Insights / Industrial IoT

What Is SCADA and How Does It Work?

What a SCADA system is made of, how data and commands move through it, how it evolved to web and IoT SCADA, and what to decide before modernising one.

Oil pumpjacks and a solar-powered monitoring cabinet, with a heat-map dashboard overlaid

The short answer

SCADA (supervisory control and data acquisition) is the layer that lets operators watch and steer industrial processes spread over a plant or a whole region. Field devices, RTUs and PLCs, read sensors and run fast local control. A communication network carries their data to central servers. HMIs show the process to people and send their commands back. SCADA supervises: the time-critical control loop stays in the PLC, while SCADA collects, stores, alarms and lets a person intervene.

Key takeaways

  • SCADA supervises; PLCs control. Keep safety and fast loops in the field controller, not in the central software.
  • The communication layer usually decides what is possible: polling rates, bandwidth and what happens during a link outage.
  • Web and IoT SCADA add remote access and analytics, and with them a much larger attack surface to design for.
  • Most modernisation adds a data layer beside existing SCADA rather than replacing controllers that already work.

Why supervisory control matters

Operators cannot manage what they cannot see. Pipelines, water networks, power distribution and production lines spread equipment over distances no one can walk every shift. Without a supervisory layer, someone has to visit each site to read a gauge, and a fault is found when it has already caused damage.

SCADA closes that gap. It turns thousands of field readings into one live picture, raises an alarm when a value leaves its safe range, and lets a person act from a control room instead of a truck. The engineering question is rarely whether to have SCADA. It is how the field, the network and the software should divide the work.

SCADA
Supervisory control and data acquisition: a system architecture that gathers data from distributed field devices, presents it to operators and sends supervisory commands back. Fast, deterministic control stays in the field controllers.

SCADA architecture: the four core components

SCADA is not one software tool. It is a layered system that bridges physical equipment and the applications people use.

An RTU, a rack of PLC modules, a servo drive and a network switch cabled to an HMI touch screen, with labels for HMIs, PLCs, RTUs and communication infrastructure
The four building blocks of SCADA: RTUs and PLCs at the equipment, the network that links them, and the HMI where operators see and act.

Remote terminal units (RTUs)

An RTU is a ruggedised, microprocessor-based unit at a remote site. It reads analog and digital signals from sensors, such as pressure, temperature, flow or a valve position, converts them into data the system can use, and reports them upstream. RTUs are built for sites with poor power and intermittent links, so they typically buffer data and timestamp events locally.

Programmable logic controllers (PLCs)

A PLC provides real-time automated control for fast processes. It runs a deterministic scan cycle: read inputs, execute control logic, write outputs, repeat. Interlocks and emergency stops belong here, because they must work whether or not the central system or the network is available. In practice the line between RTU and PLC has blurred; many sites use PLCs with communication modules in both roles.

Human-machine interfaces (HMIs)

The HMI is the visual layer. It turns process data into mimic diagrams, trends, alarm lists and controls, so an operator can see the state of a line or a network and intervene. An HMI can be a panel next to one machine or a set of screens in a control room that covers many sites.

Communication infrastructure

The network carries readings up and commands down. It can be fibre, Ethernet, licensed radio, cellular or satellite, often mixed within one system. Whatever the medium, the protocols must tolerate delay and loss, and the links must be secured, because they are a direct path to physical equipment.

SCADA components compared by what each one does, where it sits and what fails if it is missing.
ComponentMain jobWhere it sitsIf it fails
RTUAcquire field signals and report themRemote site, often unattendedThe site goes dark to operators; local buffering limits data loss
PLCDeterministic local control and interlocksNext to the machine or processThe process stops or falls back to its safe state
HMIShow the process and accept operator commandsAt the machine or in a control roomOperators lose visibility; control loops keep running
Communication networkMove data and commands between field and centreBetween sites and serversData arrives late or not at all; alarms may be missed
SCADA servers and historianPoll devices, raise alarms, store historyControl centre or cloudNo central alarms, trends or reports

How a SCADA system works, step by step

  1. SenseField sensors measure pressure, flow, level, temperature or equipment state.
  2. Acquire and controlThe RTU or PLC digitises the signal and runs any local control logic.
  3. TransmitData travels over radio, cellular, satellite or fibre, by polling or report-by-exception.
  4. SuperviseSCADA servers check values against limits, raise alarms and write history.
  5. Visualise and actThe HMI shows the state; an operator acknowledges alarms or sends a setpoint back down.

Sense, acquire and control repeat in the field controller whether or not the network or central servers are available.

How a reading becomes an alarm and an operator action, and the local loop that keeps running without the centre.

Two patterns move the data. In polling, the master asks each device for its values on a schedule. In report-by-exception, a device sends data only when a value changes beyond a threshold. Polling is predictable; report-by-exception uses far less bandwidth, which matters on cellular and satellite links.

The protocols are a mix of old and new. Modbus remains common at device level. DNP3 and IEC 60870-5-104 are widely used in utilities because they carry timestamps and handle unreliable links. OPC UA connects SCADA to plant software, and MQTT is often used to move SCADA data into IoT and cloud platforms.

HMI vs SCADA: what is the difference?

The two terms are often used together, and they are not the same thing. An HMI is one component: a screen through which a person sees and operates a process. SCADA is the whole system around it, including data acquisition from many devices, communication, alarms, history and supervisory control across sites.

How an HMI and a SCADA system differ in scope, data and typical use.
AspectHMISCADA
ScopeOne machine, cell or lineMany devices and sites
DataMostly live valuesLive values, alarms, history and reports
ControlLocal operator actionsSupervisory commands across the system
Typical formPanel or touch screen at the equipmentServers, historian and control-room or web clients

A PLC can run without an HMI or SCADA: it keeps executing its program. What is lost is visibility and the ability for a person to intervene remotely.

Where SCADA is used

  • Energy: generation and distribution assets spread over large areas report to a central control room, where operators reroute power and respond to faults.
  • Water and wastewater: pump stations, reservoirs and treatment steps such as chemical dosing run continuously and are supervised remotely.
  • Manufacturing: line and machine data reach one control room, so operators spot bottlenecks, quality drift and emergencies early.
  • Oil and gas: wellheads, tanks and pipelines report pressure, flow and level from remote locations, often over cellular or satellite links.
  • Transport: traffic signals, signs and roadside sensors feed regional traffic management centres.
Oil and gas value chain from pumpjacks through truck and tanker transport to refineries, marked with smart sensors, data transfer, secure storage, asset tracking and security cameras
Where monitoring applies along the oil and gas chain: sensors at production, data transfer and storage in transport, tracking and cameras at distribution.

Types of SCADA systems: from monolithic to IoT

Architectures evolved in generations. Most real installations mix them, which is why modernisation is mostly an integration problem.

Generations of SCADA architecture, what each added and the constraint it leaves for modernisation.
GenerationHow it worksWhat it addedConstraint today
MonolithicSelf-contained mainframe or server with proprietary protocolsCentral supervision of remote sitesNo interoperability; data locked in one vendor's system
DistributedControl functions spread across stations on a local networkLocal redundancy and faster responseHistory and data are fragmented across stations
NetworkedSystems connected over WAN and standard IP protocolsMulti-site operation and open protocolsExposure to IT-style network threats
Web-basedOperators use a browser instead of an installed clientRemote access from any approved deviceNeeds strong identity, access control and segmentation
IoT SCADAEdge devices and gateways feed a cloud or central data platformFleet-wide analytics, cheaper connectivity for small sitesData ownership, latency and keeping control decisions local

What SCADA changes for operations

  • From reactive to planned maintenance: logged deviations in pressure, temperature or run time show an asset degrading before it fails, so repairs can be scheduled.
  • Fewer manual readings: data arrives automatically, so technicians no longer drive to sites only to copy numbers, and transcription errors disappear from the record.
  • Faster response to unsafe conditions: alarms fire the moment a value leaves its limits, and automated shutdown logic in the field isolates the problem.

None of this comes automatically. Alarm limits that are too tight flood operators with noise; history that no one reviews prevents nothing. The value depends on choosing the right signals, sensible limits and a clear owner for each alarm.

Building IoT monitoring software for SCADA: the VikingSCADA project

VikingSCADA provides monitoring for industrial equipment at remote oil, water and gas sites. Before the project, readings depended on manual tracking: technicians drove long distances to wellheads and processing stations to copy values from local control modules.

  • Travel time and cost: field staff spent hours driving between remote sites.
  • Data quality: manual notes introduced transcription errors into the historical record.
  • Late detection: data was reviewed only periodically, so a malfunction could go unnoticed for days.

Indeema built a web-based IoT SCADA monitoring platform that captures and stores operational data from remote client sites. The ingestion layer was designed for SCADA traffic over low-bandwidth cellular and satellite connections. Network segmentation and strict access control keep the cloud interface separated from the field equipment.

Map with a water treatment plant, water towers, a pumpjack and oil tanks beside a laptop showing a monitoring dashboard with trend charts, gauges and bar graphs
Remote water and oil sites reporting into one web dashboard, so operators see trends, levels and alarms without visiting each location.
  • Automated data collection replaces routine site visits made only to take readings.
  • Automated logging records process values without manual transcription.
  • Real-time alarms notify field personnel as soon as an equipment value leaves its safe range.

Security: the cost of connecting SCADA

Classic SCADA relied on isolation. Every web client, cloud link and remote-access path removes some of it. Many field protocols were designed without authentication, so a network path to a controller can be a path to the physical process.

Baseline controls for a connected SCADA system

  • Segment the network into zones, with controlled conduits between field, control and enterprise networks.
  • Prefer outbound-only connections from the site to the cloud; avoid exposing field devices to inbound traffic.
  • Give every user and device its own identity, with role-based access and multi-factor authentication for remote users.
  • Encrypt links that leave the site, and use the secure variants of protocols where the equipment supports them.
  • Log access and commands, and review them; patch servers and gateways on a planned schedule.
  • Use an established framework such as ISA/IEC 62443 to structure requirements.

Engineering trade-offs

On-premises SCADA vs web or cloud SCADA

You gain
On-premises keeps data and control inside the plant network with predictable latency; web and cloud give remote access and multi-site analytics without installed clients.
You pay
On-premises makes fleet-wide visibility and remote work harder; web and cloud widen the attack surface and depend on links leaving the site.
Choose it when
Keep control and safety on-premises; use web or cloud for monitoring, history and analytics across sites.

Polling vs report-by-exception

You gain
Polling gives predictable timing and an easy health check; report-by-exception sends only changes and saves bandwidth.
You pay
Polling wastes bandwidth on unchanged values; report-by-exception needs heartbeats to tell a quiet device from a dead one.
Choose it when
Poll on fast, cheap networks; use report-by-exception with heartbeats over cellular and satellite links.

Replace the SCADA vs add an IoT data layer

You gain
Replacement can remove proprietary limits; a data layer beside existing SCADA delivers new visibility without touching working control.
You pay
Replacement risks downtime and requalification; a data layer leaves old constraints in place and adds another system to maintain.
Choose it when
Add a data layer first; replace components when support, security or interoperability make the old system untenable.

Choosing a monitoring architecture for distributed sites

Start from what the sites already have and how they connect; the platform follows from those constraints.

Choosing a monitoring architecture for distributed sites
DeviceFits whenConnectivityWhere control runsMain risk
Classic on-premises SCADAOne plant or a private network to every sitePrivate fibre, Ethernet or licensed radioPLCs, supervised from a local control roomLimited remote access and siloed data
Web SCADAOperators and managers need access from many placesSite links plus secure internet access for usersPLCs; supervision through the browserWeak identity or access control
IoT monitoring layer on existing SCADAMany small remote sites, or analytics across the fleetCellular or satellite through edge gatewaysPLCs and RTUs; the cloud only monitors and alertsLink outages and data gaps if buffering is not designed in

Decision rule: Keep control in the field, choose the transport for the worst site rather than the best, and add cloud monitoring as a layer that tolerates lost links.

Before you modernise a SCADA system

A short review that turns a modernisation idea into requirements:

  • Inventory field devices, protocols and firmware versions at every site.
  • Measure the real bandwidth, latency and outage pattern of each site link.
  • List the signals and alarms operators actually use, and who owns each alarm.
  • Decide which functions must keep working when the central system or cloud is unreachable.
  • Define buffering and backfill so data recorded during an outage is not lost.
  • Agree the security zones and remote-access model before choosing a platform.

Common mistakes

  1. Moving control logic into the cloud

    A link outage or latency spike turns into a process upset or a safety issue.

    Instead: Keep control and interlocks in PLCs; use the cloud for supervision, history and analytics.

  2. Designing for the best-connected site

    Remote sites on cellular or satellite links drop data or flood the link.

    Instead: Size polling, payloads and buffering for the worst link in the fleet.

  3. Exposing field devices for remote access

    Unauthenticated field protocols become reachable from outside the plant.

    Instead: Use segmented zones, outbound-only gateways and per-user access through a managed entry point.

  4. Alarming on everything

    Operators learn to ignore alarms, including the one that matters.

    Instead: Rationalise alarms: clear limits, priorities and an owner for each.

Where we've built this

The VikingSCADA platform above is described in full in the case study: what the client already had, why low-bandwidth remote sites made it difficult, and how the web application was built.

Case studyExtending a SCADA product with cloud monitoring and gateway updatesA web IIoT application that collects and stores data from SCADA units at remote oil, water and gas sites and alerts personnel when values leave safe limits.

Questions engineers ask

How does a SCADA system work?

Sensors measure the process, RTUs and PLCs digitise the signals and run local control, a communication network carries the data to central servers, and the servers raise alarms and store history. Operators see the process on HMIs and send supervisory commands back down.

What is the difference between SCADA and HMI?

An HMI is the screen through which a person sees and operates a process. SCADA is the full system around it: data acquisition from many devices, communication, alarms, history and supervisory control across sites.

Is SCADA a software?

SCADA usually refers to the whole system, including field devices, networks and servers. The SCADA software is the supervisory part: device communication, alarming, history and HMI screens.

Can a PLC function without HMI or SCADA?

Yes. A PLC keeps executing its control program on its own. Without an HMI or SCADA, operators lose visibility, alarms and remote intervention, but the local control loop continues.

Was this useful?

Where this shows up in our work

SolutionIndustrial IoT & IntelligenceWhen the question is how to connect existing SCADA and field equipment to a monitoring and analytics platform without disturbing control, that is our industrial IoT work.

For remote wellheads, tanks and pipelines, where links are thin and sites are unattended, see Oil & Gas.

Apply this to your product

Review your platform architecture

Review your platform architecture

Sources