Plc & Scada Summer Training Report

7/27/2019 Plc & Scada Summer Training Report

1/48

SUMMER TRAINING REPORTPLC & SCADA

SUBHASH KUMAR YADAV


2/48

YADUVANSHICOLLEGE OF ENGINEERING & TECHNOLOGY

PATIKRA, NARNAUL-HARYANA- 123002

SUMMER TRAINING REPORT

Submitted in partial fulfillment for the award of degree ofBachelor in Technology

IN

Electronics & Communication Engineering(Session 2013-2014)

Submitted by:

Subhash Kumar Yadav12ECEL26,5th Semester

Done at:


3/48

Department of Electronics & Commn. Engg.Narnaul-Haryana 123002

CERTIFICATE

Certified that this is the bonafied report of SummerInternship entitled PLC & SCADA done by SubhashKumar Yadav of fifth Semester in ELECTRONICS &COMMUNICATION ENGINEERING in the YaduvanshiColllege of Engineering & Technology during theacademic year 2013-2014 and submitted for practical

examination conducted by M.D.U University Rohtak.

CERTIFICATE


4/48

ACKNOWLEDGEMENT

I am thankful to the institute T & S Automation forproviding necessary facility to carry out my training

successfully.

I take this opportunity to thank Mr. Pradeep, PRINCIPAL,and YADUVANSHI COLLEGE OF ENGINEERING &

TECHNOLOGY for granting us the permission to carry outthe project.

I am extremely thankful to Mr. Sudhir Yadav H.O.D,Electronics and Communication department, for hertimely advices and all the facilities he provided us, tocarry out this report and finish it successfully.

I express my profound gratitude for the pragmaticguidance rendered to us our guide Mr. Rahul Yadav, My

Training Incharge & Lecturer in Electronics andCommunication Department. They have always been asource of inspiration and have been guiding us constantlythrough all our ups and downs of our endeavor in


5/48

completing out this report, for which I am greatlyindebted to them.

CONTENTS

Brief Overview of Company.

Automation PLC

1. Introduction2.History3.Advantages4.Hardware5.PLC Operation6.Communications7.PLC Programming8.Ladder logic9.Counters & Timers.10.PLC Applicaton & Examples.


6/48


7/48

PLC and SCADA System are methods to achieveAutomation.

Automation industry has fast growth potential in acountry like India, which has large industries.

This Report focus on brief concepts of PLC & SCADASystems, their development and also some of theirpossible application of these systems.

Almost every industry needs automation at presenttimes.

Issues & Future trends of Aotomation are also mentionedhere.

Subhash Kumar Yadav

21st September 2013

Automation

Automation is the use of control systems such ascomputers to control industrial machinery and process,reducing the need for human intervention. In the scope ofindustrialization, automation is a step beyond


8/48

mechanization. Whereas mechanization provided humanoperators with machinery to assist them with physicalrequirements of work, automation greatly reduces theneed for human sensory and mental requirements aswell. Processes and systems can also be automated.

Automation impacts It increases productivity and reduces cost.

It gives emphasis on flexibility and convertibility in

the manufacturing process. Manufacturers are increasingly demanding the ability

to easily switch from product A to manufacturingproduct B without having to completely rebuild theproduction lines.

Automation is often applied primarily to increase

quality in the manufacturing process, whereautomation can increase quality substantially.

Automation reduces power consumption and reducesman power requirement.

Automation improves production quality.

Automation provides safer working conditions.

Programmable LogicController (PLC)

A PROGRAMMABLE LOGIC CONTROLLER(PLC) is an industrial computer control system that


9/48

continuously monitors the state of input devices andmakes decisions based upon a custom program to controlthe state of output devices.

Almost any production line, machine function, or processcan be greatly enhanced using this type of controlsystem. However, the biggest benefit in using a PLC is theability to change and replicate the operation or processwhile collecting and communicating vital information.

Another advantage of a PLC system is that it is modular.That is, you can mix and match the types of input and

Output devices to best suit your application.

History of PLCs The first Programmable Logic Controllers were

designed and developed by Modicon as a relayreplacer for GM and Landis.

These controllers eliminated the need for rewiring

and adding additional hardware for each newconfiguration of logic.

The new system drastically increased the

functionality of the controls while reducing thecabinet space that housed the logic.

The first PLC, model 084, was invented by Dick

Morley in 1969.

The first commercial successful PLC, the 184, was

introduced in 1973 and was designed by MichaelGreenberg.


10/48

Advantages of PLCsPLCs not only are capable of performing the same tasksas hard-wired control, but are also capable of many more

complex applications. In addition, the PLC program andelectronic communication lines replace much of theinterconnecting wires required by hard-wired control.

Therefore, hard-wiring, though still required to connectfield devices, is less intensive. This also makes correctingerrors and modifying the application easier.

Some of the additional advantages ofPLCs are as follows: Smaller physical size than hard-wire solutions. Easier and faster to make changes. PLCs have integrated diagnostics and overridefunctions. Diagnostics are centrally available.

Applications can be immediately documented. Applications can be duplicated faster and lessexpensively.


11/48

Inside A PLCThe Central Processing Unit (CPU), contains an internalprogram that tells the PLC how to perform the followingfunctions:

o Execute the Control Instructions contained in the

User's Programs. This program is stored in"nonvolatile" memory, meaning that theprogram will not be lost if power is removed

o Communicate with other devices, which caninclude I/O Devices, Programming Devices,Networks, and even other PLCs.

o Perform Housekeeping activities such as

Communications, Internal Diagnostics, etc.

THE CPUThe microprocessor or processor module is the brain of aPLC system. It consists of the microprocessor, memoryintegrated circuits, and circuits necessary to store andretrieve information from memory. It also includescommunications ports to other peripherals, other PLC's orprogramming terminals. Today's processors vary widelyin their capabilities to control real world devices. Some


12/48

control as few as 6 inputs and outputs (I/O) and others40,000 or more. One processor can control more thanone process or manufacturing line. Processors are oftenlinked together in order to provide continuity throughoutthe process. The number of inputs and outputs PLCs cancontrol are limited by the overall capacity of the PLCsystem hardware and memory capabilities. The job of theprocessor is to monitor status or state of input devices,scan and solve the logic of a user program, and controlon or off state of output devices.

RAMRAM or Random Access Memory is a volatile memory thatwould lose its information if power were removed. This iswhy some processor units incorporate a battery back-up.

The type of RAM normally used is CMOS orComplementary Metal Oxide Semiconductor. CMOS RAMis used for storage of the user's program (ladder logicdiagrams) and storage memory.

ROMROM or Read Only Memory is a non-volatile type ofmemory. This means you don't need an external powersource to keep information. In this type of memory,information can be read, but not changed. For this reasonthe manufacture sometimes calls this firmware. It isplaced there for the internal use and operation of

processor units.

EEPROM


13/48

EEPROM or Electrically Erasable Programmable Read OnlyMemory is usually an add-on memory module that is usedto back up the main program in CMOS RAM of theprocessor. In many cases, the processor can beprogrammed to load the EEPROM's program to RAM ifRAM is lost or corrupted.

Input ModuleThere are many types of input modules to choose from.The type of input module used is dependent upon whatreal world input to the PLC is desired. Some examples of

inputs are limit switches, electriceyes,and pushbuttons.DC inputs, such as thumbwheel switches, can be used toenter integer values to be manipulated by the PLC. DCinput cards are used for this application. Since mostindustrial power systems are inherently noisy, electricalisolation is provided between the input and the processor.Electromagnetic interference (EMI) and Radio FrequencyInterference (RFI) can cause severe problems in most

solid state control systems. The component used mostoften to provide electrical isolation within I/O cards iscalled anoptical isolator or optocoupler. The wiring of aninput is not complex. The object is to get a voltage at aparticular point on the card. Typically there are 8 to 32input points on any one input module. Each point will beassigned a unique address by the processor. Analog inputmodules are special input cards that use analog to digital

conversion (A to D) to sense variables such astemperature, speed, pressure, and position. The externaldevice normally is connected to a controller (transducer)producing an electrical signal the analog input card can


14/48

interpret. This signal is usually 4 to 20 Ma or a 0 to 10volt signal.

Output ModuleOutput modules can be for used for ac or dc devices suchas solenoids, relays, contractors, pilot lamps, and LEDreadouts. Output cards usually have from 6 to 32 outputpoints on a single module. The output device within thecard provides the connection from the user power supplyto the load. Usually silicon controlled rectifiers (SCR),triac, or dry contact relays are use for this purpose.Individual outputs are rated most often at 2 to 3amperes. Output cards, like input cards have electricalisolation between the load being connected and the PLC.Analog output cards are a special type of output modulesthat use digital to analog conversion (D to A). The analogoutput module can take a value stored in a 12 bit file andconvert it to an analog signal.Normally this signal is 0 -10volts dc or 4 to 20 Ma. This analog signal is often used in

equipment such as motor operated valves and pneumaticposition control devices.


15/48

Fig: Block Diagram of PLC


16/48

PLC OPERATION

There are four basic steps in the operation of all PLCs :

which continually take place in a repeating loop.

Input ScanProgram ScanOutput ScanHousekeeping

Input Scan : Detects the state of all input devicesthat are connected to the PLC

Program Scan : Executes the user created programlogic.

Output Scan : Energizes or de-energize all output

devices that areconnected to the PLC. Housekeeping: This step includes communications

with programming terminals, internal diagnosticsetc...


17/48

CHECK INPUT STATUS: First the PLC takes a look ateach input to determine if it is words, is the sensor

connected to the first input on? Then on or off. In otherthe second input? Then the third and so on. It recordsthis data into its memory to be used during the next step.

EXECUTE PROGRAM: Next the PLC executes yourprogram one instruction at a time. Maybe the programsays that if the first input was on then it should turn on

the first output. Since it already knows which inputs areon/off from the previous step it will be able to decidewhether the first output should be turned on based on thestate of the first input. It will store the execution resultsfor use later during the next step.

UPDATE OUTPUT STATUS: Finally the PLC updates thestatus of the outputs. It updates the outputs based on

which inputs were on during the first step and the resultsof executing your program during the second step. Basedon the example in step 2 it would now turn on the firstoutput because the first input was on and your programsaid to turn on the first output when this condition is true.

After the third step the PLC goes back to step one andrepeats the steps continuously. One scan time is defined

as the time it takes to execute the 3 steps listed above.


18/48

COMMUNICATIONS

There are several methods to communicate between aPLC and a programmer or even between two PLCs.Communications between a PLC and a programmer (PC orHand held) are provided by the makers and you onlyhave to plug in a cable from your PC to the programmingport on the PLC. This communication can be RS232;RS485 or TTY. Communications between two PLCs can becarried out by dedicated links supplied/programmed bythe makers (RS232 etc) or via outputs from one PLC tothe inputs on another PLC. This direct link method ofcommunication can be as simple as, if an output on thefirst PLC is on then the corresponding input on the secondPLC will be on and then this input is used within the

program on the second PLC.

If a word of input/outputs (16 bits) are used thennumerical data can be transferred from one PLC to theother (refer back to the section on numbering systems).

There are many other methods of communicationbetween PLCs and also from PLC to PC. Refer to themanuals supplied with the PLC that you are using for fulldetails on communications.


19/48

PLC PROGRAMMING

Various languages are used for programming of

PLCs :

Ladder diagram (LD)Ladder diagram is a graphic programming languagederived from the circuit diagram of directly wired relaycontrols. The ladder diagram contains contact rails to theleft and the right of the diagram; these contact rails areconnected to switching elements (normally open /

normally closed contacts) via current paths and coilelements.

Function block diagram (FBD)


20/48

In the function block diagram, the functions and functionblocks are represented graphically and interconnectedinto networks. The function block diagram originates fromthe logic diagram for the design of electronic circuits.

Sequential function chart (SFC)The sequential function chart is a language resource forthe structuring of sequence-oriented control programs.

The elements of the sequential function chart are steps,transitions, alternative and parallel branching. Each steprepresents a processing status of a control program,which is active or inactive. A step consists of actions

which, identical to the transitions, are formulated in theIEC 1131-3 languages. Actions themselves can againcontain sequence structures. This feature permits thehierarchical structure of a control program. Thesequential function chart is therefore an excellent tool forthe design and structuring of control programs.

Instruction list (IL)Statement list is a textual assembler-type languagecharacterised by a simple machine model (processor withonly one register). Instruction list is formulated from


21/48

control instructions consisting of an operator and anoperand.

LD Part_TypeAOR Part_TypeBAND Part_presentAND Drill_okST Sleeve_in

With regard to language philosophy, the ladder diagram,the function block diagram and instruction list have beendefined in the way they are used in todays PLCtechnology. They are however limited to basic functionsas far as their elements are concerned. This separates

themessentially from the company dialects used today. Thecompetitiveness of these languages is maintained due tothe use of functions and function blocks.

Structured text (ST)Structured text is high-level language based on Pascal,

which consists of expressions and instructions.Instructions can be defined in the main as: Selectioninstructions such as IF...THEN...ELSE etc., repetitioninstructions such as FOR, WHILE etc. and function blockinvocations.

Sleeve_in:= (Part_TypeA OR Fig. B5.7: Part_TypeB) AND Part_presentAND Drill_ok;

Structured text enables the formulation of numerousapplications, beyond pure function technology, such asalgorithmic problems (highorder control algorithms etc.)


22/48

and data handling (data analysis, processing of complexdata structures etc.).

LADDER LOGIC

Ladder Logic, or Ladder Diagrams is the most commonprogramming language used to program a PLC.

Ladder logic was one of the first programmingapproaches used in PLCs because it borrowed heavily


23/48

from the Relay Diagrams that plant electricians alreadyknew.

The symbol used in Relay Ladder Logic consists of a

power rail to the left, a second power rail to the right, andindividual circuits that connect the left power rail to theright. The logic of each circuit (or rung) is solved from leftto right. The symbols of these diagrams look like a ladder- with two side rails and circuits that resemble rungs on aladder.

The picture above has a single circuit or "rung" of ladder.

If Input1 is ON (or true) - power (logic) completes the

circuit from the left rail to the right rail and Output1turns ON (or true).

If Output1 is OFF (or false) - then the circuit is notcompleted and logic does not flow to the right andOutput 1 is OFF.

There are many logic symbols available in Ladder Logic -including Timers, Counters, Math, and Data Moves - suchthat any logical condition or control loop can berepresented in Ladder Logic. With just a handful of basicsymbols - a Normally Open Contact, Normally ClosedContact, Normally Open Coil, Normally Closed Coil, Timer,Counter - most logical conditions can be represented.

CONTACTS AND COILS

With just the Normally Open Contact and Normally OpenCoil - a surprising array of basic logical conditions can berepresented.


24/48

Normally Open Contact. This can be used torepresent any input to the control logic - a switch orsensor, a contact from an output, or an internal output.

When "solved" the referenced input is examined for anON (logical 1) condition. If it is ON, the contact will closeand allow power (logic) to flow from left to right. If thestatus is OFF (logical 0), the contact is Open, power(logic) will NOT flow from left to right.

Normally Open Coil.This can be used to representany discrete output from the control logic. When "solved"if the logic to the left of the coil is TRUE, the refrencedoutput is ON (logical 1).

Solving a Single Rung:

Suppose a switch is wired to Input1, and a light bulb is wiredthrough Output1 in such a way that the light is OFF whenOutput1 is OFF, and ON when Output1 is ON.

When Input1 is OFF (logical 0) the contact remains open andpower cannot flow from left to right. Therefore, Output1remains OFF (logical 0).

When Input1 is ON (logical 1) then the contact closes, powerflows from left to right, and Output1 becomes ON (the lightturns ON).


25/48

The AND RungThe AND is a basic fundamental logic condition that is easy todirectly represent in Ladder Logic.

Suppose a switch is wired toSwitch1 switch is wired to Switch2, and a light bulb is wiredthrough Light1 in such a way that the light is , a second OFFwhen Light1 is OFF, and ON when Light1 is ON.

In order for Light1 to turn ON, Switch1 must be ON, ANDSwitch2 must be ON.

If Switch1 is OFF, power (logic) flow from the left rail, butstops at Switch1. Light1 will be OFF regardless of the state ofSwitch2.

If Switch1 is ON, power makes it to Switch2. If Switch2 is OFF,power cannot flow any further to the right, and Light1 is OFF.

If Switch1 is ON, AND Switch2 is ON - power flows to Light1solving its state to ON.


26/48

The OR RungThe OR is a logical condition that is easy to represent inLadder Logic.

Suppose a switch is wired to Switch1, a second switch iswired to Switch2, and a light bulb is wired through Light1 in

such a way that the light is OFF when Light1 is OFF, and ONwhen Light1 is ON. In this instance, we want to the light toturn ON if either Switch1 OR Switch2 is ON.

If Switch1 is ON - power flows to Light1 turning it ON.

If Switch2 is ON - power flows through the Switch2 contact,and up the rail to Light1 - turning it ON.

If Switch1 AND Switch 2 are ON - Light1 is ON.

The only way Light1 is OFF is if Switch1 AND Switch2 are OFF.

* Another set of basic contacts and coils that can be used inLadder Logic are the Normally Closed Contact and theNormally Closed Coil. These work just like their normally opencounterparts - only in the opposite.

When "solved" the referenced input is examined foran OFF condition. If the status is OFF (logical 0) power(logic) will flow from left to right. If the status is ON,power will not flow.


27/48

When "solved" if the coil is a logical 0, power will beturned on to the device. If logical 1, power will be OFF.

TIMERS AND COUNTERSMany times we will want to take action in a controlprogram based on more than the states of discrete inputsand outputs. Sometimes, we will want to turn somethingon after a delay, or count the number of times a switch ishit. To do these simple tasks, we will need Timers &Counters.

Simple Timers (TIM)A timer is simply a control block that takes an input andchanges an output based on time. There are two basictimer types we will deal with initially (there are otheradvanced timers, but we will start with the basics first) -On-Delay Timer and the Off-Delay Timer.

On-Delay Timer - This timer takes an input, waits aspecific amount of time, then turns ON an output (orallows logic to flow after the delay).

Off-Delay Timer - This timer takes turns ON an output(or allows logic to flow) and keeps that output ON untilthe set amount of time has passed, then turns it OFF(hence off-delay)

Simple Counter (CNT)A counter simply counts the number of events that occuron an input. There are two basic types of counters - Upcounter and a Down counter.


28/48

Up Counter - as its name implies, whenever a triggeringevent occurs, an up counter increments the counter.

Down Counter - whenever a triggering event occurs, adown counter decrements the counter.


29/48

MOTOR STARTER EXAMPLE :

First consider a hardwired approach.

The following line diagram illustrates how a normallyopen and a normally closed pushbutton might beconnected to control a three-phase AC motor. In thisexample, a motor starter coil (M) is wired in series with anormally open, momentary Start pushbutton, a normallyclosed, momentary Stop pushbutton, and normally closedoverload relay (OL) contacts.


30/48

Momentarily pressing the Start pushbutton completes thepathfor current flow and energizes the motor starter (M).

This closes the associated M and Ma (auxiliary contactlocated in the motor starter) contacts.

When the Start button is released, current continues toflow through the Stop button and the Ma contact, and theM coil remains energized. The motor will run until thenormally closed Stop button is pressed, unless theoverload relay (OL) contacts open. When the Stop buttonis pressed, the path for current flow is interrupted,opening the associated M and Ma contacts, and the motorstops.

Now consider PLC approach :This motor control application can also be accomplishedwith a PLC. In the following example, a normally open


31/48

Start pushbutton is wired to the first input (I0.0), anormally closed Stop push button is wired to the secondinput (I0.1), and normally closed overload relay contacts(part of the motor starter) are connected to the thirdinput (I0.2). These inputs are used to control normallyopen contacts in a line of ladder logic programmed intothe PLC.

Initially, I0.1 status bit is logic 1 because the normally

closed (NC) Stop Pushbutton is closed. I0.2 status bit islogic 1 because the normally closed (NC) overload relay(OL) contacts are closed. I0.0 status bit is logic 0,however, because the normally open start pushbuttonhas not been pressed. Normally open output Q0.0 contactis also programmed on Network 1 as a sealing contact.With this simple network, energizing output coil Q0.0 isrequired to turn on the motor.

The OperationWhen the Start pushbutton is pressed, the CPU receives alogic 1 from input I0.0. This causes the I0.0 contact toclose. All three inputs are now a logic 1. The CPU sends a


32/48

logic 1 to output Q0.0. The motor starter is energized andthe motor starts.

The output status bit for Q0.0 is now a 1. On the nextscan, when normally open contact Q0.0 is solved, thecontact will close & output Q0.0 will stay on even if theStart pushbutton is released.


33/48

When the Stop pushbutton is pressed, input I0.1 turns off,the I0.1 contact opens, output coil Q0.0 de-energizes, andthe motor turns off.


34/48

SCADASCADA stands for Supervisory Control And Data

Acquisition. Ir refers to an industrial control system: acomputer system monitoring and controlling a process.

The process can be industrial, infrastructure or facilitybased as described below:

Industrial Process: it includes those of manufacturing, production, power generation,fabrication and refining and process may be in

continuous, batch, repetitive or discrete modes. Infrastructure Process: it may be public or private,

and water treatment and distribution, wastewatercollection and treatment, oil and gas pipelines,electrical power transmission and distribution, andlarge communication systems.

Facility Process: it occur both in public facilities andprivate ones, including buildings, airports, ships andspace stations. They monitor and control HVAC,access and energy consumption.

A SCADA System usually consists of the followingSubSystems:

A Human-Machine Interface (HMI) is the apparatuswhich presents process data to a human operator, andthrough this, the human operator monitors and controls

the process. A supervisory (computer) system, gathering

(acquiring) data on the process and sending commands(control) to the process.


35/48

Remote Terminal Units (RTU) connecting to sensors inthe process, converting sensor signals to digital data andsending digital data to the supervisory system.

Programmable Logic Controller (PLC) used as fielddevices because they are more economical, versatile,flexible, and configurable than special-purpose RTUs.

Communication infrastructure connecting thesupervisory system to the Remote Terminal Units.

Systems conceptsThe term SCADA usually refers to centralized systems

which monitor and control entire sites, or complexes ofsystems spread out over large areas (anything betweenan industrial plant and a country). Most control actionsare performed automatically by Remote Terminal Units("RTUs") or by Programmable Logic Controllers ("PLCs").Host control functions are usually restricted to basicoverriding or supervisory level intervention.

Ex: A PLC may control the flow of cooling water through part

of an industrial process, but the SCADA system may allowoperators to change the set points for the flow, and enablealarm conditions, such as loss of flow and high temperature,to be displayed and recorded. The feedback control looppasses through the RTU or PLC, while the SCADA systemmonitors the overall performance of the loop.


36/48

Data Acquisiton begins at the RTU or PLC level andincludes meter readings and equipment status reportsthat are communicated to SCADA as required. Data is

then compiled and formatted in such a way that a controlroom operator using the HMI can make supervisorydecisions to adjust or override normal RTU (PLC) controls.Data may also be fed to a Historian, often built on acommodity Database Management System, to allowtrending and other analytical auditing.


37/48

TAGS (POINTS)SCADA systems typically implement a distributeddatabase, commonly referred to as a tag database, whichcontains data elements called tags or points. A pointrepresents a single input or output value monitored orcontrolled by the system. Points can be either "hard" or"soft". A hard point represents an actual input or outputwithin the system, while a soft point results from logicand math operations applied to other points. (Most

implementations conceptually remove the distinction bymaking every property a "soft" point expression, whichmay, in the simplest case, equal a single hard point.)Points are normally stored as value time stamp pairs: avalue, and the Time-Stamp when it was recorded or


38/48

calculated. A series of value time stamp pairs gives thehistory of that point. It's also common to store additionalmetadata with tags, such as the path to a field device orPLC register, design time comments, and alarminformation.

Human Machine InterfaceA Human Machine Interface or HMI is the apparatus whichpresents process data to a human operator, and throughwhich the human operator controls the process.

An HMI is usually linked to the SCADA system's Databaseand software programs, to provide trending, diagnosticdata, and management information such as scheduledmaintenance procedures, logistic information, detailedschematics for a particular sensor or machine, andexpert-system troubleshooting guides.

The HMI system usually presents the information to the

operating personnel graphically, in the form of a mimicdiagram. This means that the operator can see aschematic representation of the plant being controlled.For example, a picture of a pump connected to a pipe canshow the operator that the pump is running and howmuch fluid it is pumping through the pipe at the moment.

The operator can then switch the pump off. The HMIsoftware will show the flow rate of the fluid in the pipe

decrease in real time. Mimic diagrams may consist of linegraphics and schematic symbols to represent processelements, or may consist of digital photographs of theprocess equipment overlain with animated symbols.


39/48

The HMI package for the SCADA system typically includesa drawing program that the operators or systemmaintenance personnel use to change the way thesepoints are represented in the interface. Theserepresentations can be as simple as an on-screen trafficlight, which represents the state of an actual traffic lightin the field, or as complex as a multi-projector displayrepresenting the position of all of the elevators in askyscraper or all of the trains on a railway.

ALARM

An important part of most SCADA implementations isalarm handling. The system monitors whether certainalarm conditions are satisfied, to determine when an


40/48

alarm event has occurred. Once an alarm event has beendetected, one or more actions are taken (such as theactivation of one or more alarm indicators, and perhapsthe generation of email or text messages so thatmanagement or remote SCADA operators are informed).In many cases, a SCADA operator may have toacknowledge the alarm event; this may deactivate somealarm indicators, whereas other indicators remain activeuntil the alarm conditions are cleared. Alarm conditionscan be explicit - for example, an alarm point is a digitalstatus point that has either the value NORMAL or ALARMthat is calculated by a formula based on the values in

other analogue and digital points - or implicit: the SCADAsystem might automatically monitor whether the value inan analogue point lies outside high and low limit valuesassociated with that point. Examples of alarm indicatorsinclude a siren, a pop-up box on a screen, or a colouredor flashing area on a screen (that might act in a similarway to the "fuel tank empty" light in a car); in each case,the role of the alarm indicator is to draw the operator's

attention to the part of the system 'in alarm' so thatappropriate action can be taken. In designing SCADAsystems, care is needed in coping with a cascade ofalarm events occurring in a short time, otherwise theunderlying cause (which might not be the earliest eventdetected) may get lost in the noise. Unfortunately, whenused as a noun, the word 'alarm' is used rather loosely inthe industry; thus, depending on context it might mean

an alarm point, an alarm indicator, or an alarm event.


41/48

Remote Terminal Unit (RTU)The RTU connects to physical equipment. Typically, an RTUconverts the electrical signals from the equipment to digital

values such as the open/closed status from a Switch or avalve, or measurements such as pressure, flow, voltage orcurrent. By converting and sending these electrical signalsout to equipment the RTU can control equipment, such asopening or closing a switch or a valve or setting the speed ofa pump.

Characteristics of Quality SCADA RTUs :

1. Supervisory StationThe term "Supervisory Station" refers to the servers andsoftware responsible for communicating with the fieldequipment (RTUs, PLCs, etc.), and then to the HMI softwarerunning on workstations in the control room, or elsewhere. Insmaller SCADA systems, the master station may becomposed of a single PC. In larger SCADA systems, themaster station may include multiple servers, distributedsoftware applications, and disaster recovery sites. To

increase the integrity of the system the multiple servers willoften be configured in a dual-redundant or hot-standbyformation providing continuous control and monitoring in theevent of a server failure.

2. Operational philosophyFor some installations, the costs that would result from thecontrol system failing are extremely high. Possibly even lives

could be lost. Hardware for some SCADA systems isruggedized to withstand temperature, vibration, and voltageextremes, but in most critical installations reliability isenhanced by having redundant hardware andcommunications channels, up to the point of having multiple


42/48

fully equipped control centres. A failing part can be quicklyidentified and its functionality automatically taken over bybackup hardware. A failed part can often be replaced withoutinterrupting the process. The reliability of such systems can

be calculated statistically and is stated as the mean time tofailure, which is a variant of mean time between failures. Thecalculated mean time to failure of such high reliabilitysystems can be on the order of centuries.

Communication infrastructure andmethods

SCADA systems have traditionally used combinations of radioand direct serial or modem connections to meetcommunication requirements, although Ethernet and IP overSONET / SDH is also frequently used at large sites such asrailways and power stations. The remote management ormonitoring function of a SCADA system is often referred to astelemetry.

This has also come under threat with some customerswanting SCADA data to travel over their pre-establishedcorporate networks or to share the network with otherapplications. The legacy of the early low-bandwidth protocolsremains, though. SCADA protocols are designed to be verycompact and many are designed to send information to themaster station only when the master station polls the RTU.

Typical legacy SCADA protocols include Modbus RTU, RP-570,Profibus and Conitel. These communication protocols are allSCADA-vendor specific but are widely adopted and used.Standard protocols are IEC 60870-5-101 or 104, IEC 61850and DNP3. These communication protocols are standardized


43/48

and recognized by all major SCADA vendors. Many of theseprotocols now contain extensions to operate over TCP / IP. Itis good security engineering practice to avoid connectingSCADA systems to the internet so the attack surface is

reduced.

EVOLUTION

SCADA systems have evolved through 3 generations asfollows:

First generation: "Monolithic"

In the first generation, computing was done by mainframecomputers. Networks did not exist at the time SCADA wasdeveloped. Thus SCADA systems were independent systemswith no connectivity to other systems. WAN were later

designed by RTU vendors to communicate with the RTU. Thecommunication protocols used were often proprietary at thattime. The first-generation SCADA system was redundantsince a back-up mainframe system was connected at the bus


44/48

level and was used in the event of failure of the primarymainframe system.

Second generation: "Distributed"

The processing was distributed across multiple stations whichwere connected through a LAN and they shared informationin real time. Each station was responsible for a particular taskthus making the size and cost of each station less than theone used in First Generation. The network protocols usedwere still mostly proprietary, which led to significant securityproblems for any SCADA system that received attention froma hacker. Since the protocols were proprietary, very fewpeople beyond the developers and hackers knew enough todetermine how secure a SCADA installation was. Since bothparties had invested interests in keeping security issues tight,the security of a SCADA installation was often badlyoverestimated, if it wasConsidered at all.

Third generation: "Networked"These are the current generation SCADA systems which useopen system architecture rather than a vendorcontrolledproprietary environment. The SCADA system utilizes openstandards and protocols, thus distributing functionality across

a WAN rather than a LAN. It is easier to connect third partyperipheral devices like printers, disk drives, and tape drivesdue to the use of open architecture. WAN protocols such asInternet Protocol (IP) are used for communication betweenthe master station and communications equipment. Due to


45/48


46/48

increased number of connections between SCADAsystems and office networks and the Internet has madethem more vulnerable to attacks - see references.Consequently, the security of SCADA-based systems hascome into question as they are increasingly seen asextremely vulnerable to cyber warfare/cyber terrorismattacks.

In particular, security researchers are concernedabout:

1. The lack of concern about security andauthentication in the design, deployment andoperation of existing SCADA networks.

1. The belief that SCADA systems have the benefit ofsecurity through obscurity through the use of

specialized protocols and proprietary interfaces.2. The belief that SCADA networks are secure because

they are physically secured.3. The belief that SCADA networks are secure because

they are disconnected from the Internet.

SCADA systems are used to control and monitor physicalprocesses, examples of which are transmission ofelectricity, transportation of gas and oil in pipelines,water distribution, traffic lights, and other systems used


47/48

as the basis of modern society. The security of theseSCADA systems is important because compromise ordestruction of these systems would impact multiple areasof society far removed from the original compromise. Forexample, a blackout caused by a compromised electricalSCADA system would cause financial losses to all thecustomers that received electricity from that source. Howsecurity will affect legacy SCADA and new deploymentsremains to be seen.

In June 2010, Virus BlokAda reported the first detection ofmalware that attacks SCADA systems (Siemens'WinCC/PCS7 systems) running on Windows operatingsystems. The malware is called stuxnet and uses fourzero-day attacks to install a root kit which in turn logs into the SCADA's database and steals design and controlfiles. The malware is also capable of changing the control

system and hiding those changes. The malware wasfound by an anti-virus security company on 14 systemswith the majority in Iran.


48/48

To prepare the Summer Training Report

PLC & SCADAPLC & SCADA

I have gone through few books. For Preparing andgathering information for completion of our project reportthese links & references proved helpful.

REFERENCE BOOKS:-1. Microcontroller- Architecture and Programming by

jennithk.Ayalaya

FOR DATA SHEETS WE REFER THESE URLs1. www.seminarprojects.net.2. www.profilic.com3. www.wikipedia.com

Plc & Scada Summer Training Report

Documents

Transcript of Plc & Scada Summer Training Report