12.6 SCADA, Controls & Preventive Maintenance Programs
Key Takeaways
- SCADA supervises and acquires data while PLCs execute the actual control logic, and the plant must remain operable if SCADA is lost.
- Preventive maintenance is time or runtime based, predictive maintenance is condition based, and corrective maintenance is repair after failure.
- A computerized maintenance management system schedules work, records history, and tracks parts, converting maintenance from reactive to planned.
- Alarm management requires prioritization, because an operator facing hundreds of nuisance alarms will miss the one that matters.
- SCADA systems are critical infrastructure and must be segmented from business networks, with no unnecessary internet exposure.
12.6 SCADA, Controls & Preventive Maintenance Programs
Control systems and maintenance programs are grouped together here because they answer the same question from opposite directions: how does the plant keep running when nobody is watching?
1. The Control Layers
| Layer | What it is | What it does |
|---|---|---|
| Field devices | Instruments and final control elements (Section 12.4) | Measure the process; open valves, start motors |
| PLC — Programmable Logic Controller | A ruggedized industrial computer | Executes the control logic. Starts and stops pumps, runs PID loops, enforces interlocks. This is where control actually happens |
| RTU — Remote Terminal Unit | A PLC-like device at a remote site | Lift stations, tanks, well houses; communicates back to the plant |
| HMI — Human Machine Interface | Local operator screen | Lets an operator see and adjust one process area |
| SCADA — Supervisory Control and Data Acquisition | Plant-wide supervisory software | Supervises, trends, alarms, logs, and reports. Provides setpoints; it does not usually execute the control loop itself |
The distinction that gets tested: SCADA supervises; the PLC controls. If the SCADA server fails, PLCs continue running the plant on their last setpoints. This is deliberate architecture, and it means an operator must know how to run the plant locally at the PLC or in hand when SCADA is unavailable.
Control modes
| Mode | Meaning |
|---|---|
| Hand / Manual | Operator directly commands the device; automatic logic bypassed |
| Off | Device disabled |
| Auto / Remote | PLC or SCADA logic commands the device |
A HOA (Hand-Off-Auto) switch left in Hand is a leading cause of "the plant did not do what SCADA told it to." Verifying HOA positions is a routine round item.
PID control
Most continuous loops — dissolved oxygen, chlorine residual, level, pressure — use PID:
- Proportional — output responds to the size of the error. Too much gain causes oscillation.
- Integral (reset) — eliminates the residual offset by acting on accumulated error over time. Too much causes overshoot and hunting; integral windup occurs when the output saturates and the integral term keeps accumulating.
- Derivative (rate) — responds to the rate of change. Often omitted in water and wastewater because process noise makes it erratic.
A loop that oscillates continuously is usually over-tuned on gain; a loop that never quite reaches setpoint needs integral action; a loop that overshoots badly after a disturbance has too much integral.
2. Alarm Management
The most common control-system failure at a treatment plant is not technical — it is alarm flooding. When an operator faces hundreds of standing and nuisance alarms, the alarm that actually matters is invisible.
| Practice | Detail |
|---|---|
| Prioritize | Every alarm classified — typically critical, high, and low — with a defined operator response for each |
| Every alarm needs an action | If there is no action an operator can take, it is information, not an alarm |
| Set deadbands and time delays | Prevents a value hovering at a setpoint from chattering thousands of alarms |
| Eliminate standing alarms | An alarm that is always active trains operators to ignore the alarm banner |
| Review regularly | Rank by frequency and address the top offenders |
| Test autodialers and callout | Verify after every change; an untested callout list is discovered to be wrong at 3 a.m. |
Critical alarms at a water plant typically include loss of disinfection, high finished-water turbidity, low clearwell or tank level, low system pressure, and chemical feed failure. At a wastewater plant they include high wet-well level, blower or RAS pump failure, high effluent turbidity or solids, disinfection failure, and power loss.
3. Cyber Security
Water and wastewater systems are critical infrastructure, and control systems have been the target of real intrusions. Baseline expectations:
- Network segmentation — the control network separated from the business network by a firewall, with no unnecessary internet exposure.
- No default passwords, individual accounts rather than shared logins, and prompt removal of departed employees' access.
- Multi-factor authentication for all remote access, through a VPN rather than an exposed remote-desktop port.
- Patching of HMI and server operating systems on a managed schedule.
- Tested, offline backups of PLC programs, HMI applications, and historian data — a backup that has never been restored is a hypothesis.
- An incident response plan that includes operating the plant manually, because the correct response to a suspected compromise is often to disconnect and run in hand.
- Physical security of control panels, network equipment, and remote sites.
4. Maintenance Strategies
| Strategy | Trigger | Character |
|---|---|---|
| Corrective (reactive / run-to-failure) | The equipment breaks | Highest total cost for critical assets; acceptable only for non-critical, redundant, inexpensive items |
| Preventive (PM) | Calendar time or runtime hours | Lubrication, filter changes, inspections, rebuilds. Predictable but may replace healthy components |
| Predictive (PdM) | Measured condition — vibration, thermography, oil analysis, ultrasonics (Section 12.3) | Work is done when the asset needs it; highest efficiency |
| Reliability-centered | Analysis of failure modes and consequences | Assigns the right strategy to each asset based on criticality |
A mature plant uses all four, matched to asset criticality: run-to-failure on a spare hallway light, predictive monitoring on the only raw water pump.
5. Building a Preventive Maintenance Program
- Inventory the assets. Every pump, motor, valve, blower, feeder, and instrument, with a unique equipment number.
- Rank by criticality. What fails the permit or endangers the public if this stops? Redundancy, lead time for parts, and consequence of failure all feed this.
- Define tasks and intervals from manufacturer manuals, then adjust from your own failure history.
- Write clear procedures, including required PPE, lockout/tagout steps, tools, parts, and acceptance criteria.
- Schedule and assign with adequate labor allocated to planned work.
- Record everything — what was found, what was done, parts used, hours spent.
- Analyze the history. Repeat failures on the same asset point at a root cause the PM is not addressing.
CMMS — Computerized Maintenance Management System
A CMMS holds the asset register, generates and tracks work orders, schedules PMs by date or runtime, manages spare parts inventory with reorder points, and accumulates equipment history and cost. Its real value is the history: it is what turns "this pump seems to fail a lot" into a documented case for replacement in the capital budget.
Metrics worth tracking
| Metric | What it tells you |
|---|---|
| Percent planned vs. reactive work | The maturity of the program; mature programs run heavily planned |
| PM completion rate | Whether the schedule is realistic and staffed |
| Mean time between failures (MTBF) | Reliability trend for an asset or class |
| Mean time to repair (MTTR) | Parts availability and crew capability |
| Equipment availability | The outcome that matters |
| Maintenance cost per asset | Identifies replacement candidates |
6. Spare Parts and Documentation
- Stock critical spares — items with long lead times whose failure stops the plant. A spare impeller for the only raw water pump is cheap insurance; a spare for a redundant unit may not be.
- Maintain O&M manuals, as-built drawings, electrical one-lines, P&IDs, and PLC and HMI program backups in an organized, accessible location — and off site.
- Keep equipment nameplate data recorded in the CMMS. Reading a nameplate off a submerged pump at 2 a.m. is not a plan.
- Document valve positions, HOA settings, and control setpoints so a normal configuration exists to return to after an upset.
The SCADA server fails during a night shift. What generally happens to the plant?
A dissolved oxygen control loop oscillates continuously around its setpoint. Which tuning adjustment is most likely needed?
Which maintenance strategy schedules work based on measured equipment condition rather than elapsed time?
An operator faces several hundred active alarms on the SCADA screen every shift. What is the principal risk?