11.3 SCADA, Telemetry, Alarm Management, Security & Auxiliary Power
Key Takeaways
- SCADA gathers data from PLCs and remote terminal units and presents it on an HMI, but supervisory control never replaces physical operator rounds — a screen reports what a sensor says, not what the equipment is doing.
- Telemetry links remote lift stations to the plant by radio, cellular, or leased circuit, and an autodialer or alarm callout system is what converts a remote high-level alarm into an operator response at 3 a.m.
- Alarm systems fail through flooding: when too many low-value alarms are configured, operators normalize acknowledging them and miss the alarm that mattered, so alarms must be prioritized and rationalized.
- Standby generators fail most often because of dead starting batteries, stale or contaminated fuel, and lack of regular exercise under load, which is why weekly or monthly load-exercise runs and battery checks are core operator tasks.
- An automatic transfer switch senses utility failure, starts the generator, and transfers load once the generator stabilizes, then transfers back and runs a cool-down period after utility power returns.
11.3 SCADA, Telemetry, Alarm Management, Security & Auxiliary Power
Exam Focus: "SCADA and telemetry systems" and "Auxiliary power — Generator" are both Equipment line items. "Conduct routine security checks" and "Vulnerability assessments" appear in the Security, Safety, and Administrative Procedures area. Class I items stay operational: what the system does, what it cannot do, and what maintenance keeps it dependable.
1. SCADA Architecture in Plain Terms
SCADA stands for Supervisory Control and Data Acquisition. The pieces:
| Layer | What It Is | Operator Relevance |
|---|---|---|
| Field devices | Sensors and final control elements — level, flow, DO, valve actuators, motor starters | The physical truth the whole system reports on |
| PLC / RTU | Programmable Logic Controller or Remote Terminal Unit that reads inputs, runs control logic, and drives outputs | Executes pump-down setpoints, DO control loops, lead/lag rotation |
| Communications | Plant network, radio, cellular, fiber, leased circuit | The link that fails when a remote station "goes quiet" |
| HMI | Human-Machine Interface — the graphic screens operators watch | Where setpoints are changed and alarms are acknowledged |
| Historian | Database of time-stamped process values | The source of trends, reports, and much DMR backup data |
What SCADA Does Well and What It Cannot Do
SCADA excels at continuous trending, automatic setpoint control, alarm annunciation, remote station visibility, lead/lag pump rotation, and run-hour accumulation for maintenance scheduling.
SCADA does not replace rounds. A screen shows a sensor's opinion. It cannot hear a bearing starting to howl, smell a hot motor, see a seal weeping, or notice that the surface boil pattern over a diffuser grid has changed. Every process upset that begins as a mechanical problem is found by a person walking the plant, not by a graphic. Operators who trust the screen over their own senses are the ones surprised by failures.
2. Telemetry and Remote Stations
Remote lift stations are typically unmanned, so telemetry carries their status back to the plant by licensed radio, cellular modem, or leased circuit. A remote station normally reports wet well level, pump run status and run hours, pump fail, high level, power fail, and intrusion.
- An autodialer or alarm callout system contacts on-call staff when no one is watching the screen. Test it on a schedule and verify the call list is current — an out-of-date phone list is a real and common failure.
- Loss of communication must itself be an alarm. A remote station that goes silent looks identical to a remote station with nothing wrong, and that ambiguity has caused many overflows.
- Remote stations still need physical inspection at a defined frequency regardless of what telemetry reports.
3. Alarm Management
Alarm systems fail through alarm flooding. When dozens of low-value alarms annunciate every shift, operators learn to acknowledge reflexively, and the alarm that actually mattered is silenced along with the noise.
Sound practice:
- Every alarm needs a defined operator action. If there is nothing to do about it, it is an indication, not an alarm.
- Prioritize. Critical (high wet well, chlorine leak, power failure, permit-threatening condition) must be visually and audibly distinct from advisory.
- Set deadbands and time delays so a value hovering at a setpoint does not chatter.
- Document acknowledgment and response. Alarm history is frequently reviewed after an incident.
- Review nuisance alarms periodically and fix or retune them rather than teaching operators to ignore them.
4. Data Integrity and Compliance
Data drawn from SCADA regularly ends up on a Discharge Monitoring Report. That raises the standard it must meet:
- Instruments feeding compliance data need documented calibration and verification records.
- A flowmeter out of calibration invalidates every pounds-per-day loading calculation built on it, and thus the reported values.
- Never edit historian data. If a value is known bad, flag and annotate it and document the reason; altering records is a serious violation.
- Reconcile SCADA totals against independent checks — meter registers, tank draw-down, chemical usage — periodically.
5. Control System Security
Treatment plants are critical infrastructure, and their control systems are targets.
- Change default passwords on PLCs, HMIs, and network gear, and remove credentials when staff leave.
- Segregate the control network from the business network and from the public internet; remote access should be through a controlled, authenticated path.
- Control removable media. USB drives are a common infection route into isolated control networks.
- Vulnerability and resilience assessments are named in the Need-to-Know Criteria. Utilities assess physical and cyber vulnerabilities and maintain an emergency response plan that reflects the findings.
- Routine security checks — verifying gates, fences, doors, hatches, chemical storage areas, and remote station enclosures on the operator round — are the daily practice behind those assessments. Log them.
6. Auxiliary Power: Standby Generators
An NPDES permit obligates the plant to keep treating and to avoid overflows, and utility power is not guaranteed. Standby generation is the answer.
System Components
- Engine-generator set — diesel or natural gas driving an alternator.
- Automatic transfer switch (ATS) — senses utility loss, signals the engine to start, waits for voltage and frequency to stabilize, then transfers load to the generator. On utility restoration it transfers back and lets the engine run a cool-down period before shutdown.
- Fuel system — day tank and/or bulk tank with containment.
- Starting batteries and charger, block heater, jacket water cooling, and exhaust system.
Why Generators Fail — and the Maintenance That Prevents It
| Failure Cause | Prevention |
|---|---|
| Dead or weak starting batteries — the single most common cause of a generator failing to start | Check electrolyte, terminals, and charger operation on the routine round; load-test batteries and replace on age |
| Stale, contaminated, or microbially fouled fuel | Fuel polishing/filtration, water draw-off from the tank bottom, periodic fuel testing, adequate turnover |
| Failure to start after long idleness | Exercise the generator regularly — weekly or monthly — and under load, not just no-load |
| Cold-start failure | Verify the block heater is energized and functioning |
| Coolant or oil loss | Check levels every round; log them |
| Wet stacking (unburned fuel fouling a diesel run only at light load) | Periodic load-bank testing at meaningful load |
| Undersized capacity after plant expansion | Recalculate connected load whenever equipment is added; verify the ATS and generator still cover the essential load |
Load exercise is the point. A generator that starts and idles unloaded every month proves only that it starts. Running it under real load proves the alternator, the cooling system, the fuel system, and the transfer switch all still work together — which is what you need on the night the utility drops.
A standby generator that has been started and run unloaded for ten minutes every month fails to carry the plant during an actual utility outage. What maintenance practice would most likely have revealed the problem beforehand?
A remote lift station has reported no alarms and no data changes for six hours. Which alarm configuration failure does this scenario expose?
Why must an operator never edit a historian value in SCADA that is known to be erroneous?