13.4 Instrumentation, In-Line Sensors, Telemetry & SCADA
Key Takeaways
- Instrumentation and Pressure Gauges are named treatment sub-topics, while In-Line Sensors and SCADA are named distribution sub-topics.
- The standard analog instrument signal is 4 to 20 milliamps, where 4 mA represents zero so that a broken wire reads 0 mA and is distinguishable from a true zero.
- SCADA consists of field instruments, programmable logic controllers or remote terminal units, a communications network, and a human machine interface with historian.
- Online analyzers for chlorine residual, turbidity, pH, and streaming current must be verified against a bench grab sample on a routine schedule.
- Water and wastewater utilities are critical infrastructure, and cybersecurity practice requires network segmentation, no default passwords, multifactor remote access, and offline backups.
Signals and Standards
| Signal | Use | Why |
|---|---|---|
| 4-20 mA analog | The workhorse for continuous process variables | Live zero: 4 mA is the bottom of scale, so a broken wire reads 0 mA and is unambiguously a fault rather than a real zero. Current loops are immune to voltage drop over long runs |
| 0-10 V analog | Short runs, panel devices | Susceptible to voltage drop and noise |
| Discrete (digital) I/O | On/off, run/stop, open/closed, alarm | Contact closures |
| Pulse/frequency | Flow totalization from turbine and propeller meters | |
| Fieldbus / Ethernet / Modbus / DNP3 | Digital device networks and telemetry | DNP3 is common in water SCADA telemetry |
Scaling a 4-20 mA signal. A level transmitter is calibrated 0-40 feet, and the reading is 13.2 mA.
Core Instruments and Their Failure Modes
| Instrument | Measures | Common failure mode |
|---|---|---|
| Pressure gauge / transmitter | System and pump pressure | Snubber or isolation valve plugged, so the gauge reads stale; diaphragm seal failure; gauge damaged by pulsation |
| Level: pressure transducer | Tank and wet well level | Vent tube blocked with moisture, causing drift; sensor fouling |
| Level: ultrasonic | Non-contact level | False echoes from foam, turbulence, or condensation on the face; temperature compensation errors |
| Level: radar | Non-contact level | More tolerant of foam; costlier |
| Level: float / bubbler | Simple level | Float hangs up; bubbler line plugs |
| Turbidimeter | Filter effluent, combined effluent | Bubbles read as turbidity; scratched or fouled sample cell; sample line biofilm |
| Chlorine analyzer (amperometric or colorimetric DPD) | Residual | Reagent exhaustion; fouled membrane or electrode; sample line lag; must be verified against a bench grab |
| pH | Coagulation, corrosion control, disinfection | Reference junction fouling; dried-out electrode; ground loops |
| Streaming current monitor | Coagulant dose control | Sensor fouling; loses correlation after a source water change |
| Dissolved oxygen (optical or membrane) | Aeration control | Membrane fouling; optical cap aging |
| Flow | Everything | Air in the line; submerged flume or weir; drift in the zero |
| In-line residual and pressure sensors in the distribution system | Distribution water quality and hydraulics | Sample tap biofilm, dead-leg sample lines, vandalism, communication loss |
[!IMPORTANT] An online analyzer is a trend instrument until it is verified. The compliance discipline is to compare each online analyzer against a bench grab sample on a defined schedule - daily for turbidity and chlorine at most plants - and to document the comparison. When an online reading and a grab sample disagree, the grab governs until the analyzer is corrected, and a systematic offset is a finding a sanitary survey will pursue.
Calibration Vocabulary
- Zero - the reading with the measured variable at the bottom of scale
- Span - the reading at the top of scale
- Linearity - agreement across the range, checked at several points
- Drift - change over time with no change in the process
- Hysteresis - different readings approaching a value from above versus below
- Accuracy vs precision - accuracy is closeness to truth; precision is repeatability. A badly zeroed instrument can be very precise and completely wrong.
SCADA Architecture
| Layer | Components |
|---|---|
| Field | Instruments, transmitters, motor starters, VFDs, actuated valves |
| Control | PLC (programmable logic controller) or RTU (remote terminal unit) executing the control logic |
| Communications | Licensed radio, cellular, fiber, leased circuit, spread spectrum; protocols such as DNP3, Modbus, and Ethernet/IP |
| Supervisory | HMI (human-machine interface) screens, historian (trend database), alarm server, reporting |
Control modes operators must distinguish:
- Local / hand - operated at the device, bypassing SCADA
- Auto / remote - operated by the PLC logic or by the operator through the HMI
- Off - locked out
Every start-stop device should have a hand-off-auto (HOA) selector, and the position of every HOA switch is the first thing to check when equipment "does not respond to SCADA."
Alarm Management
Poor alarm design is a genuine safety problem. Practices that work:
- Prioritize alarms into a small number of levels (critical, high, advisory) and make sure a critical alarm is visibly and audibly distinct
- Eliminate nuisance and chattering alarms using deadbands and time delays; an operator who acknowledges 400 alarms a shift is not reading any of them
- Every alarm should have an action. If there is nothing to do about it, it is a status point, not an alarm
- Test critical alarms on a schedule - especially chlorine leak detection, high/low chlorine residual, turbidity, tank level, and loss of power
- Alarm callout to on-call staff with confirmed receipt; a callout system nobody has tested is a liability
Cybersecurity
Water and wastewater systems are designated critical infrastructure, and industrial control systems have been the subject of repeated intrusion attempts, including incidents at small water utilities where remote access software was left exposed with a shared or default password. Under the America's Water Infrastructure Act, community water systems above defined population thresholds must conduct risk and resilience assessments and maintain emergency response plans that explicitly address cybersecurity and electronic systems, and recertify them on a recurring cycle.
Baseline practices an operator is expected to know:
- Change every default password. Vendor defaults on PLCs, HMIs, and remote access tools are published.
- Do not share accounts. Individual accounts with individual credentials, removed promptly when staff leave.
- Multifactor authentication for all remote access, and no direct exposure of HMI or PLC to the public internet.
- Segment the control network from the business network with a firewall; no email or web browsing on an HMI.
- Inventory and patch control system assets on a managed schedule, tested first where possible.
- Disable unused ports and services, including unused USB ports on HMI workstations.
- Offline, tested backups of PLC programs, HMI configurations, and historian data - ransomware that encrypts the only copy of a PLC program can stop a plant.
- Manual operation capability. Every plant should be able to run in local/hand mode without SCADA, and operators should practice it.
- Report incidents to the State Water Board and to the appropriate federal center, and treat a suspected intrusion as an emergency response event, not an IT ticket.
[!WARNING] The most common real-world water utility cyber incident is not a sophisticated attack. It is an internet-exposed remote access tool with a weak, shared, or default password. Fixing that single class of exposure eliminates most of the realistic risk.
A level transmitter is calibrated for 0 to 50 feet and outputs a 4 to 20 mA signal. The signal reads 12.0 mA. What is the level?
An online chlorine analyzer reads 1.8 mg/L while a bench DPD grab sample of the same water reads 1.1 mg/L. What is the correct response?
Which practice most directly addresses the most common real-world cybersecurity failure at small water utilities?