit to identify the faulty module

• Operator terminal (normally a personal computer)

• Local area network card(s)

• Bridge unit to radio, microwave or landline system

• Printer connected to operator terminal

www.eit.edu.au

There are however a few problems which

can be examined:

• Operator terminal locks up

intermittently

• Throughput of the operator station and

associated system drops off

dramatically



20/11/2017

22

www.eit.edu.au

Maintenance tasks

• Whether the maintenance tasks are to be

undertaken internally by your company or

outsourced to a maintenance contractor, it

is vital that there is a comprehensive and

planned approach to maintenance

• Tasks should be broken down in to those

things done daily, weekly, monthly and

annually.

www.eit.edu.au

The maintenance unit system

• In industry today there is an increasing

tendency for companies to reduce

permanent staff to cover only the core

business of the company and to contract

out peripheral activities to specialist

maintenance companies.



20/11/2017

23

www.eit.edu.au

Thank You For Your Interest

If you are interested in further training, please visit:

The Engineering Institute of Technologies

www.eit.edu.au

IDC Technologies

www.idc-online.com



troubleshooting of scada & data acquisition systems rev4

Documents