14.2 SCADA Operation and Maintenance

Quick answer: Supervisory control and data acquisition (SCADA) gathers field data, displays and alarms it, stores history, and may send authorized supervisory commands to local controllers. Chapter 2 teaches the process meaning of SCADA data. Equipment O&M asks whether SCADA components and communication paths are available, current, recoverable, and used safely.

Treat SCADA as a system

SCADA joins field controllers and communications to control servers, human-machine interfaces (HMIs), alarms, and history. Local controllers may continue configured control when the supervisory link fails, but the exact fallback is design-specific and must be confirmed from plant documentation.

Several missing tags at one site suggest a shared field power, controller, or communication fault. Missing data from unrelated sites may indicate a central path. One bad value suggests its instrument, signal, or tag. These are hypotheses for verification, not permission to reconfigure a network.

Shift checks and alarm discipline

At turnover, review active alarms, communication health, available server status, current time, historian gaps, out-of-service tags, maintenance banners, and equipment in manual or local control. Communicate which safeguards or automatic functions are unavailable. A clean screen is not proof of health if alarms were suppressed or the display stopped updating.

Understand the alarm states defined by the plant:

• Active means the triggering condition presently exists.
• Acknowledged records that an authorized user saw it; it does not fix the cause.
• Returned to normal means the trigger has cleared, though documentation may remain.
• Shelved, inhibited, or suppressed means alarm handling was intentionally altered under a controlled procedure. It must not be used merely to quiet a nuisance alarm.

Respond according to consequence and SOP. Read the exact alarm, confirm time and equipment, check related alarms, protect the process, verify safely in the field, notify the responsible role, and document the outcome. Repeated nuisance alarms deserve a maintenance or engineering work request because alarm flooding can hide the event that matters.

Operate safely when visibility is degraded

A communication or HMI loss is not automatically a treatment failure, but it removes evidence and possibly supervisory control. Use the facility's degraded-operation or emergency plan. Depending on design, that may require local control, staffed field stations, added rounds and grab samples, manual logging, conservative operation, or taking equipment out of service. Verify which automatic sequences and local protections remain active; never assume.

Create a timeline with last known good data, first failed indication, affected tags, local conditions, actions, notifications, and restoration tests. Do not repeatedly reboot servers, switches, radios, PLCs, or HMIs. An uncontrolled restart can broaden the outage, destroy evidence, or change process state. Authorized control personnel coordinate recovery and decide whether failover or backup is appropriate.

Degraded-operation checklist

1. Protect water quality and personnel under the approved procedure.
2. Establish reliable communications between control-room and field staff.
3. Identify what is lost: viewing, alarming, history, remote command, or local automatic control.
4. Verify critical values and equipment states by approved independent methods.
5. Apply temporary monitoring and recordkeeping at a defined frequency.
6. Escalate to operations, control support, and cybersecurity support when indicators warrant.
7. Restore one controlled step at a time and complete an end-to-end test before ending fallback.

Cybersecurity is part of reliable O&M

EPA, CISA, and the FBI urge water systems to reduce public-internet exposure, change default passwords, inventory operational technology, maintain backups, plan recovery, and train personnel. Those are organizational controls, not an invitation for a Class I operator to alter a firewall or install a patch.

Use only assigned accounts and approved remote access; lock the session when leaving; do not share credentials; and never attach an unknown USB device, personal computer, modem, or software. Report unexpected login prompts, changed setpoints, disabled alarms, new users, unfamiliar remote sessions, unexplained configuration changes, or displays that differ from known screens. Preserve the event and follow the incident plan rather than exploring the system.

Planned SCADA maintenance requires impact review, backups managed by authorized staff, a rollback plan, controlled testing, and clear ownership of manual operation. After restoration, verify timestamps, critical tags, alarms, trends, command-and-feedback paths, historian capture, user access, and any redundant path. Document versions and the as-left state.

Application scenario

All values from a remote intake freeze at 09:17, yet central plant tags keep updating. Confirm timestamps and quality indicators, contact the intake under the fallback plan, obtain local level and pump status, protect supply, and open a detailed work request. Do not infer that the pumps stopped, change feeds from stale flow, or reboot network equipment without authorization. End fallback monitoring only after live values, alarms, history, and command feedback pass the restoration test.

Official source trail

• WPI 2025 Water Treatment Operator Class I Need-to-Know
• NIST SP 800-82 Revision 3, Guide to Operational Technology Security
• CISA, EPA, and FBI top cyber actions for water systems