Questions and answers
1778 questions answered across the knowledge base, grouped by the guide they come from. Each answer stands on its own; follow the link for the full reference behind it.
PLC Architecture
Read the guide →- What is the difference between a modular and a compact PLC?
- A modular controller is a chassis with slots for separately chosen processor, power supply, and I/O modules, and it can grow by adding chassis. A compact controller has a fixed processor and I/O in one unit, with limited expansion. Compact costs less and modular scales.
- What does the backplane do?
- It carries power from the supply to every module and data between the processor and every module. The processor reads and writes all I/O across it each scan, and a module is addressed by the slot it occupies on it.
- When should I use remote I/O?
- When the field wiring back to a central panel would be longer and more expensive than a network cable and a remote rack, or when the equipment is in another building. Accept that the network then has to be designed, secured, and maintained as part of the control system.
- Do I need a redundant processor?
- Only where a stopped controller costs more than the redundancy, which is a large plant or a critical process, not a typical station. Redundancy does not protect against a program error, and the network and I/O still have to be designed so that both processors can reach them.
The PLC Processor
Read the guide →- What is the difference between program mode and run mode?
- In run mode the processor executes the program and controls outputs. In program mode it stops executing, outputs go off or to their configured state, and the program can be downloaded or changed. Remote mode lets the software choose between the two without the key.
- Why does a faster processor not give a faster scan?
- Because scan time is mostly the program size, the I/O count, and the communication load, not the clock speed of the processor. Halving the program does more for scan time than doubling the processor speed.
- What does a flashing fault light mean?
- On most platforms a flashing red fault light is a recoverable fault: the processor has stopped, a fault code is recorded, and the fault can be cleared from the software or the keyswitch once the cause is fixed. Solid red is usually unrecoverable and needs a power cycle or a download. Read the platform manual for the exact pattern.
- Should the processor be left in remote mode?
- Not after commissioning. Remote mode lets anyone with network access change the mode or download. Leave it in run, remove the key, and use remote mode only during work that needs it.
Control Power Supplies
Read the guide →- How do I size a 24 VDC power supply for a PLC panel?
- Sum the maximum current of every load, add inrush for coils and capacitive loads, derate for the enclosure temperature from the datasheet curve, then add 20 to 30 percent margin. The how-to on this site works an example, and the calculator does the arithmetic.
- Should the PLC and the field devices share a power supply?
- Not if the panel matters. A shorted field cable on a shared supply drops the voltage to the processor and crashes it. A separate controller supply keeps the processor running and reporting while the field branch fuse does its job.
- Why does the panel not power up after a shutdown?
- Usually inrush. Every relay, solenoid, and capacitor draws several times its running current at once on power-up, and a supply sized for the running load folds back and never comes up. Stagger the loads, or size for the inrush.
- Where do I ground the 24 VDC common?
- At one point, bonded to the panel ground, shown on the drawings. More than one bond makes a ground loop; no bond leaves the system floating.
PLC I/O Systems
Read the guide →- What is the difference between sinking and sourcing inputs?
- Which direction current flows through the module. A sinking input is switched to the positive supply by the field device and returns current to common; a sourcing input supplies the positive and is switched to common. A three-wire sensor has to match: PNP sensors go with sinking inputs, NPN with sourcing, on most platforms. The datasheet diagram governs.
- Should I use relay or transistor outputs?
- Transistor outputs for DC loads that switch often, such as pilot lights and interposing relays, because they do not wear. Relay outputs where the load is AC, where isolation from the field matters, or where the load type is unknown. Either way, drive motor starters and solenoids through an interposing relay.
- When do I need a differential analog input?
- When the signal sources are grounded at different places or are far apart, when a drive is nearby, or when a single-ended channel is reading noise. A differential input measures between its own two terminals and ignores what the common is doing.
- What is an interposing relay for?
- It sits between the output module and the real load. It carries the load current and voltage that the module cannot, converts between the module voltage and the load voltage, and fails cheaply and separately from the module.
Controller Memory and Addressing
Read the guide →- What is the difference between an INT and a DINT?
- Size and range. An INT is sixteen bits and holds about plus or minus 32,000; a DINT is thirty-two bits and holds about plus or minus 2.1 billion. Modern platforms use DINT by default because the INT range is exceeded by an ordinary counter within weeks.
- Why did my flow total stop increasing?
- It is a REAL, and it has grown to the point where adding one increment does not change the number within its seven significant digits. Accumulate totals in a DINT with a fixed scale, or in an LREAL, and roll the total into a daily or monthly register.
- What is a user-defined type?
- A structure the programmer defines, with named members of various types, that then becomes a type like any other. A UDT for a pump, with its commands, statuses, and setpoints, makes every pump tag identical in shape and lets the pump logic be written once.
- Does the program read inputs directly from the modules?
- No. It reads the input image, a copy taken at the start of the scan, and writes the output image, which is sent to the modules at the end. That is what makes the scan deterministic, and it is why an input cannot change in the middle of a scan.
Tasks and Execution Priority
Read the guide →- Should I put my PID loop in a periodic task?
- Yes. The integral and derivative calculations assume a constant time between executions. In the continuous task that time varies with load, and the loop behaves differently on a busy scan than a quiet one. A periodic task at the loop update rate gives it the constant step it assumes.
- What rate should a periodic task run at?
- As slow as the logic in it allows. A pressure loop might need 50 to 100 ms; a level loop is fine at one second. Faster rates consume processor time and leave less for everything else.
- What happens if a periodic task overruns?
- The controller records an overlap, and skips or delays the next execution. It is a design error: too much logic for the interval, or starvation by a higher priority task. Move logic out or lengthen the interval.
- Can safety logic go in a fast periodic task?
- Speed is not the issue; integrity is. Logic that protects people belongs in a safety-rated controller or a hardwired circuit, where a single fault cannot defeat it, not in a task of the standard controller, however fast.
The Watchdog Timer
Read the guide →- What does a watchdog fault mean?
- A task took longer to execute than its configured limit, and the controller faulted rather than continue with outputs unwritten. The fault names the task. Look for a loop, a large instruction, or starvation by higher priority tasks.
- Can I just increase the watchdog time?
- You can, and it will clear the fault, and the slow scan that caused it will still be there delaying every output. Find and fix the cause first. Then set the limit from the corrected maximum scan time with some margin.
- What is a reasonable watchdog setting?
- A modest margin above the maximum scan time observed under full load. The default of a few hundred milliseconds on most platforms is reasonable for a continuous task that scans in tens of milliseconds. Periodic tasks get a limit related to their interval.
- Why did the watchdog trip once and never again?
- A one-time event, a large data transfer, an upload, or a burst of communication, coincided with a heavy scan. If the maximum scan time in normal running is close to the limit, it will happen again; if not, note it and watch the maximum.
Retentive Memory
Read the guide →- What does retentive mean in a PLC?
- That the value survives a power cycle. On some platforms every tag is retentive; on others only marked areas, files, or instructions are. The rest return to zero on power-up.
- How long does a PLC battery last?
- Two to five years depending on the model and how long the controller spends unpowered. The controller warns when it is low. Replace it on a schedule and with the controller powered, so the memory is held during the change.
- Why did all my setpoints reset to zero?
- The retention backup failed, a battery or a discharged energy storage module, or a download or a memory card restore replaced the current values with saved ones. Restore from the last upload, and then find out which happened so it does not recur.
- Should the plant restart automatically after a power outage?
- That is a decision per piece of equipment, written into the control narrative. Pumps in a lift station usually should. A chemical feed or a sequence that assumes a starting condition usually should not without checks. Either way, the first-scan logic implements the decision explicitly.
IEC 61131-3
Read the guide →- Which language should I learn first?
- Ladder, because it is what the installed base is written in and what most troubleshooting is done in. Structured text second, because it is where the calculations and the more capable logic live, and it transfers between platforms most easily. The other three are learned when a project needs them.
- Is ladder logic obsolete?
- No. It remains the best language for discrete control that maintenance staff troubleshoot online, because the state of every contact is visible in place. It is a poor language for arithmetic and data handling, and programs that force those into ladder are the ones that give it a bad name.
- Can I move a program from one vendor to another?
- Not without rewriting. Structured text and the logic structure move with editing; the I/O configuration, communications, and vendor-specific instructions are rebuilt. The PLCopen XML format helps with some tools, but the honest expectation is a re-implementation informed by the original.
- Does the standard say anything about how to structure a program?
- It provides the mechanisms, not the rules. Program organization, naming, and the discipline of one function block per equipment type are site standards, and the PLCopen guidelines are a good source for them.
Structured Text
Read the guide →- Is structured text faster than ladder?
- Execution speed is similar on most platforms; the compiler produces comparable code. Structured text is faster to write for calculations and slower to troubleshoot for discrete logic. Choose by readability for the person who will maintain it, not by execution speed.
- Can I write the whole program in structured text?
- You can, and some integrators do. In a utility where operators and electricians troubleshoot online, an all-text program is a maintenance problem they will resent for the life of the plant. Keep the discrete control they look at in ladder.
- How do I troubleshoot structured text online?
- Most platforms show live values beside each variable and let you set a breakpoint or a watch. The better answer is to write the block so it publishes its state, step, and hold reasons to tags, and to troubleshoot from those on the HMI or the tag monitor.
- Does structured text move between platforms?
- Better than any other language in the standard. The core syntax is the same; timers, function block declarations, and vendor extensions differ. Expect editing, not a rewrite.
Function Block Diagram
Read the guide →- Is FBD the same as a function block?
- No. A function block is a program organization unit with internal state, and it can be written in any of the five languages. Function block diagram is one of the languages, and it is the one most often used to wire function blocks together. The naming is confusing and the distinction matters when reading a specification.
- Can I troubleshoot FBD online?
- Yes, and it is one of its strengths for analog problems: the value on every wire is shown live, so a bad reading can be followed from the input pin through scaling and filtering to the point where it goes wrong. For discrete logic, ladder still shows the state of a contact more directly.
- Why does the diagram behave differently after I added a block?
- Execution order changed. The platform re-resolved the order when the wiring changed, and a feedback path that was reading last scan is now reading this scan, or the reverse. Mark feedback wires explicitly and check the execution numbers after any edit.
- Should I build my own pump block or use the vendor library?
- Vendor and integrator libraries exist for exactly this and are well tested. Use one where it matches the site standard and the HMI faceplates. Build your own when the library does something the site does not want, and then test it as carefully as the vendor did.
State Machines in PLC Programs
Read the guide →- Should I use a sequential function chart instead?
- SFC is the graphical form of the same idea and some platforms implement it well. It excels at simple linear sequences and at showing the active step. It becomes hard to read with many exits and parallel branches, and online troubleshooting depends on the platform. A CASE statement in structured text is portable and explicit; SFC is a fine choice where the platform and the site are comfortable with it.
- How do I handle two things happening at once?
- Two state machines. A filter with a backwash sequence and a separate flow control loop is two machines that exchange status. Trying to express parallel activity inside one state machine produces the branching mesh that the pattern was meant to avoid.
- Where do the interlocks go?
- Permissives gate the transition out of Idle. Interlocks that must stop the sequence go into the fault condition and produce the transition to Fault from every state. Interlocks that protect a single output stay on that output, after the state logic, so an output the state calls for is still blocked when its interlock says so.
- The sequence is stuck in a state. How do I find out why?
- Read the published wait reason and the step timer. If the machine does not publish them, look at the transition condition for that state in the program and evaluate each term. The fix after the event is to add the wait reason so the next time does not need the program.
PLC Will Not Run
Read the guide →- The controller faults the moment I put it in run. What is it?
- A persistent fault in the logic or the configuration: a math fault on the first scan, an I/O connection to a missing required module, or a power-up handler that faults deliberately. The fault log shows the code and the location on every attempt; fix that.
- The controller ran for years and now will not run after a power outage. Why?
- The battery or the nonvolatile memory. The program was held in battery-backed memory, the battery was dead, and the outage cleared it. Load the backup, replace the battery, and configure the controller to store the program to nonvolatile memory where the platform supports it.
- Can I run the controller with a module inhibited?
- Yes, where the platform allows a module to be inhibited or marked not required. The controller runs without that module and its points are unavailable. Do it deliberately, alarm it, and return the module to service as soon as possible; a plant running on an inhibited module is a plant with a missing set of I/O.
- The fault log is empty and the controller will not run. What now?
- Keyswitch, then program presence, then firmware. A controller with no program and no fault is waiting for a download. A controller in PROGRAM with a program and no fault is waiting for the switch.
I/O Not Updating
Read the guide →- The module indicator follows the field but the tag does not. What is it?
- The module data is not reaching the tag: a module fault that the tree shows, a mapping or alias error, a task that owns the module and is not running, or a force on the tag. The I/O tree and the force list answer it in a minute.
- Everything on one remote rack froze at once. Why?
- The adapter connection dropped: the network, the adapter power, or the adapter itself. The rack connection status tag is faulted, and the switch port shows the link state. On reconnection the points resume; the outputs went to their fault state in between.
- A single output will not turn on and the tag is on. What is left?
- The module output enable or power for that group, a blown output fuse, a failed channel, or the field circuit. Measure at the terminal: voltage present means the field; absent means the module or its supply.
- Why do inputs work in the test rig and not in the panel?
- Sinking versus sourcing, or the module common. The test rig was wired to suit the module; the panel wiring follows a drawing that assumed the other convention. Check the module manual for the common and the current direction, and the schematic for what was wired.
Permissives
Read the guide →- Should a permissive that goes false while running stop the pump?
- Only if the functional description says so, and then it is coded as a run interlock as well. A drive ready contact that drops out while running should stop the pump; a minimum off time or an AUTO selector already satisfied at the start should not. Decide condition by condition and write it down.
- Where does the anti-cycle timer belong?
- In the permissives. The minimum off time and the starts-per-hour limit protect the motor from heating; they are conditions that must be true before a start and have nothing to do with a running pump. A permissive display that shows the remaining off time saves a lot of radio calls.
- Should a HAND start respect the permissives?
- A HAND start is the operator taking responsibility, so it usually bypasses the automatic permissives such as level and AUTO. It never bypasses the trips, and a plant may choose to keep a few protective conditions, such as seal fail, in force in HAND. Say which in the functional description; the HOA logic is where accidents are designed in.
- How do I keep a long permissive list from being a maintenance burden?
- Use a standard pump block with a fixed list of permissive bits, and leave the unused ones forced true with a configuration flag. Every pump then has the same list in the same order on the same faceplate, and a new pump is configured rather than programmed.
Sequencers
Read the guide →- What is the difference between a sequencer and a state machine?
- A sequencer runs a fixed list of steps in order and returns to idle; the only branches are hold and abort. A state machine has a set of states with transitions in any direction, such as a pump that moves between stopped, starting, running, stopping, and failed. Use a sequencer for an operation with a beginning and an end, and a state machine for equipment that lives in modes.
- Where do the step times come from?
- From the functional description, which got them from the process designer, the equipment manufacturer, and the plant. Put them in setpoint registers with limits, editable from a supervisor screen, never as constants in the code. A wash duration that has to be changed by a programmer is a wash duration that never gets optimized.
- Can two sequences run at the same time?
- Two sequences on different equipment, yes; each has its own step register and code. Two filters backwashing at once is a process question, and usually the answer is a permissive that lets only one backwash run at a time because the wash supply and the waste handling are sized for one.
- How do I test a sequence without running the plant?
- With the outputs disabled or the equipment isolated, step through it with simulated feedback: force the limit switches and levels in the order the sequence expects, then in the wrong order, then not at all, and confirm every timeout and abort behaves. Then run it once for real with someone at the equipment. Sequences that were only tested on the happy path fail on the first unhappy one.
Program Organization
Read the guide →- How big should a routine be?
- Small enough to read in one sitting and to describe in one sentence: this routine runs the filters. A routine that needs a table of contents is two routines. On most projects that is a few dozen to a couple of hundred rungs, and a device block instance counts as one rung.
- Are device blocks worth it on a small system?
- Yes, on anything with more than one pump. The block takes longer to write the first time than a few rungs of logic, and it pays back on the second pump, on the HMI faceplate that binds by name, and on every future change. Small systems grow.
- Should loops really be in a periodic task?
- Yes. A PID computes with an assumed sample time; in a continuous task that time varies with scan length and the loop tuning changes with it. A periodic task at 100 to 500 ms gives the loop a fixed sample time and predictable behavior. The same applies to totalizers and rate calculations.
- What is the minimum for a program someone else can maintain?
- A main routine that shows the flow, routines named for the plant areas, I/O mapped in one place, tags named from the drawings with descriptions, setpoints as named tags, a comment on every rung whose purpose is not obvious, and a revision record. That is a day of work on a program of any size, and it is the day that saves the most later.
Control Strategies
Read the guide →- When is on-off control better than PID?
- Whenever the final control element cannot modulate, and whenever the process only needs to stay between two limits. A wet well pumped by fixed-speed pumps, a tank filled by a solenoid valve, a heater: on-off with a suitable deadband is the correct design, not a compromise.
- How do I combine drive speed control with staging pumps?
- Let PID control the lead pump speed. Stage the lag pump when the lead has been at or near maximum speed for a set time and the controlled variable is still below setpoint; destage when the lead is at minimum for a set time and the variable is above. Base staging on speed and time, not on the variable alone, so the two mechanisms do not fight.
- What is override control for?
- Holding one variable at setpoint while respecting a limit on another. A discharge pressure loop with a low-select against a maximum flow controller keeps pressure until flow would exceed the limit, and then the flow controller takes the pump speed. Alarm when the override is active so operators know why the pressure is off.
- Why tune the inner loop first in a cascade?
- Because the outer loop sees the inner loop as part of its process. An inner loop that is slow or oscillating makes the outer loop impossible to tune, and any outer tuning done first becomes wrong the moment the inner loop is changed. Inner loop fast and stable, then outer loop slow.
Alarms in the Controller
Read the guide →- Should the alarm latch in the controller or in SCADA?
- Process alarms follow the condition and are acknowledged in SCADA. Equipment alarms that need a person, such as fail to start, seal failure, or a discrepancy, latch in the controller and are reset from the screen or the panel after the cause is fixed, so that the equipment does not restart on its own.
- How do I stop the alarm flood when communications are lost?
- Package the site alarms in words and have SCADA treat the block quality as one condition: a communication alarm for the site, with the individual alarms held or marked stale rather than tripped. The controller keeps its own alarm state and the flood never happens.
- Can operators change setpoints?
- Within limits set by engineering and enforced by the controller, with the change logged. A high level setpoint can be moved within the range the wet well allows; it cannot be set above the overflow. The limits are in the alarm list.
- What about alarms for conditions the controller cannot see, like a server disk filling?
- Those are system alarms and belong in SCADA or the network monitor. The controller owns process and equipment alarms; SCADA owns its own health.
Sequential Function Chart
Read the guide →- Ladder state machine or a chart?
- A chart when the platform supports it and the sequence has more than a handful of steps or any branching; the chart is self-documenting and the step is visible. A ladder state machine with a step register when the platform lacks charts or the maintenance staff will not touch anything else. Both need the same exits, timeouts, and aborts.
- Can two charts run at once?
- Yes, and each should own its own equipment. Two charts that command the same valve will fight. A simultaneous branch inside one chart is the way to run parallel phases of one sequence; separate charts are for separate processes.
- What happens on a download or an online edit?
- Platform dependent, and dangerous. A chart may reset to its initial step or keep its active step. Plan edits for an idle sequence, and test what the platform does before relying on it.
- How do I test a chart before startup?
- With the transitions forced or simulated one at a time, watching the actions, then with timeouts shortened, then with each abort input. A chart that has never been aborted in testing will be aborted for the first time on a bad night.
Analog Signal Problems
Read the guide →- The raw count is right and the engineering value is wrong.
- The scaling parameters: the raw minimum and maximum for the channel range actually configured, and the engineering minimum and maximum from the instrument list. One of the four is stale, most often after a transmitter re-range or a module replacement with a different count span.
- Why does the channel read a small value with nothing connected?
- An open input on some modules floats to a small count rather than zero, and the under-range diagnostic is the reliable indication. Use the channel status, not the count, to detect an open loop.
- Can a module channel be damaged by a wiring mistake?
- Yes: 24 volts applied directly across a current input, a four-wire transmitter connected to a loop-powering input, or a lightning surge. A damaged channel reads a fixed count or a fault, and the module is replaced. A surge protector on loops that leave the building prevents the third case.
- How much filtering is too much?
- When the filtered value lags the process by more than the control loop or the alarm can tolerate. Transmitter damping, the module filter, and a program filter add up; a level loop with 30 seconds of combined lag hunts. Set one filter deliberately and leave the others at minimum.
Communication Failures
Read the guide →- The message instruction reports an error but the device answers a laptop tool.
- The controller message differs from the tool message: a different function code, a different address convention, a data type or count the device rejects, or a unit identifier. Compare the two requests byte for byte with the driver diagnostics or a capture.
- Communications fail only when the programming software is connected.
- The programming session consumed the last available connection or the controller communication time budget. Raise the time slice for communications or reduce the connections; check the controller limits.
- How do I tell a controller port failure from a switch port failure?
- Swap the cable to a known-good switch port; then swap the cable. If the link comes up on another switch port, the switch port was the fault; if it never comes up, the controller port or the cable is.
- Should the program keep polling a device that has failed?
- Not at full rate. Back off to a slow probe, alarm, and mark the data bad. Continuous retries to a dead device waste the controller communication budget and delay every other message.
Network Problems
Read the guide →- The controller web page says the address is right but nothing can reach it.
- The mask or the gateway, the switch port, or a firewall between. Ping from a device on the same switch first; if that works, the problem is beyond the local network, and it is the mask, the gateway, or a rule.
- I/O drops every few minutes after a switch was replaced.
- The new switch is filtering multicast without a querier, or is not configured for the ring the old one was in. Configure the switch to match the I/O protocol and the ring.
- How many connections is too many?
- Above about three quarters of the controller limit at normal operation, because failover, maintenance sessions, and retries need the rest. The limit is in the controller specifications and the current count is on its diagnostics page.
- Can the controller cause a broadcast storm?
- It can cause a multicast flood on an unfiltered network, and a controller with two ports bridged internally can close a loop if both are cabled to the same switch without ring protection. A loop between switches is the usual storm source; the controller is a rarer one.
Program Faults
Read the guide →- The controller faulted once a week for months and cleared itself. Is that a problem?
- Yes. A fault handler is clearing a recurring program fault, and every occurrence skipped some logic. Read the fault log for the code and location and fix the cause; then make the handler count and alarm.
- How do I find which screen entry caused an index fault?
- The fault record gives the routine and rung, which names the array and the index tag; the index tag value at fault time, and the audit trail on the screen, name the entry. Then clamp the index and limit the screen field.
- Can a communications write cause a program fault?
- Yes, when the written value is used as an index, a divisor, or a pointer without validation. Every value that enters the controller from a network is treated as untrusted and validated before use, for safety and for security.
- Should I raise the task period or fix the logic when tasks overlap?
- Fix the logic if the overlap is new or the task time has grown; raise the period if the task genuinely needs the time and the process can tolerate the slower rate. Either way, measure first and document the decision.
Watchdog Faults
Read the guide →- The task time is normally 8 milliseconds and the watchdog is 500. How did it fault?
- Something took 500 milliseconds once: a loop with a condition that let it run thousands of times, a string operation on a large array, or a communications burst on a platform that services communications inside the task. The maximum time and the fault record show which task; the correlation shows what triggered it.
- Does a faster processor fix it?
- It buys time, and it hides a loop that will still run away. Fix the logic first; upgrade when the program legitimately needs more capacity.
- Should the fault handler clear a watchdog fault?
- No. A watchdog fault means the program did not complete; clearing it and continuing means running with outputs that a stuck task may not have updated. Stop, alarm, and restart under control.
- Why does the task time rise when the programming laptop connects?
- The controller services the programming session from the same processor and, on many platforms, from a time slice inside the scan. Online monitoring of many tags, cross-reference searches, and uploads all add load. Go offline when not editing, and set the communication time slice deliberately.
Modicon M340
Read the guide →- Can I mix M340 and M580 I/O?
- The X80 I/O module family is shared, and modules move between the two in the same rack types, subject to the compatibility lists for the specific module and firmware. A migration from M340 to M580 often keeps the I/O and replaces the CPU and rack.
- How do I get the program out of a controller with no project file?
- If the application was downloaded with upload information enabled, Control Expert can upload it with variable names and comments. If not, the upload gives logic without the documentation. Check the memory card, which may hold the application, and ask the integrator for the project archive.
- The controller runs but SCADA cannot connect over Modbus TCP.
- The Ethernet port address and mask, the switch port, and the Modbus TCP access control if it is enabled on the module. The embedded web page on the Ethernet port shows connections and errors; if the page loads, the network path is fine and the problem is the Modbus configuration or a client limit.
- Is the M340 still current?
- It remains in production and supported as of this writing, positioned below the M580. Check the current lifecycle status with the manufacturer before specifying it for a new plant, and plan spares for any installed base regardless.
Modicon M580
Read the guide →- Can I put SCADA on the remote I/O network?
- No. The remote I/O ring is a deterministic private network for the drops. SCADA and engineering connect through the control network on the CPU service port or a network module, with the traffic kept off the ring.
- What happens to a drop when the ring breaks?
- Nothing, for a single break: the ring protocol reroutes within the recovery time. A second break isolates the drops between the breaks, and the CPU reports them lost. The first break must be alarmed and fixed; a ring that runs broken for months is a line.
- Do I need a hot standby system?
- When a controller failure would stop treatment or cause an overflow and the process cannot ride through the time to replace a CPU from spares. Many plants use a single M580 with a spare CPU on the shelf and the application on a card; a hot standby pair is for the processes that cannot wait even that long.
- Why does the engineering laptop get refused after a firmware update?
- The update enabled or reset the access control list, or a service the software uses was disabled. Read the security settings in the configuration and add the engineering addresses deliberately rather than turning the list off.
Control Expert
Read the guide →- Can Control Expert open a Unity Pro project?
- Generally yes, the archive from an older version opens in a newer one and is converted on save. The reverse is not possible. Keep the original archive before converting.
- The controller says the project does not match. What does that mean?
- The application in the controller differs from the project open on the laptop: a later change, a different build, or a different project. Upload the controller application and compare before downloading anything.
- Where is the operator interface built?
- Not here. Control Expert builds the controller application; the operator screens are in the SCADA or HMI software. The operator screens in Control Expert are engineering test tools.
- How do I move a pump block from one plant project to another?
- Export the derived function block and its data types from one project and import them into the other, or maintain the site library as a separate exported file that every project imports. A block copied by hand drifts.
Unity Pro
Read the guide →- Can I still buy Unity Pro?
- The product is sold as Control Expert; a current license covers the current version, and older versions are available to licensed users through the manufacturer support channels within their support policy. Confirm the current policy with the manufacturer.
- Will an old M340 accept a download from Control Expert?
- Only if its firmware is one the software version supports; older firmware may need updating first, which the compatibility list for the software version states. Read the list before connecting.
- The archive opens but the hardware catalog shows unknown modules.
- The project references modules not present in the catalog of the version in use, often because a catalog update or hardware package was not installed. Install the matching catalog before converting.
- What is the risk of leaving a plant on Unity Pro?
- The version stops installing or activating on current computers, the people who know it retire, and the archive is lost with a laptop. None of it is urgent until the day it is. Convert and archive on a schedule.
ControlLogix
Read the guide →- ControlLogix or CompactLogix for a plant?
- ControlLogix for large I/O counts, several controllers in one chassis, legacy networks, and redundancy; CompactLogix for small and medium plants and remote sites. The programming is the same, and logic moves between them.
- Why did the I/O connection fail after a switch replacement?
- The new switch is not configured for the multicast the older I/O connections use, or for the ring protocol, or the port speed and duplex differ. Unicast connections avoid the multicast issue where the modules support them.
- Can I upload the program without the project file?
- Yes: the controller holds the logic and tag names, and if the project was downloaded with documentation stored in the controller, the comments and descriptions as well. Recent revisions support storing that documentation; on older ones the upload has logic and tag names only.
- How many connections can it handle?
- Each controller and each communication module has a connection limit and a packet rate limit; the totals are in the specifications and the current use is on the module web pages. SCADA servers, historians, messaging, and I/O all count, and the design keeps well below the limit.
CompactLogix
Read the guide →- Can I replace an old single-port CompactLogix with a new one and keep the I/O?
- Within a generation that uses the same local I/O family, often yes with a project conversion; across generations the I/O family changes and the wiring is converted. Check the compatibility of the specific controller and modules and plan the conversion of the project to the new firmware.
- Which port goes to the radio?
- In dual-network mode, the port on the network designed for SCADA and engineering, separate from the drives and instruments. In ring or linear mode, both ports are the same network and the radio connects to the site switch on that network.
- How much I/O before I should be on ControlLogix?
- The local I/O limit of the controller generation is one threshold; the connection and memory limits are another; redundancy and legacy networks are the third. Many small plants run comfortably on a CompactLogix with remote I/O; a plant with hundreds of points, several drives on Ethernet, and a historian usually belongs on the larger controller.
- The controller lost its program after a long power outage.
- An older controller with a dead or missing battery loses its memory when power is off; a newer one stores the project in non-volatile memory or on a removable card and restores it on power-up if configured to. Check the battery schedule, the card, and the restore setting, and keep the project backup current.
Studio 5000
Read the guide →- Can I open a project from a newer version in an older version?
- No. A project saved at a newer version opens only in that version or later. Keep the version record and the installed versions in step with the plant.
- The upload has no comments.
- The project was downloaded without the documentation stored in the controller, or the controller revision does not support it. Find the project archive from the integrator or the site records, and download with documentation next time.
- How do I keep two engineers from overwriting each other?
- One master project per controller in the engineering library, checked out for a change and checked back in with a dated archive and a compare report. The controller is the truth in between, and an upload with compare before any change catches an edit that was not checked in.
- Should the plant standardize on one version?
- As far as the hardware allows. Controllers of one generation can often be brought to one firmware revision in a planned program, which reduces the versions to maintain. Older controllers that cannot run newer firmware stay on their version until they are replaced.
Siemens
Read the guide →- Can the plant SCADA read a Siemens skid controller directly?
- Over Modbus TCP if the manufacturer enabled a Modbus server in the program, over OPC UA if the CPU offers it and the nodes are exposed, or over the native protocol with a driver, subject to the protection level and the put and get setting. The interface document from the manufacturer says which.
- The CPU refuses the connection with a password prompt we do not have.
- The protection level is set and the password is with whoever built it. Contact the manufacturer or integrator; a CPU at a restrictive level cannot be read without it, and resetting the CPU to factory settings erases the program.
- Is the S7-300 still supported?
- It is in the manufacturer phase-out program with defined dates for the end of delivery and of service; check the current status. Plan migration for any S7-300 that runs a critical process, with the classic software kept alive until the conversion is done.
- What is different about optimized blocks for SCADA?
- Optimized blocks have no absolute addresses, so drivers that read by address cannot reach them; drivers that read by symbolic name, and OPC UA, can. A data block that SCADA must read by address is set to standard access, or the data is copied to one that is.
AutomationDirect
Read the guide →- Will a large SCADA platform talk to a CLICK?
- Yes, over Modbus TCP or RTU, using the fixed register map of the CLICK, which the manual and most driver libraries provide. Tag names in the SCADA map to those registers.
- Can I keep the DirectLOGIC 205 rack and replace the CPU?
- A Do-more CPU is made for that base and keeps the I/O modules, with a new program in the Do-more software. The old program is converted or rewritten; the wiring stays.
- Is the lack of redundancy a problem for a lift station?
- Not usually; lift stations on any platform run without controller redundancy and rely on backup float control, a spare controller, and the program backup. A treatment process that cannot lose its controller is a different case and a different platform.
- How do I get help at two in the morning?
- The manufacturer support line has published hours, the documentation and forums are online, and the utility either has an integrator on call or trains its own staff. The same is true of every platform; the difference is that there is no distributor engineer to call.
Legacy Systems
Read the guide →- The processor lost its program. What now?
- Load the backup with the correct software, if one exists, and replace the battery. If no backup exists, the printout is typed back in, or the process is run manually while a new program is written from the narrative. This is why the backup comes first on every visit.
- Can I keep the old controller and just add a gateway to modern SCADA?
- Yes, for a time; a protocol gateway or a driver for the legacy network gives SCADA access without touching the controller. It does not fix the battery, the spares, or the software, and it should be a step in a migration plan, not a substitute for one.
- How do I justify replacing a controller that works?
- With the consequences and the cost of the day it stops: the overflow, the boil notice, the manual operation for weeks while a replacement is engineered under pressure. A planned migration costs less than an emergency one and can be scheduled around the process.
- Is a virtual machine with old software really necessary?
- Until the last controller of that generation is gone, yes. The alternative is discovering on the day of a failure that nothing on the shelf can talk to the processor. The virtual machine, the license, and the cable are the insurance.
Raw Counts
Read the guide →- What is a raw count?
- The integer an analog input module produces from the field signal, before any scaling. Its range depends on the module and its configuration, and the module manual states where the signal limits fall in it.
- Why does my scaled value read wrong at the ends of the range but right in the middle?
- The scaling assumes the wrong counts at 4 mA or 20 mA, typically because the module range is 0 to 20 mA and the scaling was written for 4 to 20 mA, or the other way round. Read the raw count at 4 and 20 mA and correct the scaling to match.
- How do I tell a broken wire from a real zero?
- On a module that reports counts below the 4 mA point, a broken wire reads far below the minimum. On a module that clamps, only the under-range or open-wire status bit tells you. Use the status bits either way; they are what the module provides for the purpose.
- Should I use engineering units mode on the module?
- It moves the scaling from the program into the module configuration, which is cleaner and removes a place for error, at the cost of making the configuration part of the documentation. Either is fine; doing both, scaling in the module and again in the program, is the mistake.
Filtering Analog Inputs
Read the guide →- What time constant should I use?
- Short enough that the lag is small compared with the fastest change the process can make, and long enough to remove the noise. A level in a wet well can take several seconds. A pressure loop on a pump takes a fraction of a second or none. Start small and lengthen only as far as needed.
- Should I filter the input to a PID loop?
- Lightly, if the measurement is noisy, because noise reaches the output through the proportional and derivative terms. A heavy filter adds lag inside the loop and makes it unstable. Fix the noise at the source first.
- Where does the transmitter damping setting fit in?
- It is a filter in the transmitter, applied before the signal leaves the field. It is one of the places a filter can live, and it should be the only one if it is used. Note it on the instrument data sheet.
- How do I remove single spikes without adding lag?
- A median filter over three or five readings. A single bad reading is never the middle value, so it never reaches the output, and the response to a real change is delayed by one or two scans only.
Deadband and Hysteresis
Read the guide →- What is the difference between deadband and hysteresis?
- Hysteresis is the behavior: the state depends on the direction the measurement came from. Deadband is the number: the gap between the value that turns something on and the value that turns it off. In practice the words are used interchangeably.
- How do I pick the deadband for a lift station?
- From the cycle rate. The band between lead start and stop, with the well area and the inflow, sets starts per hour, and the pump and starter ratings set the maximum. The wet well cycle calculator on this site does the arithmetic. The band also has to keep the stop level above the pump intake and the start level below the high alarm.
- Why does my alarm keep going in and out?
- The alarm sets and clears at the same value, and the measurement is sitting on it. Give the alarm a deadband, so it clears only after the value has moved a useful distance back, or a delay, so it clears only after the value has stayed back for a time.
- Where do I put the deadband on a PID loop?
- On the output, in the loop configuration, sized to the smallest movement the valve or drive can usefully make. Not on the setpoint, and not on the measurement, which is the filter’s job.
Signal Validation
Read the guide →- What current means a transmitter has failed?
- Under NAMUR NE 43, below 3.6 mA or above 21 mA, which most transmitters use deliberately to signal a diagnostic failure. A broken wire reads 0 mA. Anything between about 3.8 and 20.5 mA is a measurement, possibly a wrong one.
- How long before a value counts as frozen?
- Long enough that a healthy signal would certainly have changed, which depends on the signal. A wet well level changes within a minute or two. A tank level at night might not change for ten minutes. Set the window per signal and the tolerance to a little more than the noise.
- Should the program hold the last good value?
- For a short time, while the fault is confirmed and the operator is alerted. Not indefinitely. The process keeps moving while the value does not, and a stale value that looks current is the most dangerous kind.
- Do I still need validation if the module has diagnostics?
- Yes. The module catches open wires and out-of-range currents. It cannot tell that a transmitter is frozen at a plausible value or that it disagrees with the float beside it. The status bits are the first check, not the only one.
Engineering Units
Read the guide →- Should the controller work in percent and let the screen convert?
- No. Percent hides the range and the unit, and every consumer then needs the range to make sense of the number. The controller scales to engineering units once; a percent value can be derived for a bar graph if a screen wants one.
- Where do I convert gallons per minute to million gallons per day?
- In the report or the daily totalizer calculation, documented as a conversion, not in the flow tag. The flow tag stays in the unit the instrument and the control logic use.
- What data type should an engineering unit tag be?
- A 32-bit floating point value. Integers scaled by ten or a hundred were a memory-saving habit on old controllers and now cause more errors than they save; a float carries the value and its precision without a hidden scale factor.
- The transmitter is ranged in feet and the operators think in gallons. Which does the tag carry?
- The measured unit, feet. A volume in gallons is a calculation from the tank geometry, done in the controller into a second tag with its own description. Both are real values; neither is the other relabeled.
EtherNet/IP
Read the guide →- What is the difference between implicit and explicit messaging?
- Implicit messaging is a scheduled, continuous exchange of I/O data on a connection with a fixed interval; it is how a controller reads and writes a remote device. Explicit messaging is a request and a reply, used for parameters, diagnostics, and occasional data.
- What RPI should I use?
- The slowest the process tolerates. A few milliseconds for motion and fast drives, ten to twenty for discrete I/O in a machine, fifty to a hundred or more for a slow process. Faster RPIs load the controller and the network for no benefit.
- Why does a device connect on the bench and not in the plant?
- Usually the network: a duplex mismatch, unmanaged multicast, an address conflict, or a switch that delays scheduled packets long enough to time out the connection. Occasionally the controller is out of connections.
- Do I need managed switches?
- For any network with implicit I/O on it, yes. Managed switches provide IGMP snooping for multicast, port diagnostics for troubleshooting, and VLANs for segmentation. Unmanaged switches work until the first multicast device or the first problem.
DNP3
Read the guide →- What is the difference between DNP3 and Modbus?
- Modbus is a question and answer protocol with no timestamps and no events; the master learns only what it polls, when it polls. DNP3 lets the outstation queue time-stamped events and send them unasked, which is what a slow, shared, or intermittent link needs. Modbus is simpler; DNP3 is built for telemetry.
- What is an integrity poll?
- A request for class 0, the current value of every point, plus the queued events of the other classes. It gives the master a complete, consistent picture. It is done at startup, after a communication outage, and at a long interval, because it is expensive on a slow link.
- Why do my events arrive with the wrong times?
- The outstation clock is wrong. Events carry the outstation timestamp. The master has to set the time on the outstation regularly using the protocol time synchronization, and the outstation has to keep it between syncs.
- Does DNP3 run over Ethernet?
- Yes, over TCP or UDP, on port 20000 by convention, with the same application messages as the serial version. Radio, cellular, fiber, and leased lines all carry it.
OPC UA
Read the guide →- Is OPC UA a replacement for Modbus or EtherNet/IP?
- No. Those are how controllers talk to devices and each other. OPC UA is how software above the controllers reads and writes their data with a common model and built-in security. A plant uses both.
- Why will my client not connect to the server?
- Almost always certificates. The server has not trusted the client certificate, or the client has not trusted the server’s, or the security policy the client asked for is not enabled on the server. Look in the rejected certificates folder on each side.
- What is the difference between polling and subscribing?
- Polling reads every value at an interval whether it changed or not. A subscription asks the server to send only what changed, at a publishing interval, with sampling and deadband per item. Subscriptions scale; polling does not.
- Does OPC UA work across a firewall?
- Yes. It uses a single defined port, 4840 by convention for the binary transport, and can also use HTTPS, so a firewall rule can permit exactly the connection needed. That is one of the main reasons it replaced OPC Classic.
Serial Communications
Read the guide →- What is the difference between RS-422 and RS-485?
- Both are differential over twisted pair. RS-422 has one driver and up to ten receivers on separate transmit and receive pairs, so it is point-to-point or one-to-many. RS-485 allows many drivers on a shared pair, each tri-stating when silent, so it is a true multidrop bus.
- How many devices can I put on an RS-485 bus?
- The standard allows 32 unit loads. Modern transceivers present a fraction of a unit load, so 64, 128, or 256 devices are possible depending on the devices. Modbus RTU addressing allows 247. Cable length and baud rate limit it further in practice.
- Do I really need termination resistors?
- At 9600 baud on a short bus, a link often works without them. As length and speed rise, reflections from unterminated ends corrupt frames intermittently, which is the hardest kind of fault to find. Terminate the two ends and only the two ends, every time.
- Why does the bus work with two devices and fail when I add a third?
- Usually a third terminator, a wiring star created by the branch to the new device, a duplicate address, or a device with different settings. Occasionally the new device pulls the bus with its own bias resistors fighting the master’s.
Protocol Gateways
Read the guide →- The controller reads good data from the gateway but the values never change. What is wrong?
- The gateway has lost the device and is serving cached values. Check the gateway diagnostics for the device, then configure the gateway to invalidate or flag data on device failure, and read that flag in the controller.
- Can one gateway serve two masters?
- Many can, within their connection limits, and it is common for SCADA and a controller to both read a gateway. Each master adds load to the Ethernet side but not to the serial side, which the gateway polls once. Writes from two masters to one device are a design problem the gateway does not solve.
- What is the difference between a gateway and a terminal server?
- A terminal server carries a serial protocol over Ethernet without changing it; the master still speaks the serial protocol, encapsulated. A gateway changes the protocol. A Modbus RTU device behind a terminal server is still polled as Modbus RTU over TCP; behind a gateway it is polled as Modbus TCP.
- How do I document a gateway?
- On the network drawing with its addresses and ports; in the project files with its exported configuration and the register maps of the devices behind it; on the I/O list as network points with the gateway as the path. A gateway that is not on the network drawing is the device nobody can find when it fails.
Remote I/O
Read the guide →- Can I put a remote rack at a lift station on fiber?
- On fiber that is reliable and owned by the utility, with the station accepting that a fiber cut stops it, yes, and it is done. Most utilities put a small controller there anyway so the station pumps on its own when the plant controller or the fiber is out of service. The cost difference is small and the independence is worth it.
- What is the difference between remote I/O and distributed I/O?
- Vendors use the terms loosely. Both mean I/O in a separate rack connected over a network to a controller that owns the logic. Distributed I/O sometimes means very small blocks mounted near the devices; the same rules apply.
- How many racks can one controller handle?
- The platform states a connection limit and a bandwidth budget, and the update rate multiplies the cost of each rack. A mid-size controller handles dozens of racks at moderate rates. The practical limit is usually the communication load, which the controller diagnostics report; keep it well under the ceiling so that adding a rack later does not push it over.
- Should the adapter be redundant?
- Some platforms offer redundant adapters, redundant media, or both. They are justified where a rack failure stops a critical process and the plant cannot wait for a replacement. For most utility panels, a spare adapter on the shelf and a ring topology on the network give most of the benefit.
ISA-101: Human Machine Interfaces
Read the guide →- Does ISA-101 require gray screens?
- No. It requires the owner to decide how normal and abnormal states are shown and to apply that consistently. The gray background with color reserved for abnormal conditions is the common answer because it works, but the standard prescribes the decision, not the color.
- Is ISA-101 mandatory?
- It is a consensus standard, not a regulation. It becomes mandatory on a project when the owner specifies it, which is increasingly common in water, wastewater, and process specifications.
- What is an HMI philosophy document?
- The short document, owned by the plant or utility, that states the principles the HMI is built on: purpose, users, hierarchy, use of color, alarm presentation, and change control. The style guide and the toolkit are derived from it.
- How does ISA-101 relate to ISA-18.2?
- ISA-18.2 covers alarm management and ISA-101 covers the interface. They share the lifecycle model and are meant to be applied together; how alarms appear on the displays is where the two philosophies meet.
SCADA Architecture
Read the guide →- What is the difference between SCADA and HMI?
- The HMI is the display the operator uses. SCADA is the whole system behind it: communication with the controllers, the live tag database, alarming, and history, of which the HMI is the visible part. A panel touchscreen is an HMI; a plant control room runs SCADA.
- Do I need a separate historian?
- A small system does fine with the historian built into the SCADA platform. A plant that keeps years of high-resolution data, serves it to reports and analytics, and cannot afford to lose it wants a dedicated historian on its own server with its own backup.
- Should clients be thick or thin?
- Thin and web clients keep every display on the server and make workstations interchangeable, which is what you want. Thick clients are needed where a platform requires them or where local performance matters, and then the displays still belong on the server.
- Can the SCADA server be a virtual machine?
- Yes, and it usually should be. Snapshots, backups, and failover are all easier. The host and its storage become part of the control system and need the same care and the same network placement.
Historians
Read the guide →- How much data does a historian store?
- Far less than the raw rate suggests, because it stores changes. A stable tag might store a few points an hour; a noisy one a few a second. Ten thousand tags at typical plant rates come to a few gigabytes a year on most platforms, which is why full-resolution retention for many years is now normal.
- Why does my trend look smoother than the live value?
- Compression. The historian stored only values that moved more than the deadband, and the trend interpolates between them. If detail that matters is missing, the deadband on that tag is too wide.
- Should the historian collect from SCADA or from the PLCs directly?
- From SCADA is simpler and adequate for most sites. Direct collection survives a SCADA outage and can run faster, at the cost of a second polling load on the controllers. Large plants often do both for different tags.
- What is store and forward?
- A collector at a remote site buffering data while the link to the central historian is down, then sending it when the link returns, so the history has no gap. Essential on radio and cellular sites.
SCADA Redundancy
Read the guide →- How long does a SCADA failover take?
- Typically a few seconds to a few tens of seconds, set by the heartbeat timeout and the client reconnection time. During it, clients show stale values and then reconnect. The time is configurable and it is a trade against false failovers on a busy network.
- Does redundancy protect against ransomware?
- No. Both servers are on the same network and are encrypted together. Offline backups, network segmentation, and access control protect against that; redundancy protects against hardware failure.
- Do I need redundant I/O servers as well as redundant SCADA servers?
- If the drivers run on the SCADA servers, the pair already covers them. If the I/O servers are separate machines, they need their own pair or the communication path is a single point of failure behind a redundant runtime.
- How often should failover be tested?
- On a schedule, quarterly or better, and after every change to the pair or the platform. A test under normal load with a person watching each client, followed by a check of the alarm log and historian for gaps.
The Alarm Philosophy
Read the guide →- What is the difference between an alarm and an event?
- An alarm requires an operator to do something. An event is something worth recording, a pump start, a mode change, a setpoint change, that requires no action. Events go in the log; alarms go in the alarm summary. Confusing the two is how alarm summaries fill up.
- How many alarm priorities should we have?
- Three is the usual answer, occasionally four with a diagnostic or urgent level. More than that and the operator cannot rank them at a glance, which defeats the purpose.
- Who writes the alarm philosophy?
- Operations, with engineering and the integrator contributing, and the plant’s management approving it. It is the plant’s statement of how it will run, and an integrator-written philosophy that operations did not shape is rarely followed.
- How does the philosophy relate to ISA-18.2?
- ISA-18.2 defines the alarm management lifecycle and puts the philosophy at its start. The philosophy is the plant’s document; the standard is the framework that says what it should contain and what comes after it.
Alarm Priority
Read the guide →- Should communication failure alarms be high priority?
- Usually medium. Losing communication to a lift station means losing visibility, which needs attention within minutes, but the station keeps pumping on its own controls and the consequence of a short outage is small. It becomes high if the site cannot run without SCADA, which is a design problem to fix rather than a priority to raise.
- Can the same alarm have different priorities at different times?
- ISA-18.2 allows state-based priority, where the priority depends on the operating mode. It is useful in batch and process plants and rarely needed in water and wastewater. If the same alarm seems to need two priorities, it is often two alarms, or the time to respond has been misjudged.
- What priority do I give an alarm I cannot classify?
- Ask what happens if nobody responds for an hour. If the honest answer is nothing much, it is low, or it is not an alarm and belongs in the event log. Inability to name a consequence is itself the answer.
- How do I fix a system where most alarms are already high?
- Start with the alarm history. The most frequent alarms are the first candidates, because they are the ones operators have learned to ignore. Rationalize those, then work through the rest by area. Reducing the high priority count to the target takes months at most sites and is worth it every time.
Alarm Rationalization
Read the guide →- How long does rationalization take?
- Rough planning numbers are 20 to 40 alarms per hour of session time once the philosophy is settled, with templated sites going much faster. A plant with 2,000 configured alarms is a few hundred hours spread over several months. A utility with a SCADA system built from defaults often finds that a third of the alarms are removed outright.
- Do we need an alarm philosophy first?
- Yes, at least a short one: the definition of an alarm, the consequence categories, the priority matrix, and the rules for classification. Rationalizing without it produces inconsistent decisions, and the first sessions become arguments about principles instead of alarms. A philosophy for a utility can be ten pages.
- What do we do with alarms the operator cannot act on but management wants?
- Route them somewhere other than the operator alarm list: a maintenance notification queue, an email report, an event log. The information is kept; the operator is not interrupted by it. If management insists it be an operator alarm, the operator action must be defined, and the action cannot be to call management.
- Should we buy software for this?
- Alarm management software helps with the analysis, the database, and enforcement, and pays for itself at a plant with thousands of alarms. At a small utility, a spreadsheet, the SCADA alarm history export, and a disciplined process do the same job. Buy the software when the spreadsheet stops being maintainable.
Alarm Floods
Read the guide →- Is ten alarms in ten minutes really the limit?
- It is the ISA-18.2 definition of a flood, derived from what an operator can reasonably read and understand. Operators can physically acknowledge far more, which is exactly the problem: acknowledgment rate is not comprehension rate. The number is per operator position, so a control room with two operators has two thresholds.
- Our SCADA system generates an alarm for every tag when a site goes offline. How do we fix it?
- Generate a single communication alarm from the poll status of that site and configure the tag alarms to be inhibited on bad quality. Most SCADA platforms have both features; some need the inhibit built in the alarm expression. It is one afternoon of configuration per platform and removes the most common flood at a utility.
- Is suppression the same as shelving?
- No. Suppression is designed into the system based on process state and documented in rationalization. Shelving is an operator temporarily removing a nuisance alarm from view for a set time, after which it returns. Both are legitimate and both are visible; disabling an alarm silently is neither.
- What about a flood of alarms from a real emergency?
- A real emergency produces real alarms, and some floods are unavoidable. The design goal is that the operator can still find the cause: high priority filtering, first-out flags, and consequential suppression all work during a real event as well as a nuisance one. The rationalized alarm list also matters here: if only five percent of alarms are high, filtering to high shows a short list.
Alarm Notification and Callout
Read the guide →- Should the notifier be part of the SCADA platform or a separate product?
- Either works. Built-in notification is convenient and reads the alarm database directly. A separate product is easier to make independent of the SCADA server, and some are built for this with their own hardware and lines. The independence argument favors separate for the critical path, but a built-in notifier with a well-tested site autodialer as the second path is a common and reasonable design.
- How many people should be on the escalation list?
- At least three: primary, secondary, and a supervisor, so that one missed call and one unavailable person still leave someone. For alarms with very short response times, call the first two at once.
- Can operators acknowledge alarms from their phone?
- Most applications allow it. Whether they should depends on the alarm class. Acknowledging the notification is always appropriate; acknowledging the SCADA alarm remotely is appropriate if the operator has enough information on the phone to make the decision the acknowledgment implies. Regulatory and safety alarms often require acknowledgment at the console.
- What about cellular coverage at the on-call person's home?
- Check it, for every person on the list. A voice call to a landline is still the most reliable path for someone who lives outside coverage, and the notifier should allow a different path per person.
HMI Faceplates
Read the guide →- Should the faceplate contain any logic?
- No. The controller decides whether a command is allowed and what happens; the faceplate sends the request and shows the result. Logic in the HMI diverges from the controller over time, is invisible from the panel, and does not run when the HMI is down.
- How much should be on the faceplate versus the display?
- The display shows what the operator needs to see to know the state of the process without opening anything. The faceplate holds everything about one device. If operators are opening faceplates just to check a value, that value belongs on the display; if the display is crowded with per-device detail, it belongs on the faceplate.
- Can vendors supply faceplates?
- Most SCADA platforms and many integrators supply library objects with matching controller blocks and faceplates, and they are a good starting point. Adopt one library per site rather than mixing, and adjust the layout to the site standard once, before instantiating.
- What about a device with no controller block, like a packaged system?
- Build a faceplate against the status the package exposes over its network interface, and keep the mode layers honest: if the package is in local, the faceplate says so and disables commands. A faceplate that pretends to control a package that is not listening trains operators to distrust all of them.
Trends on the HMI
Read the guide →- How many embedded trends should a display have?
- The high-performance HMI practice suggests a handful on an overview display, for the values that define the state of the process. More than six and the display is a trend page; fewer and the operator has no sense of direction. Area displays can carry more, one per key loop.
- Should trend colors match the alarm colors?
- No. Traces are in neutral colors; the alarm colors are reserved for alarm limit lines and for alarm indication. A red trace on a normal value teaches operators that red does not mean alarm.
- What sampling rate does the historian need for trends?
- Fast enough to show the fastest behavior the operator needs to see. Pressure and flow loops with a drive commonly need one to five second data; levels and residuals are fine at 10 to 60 seconds. Exception or deadband collection stores the changes rather than every sample, and the trend interpolates between them.
- Can operators build their own trends?
- They should be able to, in an ad hoc trend tool, and the useful ones should be promoted to trend groups by whoever maintains the HMI. The ad hoc tool is where investigation happens; the groups are the ones everyone uses.
Alarm Indication on the HMI
Read the guide →- Why not use green for normal and red for alarm?
- Because then red and green are everywhere, and an alarm is one red thing among many. Normal is shown in the muted display palette so that the alarm colors stand out. Green, in particular, is avoided as a status color on high-performance displays because it competes with the alarm palette and because red-green is the most common form of colorblindness.
- Should the alarm banner be on every screen?
- Yes. An operator on any display must see that a new alarm exists and its priority. The banner is small, a few lines, and it is the same on every display. The summary is the full list on its own display.
- What about alarms on remote client screens and phones?
- The same states and the same priority scheme, with whatever the device can render. A phone notification carries the priority in words and the message; the acknowledgment from the phone is logged like any other, if the site permits it.
- How do I show a device that is out of service?
- With a clear marker on the device symbol and on its faceplate, a distinct entry in the out-of-service list, and its alarms suppressed by that state. The marker must be obvious enough that an operator does not expect the device to respond, and the list must be reviewed so devices do not stay out of service by neglect.
Historian Architecture
Read the guide →- Do we need a historian if SCADA keeps trends?
- SCADA trend buffers are usually short, a few days to a few weeks, on the SCADA server, in a format only SCADA reads. A historian keeps years, serves reports and spreadsheets, survives the SCADA server, and is where compliance records live. Any utility that reports to a regulator from its data needs one, and most SCADA platforms include one.
- Should the historian collect from the PLCs or from SCADA?
- From SCADA for the bulk, because the tags are already named and scaled there. From the controllers directly for the tags where completeness matters, so a SCADA problem does not become a data gap. Direct collection adds a driver connection to each controller; count it against the controller connection limits.
- How do business users get the data?
- From the DMZ replica, through the historian client tools, a web portal, or a spreadsheet add-in that queries the DMZ server. Never by a connection into the control zone, and never by the SCADA client on an office computer.
- What happens to the historian when the SCADA server is rebuilt?
- If the historian is on the SCADA server, its archive is restored from backup as part of the rebuild, and every collector has been buffering in the meantime. If it is on its own server, nothing happens to it, and the collectors on the rebuilt SCADA server reconnect. The second answer is the reason for the dedicated server.
Historian Data Collection
Read the guide →- What deadband should I use?
- Larger than the measurement noise and smaller than the change that matters. For a level in feet with an inch of noise, a deadband of a couple of inches stores the cycles and ignores the ripple. Look at the raw trend, note the noise band, and set the deadband above it. Then look at the stored trend and confirm nothing meaningful is missing.
- Should I collect everything at one second and sort it out later?
- No. The archive fills with noise, the trends of slow values become unreadable without resampling, and the queries slow down. Collect each tag for its purpose. Storage is cheap, but a historian that stores fifty times more than it needs is harder to back up, to replicate, and to query.
- How do I know the historian is collecting?
- A collector status tag per collector, alarmed, and a daily check that the compliance tags have values at every interval. A calculated tag that counts stored points per hour for a critical tag, alarmed when it drops, catches a stalled collector before the monthly report does.
- What about data from the lab and manual readings?
- Manual entry tags in the historian, with the sample time as the timestamp and the person as an attribute, so that lab results sit beside the online values on the same trend. Many historians provide a manual entry interface; where they do not, a spreadsheet import on a schedule does the job.
Historian Compression
Read the guide →- What compression deviation should I use?
- For most analog tags, about twice the exception deviation, which is itself a little above the noise: for a level with an inch of noise, an exception of one and a half inches and a compression of three. Then trend live against stored and adjust. For anything analyzed later, tighter, down to zero.
- Does compression affect totals and averages?
- Averages and totals computed from compressed data are approximations within the deviation, which is usually fine for a daily average level and not fine for a billing or a compliance total. Totals come from a totalizer tag in the controller stored uncompressed, never from integrating a compressed rate.
- Can I turn compression off?
- Yes, for a tag or for the archive, and with modern storage many utilities do for their critical tags. The archive grows faster and queries return more points; the platform documentation gives the storage estimate. A middle path is a small deviation, which removes the noise and little else.
- Why does the historian trend not match the SCADA trend?
- The historian is showing compressed data and the SCADA buffer is showing raw samples, or the two are drawn at different sampling. A visible difference on a value that matters means the deviation is too wide; a small smoothing on a noisy value is expected.
Reporting from the Historian
Read the guide →- Can the regulator accept a report generated from the historian?
- Yes, in the form the regulator prescribes, and increasingly by electronic submission. What the regulator expects is that the numbers are traceable, that gaps are reported as the rules require, and that the instruments behind them are calibrated and verified with records. The historian report is easier to defend than a handwritten log if the specification exists.
- Our daily average residual from the historian differs from the operator log. Why?
- The log records grab samples or readings at shift times; the historian averages every good sample over the day. Both are right and they answer different questions. The permit says which it wants. If it wants the continuous average, the historian; if it wants readings at times, the report takes samples at those times.
- How should exceedances be counted?
- The permit defines the limit, the averaging period, and what counts as an exceedance. The report implements that definition exactly, in the specification, and counts from the historian data at the permit interval. An alarm count from SCADA is not the same thing, because alarm setpoints usually sit below the limit.
- What if a tag was renamed and the report shows blanks?
- The template references the old name. The change process for SCADA tag renames includes the report templates; when it is missed, the fix is the template, and the blanks for the period are recovered by re-running the report after the fix, since the data was collected under the new name.
SCADA Servers
Read the guide →- Can a small utility run everything on one server?
- Yes, and many do: one machine polling a handful of sites, evaluating alarms, keeping history, and serving two clients. Make it a virtual machine so that it can be backed up and restored easily, put it on a UPS in a decent room, and keep a tested restore. Redundancy comes when the cost of an outage justifies it.
- Should the historian be on the same server as the SCADA?
- On small systems, yes. On larger ones the historian is separated because its disk and query load interferes with polling and alarms, and because the historian is what reporting and outside users access, which is better done away from the server that controls the plant.
- How long should the UPS run?
- Long enough for the generator to start and stabilize, with margin, and long enough for a clean shutdown if the generator does not. Fifteen to thirty minutes is common. The UPS also feeds the network switches, the firewall, and the time server; a server with power and no network is not much use.
- What does time synchronization have to do with servers?
- Every alarm, event, and history sample carries a timestamp, and clients, servers, controllers, and the historian have to agree on the time or the records cannot be compared. One time source, usually a GPS-disciplined or network time server, synchronizes all of them, and a server that drifts is alarmed.
SCADA Clients
Read the guide →- Should operators have individual logins or a shared operator account?
- Individual logins. The audit trail, the alarm acknowledgment record, and the incident investigation all depend on knowing who was at the console. A shared account is convenient for exactly as long as nothing goes wrong. Make the login quick, with a badge or a short credential, and make the session time out to view-only rather than locking the screen.
- Is a web client as good as a thick client?
- For viewing and for many operator functions on modern platforms, yes. For the control room, a thick client still gives the most predictable performance, the most complete function set, and the fewest dependencies. Use the thick client where control happens and web clients everywhere else.
- Can an on-call operator control from a phone?
- The platform can allow it; the question is whether the utility should. Acknowledging an alarm and viewing the system from a phone is reasonable. Starting a pump from a phone at 3 a.m., with no view of the site and a screen the size of a hand, is a risk the utility must consciously accept, in writing, with the conditions. Most do not.
- What happens on the client when the server fails over?
- A correctly configured client reconnects to the standby within seconds, shows a message, and continues with the same displays; alarm states and acknowledgments carry over on platforms that synchronize them. A client that shows stale data with no indication is the dangerous case; every platform can show communication status on the display, and it should be on every one.
Alarm Servers
Read the guide →- Should analog alarm limits be in the controller or on the SCADA tag?
- In the controller, as a rule, with the limits as setpoints that the SCADA can display and, with the right role, change. The controller then alarms every scan and can interlock on the same condition. Limits on the SCADA tag are acceptable for advisory alarms and for data that only the SCADA sees.
- Why does an alarm come back unacknowledged after a server failover?
- The acknowledgment did not reach the standby before the switch, or the platform does not synchronize acknowledgments at all. Check the product documentation and the failover test. Where synchronization is not available, a short journal review after any failover is the workaround, and the finding goes on the upgrade list.
- What is the difference between a shelved and a suppressed alarm?
- Shelving is an operator action, temporary, with a timer, for an alarm that is a nuisance right now. Suppression by design is logic, automatic, based on plant state, for an alarm that is meaningless in that state. Both keep the alarm off the display; both are listed and reviewed; neither is a permanent fix for a bad alarm.
- How long should the alarm journal be kept?
- Long enough for incident investigation and performance trending, and as long as any regulatory requirement says. A year online and longer in archive is common. The journal is small compared with the historian and there is little reason to discard it early.
SCADA Communications
Read the guide →- Modbus or DNP3 for a lift station over radio?
- DNP3 if the controller supports it well: it reports changes with timestamps, buffers while the radio is down, and synchronizes time. Modbus works and is simpler, and it is what many small controllers offer; with Modbus the poll interval sets the latency and there is no history during an outage unless the controller keeps its own.
- How fast should remote sites be polled?
- As fast as the channel allows after the arithmetic, and as slow as the process permits. A lift station that changes over minutes is fine at a 30-second update; a pressure zone with surge concerns wants seconds. Poll critical values faster than the rest, use exceptions where the protocol supports them, and never let the poll cycle exceed the time in which a lost site becomes a problem.
- The site shows good data but the values never change. Is the link working?
- Probably not. The server is displaying the last received values without marking them stale, which is a configuration failure at the server or the driver. Check the communication statistics for that site; the time of last good response will tell you. Then fix the quality handling so that the display goes bad when the link does.
- Can cellular be the primary path for telemetry?
- Yes, and increasingly it is, with private carrier networks or VPNs, static private addressing, and modems the utility manages. The risks are coverage, carrier outages, and monthly cost, and the mitigations are a second path for critical sites and local control that does not need the link.
Color in HMI Design
Read the guide →- Operators like the colors. Why change?
- Because the purpose of the display is to make the abnormal obvious, and the evidence from process industries is that gray displays with reserved alarm colors let operators detect and respond to abnormal conditions faster and with fewer errors. The preference for color fades after a few shifts with a calm display; the first time an operator spots a problem across the room, the argument is over.
- Which colors go with which priority?
- The alarm philosophy decides, and the platform implements it. A common assignment is red for the highest priority, orange or amber for high, yellow for medium, and blue or cyan for low. The colors must not be used for anything else on the display, and each must come with a distinct symbol.
- How do I show a value that is bad quality?
- Replace the number with a marker such as dashes or a question mark, color the field magenta or hatch it, and show the same marker on any trend or bar that uses the value. A stale number in a normal color is the worst outcome, because the operator will believe it.
- What about the colors on the physical panel?
- Panel pilot lights follow their own conventions and standards, with green often meaning running and red meaning stopped or fault depending on the site standard. The HMI does not need to match the panel; it needs to be consistent with itself. Where an operator uses both, a note in the style guide about the difference is worth writing.
Situational Awareness
Read the guide →- Is a map with site icons a good overview?
- It is good for finding a site and poor for awareness: icons that change color show only whether a site is in alarm, and the map space is spent on geography rather than on state. Use a map as a navigation aid or on a wall display; make the overview a set of indicators that shows the state of each site, not its location.
- How many values belong on an overview?
- As many as can be drawn as indicators and scanned in a few seconds, which on one screen is a few dozen. Choose the ones an operator checks first on arrival and the ones whose deviation matters most. Everything else lives on the unit displays.
- How is time to limit calculated?
- From the current value, the limit, and the rate of change over a recent window: the remaining distance divided by the rate. Filter the rate so that noise does not make the prediction jump, show it only when the rate is toward the limit, and cap the display at a maximum so that a slow approach reads as more than an hour rather than as a meaningless large number.
- What about the operator who prefers the old displays?
- Keep the old displays available for a transition period and put the new overview on the main screen. Most operators come to rely on the overview within a few shifts because it saves them clicking. Involve them in the design and the transition is short.
Alarm Shelving
Read the guide →- Why limit how long an alarm can be shelved?
- Because an alarm shelved indefinitely is an alarm that has been deleted without anyone deciding to delete it. The time limit forces the alarm back in front of an operator, who decides again whether it is still a nuisance. If the underlying problem takes days, the alarm goes out of service by procedure, with a record and a return checklist, which is a different thing.
- Should the highest priority alarms be shelvable?
- No. The highest priority is reserved for alarms with severe consequences and short response times, and an operator should never have the option of hiding one. If such an alarm is chattering, that is an urgent maintenance problem, and the maintenance procedure with its out-of-service record is the tool.
- What should happen to a shelved alarm at shift change?
- It is on the handover list. The incoming operator sees it, hears why it was shelved, and either unshelves it or re-shelves it under their own name with the reason. Nothing shelved by a departing operator should silently continue into the next shift.
- How is a shelved alarm different from an acknowledged one?
- An acknowledged alarm stays on the display in the acknowledged state and is visible as an active problem; a shelved alarm is removed from the display for a time. Acknowledgment says the operator has seen it; shelving says the operator does not want to see it for a while.
Alarm Suppression
Read the guide →- Is suppression the same as raising the alarm limit?
- No. Raising a limit changes when the alarm occurs; suppression changes whether it is shown in a given state. An alarm that chatters because its limit is set at a normal operating value needs a new limit or a deadband from rationalization, not suppression.
- Where should the suppression logic live?
- With the alarm detection, which is usually the controller: the state bits are there, the logic runs every scan, and the alarm bit sent to the SCADA already includes the state. Parent-child suppression across sites, such as communication loss, lives in the SCADA because that is where the parent alarm is known.
- How do I keep a suppressed alarm from being forgotten?
- List it. A display of every suppressed alarm with its reason and its duration, a count on the overview, and a periodic review of anything suppressed longer than expected. Out-of-service entries carry an expected return date and are reviewed against it.
- Can the operator suppress an alarm?
- The operator shelves, for a limited time. Suppression by design is engineering, decided in rationalization and changed through the change process. Out of service is a maintenance action under a permit. Keeping the three separate is what keeps each one safe.
Trending
Read the guide →- Why does my trend show a straight line through a period when I know the value moved?
- The historian compression or deadband discarded the samples because they stayed within the tolerance, and the trend draws a line between the samples it kept. Tighten the deadband for that tag if the detail matters, and look at the controller or a faster-collected tag for the past event.
- How long a time range should I use to diagnose a control loop?
- A few cycles of whatever the loop is doing: for a loop cycling every five minutes, an hour; for a wet well filling and draining every twenty minutes, a couple of hours. Long enough to see the pattern repeat, short enough to see the shape of each cycle. Then widen it to see when the pattern started.
- Should trends on the operator display use the historian or the live data?
- The historian for anything longer than a few minutes, so that the trend survives a display change and matches what was stored. Live buffers on the client are fine for a short real-time trend on a faceplate, and they disappear when the display closes.
- What is the best way to compare two similar sites?
- The same trend group with the tags of each site, at the same fixed scales and time range, side by side or overlaid. Differences in cycle time, run time, or pressure profile between two stations that should be alike point at a problem at one of them.
Frozen Values
Read the guide →- The value is frozen on one display and moving on another. What is that?
- The client with the frozen display has lost its connection to the server, or the display is hung. Restart the client display; if it recurs, look at the network between that client and the server and at the client resources. The other client proves the server is fine.
- The controller shows the value changing but the server does not. Where do I look?
- At the driver: the device statistics, the last successful poll, the error count, and the license and tag count limits. A driver that hit a license limit stops updating some tags and not others; a device that went offline stops all of its tags at once.
- Why did the level read the same for a day with no alarm?
- Because nothing was watching for the absence of change. Levels change; a level that does not is either a frozen value or a broken process, and both deserve an alarm. A rate-of-change-too-low alarm on key analog values, or the heartbeat approach at the controller, covers it.
- Is a frozen value from a transmitter always a failure?
- Not always; a level in a full tank with the inlet closed is constant. But most process values move a little all the time, and a transmitter whose output is exactly constant to the last digit has usually failed or been isolated. Compare with the device and the process before deciding.
Lost Communications
Read the guide →- How long should the server wait before declaring a site lost?
- Longer than the worst normal poll cycle including retries, and shorter than the time in which the loss matters. On a radio channel with a 20-second cycle, a minute or two is common; on plant Ethernet, seconds. The alarm delay can be longer than the quality change: mark the data bad at the first failure and alarm after a short confirmation.
- The site is lost but its power fail alarm never arrived. Is that possible?
- Yes: if the power failed and the radio lost power at the same instant, nothing was sent. A UPS on the radio and the controller, sized for a few minutes, lets the site report the power failure before it goes dark, which is worth the cost of the UPS for the information alone.
- Everything went down at once. Where do I look first?
- At the server and its immediate network: the driver services, the network interface, the switch port, and the firewall. A single point that takes everything down is almost always within a few feet of the server, or is the server itself. Check whether the plant controllers on the local network are also lost; if they are, it is not the radios.
- Should lost communication stop the pumps at a remote site?
- No. The site controller runs the process on local measurements, and losing the link changes nothing at the site except that the operator cannot see it. A site that stops when the link fails has a design problem; a site that needs the link for its setpoints holds the last ones or reverts to a local default.
Bad Quality
Read the guide →- The tag shows bad quality but the device is responding to other tags. Why?
- Configuration error on that tag: the address, data type, or unit ID is wrong, or the register does not exist. If the tag is part of a block request, one bad register fails the block and every tag in it. Check the substatus and the address against the device register map.
- Can a value be bad quality at the server and good on the display?
- Only if the display is not showing quality, which is a display design fault. Every value on a display should carry a quality marker. Check the display configuration; a value that ignores quality will show the last number forever.
- What should a controller do with a bad remote value?
- Not use it. The controller receives a status bit or a quality with the value, or derives one from a heartbeat, and its logic holds the last good value for a limited time, then reverts to a local default or a safe state, and alarms. A controller that uses whatever number arrives will act on a zero the day the link fails.
- Why does the tag go bad briefly every few minutes?
- A poll cycle that occasionally exceeds the timeout, a device that is slow to answer under load, or a link with intermittent loss. Look at the driver statistics for response time and error counts; lengthen the timeout if the response time is close to it, and fix the link if the errors are real.
Server Failure
Read the guide →- The server is fine but nobody can log in. Is that a server failure?
- From the plant point of view, yes: visibility is lost. Common causes are a full disk, an authentication service or domain controller unreachable, an expired certificate, or a client license count exceeded. Check the disk first, then authentication; the server event log usually names it.
- How long should recovery take?
- As long as the recovery time objective the utility has decided it can tolerate, which depends on what runs unwatched. A few hours is achievable with a tested image restore and a spare virtual machine; days is what happens without them. Decide the objective, then buy and practice the recovery that meets it.
- What is the minimum for a small utility with one server?
- An image backup on a schedule kept off the server, the application project exported and kept with the license records, a spare machine or a hypervisor that can host a restore, a documented procedure, one practiced restore a year, and disk and service monitoring. That set costs little and covers most outages.
- Should the alarm dialer depend on the SCADA server?
- Not entirely. A dialer or notification system that takes its alarms only from the server stops when the server does. A hardware dialer at critical sites, wired to local alarm contacts, or a second small notification path that watches the server itself, is the layer that calls someone when the SCADA cannot.
Client Problems
Read the guide →- After the server upgrade, one client shows old displays. Why?
- Its project deployment did not update, or it is using cached display files. Redeploy the project to that client, clear its cache, and confirm the version on every client after any upgrade; the ones that were off or disconnected during the deployment are the ones that miss it.
- The web client works on one browser and not another.
- Browser compatibility, a blocked script or plugin, a certificate the browser does not trust, or a security setting. Use the browser the vendor supports, import the certificate, and standardize; a web client that must work on every browser is a support burden.
- How many clients can the server support?
- The license says one number and the load says another. Each client adds display rendering, script, and subscription load; a server serving twenty web clients with heavy displays slows for all of them. Watch server load as clients are added, and separate the client-serving role to its own server before the control room notices.
- Should operators be able to reboot the client?
- Yes, and they should know how, and there should be a second client so that the plant is not blind while they do it. Restarting a client is a normal operator action; restarting a server is not.
Historian Problems
Read the guide →- The trend shows a value that changed by a factor of ten on a certain date. Was the historian corrupted?
- Almost certainly not. The source changed: a scaling, a range, an engineering unit, or the tag was re-addressed. Find the change in the source configuration history on that date. The historian stored what it was given; the fix is either a correction factor in reports for the earlier period or, on some historians, a rescaling of the stored values with a record of what was done.
- How much disk should the historian have?
- Bytes per sample times samples per day per tag times tags times retention days, computed from the historian storage report for the actual system rather than from estimates, doubled for growth, plus the archives that are kept beyond the online retention. Then alarm at a threshold that gives months of warning.
- Why do the totals from the historian differ from the totalizer in the controller?
- The historian integrates sampled values; the controller integrates every scan. Sampling, compression, and gaps all reduce the historian total, and bad-quality samples treated as zero reduce it further. Use the controller totalizer for the official total and historize it as a tag; use the historian integral for analysis.
- Can I delete old tags to free space?
- Deleting a tag usually removes its history, which may be a regulatory record. Stop collecting it and leave the history, or archive the tag history to a file before deleting. Check the retention requirement for the data before anything is removed.
Alarm Problems
Read the guide →- The alarm bit is on in the controller but nothing shows on the SCADA. Why?
- The bit is not mapped to an alarm, the alarm is disabled or in a suppressed, shelved, or out-of-service state, the tag is bad quality, or the display is filtered. Look at the alarm configuration for the tag first, then the three lists, then the tag quality, then the display filter on that client.
- The notification went to the wrong person.
- The roster or the escalation schedule is stale, or the alarm is assigned to the wrong group. Rosters change with staff and shifts, and a roster that nobody owns is wrong within months. Assign an owner, review it monthly, and send a test notification to each person on it.
- An alarm cleared on its own with nobody acting. Is that a fault?
- It is normal for a momentary alarm whose condition cleared, and the returned-to-normal-unacknowledged state exists so that the operator sees it happened. If the condition should not have cleared without action, the alarm belongs latched, and if it cleared because the value went bad quality, the bad-quality handling is wrong.
- How often should critical alarms be tested?
- At least annually, and after any change to their chain; some utilities test the highest priority alarms quarterly. The test takes minutes per alarm and is the only proof that the chain still works. Record every test.
Time Synchronization
Read the guide →- How accurate does synchronization need to be?
- For alarm ordering across sites and historian consistency, a second or so is adequate; network time protocol delivers far better than that on a local network. For sequence of events within a plant, tens of milliseconds, which network time on a good network provides and which precision time protocol provides where needed. For authentication, the domain tolerates a few minutes, which is why a badly drifted clock shows up as a login failure.
- Can the control network get time from the internet?
- Not directly. A time server in the DMZ can take time from the enterprise or from internet time servers and serve it inward, or a GPS clock on the control network can provide it with no outside connection at all. The firewall rule is one direction, one port, one server.
- The remote unit clock is always wrong on Monday morning. Why?
- The unit loses time over the weekend when something that synchronizes it is not running, or it was power cycled and reset to a default date. Check the synchronization schedule, the unit battery or capacitor that keeps its clock through outages, and the log of time writes.
- Should timestamps come from the controller or the server?
- From the controller when the protocol carries them and the controller is synchronized, because they say when the event happened rather than when the server heard about it. From the server otherwise, with the understanding that the resolution is the poll interval. The alarm philosophy records which applies.
Long-Term Storage
Read the guide →- How long must turbidity records be kept?
- Federal drinking water record rules require turbidity and microbiological analysis records to be kept for at least five years and chemical analysis records for ten, and states may require longer. Treat the historian tags that back those records as permanent, at full resolution, with an exported copy.
- Is cloud storage acceptable for archives?
- For the offline copy and the exported records, cloud object storage is a reasonable off-site tier, subject to the utility security policy and to keeping a local copy as well. The online historian and its live archives stay on the control network; the cloud receives a copy through the DMZ, one direction.
- Can old data be deleted to save disk?
- Only what the policy says can be deleted, after its retention has passed, and never the compliance classes. Storage is cheap compared with the cost of a missing record. If disk is short, add disk or move old archives to near-line storage; do not purge.
- What format should the export use?
- One that a person can read with common tools in ten years: comma-separated text with a header, one file per tag or per period, timestamps in universal time in a standard format, values, units, and quality flags. Compressed if large. Document the layout in the policy.
SQL Integration
Read the guide →- Should the historian be replaced by a SQL database?
- No. A historian is built for millions of samples a day with compression and fast time-range queries; a relational database is built for structured records and joins. Keep the raw time series in the historian and put summaries, events, and integration data in SQL. Some products combine both; the division of work still applies.
- How do I get laboratory results into the SCADA displays?
- The laboratory system writes results to a table in the DMZ database, or exports a file to a DMZ share; a job on the control side reads them through a one-way path, validates the tag, time, and range, and writes them to SCADA tags marked as laboratory values. Display them beside the online analyzer with their sample time; never let an imported value drive control.
- The monthly report totals do not match the operator log.
- Common causes: the report integrates sampled flow while the operator reads the totalizer; the day boundary is in universal time rather than local; bad-quality samples were treated as zero; a daylight saving change doubled or dropped an hour. Compute totals from the totalizer tag at local midnight, carry the quality, and reconcile the two methods once so the difference is understood.
- Can the SCADA write to a database in the office?
- It can, through the DMZ, one direction, to a database the office then reads. It should not connect directly to an office database server, and the office should not connect to anything on the control network. The DMZ database, or a broker in the DMZ, is the meeting point.
VTScada
Read the guide →- Does it need a separate database server?
- No. The historian is built in and stores on the application servers. An external database can be used for reporting or integration, but the platform runs without one.
- How does redundancy work across two buildings?
- Servers at both locations are in the server lists, with the network between them; the primary serves and the standby synchronizes. A site with a slow link between buildings sets the roles so that the I/O server is near the field connections and the history synchronizes at the rate the link allows.
- Can operators view it on a phone?
- Yes, through the thin and mobile clients, subject to the licensing and, more importantly, the remote access design: a virtual private network and multi-factor authentication in front of the client, not a client exposed to the internet.
- Is the free version usable for a small site?
- A limited free edition exists with a tag limit that suits a very small system or a training setup. A production utility system is licensed by its tag count and server roles.
Ignition
Read the guide →- Which SQL database should we use?
- One the utility can administer and back up. Common choices are the open-source servers and the Microsoft server; the platform supports several. The decision is about the staff and the backup tools, not the platform.
- Do we need a programmer to maintain it?
- For a system built without scripting beyond the standard library, no; the designer is a configuration tool. For a system full of custom scripts, yes, and the scripts had better be documented. The standards decide which system you have.
- Can Ignition talk to our old controllers?
- Through its drivers for the common controller families, through an OPC server for others, and through Modbus for nearly everything. Legacy networks need a gateway or an OPC server that speaks them.
- How does licensing handle a second server for redundancy?
- The backup gateway needs its own license, typically at a reduced cost as a redundant license. Edge gateways are licensed separately. Confirm the current terms with the vendor.
GE iFIX
Read the guide →- Is iFIX still developed?
- It continues under the GE Vernova Proficy name with periodic releases and support for current operating systems. Check the lifecycle status of the installed version and of the drivers before planning around it.
- The pictures run slowly on the new workstation.
- Legacy picture formats, heavy scripting, and driver polling settings all affect picture performance; a picture with hundreds of animations on a fast scan is slow on any workstation. Profile the picture and the database scan times before blaming the hardware.
- How do I move history to a new historian?
- The Proficy Historian has migration tools between its own versions; moving to a different historian product is an export and import project that keeps the raw data and loses the vendor-specific configuration. Plan it with the retention requirements in view.
- Can I replace one node of the failover pair at a time?
- Yes, and it is the normal way to upgrade hardware: fail over to one node, rebuild the other, synchronize, and repeat. The database and pictures must match on both, and the drivers must be configured identically.
AVEVA
Read the guide →- Should a plant on InTouch move to System Platform?
- When the tag count, the number of workstations, or the need for consistency across many identical assets makes per-workstation applications unmanageable. A small plant with two workstations may never need to; a large plant with dozens of pumps and several operator stations usually benefits.
- What happened to the product names?
- Wonderware became Schneider Electric software, then AVEVA after the 2018 combination, and AVEVA itself was fully acquired by Schneider Electric in 2023. Product names were changed along the way. The installed version and its documentation identify what is actually on the server.
- Can the Historian be replaced by a different one?
- Yes, with a data migration project; the raw history exports through SQL. The retrieval extensions and the reports built on them are what has to be rebuilt.
- Does Plant SCADA integrate with System Platform?
- They are separate products with separate models, and they interoperate through the standard interfaces rather than sharing a database. A utility usually runs one or the other.
Rockwell FactoryTalk
Read the guide →- Should new systems use View or Optix?
- View Site Edition is the established distributed product with the deepest Logix integration and the largest installed base; Optix is newer and web-based. As of this writing, a utility with an existing View system extends it, and a new system weighs both against its integrator and staff experience. Confirm the current roadmap with the vendor.
- Why can a client not log in after a server change?
- The client cannot reach the directory, the directory does not know the new server, or the security settings changed. The administration console and the client diagnostic logs name the failure.
- Do we need the historian, or can we log elsewhere?
- History can be collected by any historian that can read the controllers or the data server; the FactoryTalk historian integrates with the displays and trends most directly. A utility already running a plant historian can use it.
- How much does controller tag renaming affect the SCADA?
- Every display, alarm, and trend that referenced the old name breaks. Rename in the controller only with a search across the SCADA project, or use aliasing to keep display references stable.
Schneider SCADA
Read the guide →- Is ClearSCADA the same product?
- Yes: ClearSCADA was renamed Geo SCADA Expert under the EcoStruxure brand. Installed systems and their documentation use both names.
- Can it talk to non-Schneider controllers?
- Over DNP3 and Modbus to any controller that supports them, and through controller-specific drivers for common families. A Logix or Modicon controller at a plant is polled over its protocol; the event-driven features need a DNP3 outstation at the field end.
- Why run two SCADA products at one utility?
- Because the plant and the collection system have different needs: fast Ethernet, rich graphics, and process history at the plant; scarce bandwidth, time-stamped events, and many small sites in the field. Many utilities run a plant HMI and a telemetry SCADA, with data exchanged between them, and the ownership of both by one company does not change that.
- What is the licensing basis?
- Point count and server and client roles, with the redundancy servers licensed as such. Confirm the current terms with the vendor before adding sites.
Other Platforms
Read the guide →- A vendor wants to put our plant on their cloud SCADA. Should we?
- Only after the questions above are answered in writing: where the data lives, what runs locally when the internet is down, how the field connection is secured, how the contract ends, and what the utility owns. Local control must not depend on the cloud, and the security review is the decision.
- The packaged system came with its own HMI. Do we integrate it or replace it?
- Integrate it: the skid keeps its own controller and touchscreen, and the plant SCADA reads the interface the manufacturer documented. Replacing the skid HMI voids the support for the equipment and takes on logic the plant does not own.
- Is a distributed control system overkill for a water plant?
- For most plants, yes; for a very large plant with complex chemical and biological processes and a staff used to the model, it can be right. It is a different procurement, lifecycle, and staffing model, and it should be chosen deliberately.
- How do we evaluate an independent product we have not heard of?
- References from utilities of similar size that have run it for ten years, a look at the integrator base within driving distance, the licensing and support terms in writing, and a test of exporting history and configuration.
4-20 mA Signals from the Instrument Side
Read the guide →- Why is 4 mA the bottom of the range instead of 0 mA?
- So the transmitter has current to run on and so a broken wire, which reads 0 mA, cannot be mistaken for a minimum reading, which reads 4 mA. The offset is called the live zero.
- How far can a 4-20 mA signal run?
- As far as the voltage budget allows. With a 24 V supply, a transmitter that needs 12 V, and a 250 ohm input, roughly 350 ohms of round-trip wire resistance is available, which is thousands of feet of 18 AWG. The limit is the arithmetic, not a fixed distance.
- Can I put more than one receiver on a loop?
- Yes, in series, as long as the total resistance stays inside the voltage budget. A loop-powered indicator, a chart recorder input, and a PLC input can share one loop. Devices must be in series, never in parallel; a parallel connection splits the current and both readings are wrong.
- What does it mean when a loop reads 3.6 mA or 21.5 mA?
- Almost always a transmitter fault signal under NAMUR NE 43. The instrument has detected a problem with itself or its sensor and is driving the loop out of the valid range on purpose. Read the transmitter diagnostics before trusting or replacing anything.
Wet Well Level Measurement
Read the guide →- Which level sensor is best for a lift station?
- A submersible pressure transducer for most stations, because it is accurate, cheap, and unaffected by foam, provided it can be pulled and cleaned. Radar where grease and rags make the transducer a maintenance problem. Floats alongside either, always.
- Why do I need floats if I have a level transducer?
- Because the transducer and the controller can both fail, and the floats fail differently. The high level float wired directly to the alarm and the pump starters keeps the station from overflowing when everything else has stopped working.
- Why does my ultrasonic level sensor drop out when it rains?
- High inflow makes turbulence and foam. Foam absorbs the ultrasonic pulse and the sensor loses its echo. The fix is either radar, which is not absorbed by foam, or a stilling arrangement that gives the sensor a calm patch of surface.
- How often should a wet well transducer be cleaned?
- On a schedule set by how fast it fouls at that station, which is learned from the disagreement between the transducer and the floats. Monthly is a common starting point in a greasy well; some clean wells go a year.
Hydrostatic Level Measurement
Read the guide →- How does a submersible level transducer work?
- It measures the pressure of the liquid above it, which is proportional to depth for a known density, and outputs 4 to 20 mA over a vented cable. Level above the sensor is the pressure divided by the liquid density.
- Why does my level transducer drift with the weather?
- The vent tube in the cable is blocked or wet, so the reference side is no longer at atmospheric pressure and the reading follows the barometer and the temperature. Inspect the vent and the junction box breather.
- When should I use a bubbler instead of a transducer?
- When nothing electrical should be in the liquid: corrosive chemicals, high temperature, a classified area, or a liquid that fouls diaphragms badly. Accept the air supply and the purge tube as the maintenance items in exchange.
- Does the instrument need recalibrating for a different liquid?
- Yes, if the density differs from what it was calibrated for. A specific gravity of 1.1 reads ten percent low on a water calibration. Enter the actual specific gravity, or calibrate against a measured level in the actual liquid.
Ultrasonic Level Measurement
Read the guide →- What is the blanking distance on an ultrasonic level sensor?
- The zone directly in front of the sensor, usually a foot or two, in which it cannot measure because it is still ringing from its own pulse. The maximum level must stay below the face by at least that distance.
- Why does my ultrasonic sensor read wrong on hot days?
- The speed of sound rises with temperature and the sensor compensates from its own temperature, which in the sun is not the temperature of the air in the vessel. Shade the sensor, or use radar, which does not depend on the speed of sound in air.
- Ultrasonic or radar for a wet well?
- Radar. Foam, turbulence, and vapor in a wet well are the three things ultrasonic handles worst. Ultrasonic remains a good choice for clean, calm liquids and for open-channel flow with a flume.
- What should the sensor output on loss of echo?
- A fault current that the controller recognizes as a bad signal, so that control falls back to floats or a defined safe action. Never a held last value, which looks like a level that stopped changing.
Float Switches
Read the guide →- Why use floats if there is a level transducer?
- Because the transducer, the input card, and the controller can all fail, and floats fail differently. The high level float wired directly to the alarm and the pumps is what keeps the station from overflowing when everything else has stopped.
- Should a float be wired normally open or normally closed?
- For anything critical, so that a broken wire produces the safe indication. A high level alarm float is normally closed and opens on high level, so an open circuit alarms. Write the convention on the drawing and read the input accordingly in the program.
- How far apart should wet well floats be?
- Far enough that their swinging arcs do not overlap, staggered on the bracket so they do not hang in a line, and weighted so the flow does not push them together. A tangled pair reads levels that do not exist.
- Do wet well floats need to be intrinsically safe?
- Usually. NFPA 820 classifies most wastewater wet wells as hazardous locations, and the float and its circuit must be rated for the classification, typically through an intrinsically safe barrier in the panel. Check the classification for the specific site.
Pressure Transmitters
Read the guide →- What is the difference between gauge and absolute pressure?
- Gauge pressure is measured relative to the atmosphere and reads zero open to air. Absolute is measured relative to vacuum and reads about 14.7 psi open to air at sea level. Most pump and system measurements are gauge; vacuum and barometric work is absolute.
- What does turndown mean on a pressure transmitter?
- The ratio of the transmitter’s maximum range to the span it is calibrated for. A 300 psi unit calibrated for 30 psi has a turndown of ten. High turndown is convenient for stocking, and accuracy can degrade as it increases, depending on how the datasheet states accuracy.
- Why does my pressure transmitter read a few psi with the line drained?
- Usually the liquid column in the connection between the tap and the transmitter, if the transmitter is mounted below the tap, or trapped liquid. Bleed the connection and zero the transmitter with the connection at the condition it will run in.
- Do I need a snubber?
- On a connection that sees pulsation from a reciprocating pump or surges from valves and pump starts, yes. It protects the sensor from spikes and steadies the reading, at the cost of some response speed and a restriction that can plug.
HART
Read the guide →- Does HART affect the accuracy of the 4-20 mA signal?
- No, when the input is designed for it. The tones average to zero over a few milliseconds and the input filtering removes them. On an old or very fast input, a small flicker of a few counts can appear while HART is communicating; it disappears when the handheld is disconnected.
- Can I use HART on a loop with a safety barrier?
- If the barrier is rated for HART. Many are; some passive barriers with capacitive filtering attenuate the signal. Check the barrier data sheet for HART compatibility and the loop resistance including the barrier.
- What is the difference between HART revisions?
- HART 5 and 6 are the installed base; HART 7 added extended addressing, more device variables, and time stamping, and is what current devices support. Handhelds and hosts are backward compatible. WirelessHART carries the same commands over a mesh radio network and is a different physical layer entirely.
- Is HART a replacement for a fieldbus?
- It fills the same need at lower complexity: identity, diagnostics, and configuration over existing wiring. It does not replace the analog signal for control, and it does not provide the multi-variable speed of a true digital fieldbus. For a utility, HART on 4-20 mA is usually the right amount of digital.
Differential Pressure Flow Measurement
Read the guide →- Why does my DP flowmeter read flow when the pump is off?
- The impulse lines are not balanced: a bubble, a difference in temperature, or a line that has partially drained gives a standing differential. Open the equalizing valve and check the zero. If the zero is right with the manifold equalized and wrong when it is in service, the lines are the problem.
- Can I extend the turndown with two transmitters?
- Yes. A high-range and a low-range transmitter on the same taps, with the controller switching between them, gives 10:1 or better. Smart transmitters with very good low-end performance achieve some of this alone; a venturi with a modern transmitter can do 8:1 or 10:1.
- The plate was replaced and the flow reads differently. Why?
- The bore diameter, the plate thickness, the edge sharpness, and the orientation all matter. A plate installed backwards, with the bevel upstream, reads low by several percent. A plate with a rounded edge from erosion or a different bore from the sizing sheet changes the coefficient. Compare the new plate to the sizing sheet, not to the old plate.
- Do I need to measure temperature and pressure too?
- For liquids at steady temperature, no. For gases and steam, density changes with pressure and temperature, and the flow calculation must be compensated with both measurements, either in a multivariable transmitter or in the controller.
Open Channel Flow Measurement
Read the guide →- Which is better for a wastewater plant, a flume or a weir?
- A Parshall flume for raw wastewater and anywhere solids are present, because it is self-cleaning and tolerates some submergence. A V-notch or rectangular weir for clean effluent at low flow, where its accuracy is better and nothing collects behind it.
- Can I calculate flow in the PLC instead of a flow meter?
- Yes. Read the head from a level transmitter, apply the flume or weir equation with a low-head cutoff, and totalize. The dedicated open channel flow meter does the same thing with the equations built in and a certified totalizer, which matters for permit reporting.
- How accurate is open channel flow?
- A properly built and installed Parshall flume with a well-calibrated head measurement is within about 3 to 5 percent. A weir can reach 2 percent. In practice, errors in the head measurement and in the installation dominate, and a flume that has never been checked can be off by 10 percent or more.
- How do I verify the flow meter for a permit?
- Verify the head: compare the meter reading with a staff gauge at the measuring point at several flows, and record it. Then verify the conversion with a known head against the published table. A dye dilution or velocity-area test is the independent check where the primary device itself is in doubt.
Chlorine Residual Analyzers
Read the guide →- Why does my amperometric analyzer read lower than the grab sample?
- In order of likelihood: sample flow to the cell is low or unsteady; the electrodes are fouled; the sample pH has risen and the cell does not compensate for it; the cell temperature compensation is off; or the sample line is consuming chlorine before the cell. Check flow first, then clean the cell, then compare pH.
- Free or total: which should the analyzer measure?
- Whichever the process and the permit require, and it is worth confirming both. A chlorinating drinking water plant measures free. A chloraminating one measures total, and usually monochloramine. Chlorinated wastewater effluent measures total. Measuring free chlorine in a chloraminated system gives a small, meaningless number.
- How long does a membrane cell last?
- Membrane and electrolyte are typically replaced every few months, more often in warm or dirty water, and the electrode itself lasts years. Follow the manufacturer interval, and shorten it if the calibration drifts before the interval is reached.
- Can I trust a colorimetric analyzer for compliance?
- It runs the same chemistry as the reference method, which is the strongest argument for it, and many utilities use it for the compliance point. It still needs the grab comparison on the required schedule, reagent replacement on time, and a clean optical path.
pH Measurement
Read the guide →- How often should a pH sensor be calibrated?
- Weekly to monthly in process water, set by the drift observed. Compare with a grab sample more often than you calibrate, and calibrate when the comparison says to or on the schedule, whichever comes first. A sensor that needs calibration every few days is fouling or dying, and calibration is not the fix.
- Why does the reading drift after calibration when the sensor goes back in the process?
- The process is at a different temperature than the buffers, and the sensor needs minutes to equalize; or the junction is slow to re-establish contact after the buffers; or the process has a coating that the buffers washed off and that is now re-forming. Wait fifteen minutes before judging, then compare with a grab sample.
- What is a solution ground and do I need one?
- A third metal contact on the sensor that ties the process liquid to the transmitter reference, so that stray currents in the liquid flow through it rather than through the reference junction. It stabilizes the reading in tanks with pumps, mixers, or cathodic protection. Most process sensors have one; use it.
- Is a differential sensor worth the cost?
- In wastewater and dirty water, usually. It tolerates fouling that stops a conventional reference, its salt bridge is replaceable, and it is immune to the ground loop problems that plague conventional sensors in tanks with mixers. In clean water a good double-junction combination sensor does the job for less.
Dissolved Oxygen Measurement
Read the guide →- What DO setpoint should we use?
- What the process needs, which the plant operator and the process engineer decide from the treatment objectives and the basin configuration. Around 2 mg/L is the conventional activated sludge figure; nitrification may want more at the front of the basin and less at the end; processes with anoxic zones want near zero there. The control system holds the setpoint; it does not choose it.
- Why does the DO read high near the surface and low at depth?
- Surface water exchanges oxygen with the air and is also where bubbles from the diffusers collect; deeper water has had the oxygen consumed by the biomass. The sensor is placed at a depth that represents the mixed liquor the bacteria live in, which is why 1 to 2 m is the usual depth.
- Can we skip cleaning with an optical sensor?
- No. Optical sensors do not drift the way membrane sensors do, but they foul the same way. Automatic cleaning and a manual schedule remain necessary; the difference is that the optical sensor is otherwise maintenance-free between them.
- How do we know the sensor is telling the truth?
- A periodic comparison with a calibrated portable meter at the same spot and depth, a second sensor in the critical zone, and a trend that shows the reading responding to air changes within a couple of minutes. A DO that sits flat while the blowers change is not measuring the basin.
Turbidity Measurement
Read the guide →- What is the difference between NTU, FNU, and FTU?
- All three are formazin-based units. NTU is the term for the EPA 180.1 method with a white light source measured at 90 degrees. FNU is the ISO 7027 method with an infrared source, also at 90 degrees. FTU is an older generic term. The numbers are similar in clean water and diverge in colored water; use the unit and method the regulator accepts.
- Why does the online reading differ from the bench reading?
- Different instruments, different methods, a bubble in one or a dirty cell in the other, or the grab sample sat long enough for particles to settle. A consistent offset is investigated; a small random difference is normal. Keep the bench instrument calibrated and verified too, or the comparison means nothing.
- How low can a process turbidimeter read reliably?
- Modern low-range instruments resolve to 0.001 NTU and read reliably to a few hundredths, which is below the 0.1 NTU that many plants target. At that level, the sample system, stray light, and the cleanliness of the cell dominate; a reading of 0.02 NTU is only as good as the last cleaning.
- Can turbidity be used to control filtration directly?
- It is used as a backwash trigger and an alarm, and in some plants as a feedforward to coagulation. It is not used to modulate filter flow in real time, because a filter does not respond to a flow change quickly enough to control its own effluent turbidity, and because the compliance instrument should not be in a control loop that could push it around.
Surge Protection for Signal Circuits
Read the guide →- Do I need surge protection on a 4-20 mA loop that stays inside the building?
- Usually not, if the loop never leaves the structure and the building has a proper ground. A loop that goes to a transmitter on a tank outside, down a wet well, or through a buried conduit to another structure does, at both ends.
- Is fiber the answer to network surge problems?
- Between buildings, yes. Fiber conducts no current, so a ground potential difference between two structures does not appear across the switches. Copper between buildings is protected at both ends and still fails more often; fiber is usually the better investment at any site that has lost a switch to lightning.
- Where does the protector for the wet well level transmitter go?
- At the panel entry for the level cable, and at the transmitter where the transmitter offers it or where a junction box at the well top allows a protector. The wet well transmitter is at the bottom of a hole in the ground with a cable running to the panel, which is the classic lightning path.
- Can surge protectors cause a ground loop?
- A protector connects a conductor to ground only when clamping, so in normal operation it does not. A shield grounded at both ends through a protector ground, however, is still a shield grounded at both ends; keep the shield termination rules and use protectors that pass the shield through or ground it only at the panel end.
Loop Checks
Read the guide →- Can I loop check from the transmitter instead of injecting a signal?
- Driving the transmitter itself, by applying pressure or changing a level, checks the instrument and the loop together, and it is the best test where it can be done safely. A HART simulate command that forces the transmitter output to a value tests the loop from the transmitter output. Injecting at the terminals tests the loop alone. Any of the three is a loop check; the sheet says which was used.
- Is a two-point check enough?
- No. Zero and full scale can both be right while the middle is wrong, which happens with a square root taken twice, a nonlinear scaling, or a wrong raw count range that crosses at the ends. Three points is the minimum; five on compliance loops.
- Who should be at the screen?
- Someone who can read the HMI and the controller online: the integrator engineer, or a utility staff member who has been shown how. The utility person is preferable, because the loop check is the utility learning its system, and the signature at the screen is the utility accepting the point.
- What about network points from a drive or an analyzer?
- They get a loop check too: the value on the device display is compared with the tag at the HMI at two or three operating points, the status and alarm bits are driven where they can be, and the sheet is signed. A network point that was mapped to the wrong register is as wrong as a miswired cable.
Calibration Procedures
Read the guide →- What accuracy ratio between the reference and the instrument is required?
- Four to one is the widely used minimum: the reference uncertainty is no more than a quarter of the tolerance being checked. Ten to one is comfortable. Below four to one, the reference error is a significant part of what is being measured, and the result cannot be trusted at the tolerance.
- Do we need to send our calibrators out for calibration?
- Yes, on a schedule, to a laboratory that provides a traceable certificate, typically annually. A calibrator with no current certificate is not a reference, and every calibration done with it is undermined. The certificate and the due date are part of the calibration record.
- Can a calibration be done in place without isolating the instrument?
- A comparison against a reference at the operating point can be done in place and is valuable as a check between calibrations. It does not exercise the range and it is not a calibration for the record unless the procedure for that instrument says a single-point comparison is acceptable, which is the case for some analyzers.
- What do we do with an instrument that fails as-found badly?
- Record the failure, adjust or replace it, and ask what the loop did with the wrong value between the last calibration and this one. A compliance instrument that was out of tolerance for months may require reporting; a control instrument may explain a process problem. The as-found record is what makes that question answerable.
Calibration Documentation
Read the guide →- How long must calibration records be kept?
- For compliance instruments, the period the permit or the state rule specifies, commonly five years and sometimes longer. For other instruments, as long as the instrument is in service and a period after, because the history is what supports the interval. Many utilities keep everything, since the records are small.
- Do verification checks between calibrations need records?
- Yes. A weekly secondary standard check on a turbidimeter, or a grab sample comparison on a residual analyzer, is recorded with the date, the reading, and the result. For compliance instruments those records are required; for others they are the evidence that the instrument is fine between calibrations.
- What if a calibrator certificate expired before the calibration?
- The calibration is questionable and is recorded as such. The calibrator is sent for calibration; if it comes back in tolerance, the calibrations it did in the interval are usually accepted with a note; if it does not, they are repeated. The prevention is the reference standard file with due dates reviewed monthly.
- Who signs a calibration sheet?
- The technician who did it, and where the procedure requires it, a reviewer. On compliance instruments a second signature is common. The signature is a statement that the procedure was followed and the readings are true, and it is what makes the sheet evidence.
Impulse Lines
Read the guide →- Why does my DP flow meter read a flow at zero flow?
- The two legs are not balanced: a bubble in one, condensate in one, one leg warmer than the other, or one partially drained. Close both blocks, open the equalizer, and check the zero; if it is off with the equalizer open, bleed the legs and repeat.
- How long can an impulse line be?
- As short as the installation allows, and rarely more than a few meters. Every meter adds volume, temperature effects, places for gas to collect, and response time. If the transmitter cannot be near the tap, a diaphragm seal with a capillary or a remote-mounted transmitter with a short line at the tap is better than a long line.
- Should impulse lines be insulated?
- Where they can freeze, yes, with heat tracing; where the two legs of a DP could reach different temperatures from sun or a nearby heat source, yes, together in one insulation. On a plain gauge pressure line indoors on water, no.
- Can I use a pressure transmitter on a wastewater force main with an impulse line?
- Not an open one; it plugs within days. A diaphragm seal flush-mounted at the tap, or a transmitter with an integral flush diaphragm and a full-bore isolation valve, is the standard. The seal is chosen with a diaphragm material for the service and a fill fluid for the temperature.
Ultrasonic Flowmeters
Read the guide →- Can a transit-time meter work on raw wastewater?
- Sometimes, on screened wastewater with low solids and no aeration, and often not. The beam is scattered by solids and bubbles until the meter loses signal. Doppler is designed for that liquid, and a magnetic meter is the accurate answer where a spool can be installed.
- How accurate is a clamp-on meter really?
- One to two percent of reading with correct pipe parameters, adequate straight run, a full pipe, and good coupling. Any of those missing and the error grows, sometimes to ten percent, with no indication on the display. The accuracy is in the installation, not the box.
- Why does the meter read flow when the pump is off?
- Noise being interpreted as a small velocity, or a real small flow through a leaking check valve. Set the low-flow cutoff so that velocities below the noise floor read zero, and confirm with the check valve whether the flow is real. Doppler meters are especially prone to reading noise as flow in still, dirty liquid.
- Will it work on a PVC or lined pipe?
- PVC and HDPE transmit sound well and work. Cement mortar lining bonded to the pipe works when the liner thickness is entered. Loose liners, rubber liners, and heavily corroded steel scatter or absorb the beam; the Z mode and a wetted meter are the fallbacks.
Flowmeter Installation
Read the guide →- The pipe layout does not allow the straight run. What are the options?
- A meter that needs less: a multipath ultrasonic or a magnetic meter designed for short runs. A flow conditioner upstream. Accepting a larger error and documenting it. Or rearranging the pipe, which is cheaper before construction than after. What is not an option is installing the meter and assuming the specification still applies.
- Can a magnetic meter be installed on a pump discharge?
- Yes, with the straight run measured from the discharge nozzle or the check valve, and usually a longer one than after a plain elbow because the pump discharge swirls. Five diameters after a pump is often not enough; ten is safer, and a clamp-on verification will tell you.
- Why does the meter read flow when the pump is off?
- A zero that was done with flow present, a leaking check valve passing real flow, air moving in a partially full pipe, or electrical noise from a missing fluid ground. Check the fluid ground and the pipe fullness first, then re-zero with the pipe proven full and still.
- How much does meter size matter?
- A lot at low flow. A meter one size smaller than the pipe doubles the velocity and halves the fraction of range at which it operates, at the cost of a small pressure drop. Size the meter for the flow range, and expect that to be smaller than the pipe in many water applications where pipes are sized for future demand.
Flow Troubleshooting
Read the guide →- The magnetic meter and the pump curve disagree by fifteen percent. Which is right?
- Neither, until a third measurement is made. Pump curves drift as impellers wear and the head measurement may be wrong; magnetic meters drift when electrodes coat or the ground is lost. Clamp on an ultrasonic meter or run a tank drawdown, and the odd one out is the wrong one.
- The reading is noisy only when the raw water pump runs on the drive. What is it?
- Electrical noise from the drive coupling into the electrode cable or the fluid ground, or air drawn in on the suction at low speed. Check the drive installation and the electrode cable route first, then look for air with the pump at different speeds.
- The totalizer is always a few percent below the rate integrated by the historian. Why?
- The low-flow cutoff in the transmitter drops flows below its threshold from the pulse output while the analog rate still shows them, or the historian is integrating a sampled value with a coarse interval. Compare the two over a period of steady flow; if they agree there, the difference is at low flows and the cutoff is the cause.
- When should the meter be pulled and sent for calibration?
- When electronic verification fails, when the sensor has physical damage or heavy coating that cleaning does not fix, or when a regulatory requirement sets a calibration interval. Most disputed readings are installation or configuration, and pulling the meter fixes neither.
Differential Pressure Level
Read the guide →- When is a single gauge pressure transmitter enough?
- When the space above the liquid is truly at atmospheric pressure: an open tank, a wet well, a vented reservoir. Any tank that can hold pressure or vacuum, including one whose vent can plug or freeze, needs a differential measurement or a level technology that does not use pressure.
- What is the difference between suppression and elevation?
- Both shift the zero. Suppression handles a transmitter mounted below the bottom tap, so a positive head exists at zero level, and the range starts above zero. Elevation handles a wet leg, so a negative differential exists at zero level, and the range starts below zero. Transmitters accept both; the arithmetic is the head at the empty condition.
- The digester level reads high after a feed of thin sludge. Is the transmitter wrong?
- No, the density is. The transmitter reads head, and thinner sludge produces less head for the same height, so the reading falls; thicker sludge produces more and the reading rises. If the bias matters, measure the density or use radar.
- Can the low side just be left open to atmosphere on a closed tank?
- Only if the tank is open to atmosphere too. Otherwise the transmitter reads the tank pressure as level, and a pressure swing of a few psi is several feet of false level. The low side goes to the vessel, always.
Level Troubleshooting
Read the guide →- The ultrasonic reads correctly except when the pump discharge splashes. What is happening?
- The inflow stream or the turbulence returns an echo that the instrument locks onto, or the surface scatters the echo and the instrument loses it and holds. A stilling well, a different mounting position away from the inflow, or a radar with a narrow beam are the fixes. Foam from the splash makes it worse.
- The submersible transmitter reads slightly different each morning. Why?
- The vent is blocked or holds water, so the sensor reference is no longer atmosphere and the reading tracks the barometer and the temperature of the trapped air. Check the vent tube path, the breather at the junction box, and the desiccant. A vent that is clear reads the same level every morning.
- Is a level that jumps between two values a transmitter fault?
- Almost never. It is two echoes of similar strength, and the instrument choosing between them. Read the echo profile: the false one is at a fixed distance and matches something in the vessel. Suppress it in the echo map or move the sensor so it does not see the object.
- How often should a level transmitter be checked against a tape?
- At commissioning, after any work on the mounting or the sensor, and on a routine of a few months in wet wells where fouling and reference changes are common. The check takes five minutes and catches the offsets that slowly become pump cycling problems.
Differential Pressure
Read the guide →- Why not use two pressure transmitters and subtract in the controller?
- Because each has its own error, and subtracting two large numbers to get a small one multiplies the error. Two transmitters at 60 psi with a quarter percent error each can be wrong by a few tenths of a psi, which is a large fraction of a filter head loss of a few psi. A differential transmitter measures the small number directly. Two transmitters are fine when the differential is large relative to the errors, such as pump head.
- The transmitter reads a small negative value with the equalizer open. Is it broken?
- It needs a zero trim at line pressure, which is what the equalizer-open condition is for. A small shift with line pressure and temperature is normal; trim it and close the equalizer. A large negative reading with the equalizer open is a leg that is not full or a plugged equalizer.
- Can a differential transmitter be used as a plain pressure transmitter?
- Yes, with the low side open to atmosphere, it reads gauge pressure at the high side. The range limits and the static rating still apply, and a vented low side must be protected from water and insects.
- What causes the filter head loss reading to jump at the start of backwash?
- The flow reversal changes which tap is at the higher pressure, and a transmitter ranged for positive differential reads below zero or pins. Range it bidirectionally, or accept that the reading is meaningless during backwash and mask it in the controller.
Pressure Transmitter Installation
Read the guide →- Can the transmitter mount directly on the tap without an impulse line?
- Yes, and it is the simplest installation on clean water where the tap position is accessible, with a root valve and a bleed. Add a bracket if the pipe vibrates and a sunshade if it is outdoors. Direct mounting removes the elevation offset and most of the line problems.
- Why does the reading drop for a few seconds when a pump starts?
- It may be real: a suction pressure or a discharge pressure transient at start. If the swing is larger and longer than the process explains, air in the impulse line compresses and expands with the pressure and exaggerates the transient; bleed the line.
- How long can an impulse line be?
- As short as the installation allows. Every foot adds a chance of plugging, freezing, and trapped air, and slows the response. A few feet is normal; tens of feet is a reason to consider a seal with a capillary or remote mounting of a transmitter at the tap with the readout elsewhere.
- The transmitter is rated for the ambient temperature. Does it still need shade?
- The rating is for survival and stated accuracy under conditions that a sunlit surface routinely exceeds; a dark enclosure in the sun can be 40 degrees above ambient. A sunshade keeps the transmitter within its accurate range and extends the life of the display and the electronics.
Pressure Calibration
Read the guide →- The transmitter reads correctly on the display but the controller shows a different value. Is it out of calibration?
- Not the sensor. The difference is in the output stage, the loop, or the controller scaling. Check the mA output against the reference ammeter, then the controller input against the mA, then the scaling. Output trim fixes the first; the others are wiring or configuration.
- Can I calibrate with the transmitter installed?
- Yes, with the root valve closed and a pump connected at the bleed or a calibration port, provided the reference and the process are isolated from each other. Many transmitters are calibrated in place this way. Zero at atmosphere first, then apply the test points. Remember the elevation offset if the test pressure enters at a different height from the tap.
- The as-found error is within tolerance. Should I trim it anyway?
- No. Adjusting a transmitter that passes adds nothing and loses the drift record, and each adjustment has its own small uncertainty. Record the as-found values as the as-left values and move on. Adjust when the error is out of tolerance or approaching it.
- How is a calibration different from a loop check?
- Calibration proves the transmitter measures pressure correctly against a standard. A loop check proves the signal from the transmitter reaches the controller and the HMI correctly and the alarms and controls respond. Both are needed; a calibrated transmitter wired to the wrong input has passed one and failed the other.
Ammonia Analyzers
Read the guide →- Probe or analyzer for aeration control?
- A probe in most cases: the loop needs a fast, continuous trend more than absolute accuracy, and the probe sits where the process is. Calibrate it against the laboratory weekly and clean it. An analyzer is chosen when the plant also needs a compliance-grade number from the same instrument.
- Why does the probe read high at low ammonia?
- Potassium. At low ammonium, the potassium response is a large fraction of the signal, and a probe without potassium compensation, or with a failed potassium electrode, reads high. Check the potassium electrode and the compensation setting.
- How often does the wet-chemistry analyzer need attention?
- Reagents monthly or so depending on the cycle rate, the sample filter weekly to monthly depending on the water, and a full service a few times a year. A plant that budgets no technician time for it will have a very expensive alarm generator.
- Can I use the same analyzer for the aeration basin and the effluent?
- With a sample switching system and a range that covers both, yes, at the cost of a slower update on each stream and a more complex sample system. For control on the aeration basin, a dedicated probe is usually better and the analyzer serves the effluent.
Conductivity
Read the guide →- Why does the conductivity reading change with the weather?
- The temperature compensation is wrong or the temperature element has failed, so the seasonal temperature change appears as a conductivity change. Verify the temperature reading and the coefficient.
- Which sensor for a reverse osmosis permeate?
- A contacting sensor with a low cell constant, 0.1 or so, since permeate conductivity is low and clean. The feed and concentrate use higher constants or an inductive sensor.
- Can conductivity tell me the chloride level?
- Only by a correlation for that water, established against laboratory chloride results, and only if the other ions stay in proportion. It is a proxy, not a chloride measurement.
- The two conductivity meters on the same pipe disagree by 5 percent.
- Different cell constants entered, different temperature coefficients, or one sensor fouled. Check the constant and coefficient settings first, then calibrate both in the same standard.
Nitrate Analyzers
Read the guide →- Ultraviolet probe or electrode for the anoxic zone?
- An ultraviolet probe with a wiper for most plants: no reagents, less drift, and a reading that holds between cleanings. An electrode where the budget is tight and the loop only needs a trend, with weekly calibration accepted.
- The probe reads higher than the laboratory after every rain.
- The organic and solids load rose and the compensation model is not fitting the new water. Refit the model with samples across wet and dry conditions, and check the path length for the range.
- Can one instrument measure nitrate and ammonia?
- Some spectral analyzers estimate several parameters from one spectrum, and combined probes exist with separate electrodes. Each parameter still needs its own verification against the laboratory.
- How do I verify a source water analyzer near the drinking water limit?
- With laboratory samples on a schedule set by the regulator and the trend, using an accredited method, and with a documented action level below the limit. The online analyzer gives the warning; the laboratory gives the compliance number.
- Can I convert ORP to chlorine residual?
- Not reliably. The relationship depends on pH, temperature, the chlorine species, and other oxidants and reductants in the water. A plant can establish a rough correlation for its own water at its usual pH, and it breaks when any of those change. Use a chlorine analyzer for the residual.
- The ORP setpoint for dechlorination keeps needing adjustment.
- The effluent chemistry, pH, or temperature is changing, and the knee moves with it. Verify by titration, consider a cascade with a chlorine analyzer upstream for feed-forward, and check the electrode response time; a slow electrode makes the loop hunt and looks like a wrong setpoint.
- Why do two ORP probes in the same tank read 40 millivolts apart?
- Different reference electrode types, different fouling, or one reference junction poisoned. Check both in the same standard solution; the one that is off is cleaned or replaced. Differences of tens of millivolts between electrodes are common and are why ORP is used relative to a plant baseline.
- Does ORP need temperature compensation?
- The potential changes with temperature, but there is no standard compensation the way there is for pH, because the effect depends on the chemistry. Most transmitters report the raw potential and the temperature separately, and the plant setpoints account for the seasonal range.
Calibration Troubleshooting
Read the guide →- The electrode calibrates perfectly and the reading is still wrong in the tank.
- The tank is not the buffer: fouling that the buffer washed off, a matrix effect, a temperature difference, a reference junction that behaves differently in the process, or a sample point that does not represent the tank. Take a laboratory sample beside the electrode, and compare the electrode response time in the process.
- How much error is acceptable?
- What the procedure says, set from the use of the measurement: a compliance instrument tighter than a trend, a control instrument tight enough that the loop does not chase the error. Typical tolerances are a percent or two of span for transmitters and a tenth of a pH unit for electrodes; the plant writes its own.
- Should I calibrate more often if it keeps drifting?
- Calibrating more often treats the symptom; a sensor that drifts past tolerance between calibrations is failing, fouling faster than it is cleaned, or installed where it cannot work. Fix the cause, then set the interval from the drift record.
- The transmitter passed but the controller reads 3 percent high.
- The loop: the transmitter range and the controller scaling do not match, or the input module range is off. Walk the signal from the transmitter display through the current to the counts and the scaled value, and correct the scaling, not the transmitter.
Digital Signals
Read the guide →- The input stays on with the sensor off.
- A two-wire sensor leaking enough current to hold the input on, a sourcing sensor on a sourcing input wired to the supply, or a wire shorted to positive. Measure the off-state voltage at the input; a burden resistor across the input or the right input type fixes the leakage case.
- Should alarms be normally open or normally closed?
- Closed when healthy, opening on alarm, so that a broken wire alarms. Normally open alarm contacts are used only where a spurious alarm is worse than a missed one, and that is rare in a water plant.
- Can I run a 120 volt discrete signal to a 24 volt input?
- Not directly. Use an input relay with a 120 volt coil and a dry contact to the input, or an isolated 120 volt input module. A 120 volt wire landed on a 24 volt input destroys the channel.
- How much debounce?
- A few milliseconds for a clean contact, ten to fifty for a float or a bouncy limit switch, set in the input filter or a timer in the program, and never so long that a genuine short pulse is missed. Document the value beside the point.
Frequency Signals
Read the guide →- Frequency or 4 to 20 milliamps from the flowmeter?
- Frequency when the input can read it: no drift, no offset, and the total comes free. Current when the run is long and noisy, the controller has only analog inputs, or a converter is already present. Many meters offer both; use frequency for the total and current for the rate if the design wants belt and braces.
- The flow reads zero below a certain rate.
- The input cutoff or the minimum frequency setting, or the meter itself below its minimum flow. Turbine and paddlewheel meters have a minimum below which the rotor stalls or the K-factor is far off; the input should report zero there and the design should size the meter for the range.
- Why does the total drift when the pump is off?
- Noise pulses counted while the meter is still, or a rotor turning slowly in a leaking check valve. A minimum frequency cutoff, a better threshold, and shielding fix the first; a valve fixes the second.
- How fast can a counter input go?
- High-speed counter inputs handle tens of kilohertz or more; ordinary inputs a few pulses per second at most. Check the module specification against the maximum meter frequency at full flow.
Pulse Signals
Read the guide →- Pulse or Modbus for the total?
- Modbus, where the meter offers it, gives the register value itself with no lost pulses and the rate as well. Pulse is simpler and works with any controller. Many designs use both: pulse for the running total and a periodic register read for reconciliation.
- The controller total is 3 percent lower than the register.
- Lost pulses: an input too slow for the rate, pulses during outages, or a filter too long. Check the maximum rate at full flow against the input, the pulse width, and the outage log. A total that is higher than the register is bounce or noise.
- What pulse quantity should I set on the meter?
- The largest that gives the resolution the process needs, so that the rate is low: ten or a hundred gallons per pulse for a plant flow, one gallon for a chemical feed. The rate at maximum flow should be a fraction of the input maximum.
- Can I use the same pulse for rate and total?
- Yes: the counter difference per interval gives the rate and the accumulated count gives the total. At low rates the rate from pulses is coarse, and a 4 to 20 milliamp rate signal alongside the pulse total is the usual arrangement.
Signal Isolation
Read the guide →- Do I need an isolator on every loop?
- No. Loops powered from the panel, grounded only at the panel, into a non-isolated module with all channels on the same common, work without one. Isolate the loops that cross grounds, come from drives or other panels, or need two receivers.
- Can I put the isolator at the transmitter end?
- A field-mounted isolator or an isolated transmitter output does the same job at the other end and is used where the panel cannot be changed or the common-mode problem originates at the panel. It needs power and an enclosure in the field.
- What is the difference between an isolator and a surge protector?
- A surge protector clamps transients to ground and is connected to ground on purpose; an isolator blocks the ground path. A loop that leaves the building has both: the protector at the entrance, the isolator after it.
- Why does the reading change when I ground the shield at the field end?
- The shield became the ground loop path; a shield is grounded at one end only, and the reading change proves the loop needs isolation or a correct shield ground rather than a second one.
Short-Circuit Current Rating (SCCR)
Read the guide →- What SCCR do I need?
- At least the available fault current at the point where the panel is installed, from the calculation described above. Where that number is not yet known, designing to a common commercial value such as 65 kA at 480 V avoids the problem on most sites, at some cost in component selection.
- Does a 65 kA main breaker give the panel a 65 kA rating?
- No. The breaker can interrupt 65 kA. The panel rating is the lowest rating of any power-circuit component behind that breaker, and it is often far lower unless the components were selected for it.
- What is the default rating for unmarked components?
- UL 508A Supplement SB assigns defaults by component category, and for most categories they are a few kiloamperes. Any panel that contains one unmarked power-circuit component ends up at that default. The exact values are in the supplement and should be read from the current edition.
- Can the rating be raised after the panel is built?
- Sometimes, by replacing the limiting component or adding current-limiting protection in a listed combination, and the label must then be corrected. If the panel is UL listed, the change has to be made under the listing program, not just in the field.
Enclosure Selection
Read the guide →- What is the difference between Type 4 and Type 4X?
- Both keep out windblown dust, rain, and hose-directed water. Type 4X adds corrosion resistance, meaning stainless steel or a non-metallic material. Any wastewater, coastal, or chemical site is 4X.
- Stainless or fiberglass for a lift station?
- Either is Type 4X. Stainless, 316 for chloride and sulfide exposure, is stronger, shields radio noise, and lasts longest in the sun. Fiberglass is lighter, cheaper, and immune to most chemicals, and it chalks in sunlight and needs its gaskets watched. Both are common; the site chemistry and the budget decide.
- How big should the enclosure be?
- Big enough for the heat and the wire bending space, plus twenty percent spare. Run the heat calculation with the drives and supplies in it, check the bending space at the largest terminals against NEC Article 312, and then see what size that is.
- Does a hole for a pushbutton void the rating?
- It does if the device installed in it is not rated for the enclosure type or is not gasketed as the device manufacturer requires. Door-mounted devices for a Type 4X panel are Type 4X devices, installed to their instructions.
Enclosure Heat Calculations
Read the guide →- How do I calculate the temperature inside a control panel?
- Sum the watts of heat from everything inside at the worst case, divide by the effective surface area of the enclosure times the heat transfer coefficient the enclosure manufacturer publishes, and add the ambient. The enclosure heat load calculator on this site does it.
- How much heat does a VFD produce?
- Typically a few percent of its rated power at full load, stated in the drive manual as watts of loss. A 25 horsepower drive can dissipate several hundred watts, which is why drives dominate the heat load of the panels they sit in.
- Can I put a fan in a Type 4X enclosure?
- Not without losing the rating. A fan needs an opening, and an opening admits water and dust. Use a heat exchanger or an air conditioner rated for the enclosure type, or move the heat source out.
- What temperature can a PLC tolerate?
- Most controllers and drives are rated to 50 or 60 degrees Celsius inside the enclosure, and some to less. Check the rating of every component and design to the lowest one, with margin for the hot corner near the drive.
Component Layout
Read the guide →- Where should the PLC go in a panel with VFDs?
- As far from the drives as the panel allows, and below them, with wireway between. The drives heat and radiate noise; the controller and its analog inputs want neither.
- Can power and control wiring share a wireway?
- Not if the layout can avoid it. Separate wireways, or a divided one, keep the drive and contactor noise off the signal wiring and keep a technician from finding line voltage beside a 24 volt wire. Where they must cross, cross at a right angle.
- How full should a wireway be?
- About half when the panel ships. It will be fuller after every change order, and a wireway that is full on day one cannot take the next wire without the cover coming off for good.
- How much spare space should a panel have?
- Twenty percent of the back panel and of the terminal positions is the usual rule. It costs a slightly larger enclosure and it saves the next enclosure.
Hand-Off-Auto Selectors
Read the guide →- Should the PLC be able to start a pump in Hand?
- No. Hand is the operator’s mode and the controller is out of the coil circuit. The controller sees the run feedback and, ideally, the selector position, and it accounts for the pump but does not command it.
- What stays active in Hand?
- Everything that protects the motor or a person: overload, motor thermal protection, seal failure trip if it is configured as a trip, and safety interlocks. What Hand bypasses is the controller’s decision to run, including level control and alternation.
- Do I need a PLC input for the selector position?
- Yes, at least for Auto. Without it the controller cannot tell a pump that failed to start from one that is in Off, cannot alarm a pump left in Hand, and cannot manage alternation correctly.
- Is Off the same as locked out?
- No. Off opens the control circuit; the motor circuit is still energized and the selector can be turned by anyone. Lockout is the disconnect, opened and locked, per the site procedure.
Variable Frequency Drives in Pump Panels
Read the guide →- Do I need an inverter-duty motor?
- For a new installation with a drive, yes; the cost difference is small and the insulation system is designed for the voltage peaks. For an existing motor being put on a drive, check the cable length against the drive manufacturer limits and consider an output filter. Submersible pumps are supplied by the pump manufacturer for drive duty, and the manufacturer specifies the cable and filter requirements.
- How much energy will a drive save?
- It depends entirely on the system curve. Where most of the head is friction, running at 80 percent speed uses roughly half the power. Where most of the head is static, the pump must still make the same head and the saving is small or negative because the pump leaves its efficient range. Plot the system curve before promising a payback.
- Should the PID loop be in the drive or the PLC?
- Drives include a PID controller and it works for a standalone pump. In a station with a PLC, the loop belongs in the PLC, where its tuning, limits, failure handling, and alarming are visible on SCADA and consistent with the rest of the program.
- Why does the pump run but the level keeps rising with the drive at minimum speed?
- The minimum speed is below the point where the pump develops enough head to move water into the force main. Raise the minimum speed until flow begins, with margin, and set the level control to stop the pump when inflow is below what minimum speed delivers.
Soft Starters
Read the guide →- Can a soft starter control pump speed at all?
- No. It controls voltage during start and stop; at any steady state the motor runs at full speed, or stalls. A soft starter held at reduced voltage in run is a motor heater. Speed control requires a drive.
- Does a soft starter reduce starting current enough to run on a generator?
- Usually. A generator sized for an across-the-line start must handle six times full-load current; with a soft starter at a 300 percent limit, the generator can be much smaller, or the same generator can start a larger pump. Check the generator manufacturer sizing for the starting profile.
- Is soft stop always a good idea on a pump?
- It is a good idea where check valve slam or water hammer is a problem. On a station with a large static head, a long soft stop has the pump running at a speed where it moves no water while still heating, so the stop time is set short and the check valve is chosen for the application. On a very short force main it may not be needed at all.
- What fails on a soft starter?
- Thyristors, usually from heat or a short-circuit event, and the bypass contactor, from ordinary contactor wear. Keep the starter cool and the enclosure clean. A starter with an internal bypass and correct upstream protection lasts as long as a contactor.
Circuit Breakers in Control Panels
Read the guide →- Can I use a supplementary protector on a transformer primary?
- Not as the branch circuit protection. A UL 1077 device can be used to subdivide a circuit that already has branch protection upstream, so a supplementary protector on a transformer primary is acceptable only if a UL 489 breaker or a fuse ahead of it provides the protection the code requires, and the supplementary device is then redundant.
- Why does the breaker on my drive trip at power-up?
- The drive charges its DC bus capacitors at power-up and the inrush exceeds the breaker instantaneous trip. Most drives have a precharge circuit that limits it; if the breaker still trips, it is the wrong curve, the wrong rating, or not the device the drive manufacturer specified.
- Fuse or breaker?
- Fuses interrupt higher fault currents, limit current more effectively, and are less expensive for a high SCCR. Breakers are resettable, report their state, and are easier to operate. Many panels use both: current-limiting fuses at the main for the SCCR, breakers on the branches for operation.
- How do I find the available fault current at my panel?
- From the utility at the service, then calculated through the transformers and conductors to the panel. The utility provides the value at the service; a short-circuit calculation, done by the engineer or with the transformer impedance and conductor data, gives the value at the panel. The NEC requires the value to be marked on service equipment and the SCCR on industrial control panels.
Fuses in Control Panels
Read the guide →- Can I replace a Class J fuse with a Class RK5 of the same amperage?
- They do not physically interchange, which is by design. Even where two classes fit the same holder, such as Class H in an unclipped Class R holder, the interrupting rating and let-through differ, and the panel SCCR calculation was done with the class on the drawing. Replace with the class specified.
- Why does my panel have fuses and breakers both?
- The fuses at the main provide the interrupting rating and the current limitation that give the panel its SCCR. The breakers on the branches give resettable, reportable protection for daily operation. It is a common and sensible arrangement.
- Is a fuse holder with a blown-fuse light worth it?
- On any circuit whose loss matters and is not otherwise alarmed, yes. The light shows the technician which fuse opened without pulling each one, and a version with a contact tells the controller. On a 24 V DC distribution block feeding a dozen loops, indicated fuses save an hour per event.
- How do I size the fuse for a control transformer?
- From the transformer nameplate primary current and the NEC 450.3 table, using a time-delay fuse to ride through the inrush, which can be 20 to 30 times rated current for the first half cycle on a small transformer. Most transformer manufacturers publish a fuse recommendation by kVA and voltage; use it, and use Class CC in a UL 508A panel.
Panel Power Supplies
Read the guide →- Why does the whole panel reset when one solenoid shorts?
- The bus is unfused or the fuse cannot clear on the current a switch-mode supply delivers. Distribute the output through branches with protection sized to trip on the limited current, and put the solenoids on their own branch.
- Can I use one supply for the controller and the instruments?
- Yes, and most panels do, through separate fused branches. Where the instruments are in a hazardous area through barriers, or where the instrument loops are especially noisy, a separate supply for the instruments is reasonable. What matters is that a fault on an instrument branch does not reach the controller.
- How much margin is enough?
- 25 to 30 percent over the calculated continuous load, after derating for the panel temperature. More if the panel is likely to grow. A supply running at 95 percent of its rating on a hot day has a short life and no room for the next float.
- Should the 24 V negative be grounded?
- Common practice is to bond the negative to the panel ground at one point, which gives a referenced system that is easier to troubleshoot and that lets ground faults be detected as shorts. Some designs float it deliberately for noise or for ground-fault tolerance, and then a ground fault detector is added. Either way, it is one decision, documented, applied at one point.
Control Relays
Read the guide →- Can I drive a starter coil directly from a relay output module?
- Some relay output modules are rated for it, at 120 V AC and a couple of amps, and panels are built that way. The cost is that a shorted coil or a surge on the coil circuit damages the module, which is far more expensive and slower to replace than an interposing relay. Most panel standards interpose everything that leaves the panel or exceeds a small load.
- Why did my controller output fail after a year?
- An unsuppressed relay coil is the usual reason: the inductive kick each time the output opens degrades the transistor until it fails. Add suppression at every coil, and replace the module. The second reason is a load beyond the output rating, which the same fix addresses by interposing.
- Solid-state or mechanical for a load that cycles constantly?
- Solid-state, because a mechanical relay has a contact life of hundreds of thousands to a few million operations and a load that cycles every few seconds reaches that in months. Check the leakage current against the load: a small pilot light or a controller input can stay on from the leakage of a solid-state relay, and a bleed resistor or a mechanical relay is needed there.
- Should relay logic still be used with a PLC in the panel?
- For the functions that must work when the PLC does not: the float backup, the safety circuit, the hardwired high-level call. Those stay in relays by design. Everything else belongs in the program, where it is visible, documented, and changeable without rewiring.
Terminal Blocks
Read the guide →- Can I land two wires on one terminal?
- Only if the block is rated for it and the wires are within the range for two conductors, usually with a twin ferrule for stranded wire. Most panel standards land one conductor per terminal side and use bridging bars for commons. Two wires under one screw is the connection most likely to be loose.
- Do screw terminals really loosen?
- Yes, under vibration and under thermal cycling that expands and contracts the copper. Panel maintenance programs include a retorque on power terminals for that reason. Spring and push-in terminals hold a constant force and do not need it, which is why they have taken over control wiring.
- Where do shields land?
- On ground terminals bonded to the rail at the panel end, and nowhere at the field end, for the reasons on the ground loop page. A multi-level block with a shield tier bonded to the rail, or a separate shield ground strip beside the analog strip, keeps them organized and visible.
- What happens when a strip runs out of spares?
- A new strip is added, on the drawing first, in the same numbering convention. A spare that has been used is relabeled and the I/O list updated. A panel where the spares are gone and wires are doubled under terminals has reached the point where the next change needs a panel modification, and the drawing should say so.
UPS for Control Panels
Read the guide →- Does a lift station need a UPS if it has a generator?
- For the controller and the radio through the transfer, yes, unless the program is written for a clean restart and the utility accepts losing visibility of the event. A small DC module with a few minutes of battery is inexpensive and lets the controller manage the staggered restart, as the generator operation page describes.
- How long a runtime is enough without a generator?
- Long enough to report and to keep reporting until someone can respond, plus a clean shutdown. Thirty minutes covers the alarms; two hours covers a crew arriving with a portable generator and lets SCADA see the level the whole time. Longer runtimes are batteries and money; the narrative decides.
- Why did the UPS fail during the outage it was installed for?
- The battery was dead, and nobody knew because the self-test was not alarmed or the alarm was ignored. Batteries in panels fail quietly. The fix is the replacement schedule and the alarm to SCADA, tested by pulling the supply.
- Can the SCADA server run on the same UPS as the panel?
- A server is an AC load with a different runtime need and its own shutdown software; it gets its own AC UPS in the server room, sized for its load and for the time it takes to shut down or to run until the generator carries it. Panel DC modules and server UPS units are different products for different jobs.
Noise Problems
Read the guide →- The panel was quiet when it was built. What changed?
- Usually a modification: a cable pulled through the nearest wireway, a relay added without a suppressor, a shield landed at a field box during a transmitter replacement, a radio installed inside the door. Panels accumulate noise with every change unless the rules are written down and followed.
- Is a separate instrument ground a good idea?
- A separate bar for shields and instrument commons, tied to the main panel ground at one point, is good practice; it keeps shield currents off the bus that carries everything else. A separate ground electrode for instruments, not bonded to the equipment ground, is a hazard and a noise source, and the code does not allow it.
- How do I tell a noise problem from a bad input card?
- Swap in a known-good card or move the loop to a spare channel. A card problem follows the card; a noise problem follows the wiring. Also look at whether the problem correlates with a source; card faults do not care what else is running.
- Where do I put a drive if the panel has to hold one?
- In its own section with a barrier, as far from the I/O as the enclosure allows, with the motor cable leaving directly through its own entry, a short ground strap to the bus, and its control wiring in shielded pair routed away from the motor terminals. Better still, in its own enclosure with a short shielded control cable between them.
Ground Faults
Read the guide →- The control fuse blows only when it rains. What is that?
- A ground fault in a field device or a junction box that fills with water. Divide the circuit during the rain, or measure each field branch to ground while it is wet, and expect to find a float switch cable, a box without a drain, or a conduit low point.
- Should the 24 VDC common be grounded or not?
- Either is permitted. Grounded systems make faults visible immediately by blowing a fuse and keep every signal at a known reference. Ungrounded systems tolerate a single fault and keep running, which some plants prefer for critical circuits, but only with a ground fault monitor and a policy of fixing the first fault promptly. Choose one for the plant and apply it consistently.
- The insulation tester shows a low reading but the circuit works. Is it a fault?
- A reading of a few megohms on a long field circuit with older cable is normal deterioration; a reading in the kilohms is a fault waiting for enough voltage or moisture to become a short. Trend the readings; a value that falls each year is the cable telling you when to replace it.
- Can a ground fault on one circuit affect another?
- On a grounded system the fault current returns through the ground conductors and can raise the potential of the grounding system enough to disturb instrument signals while it flows. On an ungrounded system a fault on one pole effectively grounds that pole for every circuit on the supply, and a second fault anywhere on the other pole shorts the whole supply. Both are reasons not to leave a known fault in place.
No Control Power
Read the guide →- The primary fuse blew and the new one blew immediately. What now?
- The transformer or something on its secondary is faulted. Disconnect the secondary and try again with a new fuse; if it holds, the fault is in the control circuit, and you divide that. If it blows with the secondary open, the transformer has failed. Do not try a third fuse without finding out which.
- The DC supply shows the output light but the voltage is low. Why?
- The supply is in current limit: a load is drawing more than its rating, usually a short or a ground fault on a field circuit, or too many loads added over time. Disconnect the loads one at a time and watch the output recover. A supply whose output is low with no load has failed.
- How do I tell a tripped safety relay from a failed one?
- Check the input loop: with all emergency stops released and guards closed, the relay input indicators should show both channels satisfied. Press reset. A relay that resets and holds was tripped. A relay whose inputs show satisfied and that still will not reset, or resets and immediately drops, has failed or has a wiring fault on its reset or feedback circuit.
- Why does the control power go out when the generator takes over?
- Transfer causes a brief outage, and the control transformer draws inrush on re-energization that opens an undersized primary fuse; or the generator voltage or frequency during transfer is outside what the DC supply or an undervoltage relay accepts and something drops out. Time-delay primary fuses of the right rating and a UPS on the controller supply are the usual cures; look at the transfer sequence with a recording meter if it persists.
NFPA 70 and the Control Panel
Read the guide →- Does every control panel need a UL listing?
- The code requires the short-circuit current rating and the nameplate, and permits the authority to require a listing or field evaluation. In practice most jurisdictions expect a listed panel, and a listing avoids a field evaluation at the site. Build to the standard.
- Who is responsible for the available fault current?
- The installation side: the engineer of record or the installer documents the available fault current at the service and at the panel. The panel builder supplies the rating; the engineer must make sure the rating exceeds the available current.
- Can 24 volt instrument wiring share a wireway with 120 volt control wiring?
- Class 2 conductors are kept separate from Class 1 and power conductors unless the code separation conditions are met, and noise considerations argue for separation anyway. Separate wireways in the panel and separate conduits in the field.
- Is a control panel a service disconnect?
- Not unless it is built and listed as service equipment. A panel fed from a service needs the service disconnect upstream, or must itself carry a service-rated listing, which is a different design.
UL 698A
Read the guide →- Can I use a relay instead of a barrier for the floats?
- Not for a circuit into a Division 1 wet well. The float circuit must be intrinsically safe, which means a listed barrier or isolator with a control drawing, or the float and its wiring must be otherwise suitable for the location. Intrinsically safe float relays exist and are listed as barriers.
- Do I need UL 698A if the panel is outside the wet well?
- If circuits from the panel enter the classified area through intrinsically safe barriers, the panel falls under UL 698A for that element. The panel shop that builds hazardous location panels carries that listing scope.
- What about the level transmitter in the wet well?
- A submersible or radar transmitter in a Division 1 wet well is either intrinsically safe through a barrier, or explosion-proof with the appropriate seals. Most designs use an intrinsically safe loop through a barrier or isolator with a control drawing.
- Who classifies the area?
- The engineer of record on the area classification drawing, using NFPA 820 and the code. The panel designer works from that drawing and does not classify areas.
Wireways
Read the guide →- Can 24 volt instrument wiring and 120 volt control share a wireway?
- They can be run together only where the code separation rules allow and the noise is acceptable, and in practice a shared duct makes the analog signals noisy. Separate ducts, or a partition, are the standard.
- How much growth should I allow?
- A quarter to a third of the fill at design, more on a panel for a plant that changes often. Spare terminals and spare I/O without spare wireway are wasted.
- Metal or plastic wireway?
- Plastic slotted duct for panel wiring, in a flame-rated grade. Metal wireway is an installation product for runs between enclosures and is not a substitute for panel duct.
- The wireway is full and I need to add three wires.
- Remove the cover, add the wires, and note in the change record that the duct is over fill; then plan a duct replacement at the next outage. Cutting the cover or leaving it off is how panels catch stray wires.
Terminals
Read the guide →- Screw or spring terminals?
- Both are acceptable in a listed panel. Spring terminals are faster, vibration resistant, and need no torque check; screw terminals accept a wider range of conductors and are what many field electricians expect. Pick one per plant and use ferrules with either.
- Where should the field wires land, on the terminal strip or directly on the I/O module?
- On the terminal strip. Direct landing on a module saves terminals and costs every module replacement, every loop test, and every schematic that then has to show module terminals as field terminals.
- How many spares?
- A fifth to a quarter of each strip, plus a spare strip section in the wireway plan. Spares cost little at build and a great deal at retrofit.
- Should I use multi-level terminals?
- For discrete I/O, yes: a three-level terminal carries signal, common, and ground in one width, and the strip is a third the length. Label the levels and show them on the schematic; a three-level strip drawn as single terminals is a trap.
Surge Devices
Read the guide →- Do I need surge protection inside the plant on loops that never leave the building?
- Rarely for lightning, since the building bonding limits the exposure; sometimes for switching transients near large drives. The loops that leave the building, cross between buildings, or run to a mast are the ones that need it.
- Fiber or a surge protector on the Ethernet link between buildings?
- Fiber. It removes the conductor entirely and with it the surge, the ground loop, and the noise. A copper link between buildings with protectors at each end is a compromise for short runs where fiber is impractical.
- Will a surge device protect against a direct strike on the antenna?
- A coaxial arrestor with a properly grounded mast survives most strikes and protects the radio from most of them; a direct strike on a poorly grounded mast destroys the radio and often the panel. The mast ground, the arrestor, and the panel ground bonded together are the protection; the arrestor alone is not.
- How do I know a surge device has failed?
- The indicator window or light on the device, the monitoring contact if wired, or a loop that reads open. Devices that fail short trip their fuse; devices that fail open give no indication except an inspection, which is why the schedule includes one.
Network Switches
Read the guide →- Can I use an office switch in a control panel?
- It will work until it does not: it is rated for an office temperature, it has a fan or a wall adapter, and it is not listed for the panel. An industrial switch costs more and is a control component; use one.
- How many spare ports?
- Two at minimum, more on a panel that will grow. A switch with no spare ports is replaced the day a camera is added.
- Do I need a managed switch in a lift station?
- If the station has a controller, a drive on Ethernet, a touchscreen, and a radio, and the design segments the radio from the drives, yes. A station with a controller and a radio on a two-port controller may not need a switch at all.
- Should the switch be on the UPS?
- Yes, along with the controller and the radio; a switch that drops on a power blip takes the communications down while the controller rides through.
Blown Fuses
Read the guide →- The new fuse blew as soon as I turned it on.
- The short is still there. Power off, lock out, section the circuit with an ohmmeter, and find it. Fitting a third fuse finds nothing.
- The fuse tests good but the circuit is dead.
- A fuse can test good out of the holder and fail in it: a corroded holder, a cracked end cap, or a holder clip with no tension. Measure the voltage on both sides of the fuse in the holder under load.
- Can I use a breaker instead of a fuse?
- A supplementary protector or a breaker of the right type and rating can replace a fuse in many control circuits, as a design change with the drawings updated and the listing reviewed. It is not a field substitution.
- Why did the fuse blow during a lightning storm and everything test fine afterward?
- A surge came through the circuit and the fuse opened on the transient, or a surge protector clamped and drew the current. Check the surge devices; one of them may have sacrificed itself, and the loop it protected is now unprotected.
Failed Power Supplies
Read the guide →- The supply reads 24 volts but the controller keeps rebooting.
- Measure under load during the reboot: the voltage may sag briefly when a load switches, or the ripple may be high. A supply near its limit holds the average voltage and loses it in transients. Reduce the load or replace the supply.
- Can I add a second supply in parallel to get more current?
- Only with supplies designed for parallel operation and a proper redundancy module or load-sharing setting, and each rated for what it will carry. Two supplies wired together without that fight each other.
- The supply is hot to the touch. Is that a failure?
- A supply near its rating is warm; one too hot to hold is overloaded, poorly ventilated, or in a hot panel. Measure the current and the ambient, and act before it fails.
- Why does the supply fail only on generator power?
- The generator waveform or frequency, or the voltage during load steps, is outside the supply input range. A supply with a wider input range, or a small UPS ahead of it, fixes it.
Panel PLC Faults
Read the guide →- The controller faulted once during a storm and has been fine since.
- A surge or a sag reached it. Check the surge devices, the supply hold-up, and the grounding; the next storm is the test. Log it and alarm on supply monitoring so the next one is seen.
- Why does the fault clear when I reseat the module?
- A connector with corrosion or a loose module retention, which reseating cleans temporarily. Inspect the connector, replace the module if the contacts are damaged, and check the panel for humidity and corrosive air.
- How do I tell a program fault from a panel fault?
- The fault code. Program faults name a routine and a rung; power and hardware faults name the supply, the module, or the backplane. A watchdog fault can be either and is worked from the task times.
- Should the controller be on the UPS?
- Yes, with the switch and the radio, so that the controller rides through sags and short outages and can report a power failure. The outputs may or may not be on the UPS depending on what the process should do without power.
Relay Problems
Read the guide →- The relay clicks but the pump does not start.
- The coil works and a contact does not: measure the voltage across the contact with the coil energized. A drop equal to the supply means the contact is open, from burning, a socket pin, or a wire. Then look at what the contact feeds.
- Why do the relays chatter when the big pump starts?
- The control voltage sags below the coil holding voltage during the start. Measure it. The control transformer is undersized for the panel, the starting method is harsh, or the control circuit is fed from a source that dips. A larger transformer or a separate control source fixes it.
- Can I use a solid-state relay instead?
- For frequent switching of resistive or moderate inductive loads, a solid-state relay has no contacts to burn, and it needs a heat sink, leaks a small current when off, and fails short. It is a design decision with the drawing updated, not a field swap.
- How long should a relay last?
- Mechanically, millions of operations; electrically, tens of thousands to hundreds of thousands at rated load, and far fewer at an unsuppressed inductive load. A relay in a circuit that cycles every few seconds is a wear item on a schedule.
PLC Power
Read the guide →- Can the controller and the I/O share one supply on a small panel?
- They can, and many small panels do; the risk is a field short rebooting the controller. A second small supply costs little, and on any panel where the controller must stay up through a field fault, it is worth it.
- How much UPS runtime?
- Enough to bridge the generator start, or the time to visit a site with no generator, plus margin for the batteries aging. Thirty minutes is common for a plant panel; several hours for a remote site that must keep reporting.
- Should the outputs be on the UPS?
- Only the ones the process needs during an outage, decided one by one. A UPS that runs the pumps is a much larger UPS, and the generator is the right answer for that.
- Why ground the 24 volt common?
- So that faults are detectable and the system is at a known potential. A floating supply lets a single ground fault go unnoticed until a second one shorts the supply, and it lets noise ride the common. One bond, at the supply, on the drawing.
Panel I/O
Read the guide →- Why not wire the field cables straight to the module?
- Because the module is then a terminal strip, every module replacement disturbs field wiring, every loop test needs a wire lifted, and the schematic has to show module terminals as field terminals. Terminal strips are cheap; a rewire is not.
- When do I need isolated analog inputs?
- When the loops are powered from different sources, when a transmitter is grounded at the field end, when a signal comes from another panel or a drive, and when a common-mode voltage between loops would otherwise appear as an error. On a plant panel, isolated inputs for everything are cheap insurance.
- How many spares?
- A fifth of each module type and a spare slot, plus the terminals and the wireway to use them. A panel with spare inputs and no spare terminals has no spare inputs.
- Should the I/O be in the controller panel or in the field?
- Points near the controller are hardwired; points across the plant are better served by a remote I/O rack over Ethernet or fiber, which saves conduit and copper and keeps long signal runs off the panel. The decision is on the network drawing.
Relays in the PLC Panel
Read the guide →- Can a relay output module drive a contactor coil directly?
- Within its rating, with suppression, for small contactors, yes; for larger contactors and for anything the module rating does not comfortably cover, an interposing relay. The module is harder to replace than a relay in a socket.
- Why put the emergency stop through a safety relay when the controller could stop everything?
- Because the controller can be faulted, in program mode, or wrong. A safety relay is listed for the function, monitors its own circuit, and drops the power directly. The controller is told, not trusted.
- How do I get rid of the relay logic in an old panel?
- Document what it does first, one relay at a time, then implement each function in the program with SCADA visibility, test, and remove the relays with the drawing updated. Removing relay logic without documenting it removes functions nobody knew existed.
- Slim relay modules or full-size plug-in relays?
- Slim modules for interposing on many outputs, where space and built-in suppression matter; full-size relays for higher contact ratings, multiple contacts, and where the technicians expect them. Both are fine; one standard per plant.
Isolation
Read the guide →- Do I need isolators if I use shielded cable?
- The shield reduces coupled noise; it does not remove a ground loop in the signal conductors. A loop grounded at both ends needs isolation whatever the cable.
- The analog reads fine most of the time and jumps when the big pump starts.
- The ground potential difference rises with the fault or starting current and appears in the loop. That is a ground loop; isolate the loop and check the grounding.
- Is an isolation transformer a surge protector?
- It attenuates common-mode transients and blocks DC, and a shielded isolation transformer does more, but it does not clamp a surge on the line conductors. Surge protection is a separate device; both together make clean control power.
- Can I isolate a signal at the field end instead of the panel?
- Yes, with a field-powered isolator or an isolated transmitter output, and it is done where the panel end cannot be changed. The panel end is usually more convenient because power and access are there.
Panel Surge Protection
Read the guide →- The panel has a power surge protector already. Is the loop protection really needed?
- The level transmitter cable in the wet well and the float cables are the antennas at a lift station, and the surge on them arrives at the input modules, not at the power supply. Loop and discrete protection at the entrance is what saves the controller.
- Can I mount the protectors in the field junction box instead?
- A protector in the field box protects the field device, and a second set at the panel protects the panel. Both are used on exposed sites; the panel entrance set is the one that is never omitted.
- How good does the site ground need to be?
- As low as the site allows and, more importantly, bonded: every ground at the site tied together. A single rod at high resistance with everything bonded to it is better than three excellent rods that are not bonded to each other.
- Why does the radio keep dying while the controller survives?
- The antenna feed is a direct path to the radio, and its arrestor or the mast ground is inadequate or not bonded to the panel ground. Bond the mast to the site electrode system, put the arrestor at the entrance on the bar, and check the coax for water.
Panel Networking
Read the guide →- One switch or two?
- One managed switch with virtual networks serves most panels. Two physical switches are used when the design requires physical separation, such as a private I/O ring, or when the control and device networks must not share hardware for security reasons.
- Where does the cellular router go?
- In the panel as a component, on the UPS-backed supply, with its antenna feed through the surge entrance and its Ethernet to the port the design assigns, usually the controller second port or a firewalled switch port. Not on a shelf with a wall adapter.
- Can I plug the field cable straight into the switch?
- It works, and it costs a patch cord. The problem is later: the field cable is stiff, it takes a bend it should not, the port is changed by unplugging a field cable, and the label is on the wrong thing. Couplers are cheap.
- Does the panel network need a firewall?
- Wherever the panel connects to something outside its zone: the radio, the cellular network, the plant business network. A remote site with a cellular router uses the router firewall; a plant panel on the control network relies on the plant boundary firewall. The zone drawing decides.
Duplex Pump Panels
Read the guide →- Relay panel or controller panel?
- A relay panel with a level controller is simple, cheap, and serviceable by any electrician; a controller panel adds runtime alternation, a continuous level, smarter alarms, and telemetry data. Most new stations use a small controller with a full relay backup; the backup is what makes the controller acceptable.
- How many floats for the backup?
- Four is typical: off, lead-on, lag-on, and high alarm. Some designs use three with a common off for both pumps. The high float is wired to the alarm independently of everything else.
- Should hand mode bypass the safeties?
- Hand bypasses the level control so the operator can pump down manually; it should not bypass the overload, the phase monitor, or the thermal switch. The low level cutoff in hand is a design decision; many designs keep it, and the drawing says which.
- Do I need drives on a duplex station?
- Only when the station needs flow control, a soft start for the electrical system or the force main, or energy savings from running at reduced speed. Across-the-line or soft starters serve most duplex stations, and drives add heat, harmonics, and complexity that must be designed for.
Triplex Pump Panels
Read the guide →- Why not just run the lead and lag and leave the third as a spare?
- Because a spare that never runs seizes, its seals dry, and its starter is unproven when it is needed. Rotating all three keeps each proven and balances the wear; the fixed standby scheme is used only when the third pump is genuinely different.
- How do I balance hours when one pump is larger?
- Mixed sizes complicate rotation; the usual approach is a fixed role for the different pump, such as a small jockey pump for low flows or the large pump as standby for peaks, with the two similar pumps alternating. The control narrative describes it.
- Can all three pumps run at once?
- Only if the power system, the force main, and the downstream system are designed for it. Many stations limit the logic to two running and use the third only when one of the two has failed; the design states the maximum and the reason.
- Does the backup need all five floats?
- A full backup for three pumps uses five; a backup that runs two pumps uses four. The high float is always independent. The decision depends on how the station is expected to behave with the controller down, and it is on the drawing.
Alternation
Read the guide →- Alternate by cycle or by runtime?
- By cycle for a simple station and a relay design; by runtime with a maximum consecutive starts rule where a controller is present and the pumps see very different cycle lengths. Either way, exercise the idle pump and skip the faulted one.
- Should the operator be able to fix the lead?
- Yes, for a reason, with the selection visible on the screen and logged. A fixed lead that nobody remembers setting is found when the other pump has not run for a year; the design either expires the selection or alarms on it.
- What happens to alternation when the station is in hand?
- Hand overrides alternation for that pump; the other pump stays in the rotation as the only automatic pump. The controller shows both states, and the alarm for a pump left in hand is set for a reasonable time.
- How do I alternate pumps of different sizes?
- You generally do not: the small pump takes a fixed role for low flows and the large one for peaks, or the two similar pumps alternate and the odd one is fixed standby. The control narrative describes the roles.
Distribution Pressure Control
Read the guide →- Where should the pressure transmitter go?
- On the discharge header downstream of the check valves and after a length of straight pipe, so it reads system pressure rather than pump turbulence. For the best control, a second transmitter at the critical point in the system over telemetry, used as the controlled variable or to adjust the setpoint.
- What should the minimum speed be?
- The speed at which the pump can just overcome the static head and open the check valve, with a margin. It comes from the pump curve and the system head, not from a default in the drive. Running below it does no useful work.
- Why does my booster pump start and stop all night?
- Night demand is below the flow of one pump at minimum speed and there is nothing to hold pressure while the pump rests. Add sleep logic with a hydropneumatic tank or a jockey pump, and set the wake pressure with enough deadband below the setpoint.
- How do I tune a pressure loop?
- Start with low gain and a long integral time, no derivative. Make a small setpoint step and watch the response. Increase gain until the response is brisk without overshoot, then shorten the integral time until the offset clears in a reasonable time. Pressure loops are fast; the tuning ends up gentler than most people expect.
Tank Level Control
Read the guide →- How far should a storage tank be drawn down each day?
- Enough that the water turns over in a few days at most, which for many tanks means using a quarter or more of the volume each cycle, while keeping the low point above the fire reserve and the pressure floor. It is a water quality decision the utility makes, and it usually changes with the season.
- What should the pump station do if it loses the tank level signal?
- Whatever the control narrative says, and it must say something: pump on a schedule, pump on local pressure, or hold and alarm. The one thing it must not do is keep controlling on the last value it received as if it were current.
- Where should the level transducer be installed?
- At the base of the tank on a dead leg where there is no flow past it, with its elevation recorded so the reading can be referenced to the tank floor. The overflow alarm should be a separate float or probe at the top, not derived from the transducer.
- Why does the tank level drop when the pumps are running?
- Demand on the system is higher than the pump output, which is normal at peak on a hot day. If it happens routinely, the lag pump setpoint is too low or the pumps are undersized for the demand. If the level reads lower only while the pumps run, the transducer is on a live line and reading a velocity effect rather than static head.
Lift Station Lead/Lag Control
Read the guide →- Should the lag pump be a bigger pump?
- Usually not. Identical pumps allow alternation, share spares, and behave predictably in parallel. Where a station sees a very wide flow range, one option is a small jockey pump for dry-weather flow and two larger pumps for wet weather; in that arrangement the jockey is always lead and the large pumps alternate between themselves.
- How far above lead-on should lag-on be?
- Far enough that ordinary daily peaks never reach it, and close enough that a wet weather event calls the lag before the well is most of the way to the high-level alarm. One to two feet is common. Look at a level trend over a dry month: the highest level the lead pump reached on its own is the floor for lag-on.
- Why does my station call the lag pump every cycle?
- Either the lead pump can no longer keep up, which is a capacity problem, or the lag-on setpoint is too close to lead-on. Trend the level with the run status. If level keeps rising with the lead running at normal current, look at the pump; if the lead is drawing high current, look for rags; if level rises normally but lag-on is barely above lead-on, fix the setpoints.
- Is a hardwired lag float still needed with a PLC?
- Yes. The float provides a lag call that does not depend on the transmitter, the analog input, or the processor. Wire it so that it can start the lag pump through the relay logic on its own, and also bring it into the PLC as an input so the controller knows the float has operated and can alarm the disagreement.
Lift Station Pump Alternation
Read the guide →- Does alternation increase the number of starts?
- No. The station starts the same number of times for a given inflow. Alternation divides those starts between the pumps instead of putting them all on one motor. Starts per pump roughly halve.
- Should the alternator be in the PLC or a separate relay?
- Put it in one place. A PLC gives availability logic, retentive memory, counters, and SCADA visibility. A relay alternator is simpler and works with the PLC removed, which matters in a float backup scheme. A common compromise is the PLC in charge normally, with the relay alternator active only in backup mode when the PLC watchdog has dropped out.
- How do I alternate pumps that are different sizes?
- Do not. Fix the small pump as lead, use the large pump for lag and as standby, and exercise the large pump on a schedule so it is proven. Alternating unequal pumps gives a station whose capacity and cycle times change every cycle.
- The pumps are alternating but run hours are still uneven. Why?
- Check whether one pump is consistently the lag. In a strict every-cycle scheme the lag role also alternates, but with a first-on, first-off stop sequence or a run-time based lag call, one pump can end up taking most of the two-pump time. Also check that one pump is not being held out of auto for part of each day by a maintenance routine.
Lift Station High Level
Read the guide →- Can the high-level alarm come from the level transmitter?
- A high-level setpoint in the controller is useful and should exist, but it is not the high-level alarm. It shares every failure mode of the transmitter and the controller. The float is the alarm. If the transmitter and the float disagree, that disagreement is its own alarm and usually means the transmitter is wrong.
- Should high level start the pumps or only alarm?
- Start the pumps. The most common reason a station reaches high level is that the pumps were not called when they should have been. A float that only alarms leaves the pumps idle while someone drives to the site. The exception is a station where starting the pumps on a float could be unsafe, such as one with a known discharge problem, and that is a temporary condition, not a design.
- How high can I let the well go before it counts as an overflow?
- The overflow elevation is physical: the lowest point wastewater can leave the system, which may be a manhole lid upstream rather than the station itself. Surcharging the incoming sewer is not an overflow, but it backs up into laterals and basements, and in many utilities it is reportable on its own. Set the float so the well never surcharges the incoming sewer in normal failure cases.
- How often should the high-level float be tested?
- Monthly is common, and at least at every station visit. The test is a lift by hand from the hatch while someone confirms the alarm at SCADA and the pump call. Record it. The float is the one device in the station whose failure is invisible until the day it is needed.
Lift Station Backup Control
Read the guide →- Is a second PLC better than floats for backup?
- A second PLC needs a level signal, a program, and a power supply, so it shares more failure modes with the primary than floats do, and it has to be kept in step with every program change. It is the right answer for large stations where backup mode needs real lead/lag and alarming. For a typical duplex station, floats and relays give better independence for far less complexity.
- Can the backup be a dedicated pump controller with its own floats?
- Yes, and packaged float-backup controllers exist for exactly this. Treat them as relay logic in a box: check that they run on control transformer power, that they take over on a watchdog or transfer contact rather than fighting the PLC, and that they stop on a float you can test.
- Should backup mode alternate the pumps?
- It is nice to have and not necessary. Backup mode is a rare state that should end when someone arrives. A relay alternator in the backup path is inexpensive if the panel is being built; adding one to an existing panel is rarely worth the wiring change. Calling both pumps on the backup-start float is acceptable.
- What if the transmitter fails but the PLC is fine?
- That is the more common case, and it is handled in the PLC: the signal validation logic detects the bad signal, alarms it, and the program falls back to running the sequence on the float inputs it already reads. The relay backup is for the case where the PLC itself cannot do that.
Wet Well Level PID Control
Read the guide →- What setpoint should I use?
- Low enough that the well has room above it for a storm before the lag and the high-level float, high enough to keep the pump submerged with margin and, on stations with a large well, high enough that the detention time does not go septic. In practice a setpoint in the lower third of the operating band is common, with the restart setpoint above it and the lag setpoint above that.
- Why does the level oscillate slowly over an hour?
- Too much integral action on an integrating process. Lengthen the reset time substantially or remove integral entirely; the proportional term alone will hold the level within a band, and the well does not need zero offset.
- Should the PID run in the drive?
- It can for a single-pump station, and drive PID controllers work. In a duplex or triplex station with lead/lag and staging, the loop, the floor, the stop and restart, and the staging all belong together in the PLC, where they are visible and consistent.
- How does level PID interact with the floats?
- It does not; the floats are a separate layer. The backup-start and high-level floats call the pumps through the backup relay path and are read by the PLC as inputs; if the level transmitter fails, the program falls back to float operation at a fixed speed. The PID loop is the normal mode, not the safety net.
VFD Pump Control in Wastewater
Read the guide →- Can I run a wastewater pump at 30 Hz to save energy?
- Rarely. At 30 Hz a typical wastewater pump makes a quarter of its rated head and will not open the check valve against the static head of most force mains; where it does, the velocity is too low to carry solids. Set the minimum from the curve and the velocity, and expect it to be much higher than the drive default.
- Why does the pump clog more since the drive was installed?
- Low-speed operation. The impeller runs at a speed where rags wrap easily and the force main velocity lets solids settle. Raise the minimum speed, add a daily full-speed run, and use the drive current to trigger a de-ragging routine or a pull before the well reaches high level.
- Should the drive ramp be slow to prevent water hammer?
- A deceleration ramp of 10 to 30 seconds lets the check valve close gently and the force main column slow down without a surge. Too slow a ramp keeps the pump running below the speed that moves water. Set it for the check valve and the line, and confirm the pump stops moving water only near the end of the ramp.
- Do I need a flow meter for VFD pump control?
- Not for level control, and not for fixed speed. Flow control needs a flow measurement or a calculation from speed and the pump curve. A flow meter on the discharge is worth having at any station large enough for a drive, because it gives the capacity trend and the inflow estimate, but it is not a prerequisite.
Triplex Lift Station Controls
Read the guide →- Should all three pumps be identical?
- Yes, for rotation, spares, and predictable parallel operation. A station with two large pumps and one small jockey is a different design: the jockey is always lead and the large pumps alternate as lag and standby, and the rotation logic handles only two of them.
- How far apart should the three level setpoints be?
- Lead-on above all-off by the cycle volume, lag-on far enough above lead-on that daily peaks never reach it, and the third stage far enough above lag-on that it is reached only in wet weather, with the high-level float above that. In a shallow well the three setpoints get crowded, which is a reason to use run-time and rate-of-rise calls for the second and third stages instead of level alone.
- Why does the third pump rarely run even in storms?
- Either the third stage setpoint is above where the well ever reaches, which may be fine if two pumps handle the peak, or the third pump adds so little on the system curve that the level stops rising before it is called. Check the system curve and the trend from the last event; if the pump was bought for capacity, it may not be delivering it.
- Is a triplex station better than a duplex with bigger pumps?
- A triplex gives finer staging and true redundancy at peak; a duplex with larger pumps is simpler and cheaper. The choice depends on the flow range, the force main, and the consequence of being short at peak. A duplex sized for peak with variable speed pumps often covers the same range with less equipment.
Lift Station Generator Operation
Read the guide →- Why did the station overflow with the generator running?
- Usually one of three things: the generator ran but the transfer switch did not transfer, the pumps restarted together and the set stalled or tripped, or the PLC did not restart the sequence after the power cycle. The transfer position, the generator alarms, and the pump run statuses in the SCADA history show which. Each is found by a load test that was not done.
- How big should the generator be?
- For the running load of the pumps that must operate during an outage, plus the starting inrush of the largest pump with the others running, plus the station auxiliaries, using the generator manufacturer sizing tool with the actual starting method. A soft starter or a drive on the pumps can reduce the set size substantially. Sizing for all pumps starting together is the mistake that oversizes the set, and sizing for running load only is the mistake that stalls it.
- Should the PLC be on a UPS?
- At a station with a permanent generator, yes, sized for the transfer time and the radio, so the utility sees the event as it happens and the program controls the restart. Without a generator, a UPS keeps the alarms and the radio alive long enough to report the outage and the high level, which is the point.
- What is the retransfer delay for?
- A utility restoration is often unstable for the first minutes. The delay keeps the station on the generator until the utility has been steady for a set time, commonly five to thirty minutes, so the station is not transferred back and forth. It is set on the transfer switch and recorded.
Well Pump Control
Read the guide →- Why pump to waste at every start?
- The first water out of a well after the pump has been off carries sand and sediment that settled in the column and the screen, and air from the column. Sending it to the system delivers turbid water and fouls meters and chemical feed. A few minutes to waste, until a turbidity reading or a timer says the water is clear, is standard practice, and some regulators require it.
- How is a low-water cutoff set?
- From the pump setting and the manufacturer minimum submergence: the pump intake depth, plus the submergence required for cooling and to prevent vortexing, is the cutoff level. The transducer or probe is placed there, with a restart level enough above it that the well has recovered before the pump runs again.
- Should a well pump be on a drive?
- When the well is the source for a process that needs a controlled flow, or when pressure must be held without a large tank, yes. For a well that fills a tank, a drive adds cost and heat for little benefit, and a submersible at reduced speed can lose the cooling flow past its motor. Fixed speed with a soft starter for the column surge is common.
- What does a falling current with normal flow mean?
- Usually a worn pump: the impellers and bowls have lost clearance, the pump does less work at the same speed, and the flow will follow the current down. A sudden drop with no flow is a broken shaft or a dropped pump. Compare with the baseline and the flow.
Booster Pump Stations
Read the guide →- Why does the station keep tripping on low suction in the evening?
- The lower zone cannot supply the station and its own customers at evening peak. The cutoff is doing its job. The fix is a larger main to the station, a tank on the suction side, a suction pressure limiting mode that reduces output rather than stopping, or a schedule that fills the upper zone tank before the peak.
- Where should the discharge pressure transmitter be?
- Downstream of the check valves and the station discharge valve, on the main leaving the station, so it reads what the zone sees and is not affected by which pump is running. A transmitter on an individual pump discharge reads that pump and confuses the staging.
- Can the booster be controlled on the upper zone tank level instead of pressure?
- Where the upper zone has a tank, the tank level is the natural outer loop: the station runs to fill the tank and the tank holds the zone pressure. Pressure control at the station is then a limit rather than the primary loop. Where there is no tank, pressure at the station is the only variable available.
- How is the low suction cutoff tested?
- At commissioning, by throttling the suction valve slowly with the pumps running until the transmitter reaches the cutoff, and confirming the pumps stop after the delay and restart after recovery. The transmitter is calibrated against a gauge first. The test is repeated on a schedule, because a bypassed cutoff is invisible until the day it matters.
Elevated Tank Control
Read the guide →- How full should the tank be kept?
- In the operating band, which is chosen for pressure, fire reserve, and turnover, not as full as possible. A tank held near the top has the best pressure and the worst water age. Most utilities cycle through a band of several feet daily and set the band seasonally.
- Why does the zone pressure swing through the day?
- Because the tank level swings through the operating band, and pressure is level. A deep band gives a wide swing. If the swing is objectionable, the band is shallower, at the cost of turnover, or the zone gets a pressure-regulating arrangement for the affected customers.
- What happens to the zone when the telemetry fails?
- Whatever the fallback in the control narrative says. The pump station cannot see the tank, and it runs a defined program: a time-based schedule sized to average demand, control on its own discharge pressure with limits that approximate the tank band, or hold the last state for a limited time and alarm. The altitude valve and the high-level float protect the tank from overflow while the fallback runs.
- Can the tank level be used to detect a main break?
- Yes, and it is one of the better uses of the trend. A level that falls faster than the demand history at that hour, while the pumps run as usual, is water leaving the zone somewhere. A rate-of-fall alarm on the tank level, compared with a demand profile, catches large breaks before the phones ring.
Disinfection Control
Read the guide →- Why is the residual loop so slow to correct?
- The contact tank. A dose change at the injection point reaches the outlet analyzer after the hydraulic residence time, which may be 30 minutes or more, and the loop cannot respond to what it has not seen. The feedforward on flow does the fast work; the residual loop adjusts the dose over hours. Tuning it faster produces a slow oscillation of the residual through the day.
- What residual should we target at the point of entry?
- Enough to satisfy the CT requirement at the contact tank outlet under the worst expected temperature and flow, plus enough to carry a detectable residual to the far end of distribution, and below the level that forms excessive disinfection byproducts or draws taste complaints. The utility sets it with its regulator; the control system holds it and records it.
- Should the dose be controlled on the point-of-entry residual or the contact tank outlet residual?
- The contact tank outlet residual is the CT measurement and the primary control point. The point-of-entry residual is the compliance measurement for distribution and may be trimmed by a second, downstream feed point where the plant has one. Controlling the single feed on the point-of-entry residual alone adds the clearwell residence time to the loop dead time and makes it worse.
- How do we handle hypochlorite strength decay in the dose calculation?
- Measure the strength when a delivery arrives and periodically after, enter it as a parameter, and let the controller compute the feed rate from the dose and the current strength. A controller that assumes 12.5 percent from a tank that has decayed to 9 percent under-doses by a quarter, and the residual loop chases it until it runs out of range.
Aeration Control
Read the guide →- What DO setpoint should the zones run?
- Whatever the process engineer and the operators set for the treatment objective: commonly around 2 mg/L in a conventional nitrifying basin, lower at the end of the aerobic zone, near zero in anoxic zones. The control system holds and trims it; it does not choose it. Ammonia-based control lets the setpoint float within limits the operators set.
- Why does the header pressure keep hunting?
- The most-open-valve routine and the pressure loop are fighting, usually because the routine moves the setpoint too often or too far, or because the pressure loop is tuned too fast for the blower response. Slow the routine: small setpoint steps, long intervals, a deadband on the valve position target. Tune the pressure loop for the blower, not for the header.
- Can I do aeration control without airflow meters?
- DO directly to the valve position works on a single-zone basin and poorly on several zones sharing a header, because a valve move in one zone changes the pressure and the air to the others. Airflow meters make the zones independent. They are the instrument most often left out to save money and most often added later.
- How much energy will aeration control save?
- Plants moving from fixed blower output to DO cascade control commonly report 25 to 40 percent blower energy reduction, and ammonia-based control adds to it. The number depends on how far the load varies from the design and how much the blowers can turn down. A plant with blowers that cannot turn down below 60 percent saves less until the blowers are addressed.
Headworks Control
Read the guide →- Why does the screen cycle constantly at night?
- The differential setpoint is too close to the head loss of a clean screen at low flow, the downstream level sensor is reading low, or debris is hanging on the face and never clearing. Check the two level sensors against a tape, raise the differential setpoint a little, and inspect the screen face and the rake.
- How is the influent flume checked?
- The head measurement is compared with a staff gauge at the measuring point on a schedule, and the flume dimensions are checked against the standard when there is any doubt. An independent flow measurement, such as a mag meter on the influent pump discharge or the effluent flow adjusted for plant use, gives a daily cross-check.
- What runs the grit pump when the flow meter fails?
- The schedule. Grit pumping on a fixed interval is the fallback for the flow-paced mode, and the program falls back automatically when the flow signal is invalid, with an alarm. The classifier follows the pump.
- Can the headworks panels be inside the building?
- Only if the room is unclassified or the panels are rated for the classification. The usual design puts the panels in an electrical room outside the classified boundary with intrinsically safe barriers or rated wiring methods for the instruments inside it. NFPA 820 and the electrical engineer set the boundary.
Clarifier Control
Read the guide →- How deep should the sludge blanket be?
- Deep enough to withdraw concentrated sludge and shallow enough that solids never approach the weir; typical targets are a foot or two in a primary and a few feet in a secondary, well below the mid-depth of the tank, and the operators set it for the plant. The sensor and the trend let the operator see where the blanket is and hold it there.
- Why does the torque alarm come in every morning?
- The blanket has built overnight while the withdrawal was on its night schedule, or the mechanism is starting to drag on something. Trend the torque with the blanket level: if the torque follows the blanket, increase overnight withdrawal; if it rises independently, inspect the mechanism.
- Can a clarifier run with the mechanism stopped?
- For a short time, with sludge accumulating and no scum removal. A mechanism stopped for more than a few hours lets sludge settle into a mass the drive cannot move when it restarts, which is how mechanisms are broken. A stopped mechanism is an alarm that brings someone in.
- One blanket sensor or several?
- One per clarifier, on a sweep-clear mount, is the minimum that gives control. A second at a different radius shows whether the blanket is level or piled at the center, which matters on large tanks. A plant with no blanket sensor is operating its clarifiers on a core sampler and a guess.
RAS and WAS Control
Read the guide →- What RAS rate should we run?
- The process engineer sets it from the settling characteristics and the clarifier design, typically 50 to 100 percent of influent flow, sometimes higher during poor settling. The control system holds the ratio the operators set and shows the blanket that results.
- Why is the WAS calculation different from what the lab computes?
- The inputs: the online solids sensor and the lab sample rarely agree exactly, and the calculation is sensitive to the WAS concentration. The controller calculation uses the values it is given, and the daily review compares them with the lab. When they diverge, the sensor is checked and the lab value is entered.
- Can WAS be automated fully?
- The calculation and the daily adjustment can, with the target SRT set by the operator and limits on the rate of change. Most plants keep the operator in the loop for the daily review, because the process changes in ways the calculation does not see: a temperature drop, a toxic slug, a change in the influent character. Full automation with limits and a daily report is reasonable at a plant with reliable online solids measurement.
- What happens to RAS control when the influent flow meter fails?
- The ratio has no basis and the controller falls back to a constant RAS flow at the last good value, with an alarm. The blanket trim continues if the blanket sensors are healthy. The influent meter is also the compliance flow, so its failure is already a high priority alarm.
Raw Water
Read the guide →- Should the raw water flow follow the clearwell level automatically?
- It can, with a slow controller and a ramp limit, and many plants do it. Others prefer the operator to set the rate for the shift so that the process is deliberately steady and the clearwell is allowed to swing. Either works; what does not work is a fast level loop that changes production every few minutes.
- What is the earliest warning of a raw water quality event?
- Usually turbidity rate of change, followed by conductivity for a source change and pH for an algae bloom. Upstream gauges and weather feeds, where available, come earlier still. Alarm on the rate and trend everything.
- How much straight run does the raw water magnetic meter need?
- The manufacturer figure, commonly five diameters upstream and two or three downstream, measured from the pump discharge or the nearest valve, and more after a pump. The raw water meter is the most important meter in the plant; give it a good installation and verify it against a clamp-on meter once a year.
- What happens to chemical feed when the raw water pumps stop?
- Every flow-paced feed should go to zero with the flow, and the feed pumps should be interlocked so that they cannot run without water flow. A feed pump that keeps dosing into a stopped pipe delivers a slug when flow resumes.
Wells
Read the guide →- How long should a well pump to waste?
- Long enough for the water to clear, which depends on the well. Many systems use a fixed time of a few minutes set from experience; a turbidity instrument makes it a measured condition and lets the time shrink for good wells. The permit or the state guidance may specify a minimum.
- Why rotate wells rather than always run the best one?
- Running one well continuously draws the aquifer down locally, wears one pump, and leaves the others idle where their pumps and screens deteriorate. Rotation shares the load and keeps every well proven. Priority within the rotation can still favor the best water or the lowest cost.
- What does a sudden drop in specific capacity mean?
- A change in the well or the pump rather than the aquifer, which changes slowly: a plugged screen, a broken column pipe or a failed check valve, a worn impeller, or a level transmitter that has moved. Compare flow, current, and pressure with the previous run; a broken column shows normal current and low flow.
- Can a drive be used on a well pump?
- Yes, where flow must be matched to demand or blended, and with attention to the motor and cable, since submersible motors have minimum speed and cooling requirements. Most wells run at full speed into storage, where a drive adds cost without benefit.
Aeration
Read the guide →- Is aeration enough to remove iron and manganese?
- For iron in most groundwater, aeration followed by detention and filtration works. Manganese oxidizes slowly with air unless the pH is high, and most plants use permanganate, chlorine, or a catalytic filter media to finish it. Aeration is the first step, not the whole process.
- How much does aeration raise pH?
- It depends on how much carbon dioxide the water carried; groundwater with a pH of 6.5 from dissolved carbon dioxide can come out of an aerator near 7.5 or higher. Measure it after the aerator and treat the aerated pH as the starting point for corrosion control.
- What is the off-gas concern on a stripper?
- Whatever was stripped is now in the air: hydrogen sulfide is an odor and a corrosion problem near the tower, radon and volatile organics may be regulated in the discharge, and methane is a safety issue in enclosed spaces. The air permit and the site layout decide whether the off-gas needs treatment or just a stack.
- Can a stripper run at reduced water flow?
- Yes, within the turndown of the packing and the distributor, with the air flow reduced to hold the ratio. Below the minimum wetting rate the packing channels and treatment falls off; the manufacturer gives the minimum, and the flow controller should not go below it.
Filtration
Read the guide →- Why filter to waste after a backwash?
- A freshly washed bed passes particles for the first minutes until it ripens, and the effluent turbidity spike after a wash is often the highest turbidity a filter produces all run. Sending that water to waste until the turbidimeter shows it has cleared keeps the spike out of the clearwell and out of the compliance record.
- What is unit filter run volume and why track it?
- The volume of water filtered per square foot of filter area between washes. It combines rate and run length into one number that says how productive a run was, and a falling value over months means the media, the coagulation, or the wash is deteriorating. Compute it from the flow total and the area at each wash and trend it.
- Can two filters wash at once?
- Usually not: the wash water supply and the waste handling are sized for one, and two filters out at once overloads the rest. The sequence permissive checks that no other wash is in progress and queues requests. A plant designed for two simultaneous washes says so in the functional description.
- How is head loss measured on a filter?
- With a differential pressure transmitter between the water above the media and the effluent below it, or by subtracting a pressure below the underdrain from the level above the bed. Either way it is the drop across the media, in feet of water, and it should read near the clean bed value right after a wash; a higher reading after a wash means the wash was inadequate or the taps are plugged.
Chemical Feed
Read the guide →- Why pace from flow rather than control from the residual alone?
- Because the residual is measured downstream after a delay, and a controller that waits for the residual to move reacts late and overshoots. Flow pacing changes the feed the instant the flow changes; the residual loop then corrects slowly for demand changes. Residual-only control oscillates in most plants.
- How do I know the pump is delivering what the controller thinks?
- Drawdown test with a calibration column: isolate the day tank, let the pump draw from the column for a timed interval, and compute the output. Compare with the expected rate at that speed and stroke. Do it weekly for critical chemicals and after any repair, and record the results; the trend catches wear before the residual does.
- What should the feed do if the flowmeter fails?
- Hold a fallback: the last good feed rate, or a rate computed from a fixed assumed flow, with an alarm. Pacing from a failed signal reading zero stops disinfection; pacing from a failed signal reading full scale overdoses. Signal validation on the pacing flow is part of every feed loop.
- Stroke or speed control on a diaphragm pump?
- Speed for the automatic control, because it is linear and repeatable over a wide range. Set the stroke length so that the pump runs in the middle of its speed range at the normal dose, and leave it. Pumps controlled by stroke with a positioner exist, but speed control is simpler and more accurate.
Finished Water Storage
Read the guide →- Why does the high service pump cutoff level seem high?
- Because it is set for contact time, not for pump suction. The level below which the clearwell cannot deliver the required contact time at the pumping rate is often several feet above the level where the pumps would lose suction. The cutoff is a compliance setting, and raising the pumping rate raises it.
- How is the baffling factor determined?
- By a tracer study, in which a tracer is injected at the inlet and its arrival at the outlet is measured to find the time for ten percent to pass, or by the regulatory default for the tank geometry, which is conservative. A tracer study usually earns a higher factor and more credit, and it has to be repeated if the tank is modified.
- Should the clearwell be kept as full as possible?
- For contact time, yes; for buffering and water age, no. Most plants run in a band in the upper part of the tank that keeps contact time comfortable and still cycles the level daily so that the water turns over. The band is a setpoint pair on the HMI, chosen from the contact time calculation and the daily demand pattern.
- What happens if the level transmitter fails?
- The contact time calculation, the production controller, and the pump cutoff all lose their input. Validate the signal, provide a second level measurement or backup floats at the critical levels, and define the fallback: production holds its last setpoint and the pumps continue only if a backup low-level switch is satisfied.
High Service Pumping
Read the guide →- Why not control high service pumps from the clearwell level?
- Because the clearwell level says how much water the plant has, not how much the system needs. Pumping down the clearwell when the distribution tanks are full raises pressures and wastes energy; the pumps follow the system, and the clearwell level adjusts production instead. The clearwell only limits the pumps at its low level.
- How should a station with both a drive and constant speed pumps be run?
- The drive pump leads and holds the pressure or flow; the constant speed pumps stage in when the drive has been at maximum for a time and out when it has been at minimum. The drive then absorbs the difference between the fixed pump output and the demand. With alternation, the drive pump is usually kept as lead and the others alternate as lag.
- What is a reasonable pump control valve timing?
- Whatever the surge analysis says for the main, commonly tens of seconds to a couple of minutes of closing time before the pump stops. The valve opens after the pump reaches speed and closes before it stops, with the pump stop interlocked to the valve closed limit or a timer if the limit fails. The values are setpoints on the HMI, chosen by the engineer, not by trial.
- Does off-peak filling risk water quality?
- It can, if the tanks are held full for long periods or the schedule leaves them stagnant. Water age rises and residual falls. Set the schedule to cycle the tanks daily, monitor the residual at the tank, and let water quality override the energy schedule when it must.
High Service Pumps
Read the guide →- Will a drive on the high service pump save energy?
- It depends on the head. On a system where most of the head is friction, a drive saves a great deal by matching flow to demand at low speed. On a system pumping into a tank with a high static head, the pump has to run near full speed to deliver anything and the drive saves little beyond the soft start. Draw the system curve and decide from it.
- How low can a drive pump run?
- Down to the speed at which its shutoff head equals the static head, plus a margin so it actually delivers flow, and in any case above the minimum the motor and pump need for cooling and lubrication. On a high static head system that minimum can be 80 or 90 percent of full speed; the drive is then a soft starter with a narrow control range.
- Why does the small pump in the station never seem to move water when the big one runs?
- Because the big pump raises the system head above the small pump shutoff head, and the small pump is pushed off its curve. That combination should not run; the staging logic should either run the small pump alone or the big one alone, or the small pump needs to be replaced with a match.
- What total head should I use for the efficiency calculation?
- Discharge pressure minus suction pressure, converted to feet, corrected for the elevation difference between the two gauges and, where the suction and discharge pipes are different sizes, the difference in velocity head. Use the same taps every time so the trend is consistent.
VFD Control for Water Pumping
Read the guide →- Why does the pump vibrate and heat up at low speed?
- Below the minimum speed the pump makes little or no flow and churns the water in its casing, heating it and running off its curve. Raise the minimum speed setting to where the pump delivers flow, and stop the pump instead of running it below that.
- Should every pump have a drive?
- Not necessarily. One drive pump for trimming with constant speed pumps for base load is a common and economical arrangement where the drive pump can cover the gaps between stages. Every pump on a drive gives the most flexibility and the most equipment.
- How much energy will a drive save on a well?
- Often little, because a well pump lifts against a large static head and must run near full speed. The drive earns its place on a well by soft starting, by trimming flow to a treatment rate, and by reducing water hammer, not by energy.
- Can I retrofit a drive on an existing motor?
- Often, with the motor checked for insulation class and bearing protection, the cable length considered, and a filter added if needed. Older motors and long cable runs are the cases that fail; the motor manufacturer guidance and a drive vendor review settle it.
Flow Control in Water Pumping
Read the guide →- The flow oscillates a few percent all the time.
- Too much controller gain for the loop, a noisy meter feeding it, or a drive speed reference with a coarse resolution. Reduce the gain, check the meter installation, and look at the drive reference scaling.
- Can I control flow with a valve and a drive together?
- Only with a defined split, such as the drive holding the flow and the valve fixed, or the valve holding a pressure while the drive holds flow. Two controllers on one flow fight.
- How do I split flow between three filter trains?
- A total flow setpoint divided by the trains in service, each train with its own flow loop on its own valve or feed, and the split adjusted by capacity or by run time. A train going into backwash drops out and the others pick up its share on the next calculation.
- What ramp rate should I use?
- Slow enough that the pressure at the far end of the main does not swing beyond a few psi on a setpoint change: tens of seconds from minimum to maximum on a short main, minutes on a long one. The surge analysis, if one exists, states it.
Ground Storage Tanks
Read the guide →- Where should the fill sources get the level from?
- From the tank transmitter over telemetry for normal control, with a local backup at the source if the link can fail: a pressure transmitter on the source discharge that infers the tank level, or a timed fill with limits. The narrative states the behavior on communication loss.
- How deep should the level cycle be?
- Deep enough to turn the water over in a few days while keeping enough storage for fire flow and outages: the two constraints set the band, and the residual at the outlet says whether the cycle is deep enough.
- The tank overflowed with no high level alarm.
- The primary transmitter failed high or was stuck, and there was no independent high level switch, or the switch was there and not alarmed. Add the independent switch, alarm it, and add a rate-of-change and stale-value check on the primary.
- Can the same level control the wells and the high service pumps?
- Yes: the wells fill on the upper bands and the high service pumps are protected by the lower ones, and both read the same transmitter with the independent switch as the safety. The bands are separated so that the two functions never fight.
Pump Sequencing for Storage
Read the guide →- How many sources should run at once?
- As many as the level band calls for, limited by what the electrical system and the treatment can take; the design states the maximum and the sequence enforces it. Running one source longer beats running three sources in short cycles.
- Should wells alternate or should the best well lead?
- Both can be true: rotate for exercise and drawdown recovery, and weight the rotation toward the well with the best quality or lowest cost. A well never run is a well with a surprise in it.
- The tank never reaches the off level in summer.
- The sources cannot keep up with demand at the pumping hours allowed. Extend the schedule window, add a source to the stage, check that every source is actually producing its rated flow, and look at the demand for leaks or unusual users.
- Where does the sequence live, in the tank site controller or the source controllers?
- Usually in one controller with the level, the tank site or the plant, which sends run commands to the sources; each source keeps local protection and a fallback. A sequence split across several controllers with no master is hard to reason about.
Reverse Osmosis
Read the guide →- Why normalize instead of alarming on the raw pressure?
- Because the raw pressure rises in winter as the water gets colder and the membranes tighten, with no fouling at all. Normalized values remove the temperature and pressure effects and leave the membrane condition. Alarming on raw values produces cleaning in January and missed fouling in July.
- What sets the recovery?
- The scaling potential of the concentrate: as recovery rises, the concentrate becomes more saturated in sparingly soluble salts, and the antiscalant and pH control have limits. The membrane supplier projection sets the design recovery, and the controls hold it.
- How often should a skid be cleaned?
- When the normalized trends cross their limits, which on a well-pretreated brackish water may be a few times a year and on a difficult water monthly. Cleaning on a calendar cleans too early or too late.
- Can the skid run at reduced flow?
- Within the element limits: a minimum concentrate flow per vessel to avoid scaling and a minimum flux to keep the elements clean. The turndown is stated in the design; below it the skid stops rather than idling.
Nanofiltration
Read the guide →- Why nanofiltration instead of lime softening?
- It removes organics and color as well as hardness, produces no lime sludge, and is easier to automate; it costs energy, membranes, chemicals, and a concentrate to dispose of. The choice is a treatment study; the controls are simpler for the membrane plant.
- The last stage differential pressure keeps rising.
- Scaling on the last elements, where the concentrate is most saturated. Check the antiscalant dose and the feed pH against the design, verify the recovery is not above design, and clean at low pH.
- How aggressive is the permeate?
- Aggressive enough to corrode iron and copper and to leach lead from old fittings; the stabilization section is not optional. The corrosion index of the finished water is a control target with limits.
- Can a reverse osmosis skid be converted to nanofiltration?
- The vessels and much of the piping are the same; the elements, the pump sizing, the recovery, and the chemical program change. The membrane supplier projection for the new elements decides the operating point.
Membrane Control
Read the guide →- Why compute normalization in the controller?
- So that the trend is continuous, the cleaning trigger is an alarm, and the calculation is done the same way every time by something that does not go on vacation. The spreadsheet remains a check.
- How should the recovery loop be tuned?
- Slowly. The concentrate valve loop interacts with the permeate flow loop, and a fast recovery loop makes both oscillate. Tune the flow loop first with the valve fixed, then the recovery loop slowly enough that the flow loop settles between its moves.
- What happens when the oxidant analyzer fails?
- The train stops. The membranes are the most expensive part of the plant and chlorine destroys them in hours; an analyzer fault is treated as chlorine present until proven otherwise. A redundant analyzer is the way to avoid nuisance stops.
- Can operators change the recovery?
- Within limits set from the membrane projection, with the change logged and the antiscalant and pH programs checked. A recovery above the projection scales the last stage within weeks.
Clean-in-Place
Read the guide →- Low pH or high pH first?
- What the foulant is decides: scale needs acid, organics need caustic, and where both are present the supplier usually recommends the high pH clean first so that the acid is not consumed by organics, then low pH. A wrong order wastes a cleaning; the trends and a sample of the foulant guide it.
- The normalized flow did not recover after cleaning.
- The wrong solution, too short a soak, too low a temperature, or a foulant that cleaning does not remove, such as silica or an oxidized membrane. Try the other solution with a longer soak, and if the flow still does not recover, probe the vessels and consider element replacement.
- Can cleaning damage the membranes?
- Yes: too high a temperature, pH outside the range, too high a pressure, or an incompatible chemical. The limits are in the element data sheet, and the controller enforces them so that a mistake at the chemical drum does not become a set of ruined elements.
- How long does a cleaning take?
- Several hours to most of a day for a train, longer for both solutions and heavy fouling. The plant design keeps enough trains that one can be out for a day without losing production.
Membrane Feed Pumps
Read the guide →- Why a drive instead of a throttling valve on the feed?
- A throttling valve on a high-pressure pump wastes most of the power and cannot ramp the pressure gently. The drive gives the ramp, the flow control, the soft start, and the energy saving; on a membrane plant it is not a luxury.
- What suction pressure do I need?
- Enough to keep the pump above its net positive suction head requirement at the maximum flow and temperature, after the cartridge filters at their dirty differential. The transfer pump or the feed system provides it, and the low suction trip is set with margin above the requirement.
- The drive trips on overcurrent during the ramp.
- The ramp is too fast for the current limit, the concentrate valve is too closed at start so the pump sees high pressure early, or the pump is starting into a water-hammer condition. Slow the ramp, sequence the valve, and check the suction.
- Should the feed pump be on the standby generator?
- Only if the plant must produce during an outage and the generator can carry the pump and its inrush; the ramp helps. Otherwise the train shuts down safely on power loss and flushes when power returns, and the storage carries the demand.
Concentrate Systems
Read the guide →- Why is the concentrate valve so hard on itself?
- It drops the full membrane pressure to near atmospheric in one step, which cavitates and erodes an ordinary valve. Severe-service trim, staged pressure drop, or a valve plus an orifice are the answers, and the valve is on the maintenance schedule regardless.
- Can I discharge the concentrate to the plant drain?
- Only where the permit or the sewer agreement allows the flow and the salinity, which is rare for a plant of any size. The concentrate is a regulated discharge whatever pipe it enters.
- The annulus pressure on the injection well is slowly falling.
- A leak in the tubing or the packer, a temperature effect, or a slow loss through the annulus system. It is reported to the regulator per the permit and investigated with a mechanical integrity test; injection may have to stop. Never top up the annulus to hide the trend.
- How much concentrate storage do I need?
- Enough to ride through the longest expected disposal outage at full production, or to allow steady injection through train starts and stops, whichever is larger. The tank has level control, overflow alarms, and its own permit conditions.
Lift Station SCADA
Read the guide →- How many signals is too many for a radio site?
- A packed block of a few dozen words carries everything above in one poll; the constraint is the poll cycle across all sites, not the size of one. Bring back what describes the station and pack it well.
- Should operators be able to start a pump from SCADA?
- A supervised start with a timeout, for testing, is reasonable at a station where the risk is understood; a continuous remote hand mode is not. The station must always return itself to automatic.
- Radio or cellular for a new station?
- Radio where the utility owns a system with a path to the site and no recurring cost; cellular where coverage is good, the site is beyond the radio system, and the security design is in place. Many utilities use cellular as the second path at critical stations.
- Why does the station show a communication alarm every night?
- A path that loses margin at night, from temperature inversion on a radio path or from carrier congestion on cellular, or a poll timeout set too short for the night conditions. The retry statistics by time of day name it.
Biological Treatment
Read the guide →- Can wasting be automated?
- The execution can: a waste pump run on a schedule to a computed daily volume from the sludge age target and the measured solids, with the total displayed and the operator approving the target. Many plants do it; the target remains a human decision.
- What ends the react phase in a sequencing batch reactor?
- A timer in simple designs; an ammonia or dissolved oxygen profile in advanced ones, which ends the phase when nitrification is complete and saves aeration. The timer stays as the limit.
- How many dissolved oxygen probes does a basin need?
- One per zone that has its own air control, placed where the reading represents the zone, usually toward the end of it. Two probes in one zone give a check on each other at the cost of a second probe to clean.
- Why does the ammonia rise every morning?
- The morning load arrives faster than the aeration control ramps, or the dissolved oxygen setpoint is too low for the peak, or the sludge age is at the edge of what nitrification needs in the current temperature. The trend against the influent flow says which.
Chemical Systems in Wastewater Treatment
Read the guide →- Flow pacing or feedback for hypochlorite?
- Both: flow pacing follows the diurnal flow at once, and a residual analyzer trim corrects the dose slowly for demand changes. Feedback alone hunts through the contact time lag; flow pacing alone drifts with demand.
- How often should metering pumps be verified?
- At commissioning, after any maintenance, and on a schedule that the drift record sets, monthly for most and weekly for the permit-critical feeds. A pump display is a setting, not a measurement.
- What interlocks does a methanol feed need?
- Feed only with plant flow and with the nitrate load calling for it, a leak and vapor detection system in the storage and feed area with ventilation, classified electrical equipment, a low tank cutoff, a discharge pressure limit, and a shutdown on fire alarm. The fire code and the insurer have opinions; read them.
- Why did the phosphorus rise with the coagulant feed running?
- The feed was running and not delivering: a leaking pump, a plugged line, an off-gassed suction, or a strength change; or the dose was right for a lower load. Flow verification on the feed and a phosphate analyzer trend beside the feed rate find it.
Effluent Disinfection
Read the guide →- ORP or a residual analyzer for dechlorination?
- A low-range residual analyzer gives a number the permit understands and drifts less at the endpoint; ORP is cheaper, faster, and sensitive at the knee but reads a condition rather than a concentration. Many plants control on ORP or feed-forward and prove with the residual analyzer at the outfall.
- How much contact time do I need?
- What the permit or the design states, often on the order of fifteen to thirty minutes at peak flow for a given residual; the calculated contact time with the baffling factor is displayed and alarmed so that the operator sees it fall at peak flow.
- The ultraviolet dose falls every afternoon.
- Transmittance falls with an afternoon load, or flow rises past the staged banks, or the sleeves foul during the day. The transmittance and flow trends against the dose name it; the cure is earlier bank staging, a transmittance excursion investigation upstream, or a cleaning interval.
- Can I run ultraviolet at a fixed number of banks?
- At the cost of energy and lamp life at low flow, and of dose at high flow. Flow-paced staging with a margin is the standard; a fixed configuration is a fallback when the flowmeter or the transmittance analyzer fails.
Effluent
Read the guide →- Can the online analyzer value be reported instead of the laboratory sample?
- Only where the permit says so for that parameter and the analyzer is an approved method with the required verification. Most permits take laboratory results on composite samples for the limits and use online values as evidence and warning.
- The flume reading and the magnetic meter downstream disagree by 8 percent.
- One of them is wrong: the flume level sensor datum or a submerged flume, or the magnetic meter installation. Verify the flume level against the staff gauge and the flume dimensions, and the meter against a volumetric check; the permit meter is the one that must be right.
- What happens to the report when the historian was down for a day?
- The day is reported from whatever record exists, the paper log or the sampler, and the gap is documented with the reason. Then the historian gets a buffered collector so that it does not happen twice.
- Who should get the effluent alarms?
- The operator on duty at the plant and, for the ones with regulatory consequence, the on-call supervisor through the callout system, with escalation. The alarm philosophy lists them by priority.
Residuals
Read the guide →- Can polymer dosing be closed-loop?
- Partly: the dose is paced to dry solids automatically, and some plants trim it on centrate turbidity or a charge analyzer. Cake solids from the laboratory remain the final judge, and the operator adjusts the pounds per dry ton against them.
- Why is the digester gas production falling?
- Less feed, a temperature drop, a toxic load, or an acid buildup; the temperature and feed trends and the laboratory volatile acids and alkalinity say which. Falling gas with rising carbon dioxide and falling pH is an upset that needs feed reduction and possibly alkalinity addition.
- How do I know the thickener is working?
- Underflow concentration from the solids probe against the target, overflow suspended solids, and the blanket level; polymer per dry ton for a conditioned thickener. A rising overflow solids and a falling underflow concentration is a loaded or upset thickener.
- What should be on the generator in the residuals area?
- The digester gas safety systems, the ventilation, the flare, the heating circulation where a temperature drop would matter, and the gas detection. Dewatering can usually wait; the digester cannot be left without its safety systems.
Constant Speed Pump Control
Read the guide →- How low should the off level be?
- At the minimum submergence the pump manufacturer specifies for continuous operation, so the pump does not draw air or lose cooling; a periodic skim cycle goes lower for a short time under supervision of the logic.
- The pumps start ten times an hour on a rainy day.
- The inflow is near half the pump capacity, which is the worst case, and the cycle volume is too small for it. Widen the band between off and lead-on if the well allows, or accept the starts for the duration if they are within the rating and rare.
- Should the lag pump start on level or on time?
- On level; time is a proxy that guesses. The lag band is set so that the lag comes in when the lead is genuinely not keeping up, and a lead that fails to start promotes the lag immediately regardless of level.
- Do I need a soft starter on a 10 horsepower submersible?
- Usually not for the motor or the service; possibly for the force main if it is long and the check valve slams. The surge symptoms, a banging valve and a pressure spike on the gauge at stop, decide.
Station Flow Control
Read the guide →- Does a flow cap require a drive?
- A smooth cap does; a constant speed station can only limit the number of pumps running, which caps the flow in steps. Many wet weather plans use the pump-count limit at small stations and drives at the large ones.
- How accurate is a flow estimate from the pump curve?
- Within ten to twenty percent when the curve is current and the pressure is measured, worse as the pump wears. It serves a cap with margin and a trend; it does not serve a permit report.
- What happens when the plant sends a cap and the link drops?
- The station holds the cap for a set time, then reverts to its level bands with an alarm at both ends. The time is chosen so that a short outage does not disturb the plan and a long one does not flood the well.
- Can the wet well be used as storage safely?
- Within the margin between the normal high level and the overflow, for the duration the inflow allows, with the high level alarm as the release. The plan quantifies it per station; a station with little margin is not a storage site.
Pump Sequencing Strategies
Read the guide →- How often should a scouring run happen?
- When the computed main velocity has been below the scouring value for a set period, often a few hours, or on a fixed interval where the flow is not computed. A main that is scoured on every pump-down cycle needs no separate routine.
- Is reversing a pump to clear rags safe?
- Only where the pump and drive manufacturers allow it, with a short duration and a limited number of attempts; many submersibles must not be reversed. Where it is not allowed, a stop and restart sequence often clears the impeller, and the current trend decides whether it worked.
- Can the skim cycle run automatically at night?
- Yes, on a schedule, with the level signal validated, the minimum submergence as the end point, a time limit, and a current rise as an abort. It is a routine that must be able to stop itself; a pump that runs dry because a skim cycle lost its level signal is the failure to design against.
- Should a drive station ever run at full speed?
- Regularly: for scouring, for the skim cycle, and whenever the inflow demands it. A drive station that never runs at full speed has a settling force main and a ragging pump within a season.
IEC 62443
Read the guide →- Do I have to buy the standards to use them?
- To cite specific requirement numbers in a contract or an assessment, yes, the relevant parts should be purchased. To apply the concepts, the freely available quick-start guides and summaries from ISA and the agencies cover zones, conduits, levels, and the foundational requirements well enough to start.
- What security level should a water utility target?
- SL 2 for the control zones is the common answer, meaning the system should resist an opportunistic attacker using public tools. A large utility with a specific threat profile may target SL 3 for its most critical zone. SL 4 across a whole system is neither achievable nor necessary for almost anyone.
- Is 62443 compliance a thing I can claim?
- A system can be assessed against 3-3 at a target level, and a product can be certified against 4-2. Claiming that a utility is 62443 compliant without saying which parts, which zones, and which level is a marketing statement rather than a technical one.
- How does 62443 relate to the Purdue model?
- Purdue is a reference architecture that describes levels of a control hierarchy. 62443 uses it as the starting shape for zoning but does not require it. The zones and conduits model is more flexible and is what 62443 actually assesses.
Zones and Conduits
Read the guide →- How many zones is too many?
- A zone should have a reason to exist: a distinct requirement, a distinct location, or a distinct owner. If two zones have identical requirements and share an enforcement point, merge them. Utilities typically end with a handful of plant zones plus one per remote site, which sounds like many, but each site zone is the same template.
- Can a VLAN be a zone boundary?
- A VLAN separates traffic; it does not enforce a requirement unless something between the VLANs filters traffic. A VLAN boundary with a firewall or an access list at the inter-VLAN router is an enforceable zone boundary. A VLAN alone is an organizational convenience.
- What security level do conduits get?
- A conduit inherits the requirements of the zones it connects and needs enough protection to keep the higher-level zone at its level. A conduit between an SL 2 zone and the enterprise needs enforcement that resists an SL 2 attacker coming from the enterprise side.
- Who maintains the zone drawing?
- The same person or group that owns the control network configuration, and it is reviewed whenever a device is added, a firewall rule changes, or a vendor connection is installed. It belongs with the network drawing and the asset inventory as one set of documents that describe the same system.
Vendor Remote Access
Read the guide →- The vendor says their remote tool is secure. Is that enough?
- The tool may well be secure. The question is whether the utility controls the session: who connects, when, to what, with what record. A secure tool that the vendor can use at any time without the utility knowing fails on every one of those. Use the vendor tool if it fits, but only through the utility jump host and the utility switch.
- How do we handle an emergency at 2 a.m. when no one is at the plant?
- The on-call operator enables the access remotely through the same path that operators use, which is itself MFA-protected and logged. An emergency is the case where a recorded session matters most, not the case where the controls are skipped.
- Should the integrator have a permanent account?
- A permanent named account with MFA that is disabled between sessions is reasonable and avoids re-provisioning every time. Permanent access, meaning the account can connect at any time without the utility enabling it, is not.
- What about the vendor connecting on site with their laptop?
- On-site access still goes through the utility. The vendor laptop connects to a designated engineering port or to the jump host, not to an arbitrary control switch, and the same logging applies. A laptop that has been on other customer networks is not less risky because its owner is standing in the room.
Controller Hardening
Read the guide →- Does hardening risk breaking the process?
- Some measures do, which is why each one is tested. Disabling a service that the HMI was quietly using, or enabling an access list that omits the historian, stops data. Do the work on a documented plan during a maintenance window, one controller at a time, with the program backed up and a rollback ready. Keyswitch to RUN and default password changes are safe on any working system.
- Should firmware always be current?
- Current within a tested schedule. A firmware update on a controller is a change to a running process and can change behavior; it goes through the same testing and outage planning as a program change. What is not acceptable is a controller on a firmware version with a known remotely exploitable vulnerability and no compensating control in front of it.
- Is the controller password enough?
- No. It is one layer, and on many platforms it protects the project file more than the controller. The network access list and the keyswitch are the layers that stop an attacker who never had the file.
- Where do I start on a system with two hundred controllers?
- With the inventory: which controllers, which firmware, which services, which mode. Then keyswitches to RUN and default credentials changed everywhere, because those are cheap and safe. Then the network access lists on the conduits, starting with the zones the risk assessment ranked highest.
Industrial DMZ Design
Read the guide →- Can operators view SCADA from the enterprise network?
- They can view a read-only replica or a web report served from the DMZ. Running the full SCADA client on an enterprise workstation connected to the control-zone server is the direct path the DMZ exists to prevent. Where remote operation is genuinely required, it goes through the jump host with the same controls as vendor access.
- Does the DMZ need its own domain?
- It should not be part of the enterprise domain, and it should not expose the control domain directly. Common answers are local accounts on DMZ hosts, a small DMZ domain, or a read-only replica of the control domain controller placed in the DMZ. The wrong answer is joining DMZ hosts to the enterprise domain.
- Is a data diode better than a DMZ?
- A diode enforces one-way flow physically and is the strongest form of the push-out rule for data leaving the control zone. It does not provide the inbound services a DMZ does: remote access, patch staging, file transfer. Utilities with a diode still have a DMZ for those, or have decided not to allow them at all.
- Where does the cellular telemetry network connect?
- Remote site telemetry over cellular is a conduit into the control zone from a carrier network, and it terminates on a telemetry router or VPN concentrator that belongs to the control zone boundary, not to the DMZ. It is treated as its own conduit with its own rules: only the SCADA protocol, only from the site addresses, only to the master.
Jump Hosts
Read the guide →- Is a jump host necessary if we have a VPN?
- A VPN authenticates the connection and encrypts it; it does not stop the remote machine from being what it is. The jump host is what keeps that machine off the control network. Use the VPN to reach the DMZ and the jump host to go further.
- Can the jump host be a virtual machine?
- Yes, and it usually is. A virtual machine on a DMZ host is easy to snapshot, rebuild, and isolate. It must not be on the same hypervisor as control-zone servers unless the hypervisor and its management network are themselves treated as control-zone assets.
- How do vendors move files in?
- Through a transfer server in the DMZ with malware scanning, or through a utility-controlled file share the jump host can read. Not by remote desktop drive mapping, and not by email to an operator who copies it onto a SCADA server on a USB stick.
- What about emergency access when the jump host is down?
- A second jump host, or a documented break-glass procedure with physical presence at the site. The wrong answer is a standing bypass rule for emergencies, which is a standing bypass rule.
PLC Program Backups
Read the guide →- How long should old versions be kept?
- Indefinitely, for controller projects. Storage is cheap and a five-year-old version answers questions about when a behavior changed. Version control keeps them without effort.
- Should the backup be encrypted?
- The offline and off-site copies, yes, because they are portable. The working repository is protected by the engineering zone controls and access permissions. Whatever is encrypted, the key is stored where the restore team can get it without the systems that were lost.
- What about controllers with no offline project, only the running program?
- Upload it now, save it as the master, and document that comments are missing. Rebuild the documentation over time as people touch it. A program with no backup at all is the highest priority item in the backup program.
- Who is allowed to restore a program to a controller?
- The change management process says: a named person, with a change record, with the program verified against the backup store, with operations informed. A restore is a program download, and a program download to a running process is a change with consequences whatever its reason.
Default Credentials
Read the guide →- The device only has one account and no way to disable it. What then?
- Change its password, restrict which addresses can reach the device with a firewall or an access list, disable the interface if it is not needed, and record the limitation. Many older devices are in this category, and network restriction is the compensating control.
- What if changing the password could break the SCADA connection?
- It might, if the SCADA driver or a monitoring tool logs into the device with that credential. Find those dependencies first from the driver configuration, schedule the change with operations, and update the dependent configuration in the same window with a rollback ready.
- Is a lock code on a drive keypad worth setting?
- Yes, where the drive is in a location people other than trained staff can reach, and always on the network web interface. A keypad lock prevents a casual or mistaken parameter change; the network credential prevents a remote one.
- How do we handle vendor default accounts in SCADA software?
- Rename or disable the built-in administrator where the product allows, set a long unique password where it does not, and create named accounts for every person. Vendors document their built-in accounts; treat that documentation as a list of what an attacker knows.
Small Utility Cybersecurity Priorities
Read the guide →- We have never had a problem. Why now?
- Because the scans that find reachable control systems run continuously and the incidents at utilities like yours are public. The measures cost days and prevent the outcomes that have already happened elsewhere. Not having had a problem is the situation every utility in the incident reports was in the day before.
- We cannot afford a firewall or a security consultant.
- The first five measures need neither. A small industrial firewall costs less than a pump repair, and the state, the sector associations, and the federal agencies offer free assessments, training, and in some cases funding. The expensive part of cybersecurity is the incident.
- Our integrator handles all of this.
- Ask them to show you: the inventory, the backup restore date, how they connect and how it is turned off, and who has the passwords. A good integrator will have answers and will welcome the utility owning the list. An integrator who is the only one who knows is a single point of failure the utility should not accept.
- What about our office network and email?
- They matter, and phishing is the usual way in, but this page is about the control system. The office side gets the same basics from its own provider: patches, MFA, backups, and training. The segmentation measure is what keeps an office problem from becoming a plant problem.
OT Risk Assessment
Read the guide →- How long does an assessment take at a small utility?
- Two or three working sessions of a few hours each with the operator in charge, the superintendent, and the integrator or the person who maintains the network, plus a day to write it up. The asset inventory takes longer if it does not exist, and it is the first thing to do.
- Do we need a consultant?
- A facilitator who has done it before helps with the structure and the scenario list and keeps the sessions moving. The judgments about consequence and likelihood belong to the utility, and an assessment done entirely by an outside party without the operators in the room misses the controls that matter and overrates the ones that do not.
- How does this relate to the federally required risk and resilience assessment?
- The water sector assessment covers all hazards, including cyber, for utilities above the size thresholds, and the method here produces the cyber portion in a form that fits it. A utility that has done a consequence-first OT assessment has the cyber scenarios, the controls, and the ranked list that the broader assessment asks for.
- What if likelihood is unknowable?
- It usually is, precisely. The bands are a judgment about how easy and how attractive the scenario is given the controls in place, and the reasoning is recorded. The ranking is robust to that uncertainty because the treatments that matter most, the ones that move many scenarios, are the same under any reasonable judgment.
What to Back Up in a Control System
Read the guide →- How long should backups be kept?
- Configuration backups, every version, forever; they are small and a five-year-old version answers questions. Server images, a few generations. Historian data, per the retention policy the regulator and the utility set, often years for compliance data. Credentials, current plus the last, in the store.
- Should the backups be encrypted?
- The off-site and cloud copies, yes, with the key stored where the restore team can reach it without the systems that were lost. The offline drive in a locked cabinet is protected by the lock; encrypting it too is reasonable if the key management is real.
- What about the vendor packaged systems?
- A membrane skid, a generator controller, an on-site generation system: each has a controller and an HMI with configurations the vendor may consider proprietary. The contract requires that the utility receives a backup at handover and after every vendor change, in a form the vendor can restore, and the utility keeps it with the rest.
- Can the integrator keep the backups for us?
- The integrator keeping a copy is good; the integrator keeping the only copy is not. The utility owns the system and holds its own backups, and the integrator copy is the off-site one. An integrator who goes out of business, loses a laptop, or ends the relationship takes the only copy with them.
OT Incident Response Plan
Read the guide →- How long should the plan be?
- Short enough to read under stress: a few pages for the authority, the triggers, the first hour, and the call list, with the manual operation procedures and the recovery details as appendices. A fifty-page plan is not opened during an incident.
- Who should have the authority to disconnect?
- The operator on shift, for the control network from the outside world, because waiting for a manager while an attacker is active is the worst outcome. Broader decisions, such as taking a plant to full manual for days or notifying the public, sit with the superintendent or the director. The plan names both.
- What if we are not sure it is an incident?
- Treat it as one until it is shown not to be. Isolating the control network and going to manual for a few hours costs an inconvenient shift. Not doing so when it was real costs the plant. The plan lowers the threshold for calling a trigger on purpose.
- Do we need to report an incident that did no harm?
- Usually yes, to the state and often to the federal agencies, under the utility permit and the reporting rules that apply, and it is worth doing regardless: the agencies use reports to warn other utilities, and their assistance is free. The plan lists what must be reported, to whom, and by when.
Industrial Firewalls
Read the guide →- Do we need a firewall in front of every PLC?
- In front of the ones that cannot protect themselves and that matter: controllers with no authentication on a network that other things can reach. A plant with all its controllers in one zone behind a zone firewall, with no other devices in that zone, may not need per-device firewalls. A controller sharing a network with workstations or vendor equipment does.
- Can the cellular router at a remote site be the firewall?
- Most industrial cellular routers include a stateful firewall and VPN, and at a small site that is the firewall. Configure it: allow the SCADA protocol from the master only, deny everything else inbound, VPN to the utility concentrator, no management from the cellular side, default credentials changed, and the configuration backed up.
- What throughput do we need?
- Very little. A lift station generates kilobits per second; a plant control zone generates a few megabits. Industrial firewalls are rated in the hundreds of megabits and the constraint is never throughput. Port count, mode, protocol support, and environment are the constraints.
- Should the firewall be the same brand as the controllers?
- Not necessarily. A controller vendor firewall integrates with that vendor tools and understands that vendor protocols well; a network vendor unit understands more protocols and fits a mixed plant. The zone firewalls and the DMZ firewalls are often better from a network vendor, and the per-controller units from either. Mixing vendors at the two DMZ boundaries is a deliberate practice.
Firewall Rule Design
Read the guide →- How many rules should a control network boundary have?
- As many as there are conduits, which for a utility zone boundary is typically a dozen to a few dozen. A rule set with hundreds of rules at a control boundary has accumulated rules that nobody removed, and the review is overdue.
- Should the reply traffic have its own rule?
- No. A stateful firewall tracks the connection the permitted rule created and passes the reply automatically. A separate reverse rule opens a path in the other direction that the conduit does not need. The exception is UDP-based protocols where the firewall cannot track state, and even then the reverse rule is as narrow as the forward one.
- What about a rule for ping?
- A limited ICMP echo rule from the engineering zone to the control zone helps troubleshooting and is low risk. ICMP from the enterprise into the control zone is not permitted; a device that can be pinged can be found.
- Can the SCADA server reach the internet for licensing or updates?
- Not directly. Licensing traffic goes to a DMZ relay or is handled offline; updates come from the DMZ staging server. A control zone server with a rule to the internet is a control zone server on the internet.
Controller Mode Switch and Keyswitch
Read the guide →- Our integrator says they need REMOTE to support us. What do we do?
- Provide remote support through the vendor access design: a session enabled by the utility, through the jump host, with the keyswitch turned to REMOTE by a person on site for that session and returned to RUN after. It costs a phone call and a short drive per change, and it is what stops the same path being used by someone who is not the integrator.
- Does RUN prevent online edits?
- On most platforms RUN refuses remote mode changes and downloads; some still permit online edits from the software. The manual says. Where online edits are permitted in RUN, the platform security features and the network restriction cover them, and the program change detection catches them.
- What happens to the outputs when someone turns the switch to PROGRAM?
- The controller stops executing and the outputs go to their program-mode state, off on most platforms, hold on some configurations. On a lift station that is a stopped pump; on a chemical feed it is a stopped feeder. The float backup and the manual operation procedures are what carry the process through, and the mode alarm is what gets someone to the site.
- Should the key be removed from the switch?
- Yes. A key in the switch is a switch anyone can turn. The keys are kept by the utility, tracked, and issued for a change. Keys for a controller family are often identical, so a key from one panel opens all of them, which is one more reason the network and the monitoring matter too.
Controller Program Integrity
Read the guide →- The checksum changes every time someone goes online. Why?
- On some platforms an online session that changes nothing still updates a timestamp or a counter; on others the checksum is stable unless the logic changes. Learn which values on your platform change only with the logic, and alarm on those. The audit log, where available, distinguishes an online session from an edit.
- What if the program in the controller is better than the master?
- That is common on a system where the integrator made a fix on site and the master was never updated. The compare finds it; the review confirms the change is wanted; the master is updated and the change is recorded after the fact. The integrity process is how the master catches up, not a reason to distrust the fix.
- Can an attacker change the program and restore the checksum?
- A checksum is not a cryptographic signature and a capable attacker with controller access could in principle craft a program with the same value on some platforms. The scheduled compare against the master catches what the checksum misses, the network controls and the keyswitch make the access itself hard, and platforms with signed projects close the gap. Layers, as always.
- How long does the monthly compare take?
- A few minutes per controller with the platform tool, longer with a manual review of differences. A version control product for controllers automates the upload and compare on a schedule and reports only the differences, which makes weekly compares of a hundred controllers practical.
Server Hardening
Read the guide →- Will hardening break the SCADA?
- It can, which is why the vendor guide exists and the test system comes first. Applied per the vendor guidance and tested, hardening is routine on every major platform. The failures come from applying a generic benchmark blindly to a production server.
- Is antivirus enough without allowlisting?
- No. Antivirus catches known malware and misses new and targeted tools; allowlisting stops anything that is not approved, known or not. A SCADA server runs the same few programs for years, which makes it the ideal candidate for allowlisting. Use both.
- How do vendor updates work under allowlisting?
- The update is approved through change management, the new executables are added to the allowlist, or the allowlisting tool trusts the vendor signature, and the update is applied. The process is written down once and followed each time; it adds an hour to an update and is worth it.
- What about the operator consoles?
- They are hardened too, with the same approach and a kiosk configuration: the client starts at boot, the operator has no access to the operating system, removable media is blocked, and the session times out to view-only rather than locking. Consoles are the machines most people touch and deserve the same attention as the servers.
User Accounts and Roles
Read the guide →- Operators say individual logins slow them down. What works?
- A badge reader or a short PIN at the console, a view-only state that is always there so nothing is hidden while logging in, and a timeout that returns to view-only rather than locking the screen. Most operators accept individual logins once the login takes two seconds and the displays never disappear.
- Should the integrator have a permanent engineer account?
- A named account for each integrator engineer, disabled between engagements and enabled for a defined session under a change record. A permanent, always-enabled integrator account is a shared account with a long list of people who once knew the password.
- Can the corporate IT department manage SCADA accounts?
- They can run the dedicated control system directory if the utility decides that, with the control system owner approving every account and role. What they should not do is extend the corporate domain onto the control network or apply corporate policies, such as lockouts and forced password changes, to operator consoles without the control system owner agreeing.
- How many administrators should there be?
- As few as can cover vacations and emergencies, usually two or three, each with a named administrative account used only for administration and a separate daily account. An administrator account that is used to browse displays is an administrator session waiting to be hijacked.
Patch Management
Read the guide →- The vendor qualification takes weeks. Are we exposed in the meantime?
- The exposure depends on whether the vulnerability is reachable on the system. Most operating system vulnerabilities require network access to a service that a hardened, segmented server does not expose, and a few weeks of lag is acceptable. For the ones that are exposed and exploited, the emergency path and the compensating controls exist.
- Can we skip a month?
- A month skipped is two months of updates next time, tested and applied together, which is harder to troubleshoot and longer in the window. Skip only for a reason, and record it. A cycle that skips often is a cycle that has stopped.
- What is a test system for a small utility?
- A virtual machine with a copy of the SCADA server, and one with a client, on a spare host or even on the production hypervisor with restricted networking. The vendor license usually allows a test copy. Without one, the standby server of a redundant pair is the test system, which is acceptable with a snapshot; a single production server with no test system is patched with a backup and a prayer.
- Who approves the patch?
- The control system owner, on the recommendation of whoever runs the cycle, in the change management process. The approval is a record that says what was applied and why, which is what the auditor and the incident investigator will ask for.
Historian Security
Read the guide →- Is a data diode necessary?
- For most water utilities a software replication through a firewall with one-way rules is proportionate. A unidirectional gateway is chosen where the consequences justify hardware enforcement, where a regulator or an insurer expects it, or where the utility wants to eliminate the possibility of a firewall misconfiguration. The two-historian design is the same either way; the diode replaces the firewall rule on that one path.
- The reporting tool needs to write calculated results back. Where do they go?
- Into the DMZ historian or a DMZ database, where the office and the reports can read them. If a calculated value must reach the SCADA for display, a controlled process in the control zone reads it from the DMZ through a one-way pull, validates it, and writes it to a designated tag. Nothing in the DMZ pushes into the control zone.
- What about the historian web interface that the vendor promotes?
- It is convenient and it is a web server on a control system machine. Run it on the DMZ replica only, with encryption, authentication, and the same patching as any DMZ server; disable it on the collector.
- How is historian access audited?
- By the historian audit log where the product provides one, by the operating system logon logs on the historian servers, and by the firewall logs for the connections that reach them, all forwarded to the log collector and reviewed on a schedule for readers who should not be there and for configuration changes.
Third-Party Software
Read the guide →- The SCADA vendor installer put a database and a runtime on the server. Are those third-party?
- Yes, and they are the most important ones. The vendor bundles them and qualifies updates for them; the utility patches them through the vendor guidance, tracks their versions, and disables the features the SCADA does not use. A vulnerability in the bundled database is a vulnerability in the SCADA server.
- Do we need a browser on the engineering workstation?
- Only if a vendor tool or a device configuration page requires one, and then a hardened browser that reaches only the control network, with no internet access. Servers and consoles do not need one at all.
- How do vendor tools that require internet activation get activated?
- Through an offline activation process, which most vendors provide, or on a machine in the DMZ set up for the purpose, or by a temporary, logged, specific firewall rule opened through change management and closed afterward. Not by giving the engineering workstation general internet access.
- What is the minimum for a small utility?
- A list of what is installed on each machine, a decision about what stays, removal of the rest, no remote support utilities, and third-party updates included whenever the operating system is patched. That takes a day and removes most of the exposure.
Password Policy for OT
Read the guide →- The insurer or the auditor requires ninety-day password changes. What do we do?
- Show them the current federal guidance, which recommends against forced periodic changes, and the policy that rotates on events and uses multi-factor authentication and breached-password screening. Most auditors accept a documented, current policy. If a requirement is contractual and immovable, apply it to administrative and remote accounts, and keep the operator console exempt for availability, with the reasoning recorded.
- How long should a device password be?
- As long as the device allows, which on some controllers is disappointingly short. Use the maximum, make it unique, vault it, and compensate for the device limits with network restrictions so that the password is not the only thing between the internet and the controller.
- Should operators have multi-factor authentication?
- At the console, the control room and its physical access are the second factor, and a fast individual credential is enough. For any operator function reached remotely, from home or a phone, multi-factor authentication is required like any other remote access.
- What about the password on the HMI panel at a lift station?
- A device password: unique to the site, vaulted, changed from the default at commissioning, and rotated when people change. The panel is also physically inside a locked enclosure at a fenced site, which is part of the control, and its management interface is not on the network for anyone to reach.
Credential Storage
Read the guide →- Is a cloud password manager acceptable for a water utility?
- Reputable team password managers use end-to-end encryption so that the service cannot read the entries, and many utilities use them. The utility evaluates the product, enforces multi-factor authentication on it, keeps an offline encrypted export, and decides for itself whether the most sensitive credentials, such as the break-glass set, stay offline in the safe instead. A self-hosted vault avoids the question at the cost of running it.
- What goes in the safe?
- The vault recovery credentials, the top administrative credentials for the SCADA and the directory, the firewall administrator credentials, and anything else without which the system could not be recovered if the vault were lost, each in a sealed, signed, dated envelope, with a log of openings. Not every device password; the vault holds those.
- The controller project file contains the HMI password in a comment. Does that matter?
- Yes: the project file is backed up, emailed to the integrator, and kept for years by everyone who worked on it. Remove credentials from comments and descriptions, rotate the credential, and treat project files as sensitive documents from then on.
- How do I hand a password to a technician in the field?
- They retrieve it from the vault on their own device with their own login, which logs it. If the field has no connectivity, they retrieve it before leaving, and the vault entry is rotated on a schedule appropriate to how often it is retrieved. Reading it over the radio or texting it is not a method.
Security Program Basics
Read the guide →- We have an IT security program. Does that cover the control system?
- Rarely. Office security assumes patches can be applied at will, machines can be rebooted, and confidentiality matters most; control systems invert all three. The IT program is a resource and a partner; the control system program is owned by operations, uses the frameworks written for industrial systems, and sets its own priorities. The two coordinate at the firewall between them.
- What is the first thing to fix?
- Whatever gives an attacker on the internet a direct path to the plant: a modem with a public address, a remote desktop port forwarded through the office firewall, a vendor remote tool, a default password on anything reachable. The inventory finds them; removing them is the highest-value day of the year.
- How do we show progress to the board?
- With the framework assessment: a score or a maturity level per function this year against last year, the top risks and what was done about them, the incidents and exercises, and the plan and budget for next year. One page, once a year, in language a board member understands.
- Do we need a consultant?
- For the first assessment and for specialized work such as firewall design, often yes, and the state and the sector organizations offer free assistance to small systems. For running the program, no: the owner, the inventory, the policies, and the annual cycle are the utility's own work, and a program that only a consultant understands is not the utility's program.
SCADA Backups
Read the guide →- How often should the project be exported?
- After every change, as part of the change record, and on a weekly schedule to catch what was missed. Exports are small and versions are cheap; a change that was made and not exported is a change that has to be made again after a restore.
- Do virtual machine snapshots count as backups?
- No. A snapshot lives on the same storage as the machine, grows until it hurts performance, and is lost with the storage. Snapshots are for rolling back a patch within hours; backups are copies elsewhere. Take a backup before the patch as well as the snapshot, and delete the snapshot afterward.
- What about the operator consoles?
- An image of the standard client build, kept current, plus the project deployment. Individual consoles are not backed up; they are reimaged from the standard build, which is faster and cleaner than restoring a machine that has accumulated years of drift.
- Who is responsible?
- A named person, with a schedule, a monitoring alarm that reaches them, and an annual test that management sees the result of. Backups at most utilities fail through neglect rather than technology, and the fix is a name.
Backup Testing
Read the guide →- We do not have a spare server to restore onto. How do we test?
- A virtual machine on any host with enough memory, including a workstation with hypervisor software, is enough for a restore test of a small system; the test is functional, not performance. The vendor license normally allows a test copy. If there is truly nowhere to restore to, the utility has no recovery plan, and the test has already found its first finding.
- How long should a restore take?
- An image restore of a virtual machine, minutes to an hour; a reinstall and project import, several hours; a full rebuild of a multi-server system, a day or two. The measured time from the test is the number that matters, and it is what the recovery time objective is set against, not the other way round.
- Is restoring a controller program to the running controller a test?
- No, it is a risk. Compare the backup with the running program using the vendor tools, which proves the backup matches; download to a spare or a test controller to prove it loads. Downloading a backup to a running controller is done only when the controller has failed.
- What if the test fails badly?
- Then the test has done its job, on a day when nothing was actually lost. Fix the backup job, the procedure, or the missing piece, and test again within a month. A failed test is a success of the testing program; the failure that matters is the one that happens during a real recovery.
Offline Copies
Read the guide →- Is cloud backup an offline copy?
- Only if the cloud copy is immutable with object lock or equivalent for a retention period, under an account separate from the ones on the network, with multi-factor authentication. A cloud folder that synchronizes from a server is online and will synchronize the encryption. Even with immutable cloud storage, keep a physical offline copy of the small critical set: controller programs, project export, licenses, and the vault.
- How much does an offline copy cost?
- For a small utility, two or three encrypted external drives, a fire-rated safe, and an hour a week. It is the cheapest control in the security program by a wide margin, and it is the one that has determined whether utilities recovered from ransomware in days or months.
- Who keeps the off-site copy?
- A second utility building, a bank safe deposit box, or a trusted arrangement with a neighboring utility, under the same encryption and log. Not the home of an employee, who may be unreachable or may leave.
- What about paper?
- The procedures for running the plant by hand, the drawings, the setpoints, and the sealed credentials are in the safe on paper, because on the day the offline copy is needed there may be no working computer to read a drive on. Paper is the last offline copy.
Configuration Baselines
Read the guide →- Is the integrator project archive a baseline?
- It is a starting point, and it is often not what is running: changes during commissioning and afterward were made online and never returned to the archive. Upload from the live system at acceptance, compare with the archive, resolve the differences, and store the result as the baseline.
- How much do version control tools for controllers cost?
- Vendor and third-party products that upload, compare, and record controller programs on a schedule are priced for plants of some size and pay for themselves at the first unexplained change. A small utility can do the same by hand for a handful of controllers with the vendor compare function and a repository, on a monthly calendar entry.
- What about setpoints operators change every day?
- Operating setpoints within their limits are operations, not configuration, and they are not in the baseline; the limits are. A setpoint changed outside its limits, or a limit changed, is a configuration change and goes through change management.
- Do we baseline the office computers that never touch the plant?
- No; the baseline covers the control system and what protects it. The engineering workstation that programs controllers is in; the manager laptop with a view-only web client is the office IT department concern, with the firewall between them.
Program Change Detection
Read the guide →- The controller checksum changes when an operator changes a setpoint. How do I separate that?
- Some platforms include data in the checksum, so setpoint writes change it. Use a value that covers the program only, if the platform offers one, or move setpoints to a data area excluded from the signature, or accept that the alarm on that platform covers data as well and rely on the scheduled compare to tell program from data.
- Can the SCADA itself make the change and trigger the alarm?
- The SCADA writes data, not programs, so it should not change a program signature. If it does, the signature includes data and the answer above applies. A SCADA that can download programs to controllers is a design that should be reconsidered.
- How fast should detection be?
- The signature alarm is as fast as the poll, seconds to a minute; network monitoring is real time. The scheduled compare is hours to a month. For the controllers whose compromise would hurt people or the environment, real-time detection is worth the cost; for the rest, the poll and a monthly compare are proportionate.
- What is the first thing a small utility should do?
- Configure the change counter or signature alarm on every controller that reports one, this week; it costs nothing but an hour. Then start a monthly compare of the critical controllers against the stored project with the vendor tool, and put the mode and keyswitch status on the HMI.
Change Management for OT
Read the guide →- We are three people. Do we need this?
- A three-person utility needs a one-page form and a folder, and the same eight steps done in ten minutes for a small change. The point is the record and the backup-verify-update habit, not the bureaucracy. The utilities that suffered most from unrecorded changes were small ones where everyone assumed everyone else knew.
- Who is the system owner?
- The person accountable for the control system working: usually the operations manager or the lead control engineer, formally named. The owner approves changes because the owner answers for the consequences. It is not the integrator and not the IT department.
- What about a change made during an emergency at 3 a.m.?
- Made, with the operator, to restore the process safely. Then the owner is told at once and the record is written within a day, with the backup that was or was not taken, the verification, and the baseline update. The review afterward asks whether it was really an emergency and what would have prevented it.
- How does this connect to the security program?
- Change management is how the security controls stay in place: the firewall rules, the hardening, the accounts, and the baselines all decay without it. It is also what makes change detection useful, because a detected change can be matched to a record. Most security frameworks list it as a foundational control for that reason.
Isolating a Compromised System
Read the guide →- What if isolating the office link stops something we need?
- Then the design has a dependency that has to be removed before the incident, which the exercise finds. The control system runs without the office: time from a local source, authentication from a control-side directory or local accounts, no historian or database on the office side. Anything that breaks when the office is cut is on the list to fix.
- Should we shut down the plant to be safe?
- Rarely. The controllers are running the process; shutting down creates its own hazards and a public health event. Isolate the network, keep the process running on local and manual control, and stop only a process whose controller is compromised and cannot be operated safely by hand. The manual operation procedures are what make that judgment possible.
- How long can we stay isolated?
- As long as the manual operation can be sustained with the staff available, which the procedures state: days for most utilities, with rounds and paper logs. The recovery plan works toward reconnection in stages, and the isolated state is not lifted to relieve inconvenience.
- Who do we call?
- The incident plan lists them: the utility incident lead, the integrator, the incident response firm if one is retained, the federal cybersecurity agency and law enforcement, the state regulator, and the sector information sharing center. The calls are made while the isolation is being done, not after, and the numbers are on paper.
Manual Operation Procedures
Read the guide →- Is manual operation only for cyber incidents?
- No. The same procedures cover a server failure, a lost network, a lightning strike on the radio system, and a controller that died. Cyber incidents are the case where every automated system may be unavailable at once and for longer, which is why the procedures have to cover the no-controller level for the critical processes.
- Our operators have never run the plant by hand. Where do we start?
- With the no-SCADA procedure for the whole plant, which is mostly rounds and paper logs, and a manual shift to practice it. Then the no-controller procedure for disinfection and the highest-consequence lift station. Two procedures and one drill change the utility posture more than any purchase.
- What about regulatory monitoring during manual operation?
- It continues by grab sample and portable instrument on the schedule the permit requires, and the paper log is the record. The procedure lists the samples, the instruments, the intervals, and the reporting; the regulator is told that the plant is in manual operation and how compliance is being demonstrated.
- How do we hand back to automatic?
- Process by process, with the controller or the SCADA confirmed clean and its setpoints checked against the manual settings, the equipment placed in AUTO with the operator watching the first cycles, and the manual log closed with the time. The procedure describes it so that the handover is not the moment something is left in HAND by mistake.
Recovery and Restoration
Read the guide →- How long does recovery take?
- Days to weeks for a utility with tested backups, clean media, and a plan; months for one without. The controllers and the critical processes come back first, within days if the offline copies exist; the full SCADA with history and remote access takes longer. Manual operation covers the gap, which is why its sustainable duration matters.
- Can we trust the controllers if only the servers were hit?
- Not without checking. An intruder on the SCADA server had a path to every controller it polled. Compare every controller program against its baseline; a match is evidence, and a difference is a finding. Controllers that match and whose data looks right can be trusted while the servers are rebuilt.
- Should we pay a ransom to speed recovery?
- That is a decision for management with counsel, law enforcement, and the insurer, and the federal guidance advises against it. A utility with offline backups and a tested restore has a recovery path that does not depend on the intruder, and the decision is easier. Recovery from backups is the plan; the ransom is not.
- What if the offline backups are old?
- Then the changes since the backup are re-created from the change records and the documentation, which is another reason to keep both. An old clean backup plus a list of changes is recoverable; a current backup that contains the intruder is not.
Reporting Requirements
Read the guide →- Does a phishing email that was caught count as an incident to report?
- Not under most mandatory rules, which apply to substantial incidents that affect operations or data. It is worth a voluntary report to the sector information sharing center if it targeted the utility specifically, because others may be targeted the same way. The plan defines the threshold so that the decision is not made under pressure.
- Will reporting make the incident public?
- Reports to the federal agency under the incident reporting rule are protected from public disclosure by the law; state rules vary. Public notification is a separate obligation that arises only from consequences to water quality or service, and it is coordinated with the regulator. Reporting to a regulator is not a press release.
- We paid a ransom. Is that reportable?
- Under the federal rule, a ransom payment by a covered entity is reportable within 24 hours, and some states have their own requirements. Payment decisions involve counsel, law enforcement, and the insurer before the fact, and the reporting is part of that decision.
- Who is the primacy agency?
- The state agency that administers the drinking water program, in most states the environmental or health department, or the federal environmental agency in states that do not have primacy. Its emergency contact number is on the plan, and it is called for any event that affects treatment, monitoring, or service, cyber or otherwise.
Building an OT Asset Inventory
Read the guide →- Can we just scan the network?
- Active scanning finds networked devices that answer and can crash older controllers and instruments that do not expect unsolicited traffic; it is used with care, on a schedule, with the process in a suitable state, and never as the first method. The walk finds what is not on the network or is switched off, and passive listening finds what is on the network without touching anything. Scanning is a supplement for the machines that tolerate it.
- How long does the first inventory take?
- A day per plant and an hour per remote site for the walk, plus a few days to reconcile, for a typical utility. It is the largest single effort in the first year of a security program and the one that pays back most, because everything else depends on it.
- What about the devices with no network connection?
- A standalone controller with a serial programming port is still an asset: it has a program to back up, firmware with advisories, and a panel someone can open. Include it, mark it as not networked, and it drops out of the segmentation work while staying in the backup and firmware work.
- Who owns the inventory?
- The control system owner, with a named person maintaining it. It is not an IT asset register, although the IT register may want a copy of the server entries; the fields and the criticality ratings are operational.
Passive Discovery
Read the guide →- Will the mirror port affect the switch or the process?
- A mirror session adds load to the switch processor and the mirror port; on a modern managed switch mirroring a few ports of control traffic, it is negligible. Mirroring every port on a busy switch to one port drops packets at the mirror, which affects the sensor and not the process. A tap has no effect on the switch at all.
- How long should the capture run?
- A week for discovery, to catch weekly patterns; then indefinitely as monitoring. Storage for full packet capture fills quickly; monitoring products keep metadata and alerts rather than every packet, and a utility keeping raw capture retains a rolling window.
- Can passive discovery replace the site walk?
- No. It finds what talks; the walk finds what exists. A utility that does only the walk has an inventory without a conversation map; one that does only passive discovery has a map of the talkative devices and no idea what is in the panels. Do both, and reconcile.
- Is there a free option?
- Open-source packet capture and analysis tools, run on a spare machine at a mirror port, produce the address list, the protocol list, and the conversation map for a utility with someone able to read them. Purpose-built products add protocol decoding for control systems, device identification, and alerting, and are worth the cost when the sensor is to become monitoring.
Documenting Firmware Versions
Read the guide →- The controller programming software shows one version and the web page shows another. Which is right?
- They may be reporting different components: the processor firmware in one and the communication module in the other, or a boot loader and an application. Record both with the label the device uses. If the same component reads differently in two places, the device is telling you something and the vendor should explain it.
- Do we really need module firmware, or just the processor?
- Modules and communication cards have their own advisories and their own updates, and a communication card is often the exposed part. Record them. The programming software usually shows all of them on one screen once connected.
- How do we find the latest version without giving devices internet access?
- From the vendor support site, on a workstation outside the control network, on a schedule and when advisories arrive. Record the latest version and the date checked in the inventory. Devices do not check for themselves.
- Is the version a sensitive piece of information?
- Yes: the inventory with versions is the map an attacker would want, because it says exactly which known vulnerabilities apply. It is protected like the rest of the security documentation, and not emailed to bidders or posted in shared folders.
Advisories and Alerts
Read the guide →- There are hundreds of advisories a year. How does a small utility keep up?
- By subscribing only to the vendors in its inventory, which cuts the volume to a handful a month, and by using the sector center digest, which does the first filtering for water utilities. The weekly half hour is realistic for a small system with a good inventory; without the inventory it is impossible.
- The vendor says the vulnerability is fixed in a version that requires a hardware replacement. What then?
- That is a compensating control decision: restrict who can reach the vulnerable interface, disable the feature if possible, monitor for attempts, and put the replacement on the capital plan with a date. The record says so and is reviewed until the replacement is done.
- Should the integrator do this for us?
- The integrator can and should tell the utility about advisories for the systems they built, and a support contract can include it. The utility still owns the inventory, the subscriptions, and the decisions, because the integrator does not know the exposure and the consequence in the plant the way the utility does, and the utility is the one accountable.
- What if we discover we have been vulnerable for years?
- Most utilities discover that on their first triage. The question becomes whether it was exploited: check the logs and the program baselines for the period, look for the indicators the advisory describes, and treat any doubt as a reason for a closer look. Then fix it, record it, and note that the security program has found its first result.
Risk-Based Patching
Read the guide →- Is it acceptable to never patch a controller?
- It is common, and it is acceptable when the controller is reachable only from the engineering zone, its exposed services are disabled, changes to it are detected, and the decision is written down and reviewed. It is not acceptable as an unexamined default. Many controllers also gain features and fixes from firmware that are worth an outage for other reasons.
- How do we decide consequence for a shared component like a switch?
- By what depends on it: a core switch carries every process, so its consequence is the highest of anything connected to it. The inventory criticality of network equipment is inherited from what it serves.
- The advisory says critical and our ranking says planned outage. Will an auditor accept that?
- If the record shows the exposure analysis, the consequence, the compensating control, and the review date, yes; that is what risk-based patching means and what the frameworks describe. What an auditor will not accept is a critical advisory with no record at all.
- How many open items is too many?
- There is no number; there is a trend. A list that grows every quarter means the cycle is not keeping up or the accept tier is being used as a place to put things. A list that turns over, with items closed by patches and replacements, is a program that is working.
Compensating Controls
Read the guide →- Is a compensating control as good as a patch?
- It can be as effective against the specific attack path, and it is sometimes better, because restricting reachability protects against the vulnerabilities not yet published as well. It is not a substitute for the general habit of patching, and it depends on the control staying in place, which a patch does not.
- What is a protocol-aware firewall?
- A firewall that understands the control protocols, Modbus, DNP3, EtherNet/IP and others, and can allow or block by function: permit reads from the SCADA, permit writes to specific registers, block programming and firmware functions except from a named workstation. Industrial firewalls offer this, and it is the most precise compensating control for controller vulnerabilities.
- Can we just isolate the whole control network and call it done?
- Isolation of the control network from the office and the internet is the foundation, and it is the first compensating control for every vulnerability at once. It does not protect against the engineering laptop that was on the internet last night, the contractor with a USB drive, or the vendor remote session. Layered controls inside the isolation are still needed for the components that matter most.
- How do we prove to an auditor that the control works?
- With the test in the record: from the places an attacker could be, the attempt to reach the interface fails, with a screenshot or a log. Repeat the test at the review and file it. A control that has been tested is evidence; one that has been configured is a claim.
AWIA Requirements
Read the guide →- We serve 3,000 people. Are we exempt from everything?
- From the certification requirement of this section, yes. Not from the threats, and possibly not from state requirements or from federal enforcement under the broader emergency powers of the drinking water law. The same assessment and plan, scaled down, are recommended for every system, and free help is available for small ones.
- Does the assessment have to be done by a certified professional?
- No. The act requires the utility to conduct it and certify that it did; it does not require a particular credential. Many utilities use consultants for the method and the documentation; the utility signs the certification.
- Is the assessment a public record?
- The act directs the federal agency to protect the information from disclosure, and the certification the agency receives contains no details. Copies held by the utility are subject to state public records laws, which often have exemptions for security-sensitive information; the utility should confirm with counsel and mark the documents accordingly.
- What happens if we miss the deadline?
- The federal environmental agency has enforcement authority under the drinking water law, and it has used it. Late is better than never: complete the work, certify, and document why it was late. The greater risk is the one the assessment would have found.
EPA Guidance
Read the guide →- Is the guidance mandatory?
- The guidance documents are voluntary; the risk and resilience assessment and emergency response plan requirements under the water infrastructure act are mandatory for covered systems; and the agency has stated that it will use its drinking water law authority against systems with basic gaps. In practice, the top actions are the expectation.
- How do we request the free assessment?
- Through the agency water sector cybersecurity program page, which has a request form and a contact, and through the state drinking water program, which can connect a utility to the assistance. The sector center and the federal cybersecurity agency regional advisors offer parallel help.
- Will the agency see our assessment results?
- The free assessment is technical assistance, and its purpose is to help the utility; the agency has said it is not an inspection. The utility keeps the results with its security documentation. Inspections under the drinking water law are a separate activity with their own rules.
- The pages have changed since this was written. Where do we look?
- The agency water sector cybersecurity page, the federal cybersecurity agency water and wastewater sector page, and the sector information sharing center. Between them they carry the current documents, and the sector center digest announces changes.
CISA Resources
Read the guide →- Is the scanning service safe for a control system?
- It scans only the public internet addresses the utility provides, from outside, the way an attacker would; it does not touch the control network unless the control network is exposed to the internet, which is the finding the service exists to produce. It is used by thousands of organizations.
- Will the agency tell the regulator what it found?
- The assessment services are voluntary assistance to the utility, and the agency has said the results are for the utility. Mandatory incident reports under the reporting rule are protected from public disclosure by the law. Check the current terms for each service.
- We are a very small system. Is any of this for us?
- All of it, and the small systems are the ones the agency most wants to reach because they are least resourced. The advisor visit, the scanning, the goals, and the exercise package are sized for a utility with a handful of staff. Start with the advisor.
- How current is this list?
- As of the time of writing; the agency adds and renames services. The water sector toolkit page and the regional advisor are the current sources, and the sector center digest announces changes.
VLAN Segmentation
Read the guide →- Can VLANs replace a firewall?
- No. VLANs separate; a firewall decides what may cross. Two VLANs with no routing between them are isolated, which is fine for I/O that talks only to its controller. Any two zones that must exchange data need a firewall between their VLANs, with rules, or the separation is only as good as the switch configuration.
- Is a layer 3 switch acceptable as the router between VLANs?
- Only with access lists that implement the same rules a firewall would, maintained under change management, logged, and reviewed. Most utilities cannot sustain that on a switch, and the firewall is the better tool: it logs, it understands protocols, and its rules are what everyone expects to review.
- We have unmanaged switches at remote sites. Can we segment there?
- Not with VLANs. A remote site with an unmanaged switch is one segment, and the segmentation is at the site firewall or router that connects it to the rest of the system. Replace the unmanaged switch when the site is upgraded; until then, treat the site as a single zone.
- How many VLANs does a small plant need?
- Control, supervisory, management, and a DMZ, with remote I/O in the control VLAN if the controllers are few. Four or five. The number grows with the plant, but the discipline of one VLAN per zone matters more than the count.
Data Diodes
Read the guide →- Is a diode required by any regulation for water utilities?
- No regulation requires it; the industrial security standards describe it as a means of achieving the highest security levels at a zone boundary, and some insurers and assessors regard it favorably. It is a design choice for the boundary where the utility decides that configuration is not enough.
- What happens when the outside historian falls behind?
- The gateway reports lag and gaps; the outside replica catches up from the stream if the gateway buffers, and a persistent gap is filled by a re-send initiated from the control side, because only the control side can initiate anything. Monitoring of the gateway is part of the installation.
- Can a diode replace the DMZ?
- It changes what the DMZ is for. With a diode carrying the historian and files outward, the DMZ still hosts the replicas, the jump host for the remote access that the diode cannot carry, and the update path inward. The diode removes the inbound risk on the data path; the DMZ remains for everything else.
- How much do they cost?
- The hardware is modest; the gateway software licensed per replicated application is the larger part, and the total is comparable to a redundant pair of enterprise firewalls. Against the cost of the incident it prevents on the boundary it protects, utilities that have chosen one consider it reasonable.
Segmenting a Remote Site
Read the guide →- The modem has a firewall built in. Is that enough?
- If it enforces rules on the cellular side and the LAN side, logs, and can be configured to permit only the conduit, it can serve as the site boundary device. Many modems have a capable firewall that ships wide open; the configuration is what matters, and it is backed up and baselined like any firewall.
- How does the SCADA poll the site if nothing is forwarded?
- Over the VPN or the private network: the SCADA reaches the site controller at its private address through the tunnel, and the site firewall permits that source on that port. Port forwarding is for public addresses, which the site does not have.
- We have fifty sites. Is a firewall at each affordable?
- Small industrial routers with firewall rules cost a few hundred dollars per site, and the modem firewall may already be there. Against fifty exposed controllers, it is the best purchase the security program makes. Standardize the configuration and push it to every site.
- What about sites on licensed radio with no internet at all?
- They are better off than cellular sites and still benefit from rules at the site end, because the radio network is shared by every site and a compromised site can reach the others. Encrypt the radio, restrict the site to its conduit, and keep the extras off the control segment.
VPN Design
Read the guide →- Can operators use the VPN to run the plant from home?
- They can view it and acknowledge alarms through the jump host with a view-only or acknowledge role, if the utility permits that. Control from home is a policy decision with a default of no; where a utility allows it for on-call response, it is under a named role, multi-factor authentication, logging, and a written procedure.
- Is a pre-shared key acceptable for site-to-site tunnels?
- A long random key unique to each site, stored in the vault and rotated when compromised or when staff who knew it leave, is acceptable for small systems. Certificates scale better and rotate more cleanly; use them where the routers support them.
- The vendor wants their own VPN appliance in our DMZ.
- No. The vendor uses the utility VPN with a named account enabled per session, or the utility remote access service, and lands on the utility jump host. A vendor appliance is a permanent door with a key the vendor holds and the utility cannot see through.
- What about the cellular carrier private network; is a VPN still needed?
- A private carrier network keeps site traffic off the public internet and is a good foundation; a VPN tunnel over it adds encryption and authentication that do not depend on the carrier. Most designs use both, or a carrier network with encryption the utility controls.
Multi-Factor Authentication
Read the guide →- Our SCADA login does not support a second factor. What do we do?
- Put the factor in front of it: the VPN and the jump host require it, so that nobody reaches the SCADA login remotely without having passed it. Inside the control room the console is exempt by design. Ask the vendor for multi-factor support in the next version; most platforms now integrate with the directory for it.
- Is an authenticator app on a personal phone acceptable?
- For most staff, yes, with the person agreeing to it and the app enrolled in person; the app holds no utility data. Administrators and anyone with frequent privileged access are better served by a hardware key the utility issues, which does not depend on a personal device.
- What if the multi-factor service is down?
- The break-glass account in the safe gets an administrator in to fix it, and the manual operation procedures cover the plant meanwhile, since remote access is not how the plant is run. The multi-factor service is itself hardened, redundant where practical, and on the monitoring list.
- How long does it take to roll out?
- A few weeks for a small utility: choose the factor, enable it on the VPN and the directory, enroll each person, write the recovery procedure, and issue keys to the administrators. Vendors are enrolled as their next session comes up. It is the highest-value few weeks in the program.
Session Logging
Read the guide →- Our jump host is a plain remote desktop server. Can it record?
- Not natively, in most cases. Privileged access products and some remote access services add session recording; a plain server can at least forward its logins and process logs to the collector and the SCADA audit trail covers what was done in the SCADA. Recording is the upgrade to plan for; the collector and the review are the habit to start now.
- Do we log the operators in the control room too?
- The SCADA audit trail logs their actions by their individual account, which is the record that matters. Session recording is for remote and privileged access, where the person is not in the room and the actions are configuration rather than operation.
- What if the vendor objects to being recorded?
- It is a condition of remote access, written in the contract, and most vendors accept it because it protects them too: the recording shows they did what was agreed. A vendor that will not be recorded is escorted on site instead.
- How much storage do recordings need?
- Session video compresses well; a typical engineering session is tens of megabytes, and a year of vendor sessions at a small utility fits on a modest disk. Transcripts are smaller still. The collector for text logs needs more planning than the recordings.
Deep Packet Inspection
Read the guide →- Does inspection slow the polling?
- It adds latency of a fraction of a millisecond to a few milliseconds per message on an industrial firewall sized for the traffic, which is invisible to a SCADA polling at seconds. An undersized firewall inspecting a busy network drops packets, which shows as bad quality; size it for the message rate, not the bandwidth.
- Can it stop a compromised engineering workstation?
- It limits what that workstation can do to the window and the functions the rules permit, and it alerts on anything else, which is more than a port rule can do. It cannot tell a legitimate download from a malicious one made by the same workstation in the same window; change management, session logging, and program change detection cover that.
- Is deep inspection the same as an intrusion detection system?
- They overlap. An intrusion detection sensor watches a copy of the traffic and alerts; a firewall with deep inspection sits inline and blocks. Many utilities run both: the sensor for visibility across the whole network, the firewall for enforcement at the boundaries that matter.
- Our controllers use a vendor protocol the firewall does not understand. What then?
- Address and port rules still restrict who can reach the controller, and programming is restricted to the engineering workstation by those rules. The controller own authentication and keyswitch, change detection, and monitoring carry the rest. Ask the firewall vendor whether the protocol is on their roadmap, and the controller vendor whether the protocol can be secured.
Firewall Logging and Review
Read the guide →- The logs are enormous. How does a small utility review them?
- By reviewing summaries, not entries: the collector or a simple script produces denials by source, sensitive permits, and new sources in a page. A half hour a week on that page is sustainable, and the alerts handle the urgent cases between reviews.
- Should we log the routine polling permits?
- At connection level or sampled, yes, so that a new source or a new destination on the polling rule is visible. Logging every packet of a Modbus poll is neither useful nor sustainable; most firewalls log the session rather than the packet.
- What collector should a small utility use?
- A syslog server on a hardened virtual machine with enough disk and a retention job is enough to start; open-source log platforms add search and dashboards; commercial security monitoring adds correlation and alerting. Start with the syslog server this month and grow.
- How long do we keep firewall logs?
- A year is common, with the retention set by the security policy and any regulatory or insurer expectation. The intrusions that matter are discovered months after they began, and the log has to reach back to the beginning.
Firmware Management
Read the guide →- Should every controller be on the latest firmware?
- No. Every controller should be on a supported version free of exploitable vulnerabilities in the interfaces it exposes, and identical to its siblings where practical. The latest version has the newest defects; a version a year old with a clean advisory record is often the better target.
- The vendor update tool wants internet access. How do we do it?
- Download the image on a workstation outside the control network, verify the hash, transfer it through the controlled path, and apply it from the engineering workstation with the offline procedure the vendor provides. Vendors provide offline procedures because plants ask for them.
- How do we roll back a controller firmware update that broke something?
- On platforms that allow downgrade, by applying the previous image per the vendor procedure and reloading the backed-up program; on platforms that do not, by swapping in the tested spare on the old version, which is why the spare is tested before the outage. The rollback plan is in the change record before the update starts.
- Can the integrator do the updates?
- Under the utility change process, with the utility backup, the utility test, and the utility record. The integrator brings the platform expertise and the conversion experience; the utility owns the decision, the outage, and the result.
Disabling Unused Services
Read the guide →- Will disabling the web server stop the SCADA from polling?
- No; the SCADA polls on a control protocol, not through the web server. Disabling the web server removes the management page, which the engineering tool replaces. Confirm on the test unit before production, and keep the vendor tool available.
- The controller has Modbus and the vendor protocol both enabled, and the SCADA uses the vendor protocol. Disable Modbus?
- Yes, if nothing polls it, which the traffic baseline confirms. An unused Modbus server accepts unauthenticated writes from anything that can reach it. If a future device needs it, the change record turns it on.
- Is the discovery protocol dangerous?
- It announces the device model, version, and address to the network, which is reconnaissance done for the attacker, and on some devices it accepts configuration changes. Disable it where the programming tool can address devices directly, and keep it inside the zone with the firewall where it must stay.
- How much does this reduce risk?
- Each disabled service removes every vulnerability in it, present and future, from the list the utility has to track. On a fleet of controllers with web servers, file transfer, and three protocols listening, disabling the unused ones removes most of the advisory matches for those devices in a single outage.
How to Create a PID Loop in a PLC
Read the guide →- Should the PID run in the PLC or in the drive?
- Most drives include a PID controller, and for a single pump on a single pressure or level loop it can work well. Running it in the PLC keeps the tuning, the limits, the failure handling, and the alarming in one place, visible on SCADA, and consistent across loops. Use the drive PID for a standalone application; use the PLC for anything with more than one pump or any interaction with the rest of the process.
- How do I know whether my loop is direct or reverse acting?
- Ask what happens to the process variable when the output increases. If PV rises, the loop must reduce output when PV is above setpoint: reverse acting. If PV falls when output increases, as with a pump emptying a wet well, the loop must increase output when PV is above setpoint: direct acting. Platforms name these differently; test in manual to be certain.
- What execution rate should I use?
- Fast enough that the loop sees changes as they happen and slow enough that noise does not dominate. Ten to twenty executions per process time constant is a reasonable rule. A wet well that takes ten minutes to move a foot does not need a 50 ms loop, and running it that fast only amplifies noise through the derivative and integral terms.
- The loop oscillates slowly. What is wrong?
- Slow oscillation with a period of several process time constants is usually too much integral, or gain too high on a loop with long dead time. Reduce integral first. Fast oscillation is usually gain. A loop that oscillates in manual is not a tuning problem at all; it is the process or a valve with stiction.
How to Add an Alarm
Read the guide →- Can I just set a high limit on the SCADA tag?
- For a temporary or information-only alarm, yes. For a process alarm, no: it depends on SCADA being up and the poll being current, it cannot be gated on process state without more configuration, and it does not exist for the local panel or a hardwired dialer. Build it in the controller and present it in SCADA.
- How much deadband is right?
- Enough that normal noise on the signal cannot re-trigger the alarm after it clears. Look at the trend: the peak-to-peak noise at steady state is the minimum. Two to five percent of range is typical; less on a very clean signal, more on a turbulent level.
- Should a new alarm call out?
- Only if the rationalization answer says it needs a response when the site is unstaffed and within the time available. Adding notification to every new alarm is how on-call phones end up ignored. Notification is a separate decision recorded with the alarm.
- Who approves a new alarm?
- The alarm philosophy says. At many utilities, operations approves any new alarm and its priority, and a regulatory or safety class alarm requires a documented change record. A new alarm added at a keyboard without approval is a change that bypasses the system the philosophy set up.
How to Calibrate a Pressure Transmitter
Read the guide →- How often should a pressure transmitter be calibrated?
- On the schedule the utility sets, based on the criticality of the loop and the history of the transmitter. Annually is common; compliance measurements may require more. The as-found records tell you: a transmitter that is always in tolerance at twelve months can go longer, one that drifts needs a shorter interval or replacement.
- Can I calibrate in place without isolating?
- A zero check can sometimes be done by equalizing a differential transmitter or, with the process at a known state, comparing to a reference gauge. It catches zero drift. It does not check span, and it is not a calibration for the record.
- What accuracy does the calibrator need?
- The reference should be at least four times more accurate than the tolerance being checked, and ten times is better. For a 0.5 percent loop tolerance, a 0.1 percent reference is adequate and a 0.05 percent reference is comfortable. A calibrator that has not itself been calibrated is not a reference.
- The transmitter passed calibration but the PLC still reads wrong. Why?
- The problem is downstream: the input card range, the PLC scaling, or the calibrated range in the PLC not matching the one in the transmitter. Inject a known current at the panel terminals and follow the value through the scaling.
How to Diagnose a Ground Loop
Read the guide →- Why does grounding the shield at both ends cause a problem?
- The two ground points are at slightly different potentials, and the shield connects them, so current flows in the shield. That current induces a voltage into the signal pair and, if the shield shares any part of the signal return, adds directly to the signal. One ground means no path for the current.
- Where should the shield be grounded?
- At the panel end, on the instrument ground bar, is the usual practice for 4-20 mA and other low-frequency signals. The field end is insulated. Some platforms and some high-frequency applications call for grounding both ends or for a hybrid capacitor ground; follow the platform grounding guide when it says so and document it.
- Can an isolator fix every ground loop?
- An isolator breaks the galvanic path between the field side and the panel side, which eliminates the loop as far as the signal is concerned. It does not fix a damaged cable, a wet junction box, or a floating reference, and it adds a device that needs power and can fail. Use it when the second ground is inherent to the field device.
- The signal is fine on the bench and noisy in the field. Is that a ground loop?
- Possibly, and it is the classic pattern: on the bench there is only one ground. It can also be induced noise from cable routing near drive conductors, which needs no second ground. The shield current measurement and the lift test tell them apart.
How to Configure a Modbus Connection
Read the guide →- The device returns values but they are wrong. What is the most likely cause?
- The addressing offset, the word order on 32-bit values, or a scaling factor from the map that was not applied. Read a register whose value you know from the display, and work through those three in that order.
- The device does not answer at all. Where do I start?
- On RTU: serial settings, A and B polarity, the unit address, and termination. Swap A and B and try again before anything else. On TCP: ping the device, then confirm port 502 with the test tool, then the unit ID. A gateway in front of a serial device often needs the unit ID of the serial device, not 1.
- How many devices can share an RS-485 bus?
- Electrically, 32 unit loads without a repeater, and more with modern low-load transceivers. Practically, the poll time per device times the device count sets the update rate, and a bus of a dozen devices at 9600 baud updates each every few seconds. Use a second port or a higher baud rate before it gets slow.
- Should the controller be the master or the device?
- The controller is the master and the device is the slave in nearly every case; the controller polls and writes. A device that must initiate, such as one that reports on exception, is not Modbus in the usual sense and needs a different protocol.
How to Diagnose a Bad Quality Tag
Read the guide →- Why does the tag show bad quality only sometimes?
- Intermittent communication: a serial bus with a marginal device, a radio path with fades, a network with packet loss, or a timeout set too close to the device response time. The driver counters show the failure rate. Lengthen the timeout if it is the cause; fix the path if it is not.
- Can bad quality come from the historian?
- A trend that shows gaps or a bad marker reads the quality the historian stored, which came from the driver at the time. A live tag with good quality and a trend with bad quality means the problem was earlier and is now fixed, or the historian collection failed. Check both timestamps.
- What should the display show when quality is bad?
- The value in a distinct style with a visible bad quality indicator: an outline, a color from the reserved palette, a marker such as a question mark or an X, and no number that could be read as a real value. Displaying the last value as if it were live is the failure the quality code exists to prevent.
- The controller has no fault and SCADA shows every tag bad. What is it?
- The connection between them: the SCADA server network interface, the switch, a changed IP address, a firewall rule, a driver license or service that stopped, or the controller connection limit reached by another client. The driver diagnostics and a ping from the server narrow it in minutes.
How to Calculate a Panel SCCR
Read the guide →- What SCCR do most utility panels need?
- Whatever the available fault current at the panel is, which depends on the service transformer size and the distance. A small lift station on a pole-mounted transformer at the end of a long secondary may see under 10 kA; a panel next to a large plant transformer may see 40 kA or more. Get the number; do not assume it.
- Can I raise the SCCR by putting current-limiting fuses at the main?
- Often, and it is the usual method, but only for the component categories and conditions Supplement SB allows, using the fuse let-through at the available fault current, and not for every device. Drives and some devices require their own listed combination regardless of what is ahead of them.
- Does the control circuit affect the SCCR?
- Not if it is a control circuit as UL 508A defines it: fed through a control transformer or a power supply with the required protection, and used only for control. The components on it do not enter the calculation. A receptacle or a heater fed directly from the power circuit is in the power circuit.
- Who is responsible for the SCCR?
- The panel builder determines and marks it. The engineer or the installer determines the available fault current and confirms the panel rating is adequate at the installation. An inspector checks both. A panel with an adequate rating in the shop can be inadequate on a site with more fault current than assumed.
How to Configure a Radar Level Transmitter
Read the guide →- Why does the level jump to a fixed value part way through a pump-down?
- An unmapped fixed echo, usually a pump, a rail, or the inflow pipe, that the transmitter starts tracking as the surface passes it. Re-run the false echo map with the level below the obstruction.
- Can I configure the transmitter with the well full?
- You can enter the distances and set the output, but you cannot map the false echoes usefully, and the two-point verification needs a second level. Enter the settings, then finish the mapping and the verification at low level, even if that means a return visit.
- What about foam and grease on the wet well surface?
- Radar reads the top of foam poorly and a grease mat inconsistently. Higher frequency radars with narrow beams do better; the application settings help; and where the surface is regularly covered, a submersible pressure transmitter as the second measurement with cross-checking in the controller is the practical answer.
- Should the empty distance be the bottom of the well?
- It should be the point you want to read as 4 mA, which is usually the bottom or a little above it, below the low-level cutoff. Setting it at the cutoff loses the ability to see the well below that level, which is useful for a dry-run diagnosis. Setting it far below the bottom wastes range.
How to Assign IP Addresses on a Control Network
Read the guide →- Why not just use 192.168.1.x like the vendor defaults?
- Because everything else uses it too. A cellular modem, a laptop on a home network over VPN, a vendor tool, and a new device out of the box all default into 192.168.0.x or 192.168.1.x, and every one of them collides with a control network that lives there. A 10.x.x.x plan avoids every collision and gives room to number sites and zones.
- Can two remote sites use the same subnet?
- Only if they will never be connected. Two sites at 192.168.1.0/24 cannot be joined by a VPN or a central SCADA without address translation, which is confusing to troubleshoot. Give every site its own subnet from the start; it costs nothing.
- Should the gateway be set on every device?
- Set it where the device must communicate outside its subnet: servers, HMIs, controllers that report to a central SCADA. Leave it blank on remote I/O adapters, drives, and instruments that only talk to the local controller; without a gateway they cannot be reached from, or reach, another subnet even if a firewall rule is wrong.
- What about IPv6?
- Turn it off on control devices and workstations where the option exists, and do not plan around it. Control equipment overwhelmingly uses IPv4, and an IPv6 stack left enabled on a workstation is an unmanaged path that no firewall rule was written for.
How to Configure VLANs on a Control Network
Read the guide →- Is a VLAN a security boundary?
- Only with a firewall between VLANs. Two VLANs on the same switch with no router between them cannot talk, which isolates them, but the moment a layer 3 switch or a router joins them the boundary is whatever that device enforces. Route between zones on the firewall, where rules and logs exist.
- Why not use the layer 3 switch to route between VLANs? It is faster.
- It is also unfiltered and unlogged unless access lists are written and maintained on it, which rarely happens. Control traffic between zones is small; a firewall handles it without difficulty. Reserve switch routing for cases where the firewall is the documented bottleneck, and then write the access lists.
- What is the harm in using VLAN 1?
- It is the default for every port and every trunk native VLAN, so a new switch, a reset switch, or a forgotten port lands in it, and management traffic on it mixes with anything untagged. Keeping VLAN 1 empty means those defaults land in a VLAN that connects to nothing.
- How do I add a VLAN to an unmanaged switch?
- You cannot. An unmanaged switch passes tagged frames without understanding them, which sometimes works between two managed switches, and puts every device on it in whatever VLAN its uplink port is assigned. Replace unmanaged switches in the path with managed ones before building VLANs.
How to Troubleshoot an Ethernet Connection
Read the guide →- The link light is on but the switch shows the port down. How?
- The device sees a carrier from the switch while the switch has the port administratively down, error-disabled, or in a state that stops forwarding. Read the switch port status and log; the port was disabled by configuration, by a security feature such as port security or BPDU guard, or by a loop protection feature.
- Should I force 100 Mb full duplex on PLC ports?
- Only if both ends are forced identically and the setting is documented. Modern equipment auto-negotiates reliably, and the classic failure is a forced switch port talking to an auto device, which negotiates to half duplex. Default to auto on both ends.
- The device pings but its web page and its protocol both time out. What does that mean?
- The network path is good and the device is not serving the port. Common causes: the service is disabled, the device has reached its connection limit and needs old connections to time out, the firmware crashed the TCP stack while ICMP still answers, or a firewall allows ICMP but not the port. Power cycle the device only after checking the firewall and connection count.
- How do I find a loop?
- A loop shows as every port on the switch flashing continuously, high CPU on the switch, and devices across the whole VLAN dropping. Look at the switch log for topology changes and the storm control counters, then find the cable that was added most recently between two switches or between two ports on the same switch. Enable spanning tree and loop protection so the next one is blocked instead of felt.
How to Diagnose Packet Loss
Read the guide →- The switch counters are all zero but ping still loses packets. Where is the loss?
- Somewhere the counters do not see: a radio link that retries silently, a firewall that rate-limits ICMP, an unmanaged switch in the path, or the end device dropping pings under load. Ping the far side of each of those in turn, and test with the protocol rather than ping if the end device is the suspect.
- How much loss is acceptable?
- On a wired control network, none; a switched Ethernet path with good cables delivers every frame. On radio and cellular, a percent or two is normal and the protocol timeouts and retries are designed for it. Anything above the commissioning baseline on any link is a fault to find.
- Ping loss started after a firmware update on the controller. What changed?
- Probably the priority the controller gives to ICMP, or the number of connections it accepts. Check the protocol communication status first; if it is good, the loss is a measurement artifact. If the protocol also fails, the update may have changed connection limits or the default port speed and duplex.
- Can a bad cable on one device cause loss on other devices?
- On a switched network, a bad cable affects only its own port, unless the errors are severe enough to flood the switch with malformed frames or the cable is a trunk. Loss on several devices at once points at a shared link, a loop, or a storm, not at one device cable.
How to Build a Sequencer
Read the guide →- How do I handle two things that must happen at once?
- Either put both in the same step, since a step can drive several outputs, or run two sequencers with their own step registers and a handshake step in each. Two sequencers writing the same output is the error to avoid.
- The sequence sticks in a step and nobody notices.
- The step has no timeout, or the timeout is hours. Every step waiting on the field has a timeout measured in the time the field action should take plus margin, and the fault step alarms.
- Should the sequence resume after a power loss?
- For a backwash or a clean-in-place, usually restart from a safe step with operator confirmation; for a batch with chemistry in progress, resume the held step after confirmation. The narrative decides, and the step register is retentive only if resume is chosen.
- How do I test a sequence without running the equipment?
- On an emulator or a spare controller with the inputs forced or simulated by a test routine that mimics the field responses, walking every transition. Then live with each step confirmed by an operator.
How to Diagnose Read and Write Communications
Read the guide →- The device works with the laptop tool and not with the controller.
- The two requests differ. Compare function code, starting address, register count, unit identifier, and data type; the controller driver often defaults to a multiple-register write or a zero-based address that the device does not accept.
- Reads work and writes return exception 02.
- The write targets a register that is read-only, does not exist, or sits in a different table than the read. The manual names the writable registers; the write address is corrected.
- Everything worked until the firewall was installed.
- The firewall is dropping the traffic, and possibly by design. Read the firewall log, confirm with the security owner what should cross, and write the rule for that traffic only.
- How do I capture serial traffic?
- A serial tap or a converter with a monitoring port between the controller and the bus, feeding a laptop with a serial analyzer; or the driver diagnostics on the controller if it offers a byte-level view. A meter on the bus shows signal presence and levels but not content.
How to Configure Remote I/O
Read the guide →- The adapter is pingable but the controller shows a connection fault.
- The configuration does not match the hardware: a catalog number, a revision under exact keying, a slot, or a module the adapter does not see. The fault code in the I/O tree names it.
- The connection drops every few minutes after a switch change.
- Multicast filtering without a querier: the switch prunes the group after a timeout. Enable the querier on the I/O network or use unicast connections.
- How fast should the packet interval be?
- As slow as the process allows. A lift station rack at 50 milliseconds is fine; a plant with forty racks at 10 milliseconds saturates the controller. The controller reports the packet rate against its limit.
- Can I add a module to a running rack?
- Adding to the configuration usually needs a download or an online change that the platform supports; inserting the module under power depends on the hardware. Plan it as a change with the outputs of that rack considered.
How to Build a Tag
Read the guide →- Should the SCADA tag scale the raw value?
- No, if the controller can scale it, which it can. The controller holds the engineering value in a float; SCADA displays it. Scaling in SCADA creates a second place for the range to be wrong.
- What goes in the description?
- What the point is, where, and in what units, in words: Clearwell level, feet above floor. The description appears in alarm messages and tag browsers and is what a new operator reads.
- How do I keep tag names consistent across sites?
- A written convention, a template per equipment class, and a review of every tag export against the convention before it goes live. Naming drift is the main reason screens from two integrators look like two plants.
- The value shows on the screen but is wrong.
- Check the binding: table, offset, data type, word order, and unit identifier; then the scaling in both places. Read the raw value at the controller and compare.
How to Configure Alarms
Read the guide →- Controller alarm or SCADA alarm?
- Controller for anything about the process or equipment: it is evaluated every scan, survives a SCADA outage, and drives interlocks. SCADA for the system health items the controller cannot see. Both appear in the same alarm system.
- How many priorities?
- Three or four: urgent, high, medium, low, or similar. More than four cannot be distinguished by an operator under load.
- What alarm rate is acceptable?
- The commonly cited targets are on the order of one or two alarms per operator per ten minutes on average, and a flood is more than ten in ten minutes. Rates above that mean rationalization was skipped or the limits are wrong.
- Should every alarm call out?
- No. Urgent and high call out per the roster; medium and low wait for the screen. A pager that goes off for a door open at noon is a pager that gets ignored at midnight.
How to Trend Data
Read the guide →- How many pens on one trend?
- Two to four. Beyond that the chart is unreadable and the question is not one question. Build two trends.
- Live trend or historian trend?
- Historian. A live trend starts empty and forgets when the client closes; a historian trend opens with the past and is the same on every client.
- Why does my trend show a straight line where the level cycled?
- The history collection interval or deadband is too coarse for that tag, or the trend is decimating the samples. Check the collection settings for the tag and the trend sampling mode.
- Should operators be able to save their own trends?
- Yes. A saved trend per user or per shift is how operators build the views they actually use, and the good ones become the standard trends.
How to Configure a Historian
Read the guide →- How much history should I keep?
- Compliance data for the period the regulator requires plus margin, often five years or more; operational data for a year or two at full resolution and longer aggregated. Disk is cheap; data you deleted is gone.
- Should the historian collect from the controllers or from SCADA?
- From the controllers directly where the historian has drivers, so that a SCADA outage does not lose history; through the SCADA server where that is the only path. Either way, buffers at the collector.
- The trend shows gaps after every server reboot.
- No store-and-forward, or a buffer that is not enabled for those tags. Enable and size the buffer, and test it by pulling the cable.
- Who owns the historian?
- Someone named: a person who checks disk space, reviews the tag classes when tags are added, tests the restore, and updates the sizing. A historian without an owner fills its disk on a holiday.
How to Build Pump Graphics
Read the guide →- Should a running pump be green?
- Not on a high-performance screen. Running is normal, and normal is grey; green and red are reserved for states that need attention. A filled symbol reads as running from across the room without color.
- How do I show a pump on a drive?
- The same symbol with a small speed value or bar, and the faceplate with the speed reference, the actual speed, and the drive fault reason. A separate drive faceplate is opened from the pump faceplate for the drive details.
- Where does the hand-off-auto selector on the panel appear?
- As the mode indicator on the symbol and the mode display on the faceplate, read from the panel selector inputs. The faceplate cannot change a physical selector; it shows that the pump is not in remote control.
- One template for every pump in the utility?
- Yes, with parameters for the differences: drive or not, feedbacks available, current measured. One template means one behavior to learn and one place to fix.
How to Configure Remote Access
Read the guide →- Can operators use the SCADA web client from home directly?
- Through the virtual private network and the demilitarized zone, yes; exposed to the internet, no, whatever the vendor says about its security. The web client is served from the demilitarized zone or reached through the jump host.
- Why a jump host instead of connecting the client straight through the tunnel?
- A laptop at home is not a hardened machine, and the tunnel would carry whatever is on it into the control network. The jump host is one machine the plant controls, patches, and records.
- What about the integrator who needs to program controllers from their office?
- The vendor role: enabled per request for a set time, through the same tunnel and jump host, with the engineering protocols permitted from the jump host to the specific controller, and a plant person watching. Standing vendor access is a back door.
- How do I know the bypasses are gone?
- An external scan of the plant public addresses, an inventory of every cellular device and modem, and a look at every router configuration for port forwards. Then a policy and a periodic repeat.
How to Troubleshoot a Flowmeter
Read the guide →- The meter reads flow when the pump is off.
- A magnetic meter with electrode noise or a grounding problem, a differential pressure meter with a zero shift, an ultrasonic meter with a signal problem, or a check valve leaking so there is real flow. Set the low flow cutoff appropriately, then check grounding and zero.
- The meter reads exactly zero with the pump running.
- The empty-pipe detection has triggered, the signal path is open, or the transmitter has faulted. Read the diagnostic, then measure the loop current.
- How do I get an independent measurement without a second meter?
- A tank or wet well draw-down: close the inlet, run the pump for a timed interval, compute the volume from the level change and the geometry. A clamp-on ultrasonic meter is the portable alternative.
- The total is wrong but the rate looks right.
- The pulse scaling or the totalizer in the controller, not the meter: check the volume per pulse, the counter input rate, and the rollover handling.
How to Select Surge Protection
Read the guide →- Do I need protection on loops that stay inside the plant?
- Usually not for lightning if the building is bonded; consider it for loops near large drives or between buildings on separate grounds. Prioritize what leaves the building.
- How do I pick the surge current rating?
- From the exposure: higher for the service entrance and for remote sites on hills or with masts, lower for downstream stages. The manufacturer application guides give ranges by location; when in doubt, choose the higher rating at the entrance.
- What series resistance can a loop tolerate?
- The loop voltage budget: supply voltage minus the transmitter minimum minus the receiver drop minus the cable drop, divided by 20 milliamps, gives the ohms available; the protector resistance must fit within it with margin.
- Can one device protect several loops?
- Multi-channel protectors exist for groups of circuits at the same voltage, and they save space; each channel is still a device with its own ratings, and a failure in one channel is found only by testing that channel.
How to Size an Enclosure
Read the guide →- How much spare space?
- A quarter to a third of the mounting area on a plant panel, more on a panel for a process that will change. Spare space costs a few inches of steel; a second enclosure costs a project.
- Can I mount components on the door?
- Operator devices, displays, and light devices, with the door bonded and the depth accounted for. Not heavy devices, and nothing that puts live parts within reach when the door opens without a dead front.
- Fan or air conditioner?
- A filtered fan where the ambient air is cool, clean, and dry enough to cool the panel; an air conditioner where it is not or where the load is large; a heat exchanger between. The heat calculation and the site conditions decide, and a fan in a dusty room is a filter maintenance program.
- Why is the panel hotter than the calculation said?
- A component loss underestimated, usually a drive or a power supply at load; a sun exposure not counted; a filter clogged; or a component mounted in the hot zone above a transformer. Measure the temperature at the top and the drive losses at load.
How to Build Terminal Schedules
Read the guide →- Spreadsheet or drafting tool report?
- The drafting tool report where the schematic is drawn in a tool that tracks wires; it cannot disagree with the drawing. A spreadsheet driven from the wire list otherwise, with a discipline that the drawing changes first.
- How do I number terminals on a multi-level block?
- One number per position with a level suffix, upper, middle, lower, or U, M, L, and the schematic drawn to show the levels. A three-level strip drawn as flat terminals is where wiring errors come from.
- What about junction boxes in the field?
- Each junction box has its own schedule on the same pattern, with its cable in and cables out, and the panel schedule references the box and its terminal. The chain from panel to device is traceable through the schedules.
- The panel shop wired it differently from the schedule.
- Find out why; sometimes the layout forced it. Then the schematic is corrected to what was built, the schedule regenerated, and the panel re-marked if needed. Never two documents that disagree.
How to Design Panel Grounding
Read the guide →- Should the instrument ground have its own rod?
- No. A separate rod that is not bonded to the rest is an isolated ground and a hazard; the instrument ground is a bar bonded to the enclosure ground at one point. If a rod is installed for the instrument bar, it is bonded to the site electrode system too.
- Where do the cable shields go?
- On the shield bar at the panel end, with the field end insulated. A shield grounded at both ends carries ground loop current and noise into the signal.
- How low should the electrode resistance be?
- As low as the site allows, with the code and the surge device requirements as the reference; more important is that every electrode at the site is bonded together. Record the measured value and retest periodically.
- The drive manual says bond the motor cable shield at both ends. Does that contradict the shield rule?
- No. The drive output cable shield is a power circuit shield carrying high-frequency current back to the drive and is bonded at both ends per the drive manual. Signal shields are grounded at one end. Different circuits, different rules.
How to Test Fiber
Read the guide →- Light source and power meter, or reflectometer, or both?
- Both at acceptance: the light source and meter gives the accurate total loss, the reflectometer shows where the loss is and gives the baseline trace. At a fault the reflectometer finds the event; the meter confirms the repair.
- Which wavelengths?
- The ones the transceivers use, and both windows the fiber supports: 1310 and 1550 nanometers for single-mode, 850 and 1300 for multimode. A bend shows more at the longer wavelength.
- The loss is fine but the link still errors.
- Receive power above the overload level on a short link, a mismatched transceiver pair, or a reflective event close to the transmitter raising its noise. Read the transceiver diagnostics and check for a fixed attenuator need.
- Can I test with the transceivers only?
- The transceiver power readings are a useful check and the fastest troubleshooting step, but they do not give per-strand loss or event location, and their accuracy is a decibel or two. Acceptance testing uses the instruments.
Processor Faulted
Read the guide →- Can I just clear the fault and put it back in run?
- You can, and it is often the right first move to get the process running, provided the equipment is in a state where outputs coming back is safe. But clear it having read and recorded the code, because if the cause is still there the fault comes back and you have lost the evidence.
- What is the difference between a recoverable and an unrecoverable fault?
- A recoverable fault can be cleared and the processor returned to run without a power cycle. An unrecoverable fault needs a power cycle, and sometimes a download, because the processor cannot trust its own state.
- The processor faulted after I replaced an I/O module. Why?
- The replacement is a different part number or revision than the I/O configuration expects, or it was inserted with the chassis powered on a platform that does not allow it. Match the part number exactly, or update the configuration and download.
- Why do the outputs behave strangely when the processor is faulted?
- They are at their configured fault state, which is set per module or per channel: hold last state, turn off, or go to a value. That configuration is a design decision and it may not be what the process needs. Review it.
Outputs Not Energizing
Read the guide →- The output shows on in the program but the light on the module is off. What does that mean?
- The processor is not delivering the output image to the module: a force, a mode that is not writing outputs, a lost remote connection, or a failed module or backplane slot. Check forces and mode first, then the I/O status.
- The module light is on but there is no voltage at the terminal.
- The module fuse for that group is open or the field supply to that group common is missing. Measure the common against the supply return, then check the group fuse and the branch fuse feeding it.
- Why would a new fuse blow immediately?
- The fault that blew the first one is still there: a shorted coil or cable, an overloaded point, or an unsuppressed inductive load that has damaged the output. Measure the load and the wiring before replacing the fuse again.
- Can a PLC output drive a motor starter coil directly?
- Some can, within the point rating, but it is poor practice. An interposing relay keeps the coil current and voltage off the module, provides isolation, and fails cheaply. Most panels use one.
Inputs Not Reading
Read the guide →- The module light is on but the program bit is off. What is wrong?
- The module sees the voltage and the processor is not reading the module, or is reading it and something in the program is masking it: a force, a wrong address, a remote connection that is stale, or logic that reads the bit with the wrong instruction for the wiring convention. Check those in that order.
- Why did a whole group of inputs stop reading at once?
- The wetting voltage or the common for that group is gone. A branch fuse for the field supply has opened, or the common terminal has come loose. One point failing is a device or a wire; a group is a supply.
- What is a wetting voltage?
- The voltage that a closed field contact lets through to the input module. It comes from a supply in the panel, 24 VDC or 120 VAC depending on the module, and without it a closed contact delivers nothing to the input.
- Can I test an input by shorting the terminal to the supply?
- Jumpering the input terminal to the wetting supply, with the field wire lifted, is a legitimate way to prove the module point, provided the voltage and the polarity are right for the module and the circuit is one where making that input true is safe. Know what the input does in the program first.
Program Will Not Download
Read the guide →- Why is the download option greyed out?
- The software is not connected to a processor that will accept one. Either there is no connection, or the processor is in run with the key in run. Connect, then change the mode.
- The software says the controller is the wrong revision. Should I flash it?
- Only if the site standard says that revision is the target. Flashing changes the processor firmware for everything that runs on it. The alternative is to change the project revision to match the processor, which may be the right answer if the processor is the one that was already running the plant.
- Can I download while the plant is running?
- A full download requires program mode, which stops logic and drives outputs to their configured state for the duration. Online edits change logic while running and are the tool for small changes. A full download is planned with the process in a state that can tolerate the stop.
- Should I upload before I download?
- Yes, whenever there is any doubt that the saved project is current. Online edits made since the last save exist only in the processor, and a download erases them.
Logic Not Executing As Expected
Read the guide →- The rung is true online but the output does not turn on. Why?
- Almost always another rung writing the same output later in the scan. Cross reference the output tag. If nothing else writes it, check for a force, then for the routine not actually being scanned.
- Why does my equals comparison never work on a level setpoint?
- Because the two floating point values differ in the last bit and are never exactly equal. Compare with a tolerance, or use greater than or equal and less than or equal with a deadband.
- I made an online edit and nothing changed.
- The edit is accepted but not assembled, so the controller still runs the old rung. Or the edit is in a routine that is not called. Or the edit was made to a project that was never downloaded. Check each in that order.
- What is a destructive output?
- An instruction that unconditionally writes a bit every scan, such as a standard output coil. Two of them on the same bit fight, and the last one scanned wins. Use one output per bit and combine the conditions on its rung.
Retentive Data Lost
Read the guide →- Can I get the setpoints back after the battery died?
- From the last upload of the controller, from the SCADA database or historian, or from the control narrative and the operators. The controller itself has nothing to give back.
- Why did a download reset my setpoints?
- A download writes the whole project, including the tag values saved in the project file, and those are the values from the day it was saved. Upload before you download, and either merge the current values into the project or restore them afterward.
- How do I know if my controller has a battery or a capacitor module?
- From the processor manual and the module on the front of it. Newer processors mostly use an energy storage module with no replacement; older ones use a lithium battery with a replacement interval. Either way the controller reports its status.
- Should setpoints be stored in SCADA as well as the PLC?
- Yes. The controller is the authority while running, and SCADA is the backup that refills it after a loss. Write-back on first scan or on an operator command, with the operator confirming, is the usual arrangement.
Values Frozen On Screen
Read the guide →- How can I tell whether the controller or SCADA is the problem?
- Watch the tag in the controller with the programming software. If it changes there and not on the screen, the path between them is broken. If it is static there too, the controller or the field is the problem and SCADA is showing the truth.
- Why does the driver show connected but the values do not update?
- The controller is answering but not scanning: faulted or in program mode. Or the tag is in a scan group that is disabled or set to a very slow rate. Or the value genuinely is not changing.
- Why did every screen freeze at once?
- The tag server or the SCADA runtime stopped, the license lapsed, or the client lost the server. Check the service on the server and the connection banner on the client.
- How do I make stale data obvious to operators?
- Use the platform feature that displays bad or stale quality differently, and put a communication status indicator for each controller on the overview display. Frozen data that looks live is the failure to design out.
Tag Shows Bad Quality
Read the guide →- What is the difference between bad and uncertain quality?
- Bad means the driver has no trustworthy value: the device is unreachable or refused the request. Uncertain means the driver has a value it does not fully trust, usually the last good one held past its update time, or one the device flagged as questionable.
- Why is one tag bad when the rest from the same device are good?
- That tag’s address does not exist on the device, or its data type does not match what the register holds. The connection is fine. Check the address against the register map and the type against what the device serves.
- All my tags went bad after a PLC download. Why?
- Tags were renamed, moved to a different scope, or deleted in the new program, or the download changed the controller path. Compare the SCADA tag list to the controller’s and update the references.
- Can a value be wrong with good quality?
- Yes. A float read with the wrong word order, or an integer read from the wrong register, returns a number the driver has no reason to doubt. Good quality means the transaction succeeded, not that the mapping is right.
Pump Will Not Start
Read the guide →- The pump starts in HAND and the controller output is on, but it will not run in AUTO. What is left?
- The path between the controller output and the starter in the AUTO position: the output module channel, an interposing relay, the AUTO contact of the HOA, and the wiring. Measure at each. An output channel can be on in the program and dead on the terminal.
- The overload trips every time I reset it. Should I raise the setting?
- No. The overload is set from the motor nameplate full-load current, and a motor that trips a correctly set overload is drawing more than it should: locked rotor, rags, a failing bearing, single phasing, or a wrong voltage. Raising the setting turns a tripped overload into a burned motor.
- How do I know whether the drive is receiving the run command?
- The drive status display or the keypad shows the state of the digital inputs and, on a networked drive, the command word. If the drive shows ready and no run command, the problem is the source of the command. If it shows the run command and does not run, look at the enable, safe torque off, and fault status.
- What causes a pump to fail to start only occasionally?
- A marginal control circuit: a corroded HOA contact, an overload auxiliary that is intermittent, a loose terminal, a coil at the low end of its voltage tolerance on a long control run, or a float contact that only sometimes closes. Catch it with a trend of the call and the run confirmation, and measure while it is failing.
Pump Runs But No Flow
Read the guide →- The pump moves water in HAND but not in AUTO. Is that a pump problem?
- No. If the pump moves water at all, the pump is fine. In AUTO it is running for a shorter time, at a different speed, or with a different valve state. Look at the drive speed reference in AUTO, the minimum run time, and any valve that is sequenced with the pump.
- How do I know whether the impeller is worn out?
- Compare the drawdown rate with the commissioning record at the same level band and the same number of pumps. A pump delivering 70 percent of its original flow at normal current and normal pressure has lost capacity to wear. Wear ring clearance measured at the next pull confirms it.
- Can a variable speed pump run without flow?
- Yes, if the speed is below the point where the pump develops enough head to open the check valve against the force main static head. A drive minimum speed set too low, or a speed reference stuck low, gives a running pump moving nothing. Raise the minimum speed above the point where flow begins, which is found from the curve or by test.
- What causes a station to reach high level with both pumps showing running?
- Both pumps clogged, which happens in a wipes event; a blocked or closed force main; or a level transmitter reading low with the pumps having shut off long ago. Motor current and discharge pressure on both pumps answer it.
Pump Short Cycles
Read the guide →- How many starts per hour is too many?
- The motor manufacturer sets it, and for submersible wastewater pumps it is commonly six to ten. Large motors and motors on across-the-line starters allow fewer. A drive with a soft start allows more, because each start heats the motor less. The number is on the motor data sheet, and if it is not, ask.
- Why does the station only short cycle at night?
- At night the inflow is lowest, so the well takes longest to refill, and the run is the same length as always. If the cycle looks short it is because the run is short: the band is narrow. Where the inflow at some hour happens to be near half the pump capacity, that is the worst-case cycle from the formula.
- Should I add a delay to the stop, or to the start?
- A short off-delay at the stop setpoint prevents restarts on noise. A minimum off time after a stop prevents the next start regardless of level and is the direct protection for the motor. Use both; keep the minimum off time short enough that a real rise in level is not held off dangerously.
- The pump short cycles only with the VFD in AUTO. Why?
- The drive is probably running at a speed too low to move water against the static head, so the level rises with the pump running and the logic stops and starts it around the stop setpoint. Raise the minimum speed, or check that the speed reference in AUTO is what the program intends.
Drive Will Not Start in AUTO
Read the guide →- The drive shows the run command and the reference, and still will not run. What is left?
- Enable, safe torque off, an external fault or interlock input, a warning that blocks start such as motor overtemperature, or a drive that requires a rising edge on the run command and is seeing a level. Check every input the drive lists as required, and check whether the drive expects two-wire or three-wire control.
- How do I tell whether the drive uses two-wire or three-wire control?
- Two-wire control runs while the run input is held closed. Three-wire control starts on a momentary start input and stops on a normally closed stop input. A controller output wired as a maintained contact to a drive configured for three-wire control gives one start and then nothing, or nothing at all if the stop input is open.
- The drive ran in AUTO yesterday. What changed?
- Something. A parameter reset or a swapped drive, a program download that changed an output or a scaling, a relay that failed, a seal-leak or safety relay that dropped out, a network connection lost. The drive display and the change log narrow it. The most common answer is a drive that was replaced and configured for HAND operation only, because that was what was tested.
- Should the drive enable be controlled by the PLC?
- It is usually hardwired through the HOA and the safety devices, so that the drive is enabled whenever the pump is in HAND or AUTO and disabled in OFF and on a safety trip, independent of the controller. Wire it that way, document it, and do not route it through a controller output unless the design calls for it.
Transmitter Reads Wrong Value
Read the guide →- The level reads 0.8 feet high at every level. What is it?
- A constant offset: the transmitter reference point is not where the configuration assumes, the empty distance was taken from a drawing instead of a tape, or on a pressure transmitter the elevation head from the mounting. Re-measure the reference distance and re-enter it.
- The flow reads right at zero and at full scale but low at half flow. Why?
- A differential pressure flow signal is being square-rooted twice, once in the transmitter and once in the controller, or not at all. At 50 percent flow the DP is 25 percent, and a double square root gives about 71 percent of the right value. Set one device to take the square root and the other to pass the signal linearly.
- Should I calibrate the transmitter or fix the scaling?
- Whichever is wrong. If the transmitter matches the reference and the HMI does not, the controller scaling is wrong and the transmitter is left alone. If the transmitter does not match the reference, the transmitter is calibrated and the scaling is left alone. Fixing the wrong one makes the next comparison worse.
- How close should the transmitter and the reference be?
- Within the combined uncertainty of both, which for a good pressure transmitter and a test gauge is well under a percent of span, and for a wet well tape against a radar is an inch or two. A difference within that is noted, not chased.
Level Reading Jumps
Read the guide →- Why does the level jump only when the well is nearly empty?
- The obstruction or the disturbance is low in the well: a pump body, the inflow falling further when the level is low, or a submersible transmitter being stirred by the pump intake. Re-map at low level, move the sensor, or raise the stop setpoint slightly.
- The radar was fine for years and now jumps. What changed?
- Something new in the beam: a float cable, a rag caught on a rail, a pump replaced with a different profile, a new ladder. Look in the well from the hatch. The echo curve in the configuration tool shows the new reflection.
- Can I just add deadband to the pump setpoints?
- Deadband stops the pump from cycling on noise at the setpoint, and it is part of a good sequence. It does not fix a measurement that jumps a foot, and a deadband wide enough to cover that changes the station operation. Fix the measurement.
- Should I replace the ultrasonic with a radar?
- If the causes are condensation, temperature gradients, or vapor, yes; radar is largely immune to all three and has become the default for wet wells. If the cause is a false echo from an obstruction, a radar has the same problem and needs the same mapping.
Device Times Out
Read the guide →- The device times out every few minutes and then recovers. What is it?
- A marginal path or a busy device: a radio fade, a periodic burst of other traffic, a device task that runs periodically and delays the reply, or a poll schedule that occasionally collides. The response time trend shows the peaks; match their timing to something in the system.
- The device answers the laptop but not the SCADA server. Why?
- A difference in configuration between the two masters, or a network difference: the server on a different VLAN with a firewall rule, a different unit ID, a different port, or a connection limit the server has reached and the laptop has not. Compare settings first, then the network path.
- How long should a Modbus timeout be?
- Long enough for the slowest legitimate response plus margin. On a direct serial link, 500 ms to 1 s. Through a radio, 2 to 5 s. Over cellular, 5 to 10 s. Measure and set; do not use the default.
- Can too many retries make things worse?
- Yes. Retries on a timed-out device consume poll time that the other devices needed, so one dead device slows the whole bus. Two or three retries, then mark the device offline and poll it less often until it answers.
Alarms Not Annunciating
Read the guide →- The alarm shows in the summary but never sounded. Why?
- The priority is below the audible threshold on that client, the client is silenced, or the sound hardware failed. Check the client audio configuration for the priority and test the sound. A silenced state that persists across alarms is a configuration fault.
- The alarm was in the journal and nobody was called. Why?
- The notification rule did not match, the notifier did not receive the alarm from SCADA, the notifier failed, or it called the wrong person. The notifier log answers it. If the notifier keeps no log, that is the first problem to fix.
- The alarm bit set and the tag was good, but the alarm server has no record. Why?
- The alarm server was not evaluating: the service was stopped, the standby server had the alarm role after a failover and was not running it, or the alarm configuration for the tag was removed. Check the service state and the failover history at the time.
- How do I prevent this?
- A master alarm database that is the configuration source, permissions that keep disabling and indefinite shelving away from ordinary users, area and filter settings under change control, a notifier heartbeat that is acknowledged every shift, and an end-to-end alarm test on a schedule.
Drive Faults on Overcurrent
Read the guide →- The drive trips the moment I press start, even with the pump valve open. What is it?
- Almost always the motor circuit: a shorted winding, a shorted or wet cable, or a ground fault. Lock out, disconnect the motor at the drive, and test the insulation. A locked rotor is the other possibility; turn the shaft.
- The drive trips at the same frequency every time during the ramp. Why?
- The load at that speed exceeds what the drive can deliver within the ramp: a pump reaching the head where the check valve opens and the current jumps, or a ramp too short for the inertia. Lengthen the acceleration time and watch the current at that frequency. If the current is still above the motor rating with a long ramp, the pump is jammed or wrong for the head.
- Can a long motor cable cause overcurrent trips?
- Yes. A long cable has capacitance that the drive charges at every switching edge, and the charging current adds to the motor current; on a submersible pump with hundreds of feet of cable it can trip the drive. An output reactor, a dV/dt filter, or a lower switching frequency, per the drive manufacturer cable length guidance.
- The drive trips on overcurrent on stop. Why on stop?
- The pump is driving the motor as it decelerates, and the energy comes back into the drive; the drive sees it as current and, usually, as a rising bus voltage. Lengthen the deceleration ramp, enable the drive overvoltage control, or add a braking resistor where the load requires a fast stop. On a pump, a coast to stop is often acceptable.
Drive Faults on Overvoltage
Read the guide →- The drive trips on overvoltage every time the pump stops. What do I change?
- The deceleration: lengthen the ramp, enable the overvoltage controller, or set the stop mode to coast. On a pump, a coast is usually acceptable and it removes the regeneration entirely. Check that the check valve closes gently with the new stop.
- The trips happen at 2 p.m. every day. Why?
- Something on the utility feeder switches at that time, most often a capacitor bank for power factor correction, and the transient reaches the drive. A line reactor at the drive input is the fix; the utility may also be willing to adjust the switching.
- Can a drive run on a generator without overvoltage trips?
- Yes, with a longer deceleration or the overvoltage controller enabled, because a generator cannot absorb regenerated energy the way the utility can. Generator voltage regulation also matters; a set with a poor regulator swings the bus.
- Should I add a line reactor to every drive?
- A 3 percent line reactor or a DC bus choke is standard practice on drives above a few horsepower: it reduces harmonics, protects against transients, and extends the drive life. Many drives include a DC choke; check before adding a reactor that duplicates it.
Motor Will Not Reach Speed
Read the guide →- The drive shows 60 Hz and the pump only delivers 70 percent of its flow. What is wrong?
- If the current is high, the motor is slipping under an overload and the pump is at a lower speed than the frequency suggests, or the pump itself is worn or partly clogged and delivers less at speed. If the current is normal or low, the pump is at speed and the flow shortfall is hydraulic: a worn impeller, a partly closed valve, a high head. Compare with the pump curve at the measured head.
- After replacing the drive the pump runs slower than before. Why?
- The new drive is at default parameters: a maximum frequency, a motor data set, a volts per hertz pattern, or a reference scaling that differs from the old one. Load the backed-up parameter set, or re-enter every parameter from the record, and confirm the four numbers.
- Can I run the motor above 60 Hz to compensate?
- Only with the pump and motor manufacturer approval and a check of the motor power at the higher speed. Above base frequency the motor voltage cannot rise further, so torque falls, while the pump power demand rises with the cube of speed. Most pump applications never exceed base frequency.
- The drive says the motor is at speed but the pump is not turning. What is left?
- The coupling, the shaft, or the key between the motor and the pump. The motor is spinning free at low current. Lock out and inspect.
Drive Trips on Ground Fault
Read the guide →- The insulation reads fine and the drive still trips on ground fault. What now?
- Capacitive leakage on a long or shielded cable, an output filter with a ground path, a wiring error, or the drive. Check the cable length against the drive limit and try a lower switching frequency; inspect every termination; run the drive with the motor disconnected. In that order.
- What insulation resistance is acceptable?
- A common rule for a motor is a minimum of one megohm per kilovolt of rating plus one, so at least 1.5 megohms for a 480 V motor, with new motors reading in the hundreds of megohms or more. The trend matters more than the number: a motor that read 500 megohms last year and 20 this year is failing.
- Why does the pump trip only after running for twenty minutes?
- The insulation breaks down at temperature: a winding with a weak spot that holds when cold and leaks when hot. Test the motor immediately after it has run, or with a heated test where the shop can do it. The motor is at the end of its life.
- Can a ground fault on one pump trip the drive on the other?
- Not through the drive, since each drive measures its own outputs. It can trip an upstream ground fault protection device that covers both, and a fault that puts current into the ground grid can disturb instruments. The drive that trips is the one with the faulted motor.
Ground Loop Symptoms
Read the guide →- How much voltage between grounds is too much?
- For a 0-10 V signal, a few hundred millivolts is a visible error. For a 4-20 mA loop with one ground, a few volts is harmless. For serial RS-485, the standard tolerates about minus 7 to plus 12 volts of common mode, and beyond that transceivers fail. Whatever the signal, several volts between grounds means current is flowing where it should not, and that is a grounding fault to find.
- The offset only appears when the well pump runs. Is that a ground loop?
- Probably: the pump motor and its drive put current into the grounding system while running, the potential between grounds rises, and a signal circuit with two grounds shows it. Measure the voltage between grounds with the pump off and on. The fix is the same, isolate the signal, and a shielded motor cable bonded at both ends reduces the cause.
- Can a ground loop damage anything?
- Usually it just corrupts signals, but a shield carrying fault current or lightning current can burn, and an input channel exposed to a large common-mode voltage can be destroyed. Isolation protects the input as well as the reading.
- Is a battery-powered meter reading the same as the controller proof there is no loop?
- No. A floating meter measures the voltage at its leads and is not part of any ground loop. The controller input has a ground reference and is. Compare the transmitter local display, the loop current at both ends, and the controller reading; the loop shows up as the difference between the last two.
Floating Reference Between Panels
Read the guide →- Is it wrong for a 24 VDC supply to be ungrounded?
- No. A control circuit at that voltage may be grounded or ungrounded. Ungrounded systems tolerate one ground fault and need a ground fault monitor so that the fault is found before a second one causes trouble. The fault is inconsistency: one panel grounded and another not, with signals wired directly between them.
- Why did it work on the bench?
- On the bench both panels were fed from one supply or sat on one bench ground, and the earth or the shared supply provided the return. In the field each panel had its own supply and its own ground, or a ground path of high impedance, and the return disappeared.
- Can I just run a common wire between the panels?
- For discrete signals within one building on one grounding system, yes, if the commons are bonded at one point each and the wire carries only the signal returns, not load current. The cleaner answer that also protects each panel from the other is an interposing relay per signal.
- The input reads 12 V and is off. What is that?
- The signature of a floating reference or an open return: the input sees a voltage through leakage but no current flows through it. Measure from the input common to the sending panel common; the wandering or offset voltage you find is the missing reference.
Shield Grounded at Both Ends
Read the guide →- The manufacturer says to ground the shield at the transmitter. Who is right?
- Follow the manufacturer for that device, and then do not ground the same shield at the panel. The rule is one ground per shield, and some transmitters, particularly ones with radio frequency protection built in, are designed for the shield to terminate at the device. What is never right is both.
- Is it acceptable to leave a shield unconnected at both ends?
- It does nothing then, and the pair is unshielded. Connect it at one end. A shield with no ground can also float up to a voltage through capacitance and give a surprising tingle from a long cable.
- Why are drive motor cables bonded at both ends when instrument cables are not?
- Because the motor cable shield has a different job: it is the return path for the high-frequency current the drive pushes through the motor cable capacitance. Bonded at both ends with a 360 degree connection, that current stays in the cable instead of returning through the plant ground, where it would raise the potential differences that cause instrument problems.
- Can I ground shields on a common bar with everything else in the panel?
- Yes, if that bar is bonded to the panel ground bus, which is the reference for the analog inputs. Some designs use a separate instrument ground bar tied to the main bus at one point; that is fine too. The point is one connection to one ground per shield.
Missing Equipment Ground
Read the guide →- The panel is fed through metal conduit. Is that not the ground?
- Metallic conduit with proper fittings is a permitted equipment grounding conductor, and it works until a joint corrodes, a coupling loosens, or someone replaces a section with nonmetallic. Many designers run a separate ground conductor inside the conduit anyway for that reason. If conduit is the ground, every joint is part of the fault path and has to be tested as such.
- How low should the resistance to the source ground be?
- Well under one ohm for a panel fed within a building, often under a tenth. What matters is that the fault current through it is enough to trip the breaker quickly, and that requires the impedance of the whole loop to be low. A value over an ohm means a bad connection somewhere in the path.
- Can I use a plug-in outlet tester?
- It will show an open ground at a receptacle, which is useful. It cannot tell a good ground from a poor one, and it cannot see a neutral-to-ground jumper masquerading as a ground. Follow up any finding with the resistance test.
- Why does the surge protector care?
- A surge protective device works by diverting surge current to ground. With no ground, or a long high-impedance one, the surge has nowhere to go and the protected equipment takes it. The ground conductor to the surge protector should be short and direct; a missing one means the device is decoration.
High Neutral-to-Ground Voltage
Read the guide →- What neutral-to-ground voltage is acceptable for a PLC panel?
- Under two volts under load is the usual guidance, and most control power supplies are unaffected below that. Above it, investigate the cause rather than the number; the same causes produce transients and ground current that hurt the equipment more than a steady two volts does.
- My reading is exactly zero at a panel far from the service. Is that good?
- Only if that panel is unloaded. A loaded panel far from the service has to show some drop. Zero almost always means the neutral is bonded to ground in that panel or nearby, and the ground system is carrying part of the neutral current. Clamp the ground conductor to confirm.
- Can a drive cause high neutral-to-ground voltage?
- A single-phase drive or a bank of switch-mode power supplies draws current in pulses rich in third harmonic, and on a three-phase four-wire system those add on the neutral instead of cancelling. The neutral current can exceed the phase current, and the drop follows. A true RMS clamp on the neutral shows it; the fix is a larger neutral, separate neutrals per phase, or harmonic mitigation.
- Does an isolation transformer fix it?
- A transformer creates a separately derived system with its own neutral-to-ground bond at the transformer, so the panel it feeds starts from a fresh zero and is unaffected by the upstream neutral drop. It is the standard cure for a control panel fed by a long, noisy, heavily loaded circuit, and it also blocks a good deal of common-mode noise. It does not fix the upstream problem, which still needs attention.
Cable Routing Problems
Read the guide →- Can a shielded cable share a conduit with power?
- Codes allow certain combinations, and the shield helps, but it does not make it a good idea. A shield reduces capacitive coupling and does little against magnetic coupling from motor current, and a drive cable in the same conduit will still be heard. Treat a shared conduit as a last resort and keep the drive cables out of it entirely.
- How far apart do drive cables and signal cables need to be?
- Follow the drive manufacturer table, which usually gives spacing as a function of parallel length and cable type, and the values are commonly a foot or more for open runs of any length, less in steel conduit. When in doubt, more. The cost of distance is a few feet of cable; the cost of too little is an isolator on every loop.
- The noise only started after a new cable was pulled. Nothing else changed.
- Then the new cable either is the source, such as a new drive cable pulled through a tray of signal cables, or is the victim, such as a new analog cable pulled through the nearest conduit that happened to carry motor leads. Trace it. Pulling a cable through whatever conduit has room is the most common way a clean plant gets noisy.
- Does crossing at a right angle really matter?
- Yes, because coupling is proportional to the length over which the cables run parallel. At a right angle that length is essentially the cable diameter. A crossing at a shallow angle, or a run that drifts alongside for a few feet before crossing, is a short parallel run, and several of them add up.
Common-Mode Noise
Read the guide →- My input is differential. Why does it still see the noise?
- Because the common-mode voltage exceeds the range the input can reject, or because the circuit is unbalanced enough that some of the common mode converts to normal mode. Measure the common-mode voltage against the module specification; if it is anywhere near the limit, isolate.
- Will a ferrite core fix 60 Hz common mode?
- No. Ferrite chokes work at kilohertz and above; at 60 Hz they are a piece of wire. Power-frequency common mode comes from ground potential differences and is fixed by isolation and by correcting the grounding system.
- Is common-mode noise the same thing as a ground loop?
- A ground loop is one way common-mode voltage gets applied to a circuit: two ground connections at different potentials. Common mode also arises without any loop, from capacitive coupling and from drive currents. The tests and the fixes overlap, and isolation cures both.
- Why does a drive produce common-mode current?
- The drive switches its output between the DC bus rails thousands of times a second, and the sum of the three output voltages is never zero at any instant. That non-zero sum drives current through the capacitance between the motor cable and ground and between the motor windings and the frame. With a shielded cable bonded at both ends, that current returns on the shield; without one it returns through the plant ground and every signal circuit that touches it.
Radio Frequency Interference
Read the guide →- Why does the reading go up rather than just getting noisy?
- Because the input rectifies the radio energy into a DC offset. The high-frequency voltage itself is beyond what the input can follow; what it produces is a shift in the operating point of the input stage, which the rest of the circuit reads as a change in the process value.
- Can I just tell people not to use radios near the panel?
- It helps for handhelds and is a reasonable rule with the door open, but the plant radio system, the cellular modem, and the telemetry radio transmit whether or not anyone is standing there. Fix the entry paths and the rule becomes a courtesy rather than a requirement.
- Is a plastic enclosure a problem?
- It offers no shielding, so the cabling and the devices inside have to provide all the immunity. A metal enclosure, bonded and closed, attenuates radio energy substantially. Where a plastic enclosure is required for corrosion, use shielded cable with proper termination, ferrites, and devices with good immunity ratings.
- The transmitter is rated for radio immunity and still shifts. Why?
- The rating is measured with the cable installed as the manufacturer specifies, usually shielded and terminated correctly. A transmitter wired with unshielded cable or a long shield pigtail sees much more energy than the test did. Fix the cable termination before blaming the transmitter, and then check for surge damage.
Unshielded Cable in a Noisy Run
Read the guide →- The loop is 4-20 mA on unshielded wire and works fine. Should I replace it anyway?
- If it is clean and the route is not going to get noisier, leave it and note the cable type on the drawing. Current loops on plain conductors are common in older plants and often trouble-free. Replace it the next time the conduit is opened, or the day a drive is installed nearby.
- Can I add a shield by pulling a bare ground wire alongside the conductors?
- No. A drain wire beside the pair is not a shield; a shield surrounds the conductors. Pulling a ground wire in a conduit with the signal conductors does nothing useful and can create a ground loop if it is grounded at both ends.
- Why is my thermocouple hopeless on unshielded wire?
- A thermocouple produces millivolts from a high-impedance source, so a few millivolts of induced noise is a large fraction of the signal. Use shielded thermocouple extension wire, or put a transmitter at the sensor and send 4-20 mA. The same is true of pH electrodes and any other millivolt signal.
- Is it worth twisting the existing conductors by hand at the ends?
- No. Twisting works along the whole run, where the coupling happens; a few twists at the terminals change nothing. Either re-pull twisted shielded cable or use one of the other options.
VFD Noise on Analog Signals
Read the guide →- The drive has an EMC filter. Why does it still cause noise?
- The input filter reduces what the drive puts back on the supply line and does nothing for the output side, which is where the motor cable noise originates. The output side needs the shielded motor cable, the grounding, and if needed an output reactor or filter. Also check that the filter is connected; some drives ship with the filter ground disconnected for use on ungrounded supplies.
- Will a software filter on the input fix it?
- It will hide it, at the cost of response time, and the drive will go on injecting current into the ground system that reaches other signals. Use the filter to make the loop usable while the drive installation is corrected, and then reduce it.
- Is a lower carrier frequency bad for the motor?
- Within the range the drive manual allows, a lower carrier means more audible noise and slightly more motor heating from current ripple, and less drive heating and less electrical noise. Pump and fan applications run fine at the lower end of the range, and many drives default to a value chosen for quiet rather than for instruments.
- The noise is on a 4-20 mA loop. Current loops are supposed to be immune.
- They are immune to induced voltage in series with the loop, but not to current injected through capacitance into the loop conductors, and not to a common-mode voltage beyond the input range. A drive does both. The shielded twisted pair with one ground removes most of the injection, and isolation handles the rest.
Drive Causes Instrument Noise
Read the guide →- The drive has been in for years and the noise just started. Is it still the drive?
- Possibly: shield terminations corrode, a ground strap loosens, a motor cable is replaced with plain conductors during a motor change, or a carrier frequency is raised to quiet a motor. Walk the checklist again; something in it changed. If nothing did, the new instrument or the new cable is the victim of a drive that was always noisy but never mattered.
- Can I use armored cable instead of shielded drive cable?
- Continuous corrugated aluminum armor bonded at both ends with the right fittings works well and is common in drive installations. Interlocked steel armor is less effective at high frequency. Either way, the termination must be a full 360 degree bond, and the cable should include ground conductors as the drive manual specifies.
- Does the reactor go on the input or the output?
- An input reactor reduces harmonics on the supply and protects the drive from line transients; it does nothing for output noise. An output reactor or dv/dt filter slows the edges going to the motor, which reduces reflected voltage at the motor and reduces the common-mode current. For instrument noise, the output side is the one that matters.
- How low can the carrier frequency go?
- To the minimum the drive manual allows, often around 2 kHz, at which the motor is audibly noisy and current ripple is higher. For pumps and fans in a plant that is not a concern. Many installations settle on a value near the low end that keeps the motor tolerable and the instruments quiet.
No Control Power in Panel
Read the guide →- The control breaker was tripped. Can I just reset it?
- Once, with everything downstream in a safe state, and while watching what happens. If it trips again, there is a short or a ground fault to find by dividing the circuit. If it holds, look for what drew the overload: a coil that failed, a circuit that was added, a wet field device.
- Why did the panel die after a brief power blink?
- The control transformer drew a large inrush when it was re-energized and opened a primary fuse that was sized without margin, or a power monitor relay dropped out and needs a reset. Time-delay fuses of the rating the transformer manufacturer specifies prevent the first; the second is a design choice that the operators need to know about.
- The safety relay lights show a channel fault. What is that?
- The two channels of the emergency stop loop did not agree within the allowed time, usually because one contact of a button or a switch is not making, or a wire in one channel is broken. Check each device in the loop for both contacts changing state together, and the wiring of both channels.
- How do I tell a failed DC supply from an overloaded one?
- Disconnect the output loads. A supply whose output returns to voltage with no load is being overloaded or shorted downstream; a supply that stays dead or low with no load has failed. Most supplies indicate current limit by cycling or a changed indicator.
Fuse Blows Repeatedly
Read the guide →- The fuse blows only when the well pump starts. What is it?
- If the fuse is on the control circuit, the pump start energizes a contactor coil that has shorted or a circuit with a ground fault, or the start drags the control voltage down enough that several coils draw pull-in current together. Measure the coil, then the branch to ground, then the control voltage during the start.
- The megger shows nothing wrong but the fuse keeps blowing.
- Then the fault is not a steady short: inrush against the wrong fuse, an overload that develops under load, a loose holder heating the fuse, or an intermittent short that the ohmmeter did not catch at rest. Check the fuse type, clamp the running current, feel the holder, and wiggle the wiring with the meter connected.
- Can I use a breaker instead?
- A supplementary protector or a breaker of the correct rating and curve can replace a fuse where the design allows and the short-circuit rating permits, and it makes resetting easier, which is exactly why the cause still has to be found first. Repeated resets of a breaker into a fault are as bad as repeated fuses.
- The fuse holder is discolored. Is that the cause?
- Often. A holder whose contacts have lost tension heats the fuse under normal current until the element fatigues and opens, and the discoloration is the evidence. Replace the holder, torque the terminals, and the fuse stops blowing.
Relay Chatter
Read the guide →- The contactor hums but the loads run. Is that a problem?
- A loud hum from an AC contactor means the magnet is not seating: dirt or rust on the pole faces, a bent armature, or a cracked shading ring. It will overheat the coil and eventually fail, and the noise is the warning. Clean or replace it during the next outage.
- The relay chatters only when the generator is running.
- The control voltage on the generator is lower or less stable than on utility, and the coil is close to its drop-out voltage. Measure the control voltage on generator; correct the generator voltage regulation or provide a constant voltage source for the control circuit.
- Can a relay chatter from electrical noise?
- A sensitive relay driven from a long unshielded wire near a drive can pick up enough to dither, and a coil circuit sharing a common with a noisy load sees the common bounce. Route the coil wiring away from noise, give the circuit its own common, and use a relay with a suitable pull-in current.
- The relay welded after chattering. Why?
- Each chatter cycle makes and breaks the load current with the contacts barely apart, which arcs and heats them until they weld. A chattering relay carrying a load is damaged quickly; find the cause the same day and replace the relay, because its contacts are no longer trustworthy.
Ground Fault Present
Read the guide →- The system runs fine with the ground fault light on. Why fix it?
- On an ungrounded system the first fault is harmless and the second is a dead short between the poles through the earth, at whatever moment the second one appears. The light is the only warning the system gives. Find the first fault while it is convenient.
- The fault comes and goes. How do I catch it?
- Note when: rain, level, a pump running, a temperature. Then go to the field under those conditions, or leave a branch open through the next occurrence to see if the indication stays clear. A recording of the monitor value against time and weather often names the branch.
- The drive trips on ground fault but the insulation test is fine.
- The drive measures current imbalance on its output, which includes the capacitive leakage of a long shielded cable and an output filter as well as a real fault, and a motor that is wet reads fine when dry. Test the motor and cable when the trip is fresh, check the cable length against the drive limit, and read the drive manual for the ground fault setting.
- Should we ground the DC system so faults are obvious?
- A grounded system blows a fuse on the first positive-side fault, which makes it obvious and stops the circuit; an ungrounded one keeps running and warns. Either is acceptable; the decision is a plant policy, and an ungrounded system needs a working monitor and someone who responds to it.
Panel Overheating
Read the guide →- Can I leave the door open on hot days?
- It loses the enclosure rating and admits dust, insects, and hands, and it is the reason the panel is full of dirt. It is a temporary measure while the real fix is ordered, not an operating practice. A panel that needs its door open has a heat problem to solve.
- How hot is too hot inside?
- The rating of the components: most controllers and supplies are rated to 55 or 60 degrees Celsius at the component, drives to 40 or 50 with derating above, and the enclosure air near the top is where the reading is taken. A rise of more than 15 or 20 degrees above ambient in a sealed enclosure is a sign the calculation was never done.
- Would a bigger fan help?
- Only if the enclosure is vented and the ambient is lower than the target inside; a fan cannot cool below the outside air. In a sealed enclosure a fan only circulates; the heat has to leave through the walls or a heat exchanger.
- The drive in the panel is fine but the controller faults. Why?
- The drive heats the air and the controller above it takes the heat; drives are rated hotter than controllers. Move the controller lower or to another enclosure, or cool the enclosure. The layout drawing convention of power at the top and controls below exists partly for this reason.
Nuisance Breaker Trips
Read the guide →- The breaker trips when the drive is powered up. Is the drive faulty?
- Usually not; the drive draws a large inrush to charge its bus capacitors, and a fast-curve breaker or one with a low instantaneous setting trips on it. The drive manual specifies the protection; a slow-curve device or a breaker of the recommended type stops it. A drive whose inrush has grown, because a precharge resistor or a relay has failed, is the exception.
- The clamp meter says the load is well under the rating.
- Check three things: whether the meter reads true current, since harmonics make an average-reading meter read low; the panel temperature, since the breaker derates; and the terminals, since a loose one heats the breaker from outside. Then consider a weakened breaker.
- How many times can a breaker trip before it should be replaced?
- Manufacturers rate breakers for a number of fault interruptions and a larger number of overload trips; a small breaker that has tripped dozens of times, or interrupted a real short, is suspect. A breaker that trips at less than its rating on a bench test is replaced.
- Can I put two loads on one breaker to stop the trips on the other one?
- Only within the rating and the conductor ampacity, and not if one is a motor or a transformer whose inrush will trip the shared breaker. Each load type wants its own protection matched to it; sharing is how the circuit got overloaded in the first place.
Loss of Control Voltage
Read the guide →- The controller resets once a week and the control voltage is always fine when I look.
- Because the sag lasted a fraction of a second. Read the controller event log for the reset times, then correlate with pump starts and the transfer switch exercise schedule. A recorder on the control circuit through the next week catches it.
- We have a UPS. How can the controls still lose power?
- The UPS may be in bypass after a fault, its battery may be dead, the controls may be on a receptacle that is not on the UPS output, or the sag may be on a circuit the UPS does not feed. Test the UPS by pulling its input with the load on it, and trace which loads it actually feeds.
- How deep a sag matters?
- Contactor coils drop out around two thirds to three quarters of rated voltage; controllers and supplies ride through brief sags and reset on deeper or longer ones per their hold-up; drives fault on undervoltage per their setting. A sag to 80 percent for a few cycles is survivable for most controls; one to 50 percent for half a second is not.
- Would a bigger control transformer fix the motor start sag?
- Only if the sag is the transformer itself under coil load. A sag caused by the motor pulling the line down reaches the transformer input and comes out the secondary; the fix for that is ride-through on the controls or a soft start on the motor.
Power Supply Failure
Read the guide →- The supply says 24 volts on its display but the controller is dead.
- Measure at the controller terminals. A loose output terminal, an open branch breaker, or a broken wire between the supply and the load leaves the supply happy and the load dead. The supply display is not the load.
- Can I replace it with a bigger supply?
- Yes, if the input circuit and the DC branch protection are still adequate, and it is often the right choice when the load has grown. The branch protection protects the wiring from the larger supply current, so check that the branch breakers and fuses still match the conductors.
- The new supply failed after a month. Why?
- The condition that killed the first one is still there: heat, an input voltage out of range, a load at the rating, a surge path, or a load that cycles the supply into current limit repeatedly. Measure the panel temperature and the load current before installing a third.
- Should the DC common be grounded?
- Either is permitted, and the plant should have one policy. A grounded common makes a positive-side ground fault trip the branch protection, which is obvious; an ungrounded common tolerates one fault and needs a monitor. Whatever the policy, a supply feeding a circuit that is grounded twice in different places is carrying ground current.
UPS Not Carrying Load
Read the guide →- How long should the UPS run?
- Long enough for the generator to start and the transfer to complete with margin, or for a clean shutdown, or for the outage the utility decides to ride through where there is no generator. Fifteen to thirty minutes is common for controls with a generator; hours for a remote site radio and controller with no generator, which is a larger battery than most UPS units carry.
- The UPS runtime display says twenty minutes. Can I trust it?
- It is an estimate from the battery voltage and the load, and it is optimistic on an aged battery that collapses under load. Trust the load test, not the display.
- Should the UPS be on the generator circuit?
- Yes: the UPS input from the generator-backed circuit, so that when the generator picks up, the UPS recharges and returns to normal, and its runtime is spent only on the transfer gap. A UPS on a circuit the generator does not feed runs until its battery is gone.
- Is a UPS enough for a remote site?
- For the controller and the radio through short outages, yes, sized for hours rather than minutes. For the pumps, no; the site needs a generator or a portable connection, and the UPS keeps the site reporting the outage while the pumps are down.
Voltage Sag on Motor Start
Read the guide →- The utility says our service is fine. Why the sag?
- The service may be fine at the transformer and the sag is in the feeder to the panel or a connection along it, or the transformer is adequate for the running load and not for the start. Measure at both ends and do the arithmetic; the answer is usually inside the fence.
- Will a soft starter fix drives faulting on the sag?
- It reduces the sag at its source, which helps everything. The drives also have an undervoltage trip level and a ride-through setting in their parameters; set them per the manual for the sag that remains.
- The sag only happens on generator. Is the generator too small?
- For motor starting, probably. Generators are often sized on running kilowatts and not on starting kVA, and the regulator response adds to the sag. Options are a soft starter on the pumps, a start sequence that staggers them, or a generator sized for the start.
- Can the sag damage anything?
- Contactors that drop and reseal under load arc their contacts; motors that lose their contactor mid-start restart against rotation; drives that trip repeatedly stress their bus; controllers that reset lose retentive data. Over years the sag costs contactors, drives, and outages; the fix pays.
Generator Transfer Problems
Read the guide →- The generator exercises every week and runs fine. Why did it fail in the outage?
- A weekly exercise without transfer proves the engine starts; it does not prove the switch transfers, the loads restart, or the controls ride through. Exercise under load, with the transfer, on a schedule.
- The pumps ran backward on generator. How?
- The generator was connected with a different phase sequence from the utility, and the transfer switch passes whatever rotation its source has. A rotation meter at the switch load side on each source shows it; the fix is at the generator connection, and the first transfer test after any generator work checks it.
- The controls have a UPS and still reset on transfer. Why?
- The gap was longer than the UPS runtime, the UPS battery has aged, the UPS was in bypass, or the controls are not on it. Measure the gap from the switch log, and test the UPS under load.
- Should the transfer switch be closed transition?
- A closed-transition switch parallels the generator with the utility for a moment and transfers without a gap, which is better for the process and requires utility approval and a generator that can synchronize. Many utilities use open transition with a UPS on the controls, which is simpler. The decision is in the design; the controls need a UPS either way.
Pump Loses Prime
Read the guide →- The pump primes if I fill it by hand, then loses prime again the next day.
- The suction line is draining between runs: a foot valve or a check valve leaking back, or an air leak high on the suction line that lets the water fall. Fill the line, wait, and check the level; then the foot valve.
- Why does it happen only in summer?
- Warm water vaporizes more readily, so the available suction lift falls with temperature, and a pump that is marginal on lift cavitates and loses prime on hot days. Reduce the lift, shorten the suction line, or lower the pump.
- Can a submersible pump lose prime?
- A submersible does not need priming; it can become air-bound if it starts in a well full of air, or draw air through a vortex at a low stop level, with the same result of no flow. An air release on the discharge and a higher stop level are the answers.
- How long should the controller allow for priming?
- As long as the pump takes on a good day with margin, from the pump manual and a timed test at commissioning, commonly one to three minutes for a self-priming pump. Longer than that is a dry pump, and the timer stops it.
Seal Failure Alarm
Read the guide →- Can I keep running a pump with a seal fail alarm?
- On most installations, yes, for a limited time: the upper seal protects the motor. The alarm is the signal to schedule the pull. Running for months on a seal alarm is how a motor floods and a repair becomes a replacement.
- The new pump alarms on seal fail right out of the box.
- The relay in the panel does not match the new pump probe. Manufacturers specify different thresholds and some use different probe designs. Replace the relay with the one the pump manufacturer specifies, or set the threshold per their instructions.
- Should the seal fail alarm stop the pump?
- The functional description decides, and the usual answer is no, because stopping the only pump at a lift station over a warning is worse than running it. Where the pump is one of several and the plant prefers to protect the motor, the alarm can stop it with the lag taking over. Either way, the motor moisture and thermal protections do stop it.
- How do I clear an alarm from a wet junction box?
- Dry the box and the cable end, re-terminate the probe conductors, seal the gland, drain the box, and confirm the resistance at the panel is back to the normal high value. Then find out how the water got in; a box that floods once floods again.
Both Pumps Running Constantly
Read the guide →- The pumps are new and both still run all the time.
- Then the inflow is the problem, or the discharge is. Do the drawdown test: new pumps that deliver their curve into an inflow that exceeds them means the station is undersized or the inflow has grown, usually from infiltration; new pumps that deliver far less than their curve means the discharge is restricted or the force main is surcharged.
- How do I tell a ragged impeller from a worn one?
- A ragged impeller shows erratic amps and often clears partially when the pump is reversed or bumped; a worn impeller shows steadily low delivery with normal amps for the reduced flow. Both are confirmed by pulling the pump; rags on the impeller are obvious, and wear is measured at the clearances.
- Can both pumps running damage anything?
- Not by itself; pumps are made to run. The risk is the overflow when they cannot keep up, and the wear on both when one pump has failed and the other is carrying the station alone. A run hours alarm and a both-pumps-running alarm after a set time bring the condition to someone before the high level does.
- The force main has an air release valve. Could it still be air-locked?
- If the valve is stuck, plugged, or isolated, yes. An air release valve that has not been maintained does not release, and a high point in the main holds a pocket of air that both pumps push against. Check the valve; a main that is quiet when the pumps run and then surges when the air moves has a pocket.
Valve Will Not Reach Position
Read the guide →- The feedback says 100 percent but the valve is clearly not closed.
- The span was calibrated short, or the feedback linkage has slipped. Compare the mechanical indicator with the feedback at both ends; recalibrate the positioner or the feedback at the true ends of travel, and check the linkage.
- The actuator trips on torque at the seat every time it closes.
- Either the valve should be position seated and the actuator is set to torque seat, or the torque setting is below what the valve needs at the seat, or something is on the seat. Check the seating mode and the torque setting against the valve manufacturer data, then inspect the seat.
- Why does the valve reach position when the pump is off but not when it is running?
- The differential pressure across the valve rises when the pump runs, and the actuator does not have the torque or the thrust to move the valve against it. The actuator is undersized for the service, or its supply pressure has fallen. Check the sizing and the supply.
- Can I just move the limit switch so the feedback reads right?
- If the valve reaches its mechanical end and the limit is the only thing short, yes, that is the recalibration. If the valve is stopping short because of an obstruction and the limit is moved to match, the valve now reports closed while it leaks, which is worse than the original fault.
Valve Hunting
Read the guide →- I reduced the gain and it still hunts, just slower.
- That is stiction: the amplitude stays and the period lengthens as the controller slows. Do the step test in manual; a valve that does not respond to small steps and then jumps has friction that tuning cannot cure. Fix the valve.
- The valve hunts only at night.
- At night the flow is low, the valve is near its seat, and the gain is high; or the air supply pressure changes as other users drop off. Look at the valve position at night on the trend, and at the supply pressure.
- Can I add deadband to stop the hunting?
- A deadband on the controller output that matches the actuator resolution stops the actuator chasing tiny changes, and it is legitimate. A large deadband to hide a limit cycle leaves the process cycling inside it. Use the smallest deadband that stops the jitter, and fix the valve.
- The positioner auto-tuned and the valve now rings.
- The auto-tune was run with wrong actuator parameters, or with the valve not at operating conditions. Set the actuator type and size, run it again with the process pressure on the valve, and then reduce the gain a step from what it chose; auto-tunes prefer speed over damping.
Valve Slow to Respond
Read the guide →- The valve is slow only in the morning.
- Cold: the packing and the lubricant stiffen, water in the air line freezes, or the exhaust silencer ices. Check the air dryer and drain the line; heat trace the actuator where the site freezes; use a low-temperature lubricant.
- Adding a volume booster made it hunt.
- The booster made the valve fast enough that the positioner or the loop tuning, set for the slow valve, is now too aggressive. Retune the positioner with the booster in place, then the loop.
- Can I speed up an electric actuator?
- Some have a speed parameter within a range; most have a stroke time fixed by the gear ratio. A different gearbox or a different actuator is the way to a faster stroke, and the torque falls as the speed rises, so the sizing is rechecked.
- The controller output changes instantly but the valve position trace ramps. Is that the actuator?
- Yes, if the positioner input also steps: the ramp is the actuator stroke time, limited by the supply, the positioner, or the gearing. If the positioner input itself ramps, the controller has a rate limit or a filter on the output, which is a setting.
Position Feedback Wrong
Read the guide →- The feedback reads correctly at the valve display but wrong on the HMI.
- Then the device is right and the path to the HMI is wrong: the loop, the input card, the controller scaling, or the HMI tag. Measure the milliamps at the input, compute what the scaling should produce, and compare with the tag.
- Should the feedback be used to close the control loop?
- The positioner uses the feedback internally to hold the valve where it is commanded; the process loop controls on the process variable, not on the position. Position feedback to the controller is for display, interlocks, and diagnostics such as comparing command with position. A loop that controls on position instead of the process is controlling the wrong thing.
- Why does the open limit come on at 95 percent?
- The limit switch was set with the valve short of its mechanical open, or the cam moved. Reset it at the true open position. A limit that comes on early can let a sequence proceed before the valve is fully open, which matters for a pump start.
- How often should position feedback be checked?
- At every valve maintenance, after any actuator or linkage work, and on the calibration schedule for the loop it serves, with the three-point comparison. It takes ten minutes and it is what the interlocks depend on.
Actuator Torque Fault
Read the guide →- The actuator trips on torque at the seat but the valve still leaks.
- The seat is fouled or damaged, so the torque is reached against debris before the disc seals. Cleaning or repairing the seat is the fix; raising the torque presses the disc into the debris harder and damages the seat.
- Can I raise the torque setting?
- Up to the valve manufacturer rating for the valve, and only when the setting is below what the valve needs. Above the rating, the actuator can break the valve. The rating is on the valve data sheet; if it is not, ask the manufacturer before touching the setting.
- The valve trips on torque when the pump starts.
- The pump raises the differential across the valve beyond what the actuator can overcome, usually on a valve that is closing against the pump or opening against a head. Sequence the valve to move before the pump builds pressure, or resize the actuator.
- How do I free a seized valve?
- By hand, with the actuator declutched, gently in both directions, with penetrating lubricant on the stem, never with a cheater bar that bends the stem. A valve that will not free by hand is repaired or replaced, not forced by the actuator.
Remote Site Stops Communicating
Read the guide →- The site radio shows a good signal from the master but the master cannot hear the site.
- The site transmitter is the problem, or its path outbound: a transmitter that has failed, a transmit power reset to minimum, or an amplifier stage damaged by lightning while the receiver survived. Substitute the radio.
- The site came back on its own after an hour. Should I still visit?
- Yes, and soon. A site that recovers on its own had a marginal condition: water drying in a connector, a power supply that reset, an intermittent path. It will do it again, and the visit while the evidence is fresh finds it.
- Can I diagnose the antenna without a test set?
- Partly: inspect the connectors for water and corrosion, the arrestor for damage, the coax for cuts and kinks, and the antenna for alignment; compare the received signal with the record. A standing wave ratio meter or an antenna analyzer is inexpensive and settles the question; a radio system without one is diagnosed by replacement.
- Why did only this site lose the path?
- Each site has its own path, and something on this one changed: a tree line grew, a building went up, a tank was painted, the antenna was turned by wind or by a contractor. Compare the received signal at both ends with the record and look along the path.
Intermittent Radio Path
Read the guide →- The path study said the link was fine. Why is it intermittent?
- Path studies model a clear path with assumed antenna heights and coax; the installed antenna may be lower, the coax longer and lossier, the trees taller, and the margin smaller than modeled. Measure the actual received signal at both ends and compare with the study; the difference is where the margin went.
- Can I just increase the transmit power?
- Within the license or the unlicensed limit, a few decibels, which rarely closes the gap and can worsen interference to others. Antenna gain and height, and lower coax loss, add margin at both ends and are the usual answer.
- How much fade margin is enough?
- Twenty decibels is a common minimum for telemetry paths, thirty for paths over water or flat terrain prone to ducting, and more for long paths. The number is set in the path study against the availability the utility wants.
- The site is fine every time I visit.
- It is intermittent, and the visit is not at the bad time. The trend is the tool: leave the signal and retry counts historized and look at them against the times it fails. Then visit at that time, or with the evidence of what changed.
High Retry Count
Read the guide →- What retry rate is normal?
- A percent or two on a well-designed radio system, from ordinary fading; five percent is worth looking at; ten percent is a problem that will get worse; above that the site is about to go offline. Cellular paths run higher and are handled with longer timeouts.
- The retries started when we added three sites to the channel.
- The cycle got longer and the timeouts and the cycle now overlap, or the new sites collide with the old on a channel that is now too busy. Recompute the cycle time; move sites to another channel, or shorten the polls with report by exception.
- Retries are high on one site with a strong signal. What is that?
- The site radio hears the master fine; the problem is behind it or in its transmitter. The controller may be answering late, the serial settings may mismatch, or the site transmitter may be weak while its receiver is fine. Check the master received signal from that site, then the controller.
- Should I increase the retry count so the sites stay online?
- More retries hide the problem and lengthen the cycle for every site; two or three is the usual maximum. Fix the cause of the retries, and let the communication alarm tell you when a site is genuinely lost.
Poor Signal Margin
Read the guide →- The far antenna is visible from this one. Why is the margin poor?
- Visibility is the line of sight; the signal needs the Fresnel zone, which is wide, clear. A path that grazes a ridge or a tree line that the eye sees as just below the line is obstructed by radio standards. Raise the antennas or run the profile.
- Does rain really matter at these frequencies?
- At the frequencies used for utility telemetry, rain itself attenuates little; what rain brings is wet foliage, which absorbs a great deal, and atmospheric conditions that bend the path. A path that fails in rain has trees in its zone or too little margin for the conditions.
- How do I get a path profile?
- Path study software with terrain data, which most radio vendors and integrators run, or a survey with a GPS and the antenna heights entered. The profile shows the terrain along the path and the Fresnel zone at the antenna heights, and it is the document to keep with the site record.
- Is a repeater better than a taller mast?
- A repeater adds a site to maintain and a hop that halves the channel capacity for the sites beyond it; a taller mast is a structure with its own cost. For one bad path, the mast; for several sites behind the same ridge, the repeater. The path study prices both.
Interference on Channel
Read the guide →- We have a license. Can the interferer be made to stop?
- If the interferer is another licensed user on the same or an adjacent channel, the coordinator resolves it; if it is an unlicensed device, the regulator rules apply, and the utility documents the interference with measurements and times. In practice a filter and a directional antenna solve most cases faster than the process.
- The cell carrier put a site on our tower and the telemetry got worse.
- Receiver overload or intermodulation from the new transmitters. A cavity filter on the telemetry receiver and vertical separation on the tower are the usual cures, and the tower lease often obliges the new tenant to resolve interference they caused.
- Can a drive really interfere with a radio?
- A drive with an unshielded motor cable radiates broadband noise into the hundreds of megahertz, and a site antenna a few feet from it hears the noise floor rise every time the pump runs. The shielded motor cable, the drive grounding, and moving the antenna up the mast fix it.
- How do I know whether the interference is at my end or the far end?
- Measure the noise floor at both ends with the other silent. Interference near one site raises that site noise floor only, and that site loses the polls it should receive; the other end hears the site fine. The retries and the noise reading together say which end.
Cellular Modem Will Not Register
Read the guide →- The modem worked yesterday and today shows registration denied.
- The account: a suspension for billing, a plan change, an inactivity rule on a module that has been quiet, or a carrier provisioning error. Call the carrier with the identifiers; the modem cannot fix its own account.
- A new modem with the old module will not register.
- The carrier may associate the module with the old device identifier and need to re-provision it for the new one, or the new modem may lack the bands or the certification the carrier requires. The carrier portal or a call resolves the first; the modem specification the second.
- The phone shows full signal and the modem shows none.
- The modem antenna, its connection, or its bands. Phones support more bands than industrial modems, and a modem inside a metal enclosure with a stub antenna sees far less than a phone outside it. Check the antenna and the connection, then the modem bands against the carrier bands at the site.
- Should the modem be set to a fixed band or technology?
- Only where the carrier or the field test shows that automatic selection lands on a poor band; a fixed setting stops the modem from adapting when the carrier changes its network. Automatic with a preferred band is the usual setting; record whatever is chosen.
Frequent Reconnects
Read the guide →- The modem shows connected all day but the SCADA says the site drops. Why?
- The radio session is up and the data path is not: the translation entry or the tunnel has expired while the modem still reports attached. A keepalive on the tunnel, and a check that the polling is actually reaching the site, resolves it.
- How often should the keepalive run?
- Shorter than the shortest timeout in the path, which is often a few minutes; every minute or two is common. It costs a few bytes each time, which adds up on a metered plan, so it is set as long as the timeouts allow.
- Would a second carrier help?
- For a site at the edge of one carrier coverage and inside another, yes, and a dual-module modem can fail over between them. For a site with a handoff problem, a directional antenna is cheaper and usually enough.
- The reconnects started after a modem firmware update.
- A firmware release with a session bug, or a changed default such as a keepalive or a band setting that the update reset. Compare the configuration with the record, and check the vendor notes for the release; roll back if the vendor confirms the issue.
Data Plan or APN Problems
Read the guide →- The modem shows an address and the site still cannot be reached.
- The address is on the wrong network, usually a public or a carrier-private range rather than the utility private network, because the module is on the wrong plan or the access point name selects the wrong one. The tunnel expects the private address. Correct the plan and the name.
- Why did five sites fail on the same day?
- A carrier change: an access point name retired, a plan migrated, a network generation shut down, or an account-level suspension. The carrier notice, often sent to an address nobody reads, says which. Every modem is updated, and the notices go to a mailbox someone owns.
- Is an unlimited plan the answer?
- Unlimited telemetry plans are usually throttled after a threshold, and the throttled rate may be enough for polling or may not. The arithmetic and a plan with a cap above it, with usage alerts, is more predictable; an unlimited plan is a reasonable choice for a site with a camera.
- Does the tunnel really double the data?
- A tunnel adds headers to every packet, and small telemetry packets are mostly headers, so the overhead factor is large: often two or three times. A lighter tunnel protocol or a private carrier network that needs no tunnel reduces it; the arithmetic includes whatever is used.
VPN Tunnel Drops
Read the guide →- The tunnel drops exactly every eight hours.
- A rekey lifetime of eight hours on one end that the other end does not agree with, or a certificate or a session limit at the concentrator with that period. The concentrator log at the moment of the drop names the negotiation that failed; match the lifetimes.
- Polling works but the historian backfill from the site never completes.
- Large packets are being dropped: the maximum transmission unit. Run the ping test, set the unit and the clamp, and the backfill runs.
- Should the site or the plant initiate the tunnel?
- The site, because the site address may change and the site is behind translation; the plant concentrator has a fixed address and accepts the connection. With a private static address plan either can, and the plant initiating lets it detect a dead site faster.
- How many sites can one concentrator carry?
- As many as its license and its throughput allow, which the vendor states; cellular sites use little bandwidth and the session count is the limit. A concentrator at its limit drops sites when others connect, which looks like a random cellular problem until the log is read.
Weak Cellular Signal
Read the guide →- My phone works at the site. Why does the modem not?
- The phone is outside the panel with a better antenna system and more bands; the modem is inside a metal box with a stub. Put the modem antenna where the phone was and the modem will do as well or better.
- How much gain do I need?
- Enough to bring the received power into the usable range with margin, which a directional antenna of moderate gain on a short low-loss coax provides in most marginal sites. More gain narrows the beam and makes aiming critical; the modem reading with the antenna in place is the test.
- The signal was fine for years and dropped last month.
- The carrier changed something: a tower re-oriented, a band moved, a cell decommissioned; or the antenna system failed: water in the connector, a cracked coax, a corroded element. Check the serving cell and band against the record, then the antenna system.
- Is a higher band worse?
- Higher frequency bands carry more data and reach less, and the modem may prefer them for speed when the lower band would be more reliable at a distant site. Preferring the lower band at a marginal site trades speed the telemetry does not need for reach it does.
Fiber Link Down
Read the guide →- The link light is on at one end and off at the other. Which end is broken?
- The end whose light is off is not receiving; the fault is on the strand that feeds it, or in the transmitter at the other end. Read the transmit power at the lit end: if it is normal, the strand or a connector on that direction is the problem; if it is absent, the transceiver there has failed.
- Both ends show good receive power but no link.
- The fiber is fine. Look at the port configuration: speed, duplex, autonegotiation, and whether the port is administratively down or was shut by a protection feature. Then confirm the two transceivers are the same speed and that the switch supports the module.
- Can I test the fiber with a flashlight?
- A visible light source at one end and an eye at the far patch panel confirms continuity and finds a reversed pair on a short multimode run, but it says nothing about loss. A visual fault locator does the same job properly and also lights up a tight bend or a break through the jacket on a patch cord.
- The reflectometer says the break is at 640 meters but the route is only 500 meters long.
- Fiber distance exceeds route distance: slack loops at each end and at every splice, the cable lay, and the reflectometer calibration for the fiber refractive index. Apply the as-built slack from the fiber schedule and use the index of refraction from the cable data sheet.
High Optical Loss
Read the guide →- How much margin should a link have?
- At least 3 decibels after the calculated budget on a new link, and more on a link that will be spliced after a repair or that runs outdoors through temperature extremes. A link with 1 decibel of margin is a link waiting for a speck of dust.
- The loss is high in one direction only.
- The two directions usually use different strands, so the fault is on one strand: a connector, a splice, or a bend on that strand only. If the link is bidirectional on a single strand, a one-direction loss points at a wavelength-dependent event such as a bend, which affects longer wavelengths more.
- Can I add an attenuator or an amplifier to fix it?
- An attenuator reduces power and cures the opposite problem, a short link that overloads the receiver. High loss is cured by finding the event or by a higher-budget transceiver pair. Amplifiers belong to long-haul carriers, not to a plant network.
- The link passed acceptance and now reads 4 decibels worse. Nothing has been touched.
- Something has: a connector that was disturbed during other cabinet work, a cord that was tie-wrapped, water entering a splice case or a cable, or a connector that was contaminated when a dust cap was left off. Compare the reflectometer trace with the acceptance trace and look at the event that grew.
Intermittent Fiber Link
Read the guide →- The link only drops for a second or two. Does it matter?
- It matters to everything that runs over it: a redundancy protocol reconverges, controllers time out their connections and retry, a historian gets a gap, and an operator sees a communication alarm. A link that drops for a second has a fault that is growing.
- Why does it work fine when the technician is standing there?
- Because the conditions that expose the fault, cold, wind, vibration, a closed door, are not present, and because the technician reseated the connector on arrival. Trend the power and the port state through the conditions that produce the drops.
- Could the fiber be too short?
- Yes: a long-reach transceiver on a short run can overload the receiver, which produces errors and drops that look like a bad link. The receive power above the receiver overload level on the data sheet is the check, and a fixed attenuator is the fix.
- How do I tell a transceiver problem from a fiber problem without spares?
- Transmit power and temperature on the suspect module: transmit power that wanders or sits below the rating with a module temperature near its limit is the module. Fiber problems show as receive power that changes while the far transmit power holds steady.
Wrong Fiber Type or Wavelength
Read the guide →- Can I run single-mode transceivers over the existing multimode cable?
- Sometimes on a short run, with mode-conditioning patch cords designed for that purpose, and with a measured margin. It is a workaround with a loss penalty and a modal noise penalty, not a design, and it should be documented as temporary.
- The link came up with the wrong cord in it. Why fix it?
- Because it is running on the margin the design left for aging and repairs. It will fail when a connector picks up a speck of dust or the temperature swings, and the person who finds it then will not know about the cord.
- My bidirectional modules have the same part number at both ends and it worked before.
- It did not; check again. Either the part numbers differ by a suffix that marks upstream and downstream, or the link was on a different pair of modules. Bidirectional links need complementary modules.
- How do I tell 50 micron from 62.5 micron fiber if the print has worn off?
- A scope shows the core diameter against a reference; a reflectometer shows a direction-dependent step at the joint with known fiber; and the building records or the cable manufacturer with the batch number settle it. When it cannot be settled, replace the cord.
Dirty or Damaged Connector
Read the guide →- The cord looks clean. Do I really need a scope?
- Yes. The particles that matter are far below what the eye can see, and the end face is a millimeter or two across. A scope costs less than one site visit and is used on every visit.
- I cleaned it and the loss came back the next day.
- The other side of the mating was dirty and contaminated it, the port was dirty, or the end face is damaged and collects material in the scratches. Inspect both sides and the port, and replace a damaged connector.
- Can a dirty connector damage the transceiver?
- It can damage the transceiver port ferrule by scratching it, after which every cord that goes into that port is scratched too. Reflected light from a bad mating also raises the noise at the transmitter. A port that has received a dirty cord is cleaned with the proper stick cleaner and inspected with a port adapter.
- Is angled polish more or less sensitive to dirt?
- It is just as sensitive to loss and less sensitive to reflection, because the angled face sends the reflection into the cladding rather than back down the core. It also must only be mated to another angled connector; the green boot or housing marks it.
Intermittent Packet Loss
Read the guide →- Is 1 percent loss acceptable on a control network?
- No. A healthy wired plant network loses nothing; a fraction of a percent is a fault that is going to grow. Radio and cellular paths have loss by nature, and the polling design there tolerates it with retries and timeouts sized for the medium.
- The counters are all zero but the polls still fail.
- Counters clear on a reboot and some switches count only what they are configured to; confirm the counters are live by finding one that moves. If they truly are clean, the loss is in a device rather than a link: the polled device, the polling host, or a firewall between them dropping what it does not recognize.
- Could the loss be a security appliance?
- Yes: a firewall with a session table that fills, a deep packet inspection engine that drops a frame it cannot parse, or an intrusion prevention rule that triggers on a legitimate protocol. The firewall log shows the drops with a reason.
- How fast should I poll?
- As slowly as the process allows and no faster than the slowest device in the poll can answer with margin. A device that takes 40 milliseconds to answer cannot be polled at 50 by three masters. Measure the response time and set the scan rate from it.
Cannot Ping Across VLANs
Read the guide →- Both gateways ping from both sides, but the two devices cannot reach each other.
- Each device has a working local path and the router forwards. The remaining candidates are the far device configuration, a host firewall, and a rule that filters device-to-device traffic while permitting router interfaces. Test the protocol and read the firewall log.
- Do I need a router if I have a layer three switch?
- A layer three switch is the router in most plant networks; it has a virtual interface per network and forwards between them, subject to any access lists. The checks are the same: the interface exists, is up, has the gateway address, and forwarding is enabled.
- The ping works from the switch but not from my laptop on the same network.
- The switch is testing from its own interface, which may be on the far network. The laptop has a different address, mask, or gateway, or a host firewall. Compare the laptop configuration with a device that works.
- Can I just put everything on one virtual network?
- Not on a segmented plant network, and not without a reason. Segmentation is the security control that keeps a compromised workstation off the controllers. The crossing is designed and permitted for the traffic that needs it; making the boundary disappear is not a fix.
Duplicate IP Address
Read the guide →- The conflict only happens when a particular laptop is plugged in.
- The laptop holds the address. Change the laptop to the maintenance address and record it. The controller was never the problem.
- How can two devices with the same address both seem to work sometimes?
- Each switch and host learns the last hardware address that spoke, so traffic goes to whichever device most recently sent a frame. Two quiet devices can trade the address back and forth for hours, each working part of the time.
- Does an address server prevent duplicates?
- It prevents them among the devices it serves, and it causes them when its pool overlaps the static addresses of the devices it does not. Control devices are static and excluded from the pool; the server handles workstations and visitors.
- What if the duplicate is on the gateway address?
- Every device on the network intermittently loses its route off the network; it is the most disruptive duplicate and the first to fix. The address table finds the impostor, which is usually a device set up from a form where someone typed the gateway into the address field.
Switch Port Errors Incrementing
Read the guide →- The errors are tiny compared with the traffic. Does it matter?
- On a wired control link, yes, because the rate is not zero and it will not stay tiny; the cable is degrading, or the noise event that causes it will come at the wrong moment. Find it while it is small.
- Errors appear only at one end of the link.
- Input errors count damaged frames received, so the end that counts them is receiving the damage: the transmit side at the other end, or the cable pair carrying that direction. Swap the cable first, then the far transceiver or interface.
- Can I just replace the switch?
- If the errors are on many ports and follow the switch after everything else is ruled out, yes. If they are on one port, the switch is the least likely part; the cable, the connectors, the far device, and the environment come first.
- Why do late collisions matter on a modern network?
- Because they only occur on a half-duplex link, and a half-duplex link on a modern network is a duplex mismatch, which loses frames under load. The counter is the proof of the mismatch and the fix is a matched setting at both ends.
Broadcast Storm
Read the guide →- The controllers kept running through the storm. Was it a problem?
- Yes. Everything that depends on the network stopped: operator control, supervisory setpoints, interlocks between controllers, alarms, and the historian. A controller that runs blind on its last setpoint is not the same as a plant under control.
- We have spanning tree. How did we get a loop?
- A ring protocol and spanning tree running on different switches without agreement, a switch with the protocol disabled on a port, an unmanaged switch that does not participate, or a media converter that drops the protocol frames. Read the configuration of every switch in the loop and enable protection everywhere.
- Can a storm damage equipment?
- Not the hardware, but it can put a controller into a fault state when a network interface is overwhelmed, drop a redundant controller pair out of synchronization, and fill a switch log with events. The consequences are process consequences.
- Why did it start when the electrician plugged in the camera?
- Because the camera, or the small switch it came with, had two ports and both were cabled, or because the cable from the camera location was already connected at the other end. Loop protection on the access port would have shut it down in a second. Enable it.
Trend Gaps
Read the guide →- The trend shows a flat line, not a blank. Is that a gap?
- It depends on the display. Many trend tools draw a line between the last sample before and the first sample after an interval with no data, which hides the gap. Look at the raw samples for the interval; if there are none, it is a gap, and the display setting to show gaps as breaks should be turned on.
- The communication was down for two hours and the data came back afterward. Why is there still a gap on some tags?
- The buffer forwarded the tags it was buffering; tags not in the buffered set, or added after the buffer was configured, or handled by a different collector, were not stored. Review which tags the buffer covers.
- Why do gaps appear only on the historian and not on the operator screens?
- The screens show the live value from the controller over one path; the historian collects over another, often through a separate interface or server. One path can fail while the other works, and the gap is on the failed one.
- Can I backfill a gap from the chart recorder or the controller log?
- If the historian supports inserting time stamped values and the source is a recorded measurement, yes, with a note that the values were imported and from where. Values estimated by a person are not backfill.
Client Cannot Connect
Read the guide →- The client connects by address but not by name. Can I just use the address?
- As a workaround to get the operator working, yes. As a fix, no: the certificate is issued for the name, redundancy fails over by name, and the next name resolution failure will take out something else. Fix the name server or the host entry.
- The server says the license is exceeded but only two people are logged in.
- Sessions from workstations that were closed without logging out, web sessions in abandoned browser tabs, and a test client left running all hold licenses. The session list on the server shows them; close them and set a session timeout.
- Everything worked yesterday and nothing changed.
- Something changed: a certificate reached its expiry date, a password aged out, an automatic update ran on the server or the workstation, or a firewall policy was pushed. The server log and the update history for the last day name it.
- Should I reboot the server?
- Not first. A reboot on a running plant costs the operators their view and may not fix a certificate, a license, or a network problem. Read the log, test the layers, and reboot only when the service is hung and a restart of the service alone does not clear it.
Duplicate or Missing History
Read the guide →- Is a repeated hour in November a fault?
- It is a consequence of storing local time. The hour between one and two happened twice, and a historian that stores local time either overwrites the first hour or keeps both. Storing in universal time is the fix; until then, reports that cover that night are read with that in mind.
- Can I just delete everything in the period and re-import from the controller?
- Only if the controller recorded the whole period at the resolution the historian needs and the import is documented. Deleting a partially good record to replace it with a partial import trades one problem for another.
- The two values at the same time stamp are different. Which is right?
- Neither is known to be. Two sources with different clocks, or a source that resent a corrected value, produce that pattern. Find the mechanism before choosing; if it cannot be found, keep both, flag the period, and note it in any report.
- Why did the failover duplicate history when it was supposed to protect it?
- Because both members of the pair collected during the transition and both wrote, or the standby forwarded its buffer onto data the primary had already stored. The redundancy design decides who writes and when; test the failover and check the record afterward.
Signal Pegged High or Low
Read the guide →- The transmitter says 20.0 and the process is nowhere near full scale.
- The transmitter has either the wrong range, a sensor that has failed toward full scale, or a fault that it reports as full scale rather than as a fault current. The transmitter configuration and diagnostics say which; a sensor fault is confirmed by applying a known input.
- Why does my controller show 3.6 mA as a valid low reading instead of a fault?
- Because the input scaling extends below 4 milliamps and nothing in the logic checks for under-range. The input module under-range flag, or a comparison against 3.8 milliamps, should drive a bad-quality flag and an alarm rather than a value.
- The signal pegs high when a nearby motor starts.
- That is noise or a supply sag rather than a rail: a common-mode surge on the loop, a supply that dips under the start, or a ground path that shifts. Measure the loop current during the start with a meter that records minimum and maximum.
- Can a bad loop supply make a signal peg?
- A supply without enough voltage for the loop resistance cannot drive 20 milliamps and the signal saturates below full scale; a supply that fails leaves the loop at 0. Measure the supply at the transmitter with the loop at 20 milliamps.
Analog Does Not Match Field Indicator
Read the guide →- The difference is exactly 2.3 psi, always.
- A constant difference that size is an elevation difference of about five feet of water, a gauge that was never zeroed, or a transmitter zero offset. Compare the mounting heights first; then zero whichever instrument is off against the reference.
- The screen reads 10 percent high everywhere.
- A proportional error is a span or a range problem: the transmitter upper range value against the controller upper scaling value. One of them was changed without the other, or the transmitter span has drifted.
- The gauge responds instantly and the screen takes thirty seconds.
- Damping in the transmitter, a filter in the controller, a slow scan, or a partly blocked impulse line. Each is found by watching the transmitter display against the gauge during a step: if the transmitter itself lags, it is damping or the impulse line.
- Which one goes on the compliance report?
- The calibrated, documented instrument, which should be the transmitter. If it is not calibrated, calibrate it before the report, and note the as-found error.
Loop Powers Up but Reads Zero
Read the guide →- The transmitter display shows 12 mA. Why does the controller see zero?
- The transmitter is reporting what it is trying to drive, not what the input receives. The current is bypassing the input or the input is not reading it: measure in series at the input terminals and read the voltage across the input.
- The input reads a small negative number.
- The polarity at the input is reversed; the current is flowing but the wrong way through the input. Swap the two leads at the input.
- I get 24 volts across the input terminals.
- The input is open. The channel fuse, a jumper set for voltage mode, a missing shunt resistor on a voltage input, or a failed input circuit. The supply is pushing against an open and no current flows.
- Can I test the loop without the transmitter?
- Yes: a loop calibrator in place of the transmitter, set to simulate a two-wire transmitter, drives a known current through the loop. The controller should follow it. If it does, the transmitter is the problem; if it does not, the loop or the input is.
Read Works but Write Fails
Read the guide →- Reads work with function 03 and writes fail with exception 01.
- The device does not support the write function the driver is using. Most drivers default to function 16 for holding register writes; many small devices support only function 06. Change the driver to single-register writes.
- The write succeeds but the value comes back wrong, not old.
- The data type or the word order differs: a float written in the wrong byte or word order, or a scaled integer written unscaled. Compare the raw bytes in the request with what the device manual says the register expects.
- Writes worked until we added the firewall.
- The firewall or its inspection rules are blocking writes, probably by design. The security policy for the zone decides whether the write should cross; if it should, a rule for that function code, register range, and master is written and documented.
- The drive accepts the speed reference but ignores the start command.
- The drive is not in the mode that takes remote commands, or the command word needs a sequence such as a ready bit before a run bit. The drive manual describes the control word sequence and the mode parameter.
Wrong Register Data
Read the guide →- The value is right most of the time and occasionally garbage for one scan.
- A 32-bit value read as two separate 16-bit registers in two requests can be torn: one half from before an update, the other from after. Read both registers in one request, or use a driver that reads the pair atomically.
- The manual says register 40010 but nothing sensible is there.
- Try 40009 and 40011, then the input register table at 30010. Then confirm the firmware version against the manual. Register numbering with a table prefix, addressing with an offset from zero, and a manual for a different model account for nearly every case.
- Can the device be sending wrong data?
- Rarely, but a device that reports a measured value in a register may also report a status that says the value is invalid, and the master that ignores the status shows the stale or default number. Read the status register with the value.
- How do I tell which word order a device uses without the manual?
- Read a known float as raw registers and try both orders; one gives the display value and the other gives something absurd. Do the same for a known long integer. Then apply the finding to the whole map, since a device is consistent within itself.
Protocol Gateway Stops Passing Data
Read the guide →- The gateway pings and answers Modbus but every value is zero.
- The gateway lost its device-side link or its configuration and is serving an empty table. The diagnostics page shows which; a gateway on defaults after a power cycle is the usual finding, and the saved configuration is restored and written to non-volatile memory.
- Data stops every few hours and comes back after a minute.
- The gateway is rebooting: a watchdog reset from a firmware fault, a power supply that dips, or a scheduled reset. The uptime counter proves it, and the fix is the power supply or a firmware update.
- Adding one more device made everything slow and then stop.
- The device side poll cycle grew beyond what the master side expects, the master started timing out and retrying, and the retries made the cycle longer. Slow the master, poll fewer registers, or split the devices across two gateways.
- Why does the SCADA say the data is good when it is frozen?
- Because the gateway answered the poll with a valid frame containing the held value, and the driver cannot tell a held value from a fresh one. Bad quality has to come from the gateway reporting the timeout, or from a heartbeat the controller checks.
How to Read a P&ID
Read the guide →- What does the number in an instrument tag mean?
- It is the loop number. Every device that belongs to the same control loop carries the same number, which is how you trace a measurement to its controller and final element across a drawing set. Some plants prefix it with a unit or area number.
- What is the difference between a P&ID and a PFD?
- A process flow diagram (PFD) shows major equipment and main process streams with flows and conditions. A P&ID adds every line, valve, and instrument and the control scheme. The PFD explains the process; the P&ID specifies it.
- What do FC and FO mean next to a valve?
- Fail closed and fail open: the position the valve takes on loss of air or power. FL means fail last, meaning it stays where it was. The choice is a safety decision and the control system must respect it.
- Which standard defines P&ID symbols?
- ISA-5.1, Instrumentation Symbols and Identification, defines the tag letters, bubble shapes, and line types used on most P&IDs in North America. Many owners publish a legend sheet with their own additions, and the legend on the drawing set governs where it differs.
Control Narratives
Read the guide →- Who writes the control narrative?
- On most projects the design engineer writes the first issue as part of the specification, and the integrator revises it through programming and testing. On design-build work the integrator often writes it from the process description. Whoever writes it, the owner approves it, because it is the definition of what they are buying.
- How is a control narrative different from a sequence of operations?
- A sequence of operations is the ordered, step-by-step form: first this happens, then that. A narrative covers the same behavior but also describes modes, interlocks, alarms, and failure handling that are not sequential. Many projects use the term interchangeably, and what matters is the coverage, not the title.
- How detailed should it be?
- Detailed enough that two competent programmers working from it independently would produce systems that behave the same way. Setpoints, delays, ranges, and reset conditions are the details that get lost first, and they are the ones that matter.
- Should the narrative reference tag numbers?
- Yes. Behavior is described in words, but the instruments and equipment involved are identified by their P&ID tags so the narrative, the drawings, and the program all refer to the same things by the same names.
Sequences of Operation
Read the guide →- What is the difference between a sequence of operation and a control narrative?
- The sequence is the ordered, step-by-step part: first this, then that, with the conditions between. The narrative is the whole description, including the sequence and also the modes, interlocks, alarms, and failure handling that are not sequential. On small systems the terms are used interchangeably.
- How detailed should the steps be?
- Detailed enough that two programmers working independently would build systems that behave identically, and that a tester can force every transition and expire every timeout. Tags, values, and durations on every transition.
- Do I need a timeout on every step?
- On every step that waits for something to happen, yes, with a stated response. Steps that wait for a command from a person can wait indefinitely, and the document says so.
- How does a sequence become a program?
- As a state machine: one active step at a time, each step setting its outputs, and transitions moving between them. A sequential function chart implements it directly; ladder does it with a step bit or a step number and the transitions as rungs. The state machines page covers the pattern.
Cause and Effect Matrices
Read the guide →- What is a cause and effect matrix used for?
- To state, in one table, every condition that triggers a protective action and every action it triggers. It is the design record of the interlocks, the review tool for finding gaps, and the test procedure for proving them.
- Is it only for safety systems?
- It came from process safety, and it is equally useful for ordinary equipment protection in a pump station or a treatment plant. Any system with more than a handful of interlocks benefits from having them in one table.
- How does it relate to the control narrative?
- The narrative describes the interlocks in prose; the matrix tabulates them. They must agree, and the matrix is easier to check for completeness because an empty cell is visible in a way a missing sentence is not.
- Should every row be hardwired?
- No. Rows that protect people or that must work without the controller are hardwired. Equipment protection that can tolerate a controller fault is often software alone. The column that states which is the point of the exercise.
Factory Acceptance Testing
Read the guide →- Who writes the FAT procedure?
- Usually the integrator, from the approved narrative and matrix, and the owner reviews it before the test. On some projects the owner’s engineer writes it. Either way it is issued before the test and followed during it.
- Does the owner have to attend?
- Someone who will accept the system should witness it. A FAT without the owner is a shop test, and the discoveries it makes are the integrator’s alone. Remote witnessing by video is common and workable for the logic and HMI portions.
- What if the narrative is not approved yet?
- Then the test cannot be against it, and any disagreement at the FAT becomes an argument about what was meant. Get the narrative approved first, even if it delays the FAT.
- How long does a FAT take?
- A day for a small pump panel, a week or more for a plant. The I/O check is mechanical and scales with the point count; the sequences and failure modes are where the time and the value are.
Site Acceptance Testing
Read the guide →- What is the difference between a FAT and a SAT?
- The FAT tests the panel and the program in the shop against a simulated field. The SAT tests the installed system with real instruments, real wiring, the real network, and the real process. The FAT finds design and build errors cheaply; the SAT finds installation and integration errors.
- Do loop checks count as the SAT?
- No. Loop checks prove each point individually and come before the SAT. The SAT proves the system as a whole: equipment under control, sequences, interlocks, alarms, and failures, with a record.
- Who witnesses the SAT?
- The owner, usually through their engineer, and operations, who will run the plant. Their observation of the operator-use portion is the most valuable review the HMI will get.
- When is the system accepted?
- When the SAT punch list is closed and the acceptance is signed. Some contracts add a performance period after startup before final acceptance, and the SAT record is what that period is measured against.
I/O Lists
Read the guide →- Is the I/O list the same as the instrument list?
- No. The instrument list is one row per instrument with its process data, range, and specification; the I/O list is one row per controller point. A transmitter appears once on the instrument list and once or more on the I/O list, depending on its signals. The two cross-reference each other by tag.
- Should network points be on the I/O list?
- Yes, as rows with a network I/O type, the device address, and the register or tag in the device. A drive on a network provides a dozen points that need the same documentation as hardwired ones, and a list that omits them is incomplete.
- Who owns the I/O list after commissioning?
- The utility, held by whoever owns the controller configuration. The integrator delivers it as a record document; from then on it is maintained with the program. An integrator who keeps the only copy is a risk to the utility.
- What tag convention should we use?
- The site standard, and if there is none, one based on ISA-5.1 for instruments and a consistent equipment-based scheme for devices, written down before the first tag is assigned. Changing the convention after commissioning is a project of its own.
Instrument Lists
Read the guide →- Do we need an instrument list on a small project?
- A lift station has a level transmitter, a pressure transmitter, a few floats, and a flow meter. That is a short list, and it still needs to exist, because the same lift station will be maintained for twenty years by people who were not there when it was built. The list is a page.
- What is the difference between an instrument list and an instrument index?
- Nothing of substance. Some organizations use index for the short listing and list for the version with design data; others use the words interchangeably. Use the term the site uses and keep one document.
- Where should the list live after the project?
- In the computerized maintenance management system if the utility has one, with the instrument list columns mapped to asset fields, so that calibration scheduling and work orders reference the same records. Otherwise in a controlled spreadsheet held with the drawings and the I/O list.
- Should final control elements be on it?
- Yes. Control valves, actuators, drives used for control, and chemical feed pumps are on the instrument list with their own specification sheets, because they are specified, calibrated, and maintained like instruments.
Control Schematics
Read the guide →- Do we need schematics if the logic is in the PLC?
- Yes. The controller replaces relay logic; it does not replace the control circuits that feed the controller inputs, drive its outputs through relays and starters, and keep the HOA, the overloads, and the safety devices working when the controller is not. Those circuits are on the schematic, and so is every controller channel.
- What is the difference between a schematic and an elementary diagram?
- None in this context. Elementary diagram is the older term for the same ladder-style functional drawing, still used in some specifications and by some utilities.
- Should the PLC program logic be shown on the schematic?
- No. The schematic shows the hardware circuit up to the controller channel and a note on what the channel does. The logic lives in the program and its documentation. Drawing a ladder rung from the program on the schematic invites the two to disagree.
- Who is the schematic drawn for?
- The person at the panel with a meter and a problem. Every decision about layout, numbering, and cross-references serves that reader. If a convention makes the drawing prettier and harder to trace, the reader loses.
Commissioning Checklist
Read the guide →- How long does commissioning take?
- Loop checks run at roughly 20 to 40 points per day per two-person team, depending on distance to the field devices. Functional and integrated testing is days to weeks depending on the plant. The performance demonstration is whatever the contract sets. A duplex lift station is commissioned in a few days; a treatment plant in weeks to months. Every project underestimates it.
- Who should witness the tests?
- The utility, through its operations and maintenance staff and its engineer, for every test whose result it will live with: the functional tests on its equipment, the integrated tests including the failures, and the alarm tests. The integrator runs the test; the utility signs that it saw it pass.
- What if the process is not available for testing?
- Simulate what can be simulated, at the field terminals or in the controller, and record which tests were simulated and which were done on the live process. A test done in simulation is repeated on the process when it becomes available, and the open items list carries it until then.
- Can commissioning be skipped for a small change?
- The scope scales; the stages do not. A replaced transmitter gets a calibration and a loop check. A program change gets a functional test of what it changed and a regression check of what it touches. A new pump gets the full sequence for that pump. Skipping the record is how a small change becomes an unexplained problem later.
ISA Standards for Controls
Read the guide →- Do we have to follow ISA standards?
- Only where a specification, a contract, or a regulation cites them. No law requires ISA-101 for a water plant HMI. Following them is how a utility gets a system that any integrator can work on and that matches the practice of the profession, which is why specifications cite them.
- What is the difference between ISA-99 and IEC 62443?
- The same work. ISA-99 is the ISA committee that developed the security series and the original numbering; the standards are published jointly as ISA/IEC 62443 and referenced by the IEC number. The committee continues as ISA99.
- Which ISA-5.1 edition should we use?
- The current one, cited by year in the specification and the site tag standard. The 2009 revision made significant changes to the letter table and the symbols from the 1984 version that much of the installed base was drawn under; a site with older drawings decides whether to redraw or to carry both conventions with a note.
- Are there ISA standards for water specifically?
- No. ISA standards are process-industry generic, and water and wastewater apply them like any other process. The water sector has its own bodies, AWWA and WEF, whose manuals of practice reference ISA where control systems are involved.
IEC Standards for Controls
Read the guide →- Does IEC 61131-3 conformance mean I can move my program to another PLC?
- No. Conformance is declared per feature and every vendor adds extensions; a structured text program moves with editing, a ladder program moves with more, and the I/O and communications are rebuilt. The standard is why the languages are recognizable across platforms, not a promise of portability.
- Is an IP68 instrument the same as NEMA 6P?
- They are comparable for submersion, and both are used for submersible level transmitters. The IP rating says how deep and how long; the NEMA type adds the environmental tests. A specification for North America usually asks for the NEMA type or a UL listing, and accepts the IP rating as supporting information.
- Where does DNP3 fit among the IEC protocols?
- DNP3 is IEEE 1815, not an IEC standard, and it is the dominant utility telemetry protocol in North America. IEC 60870-5-104 fills the same role in Europe and elsewhere. They share ancestry and concepts; a SCADA master for a North American water utility speaks DNP3.
- Which IEC 62443 parts should a small utility buy?
- The IEC 62443 page covers the series. For a utility implementing a program: 2-1 for the program, 3-2 for the risk assessment and zoning, and 3-3 for the system requirements. For a utility that only wants the vocabulary, the free summaries and this site are enough to start.
NFPA Standards for Controls
Read the guide →- Does the NEC apply to a control panel built by a panel shop?
- The panel is built and listed to UL 508A, which the NEC references in Article 409, and it is installed under the NEC. The installer is responsible for the field wiring, the SCCR adequacy at the location, the working space, and the marking; the panel shop for the panel construction. Both are inspected.
- What edition of the NEC should we design to?
- The edition adopted by the jurisdiction where the work will be inspected, which the engineer confirms with the AHJ at the start of design. Where a project spans jurisdictions or the adoption is pending, designing to the newer edition is usually safe, because editions rarely relax requirements.
- Is a wastewater wet well always Division 1?
- NFPA 820 classifies most wet wells and their associated spaces as Class I Division 1 unless ventilated to the standard, in which case they may be Division 2; the exact classification depends on the space, the ventilation, and the edition. The engineer classifies each space from the tables and documents the result on a hazardous area classification drawing.
- Where does NFPA 79 apply instead of UL 508A?
- NFPA 79 applies to the electrical equipment of industrial machinery, such as a packaged screen or a dewatering unit that arrives with its own controls. A stand-alone industrial control panel is built to UL 508A. A packaged system may be built to either, and the specification says which is required.
UL Standards for Controls
Read the guide →- Is a panel built by an electrician in the field a UL 508A panel?
- No. UL 508A panels are built by shops authorized under the UL program and labeled with the shop file number. A field-assembled panel is inspected by the AHJ as an installation and may be required to have a field evaluation by a laboratory before it is accepted. Many jurisdictions require the UL 508A label for any industrial control panel.
- Can I use a component with a CSA or ETL mark in a UL 508A panel?
- Yes, if it is certified to the applicable UL or harmonized standard by a recognized laboratory. The standard and the certification are what matter, not which laboratory issued them. The panel shop records the certificate.
- What is the difference between UL 508A and UL 698A?
- UL 508A is for industrial control panels in ordinary locations. UL 698A adds the requirements for panels that connect to intrinsically safe circuits in hazardous locations, or that are purged and pressurized to sit in one. A lift station panel with intrinsically safe barriers for the wet well floats may be built under 698A.
- Does a UL listing mean the equipment will work?
- It means the equipment met the safety requirements of the standard in the tests. Performance, accuracy, and suitability for the application are not part of a safety listing. A listed transmitter can still be the wrong transmitter for the job.
Wiring Diagrams
Read the guide →- Do we need both a schematic and a wiring diagram?
- Yes, for anything beyond a trivial panel. The schematic shows function and is what is read to understand and troubleshoot a circuit; the wiring diagram shows connections and is what is read to build and trace it. Combining them produces a drawing that does neither job well.
- Which wire numbering method should we use?
- Numbering by schematic line is the most traceable and is the common practice in North American industrial panels. The important thing is one method across the project, stated in the standard, and used by every panel builder and integrator on the job.
- The panel builder used different colors from our standard. Does it matter?
- It matters for safety and for every technician who opens the panel expecting the standard. The colors are in the specification and are checked at the factory acceptance test; a panel that arrives with the wrong colors is corrected or the drawings state the deviation prominently. Yellow for externally fed circuits is not negotiable.
- Where do loop diagrams fit?
- A loop diagram is a wiring diagram for one instrument loop, showing every connection from the field device to the controller channel across junction boxes and panels, with power, shield, and grounding. Plants with many instruments produce one per loop from the instrument database; smaller systems cover the same information on the interconnection diagram and the I/O list.
Network Drawings
Read the guide →- We have one drawing that mixes logical and physical. Is that acceptable?
- For a very small system, a single drawing that shows the firewall, the switches, and the devices with addresses can serve both purposes. Beyond a handful of switches, the mixture becomes unreadable, and the two drawings are separated: structure on one, cabling on the other.
- What symbols should we use?
- A consistent set: the project standard defines a symbol for each device type and a line style for each medium, and every drawing uses them. Vendor icon sets are fine for the physical drawing; the logical drawing benefits from plain boxes and labeled boundaries that anyone can read.
- How much detail goes on the drawing versus the schedule?
- The drawing shows names, addresses, and identifiers enough to find a device; the schedule holds every field. A drawing that tries to hold every MAC address and firmware version is unreadable and always out of date; a schedule holds them naturally.
- Who is allowed to see the network drawings?
- The control system staff, the integrator under contract, the assessor under agreement, and management on request. Not the general drawing index, the shared drive, or the bidders as a matter of course. The drawings are the map of the system; treat them as the security documentation they are.
Panel Layouts
Read the guide →- Does the layout have to be to scale?
- Yes. The builder drills from it, the reviewer measures spacings on it, and the heat and wireway checks depend on the real sizes. A schematic is symbolic; a layout is a dimensioned drawing.
- Where should the controller go?
- Where the signal wiring from the field terminals reaches it without crossing the power section, away from the drive heat, at a height where a technician can connect a laptop and read the indicators, and with space for expansion modules. The middle of the plate on the terminal side is usual.
- Can we put a drive in the same enclosure as the controller?
- Small drives, with the clearances, a separate wireway for the motor leads, the shielded motor cable leaving through its own entry, and the heat accounted for, yes. Larger drives or several drives belong in their own enclosure beside the control panel, connected by a short shielded control cable.
- What goes in the bill of material?
- Every purchased item on the drawing: enclosure, plate, every device, every terminal, the wireways, the rails, the nameplates, with manufacturer and part number, so that the panel can be built, quoted, and repaired from the list. Consumables such as wire and labels are listed by type and quantity.
Cable Schedules
Read the guide →- Do we schedule the cables inside a panel?
- No; panel wiring is on the wiring diagram. The cable schedule covers cables that leave a panel: to the field, to another panel, to a motor, to a junction box. The boundary is the panel terminal strip.
- How much spare should a multiconductor cable have?
- A pair or two per cable for instrument and control cables, landed on spare terminals at both ends, and more on long runs to remote junction boxes where pulling another cable is expensive. The schedule records which conductors are spare so that they can be used without a site visit to find out.
- Who keeps the schedule after the project?
- The utility, as a controlled document with the drawings, updated by every change record that adds, removes, or reroutes a cable. The integrator or the contractor hands over the as-built schedule; the utility keeps it true.
- What about cables that the contractor routed differently from the schedule?
- The as-built records what was done, not what was planned. The contractor marks the change, the engineer reviews it for class separation and fill, and the schedule is corrected. A route change that mixed a signal cable into a power conduit is a finding to fix, not to record.
Fiber Schedules
Read the guide →- Can the fiber schedule be part of the cable schedule?
- The cable can be a row in the cable schedule; the strands need their own table, one row per strand, with the test results. Most projects keep a separate fiber schedule that references the cable number, because the strand detail does not fit the cable schedule columns.
- How much loss is acceptable?
- It depends on the link: the transmitter and receiver specifications give the budget, and the measured loss plus a margin of a few decibels must fit inside it. Single-mode links over plant distances have budgets that are hard to exceed; multimode links at higher speeds have small budgets and are the ones to check.
- Who tests the fiber?
- The installing contractor at commissioning, with results submitted per strand as a deliverable, and the utility or its integrator when a link is repaired or a new link is lit. A reflectometer is worth owning for a utility with fiber between sites; a light source and power meter are inexpensive.
- What is a dark strand?
- A strand that is installed, terminated at both ends, and tested, but carries no link. It is the spare capacity of the cable, and the schedule is the only place anyone learns it exists. Utilities that run out of strands usually have dark ones nobody recorded.
Network Schedules
Read the guide →- Is a spreadsheet good enough?
- For a system of a few hundred devices with one owner and a change process that updates it, yes. The failure is not the tool but the habit; a database with a change workflow helps at scale and does not replace the habit.
- Why record the unused switch ports?
- Because an unused port that is enabled in the control VLAN is a live connection into the control network for anyone who finds it. The schedule says the port is shut down, the switch configuration is checked against the schedule, and a port that someone enabled without a record is found at the audit.
- Where does the conduit list come from?
- From the functional description of what must talk to what, written as flows during the firewall rule design, before the rules. Each flow has a reason. The rules implement the list; the list explains the rules, and it is what a reviewer reads.
- How do the schedules relate to the passive monitoring sensor?
- The sensor produces the observed list of devices and conversations; the schedules are the intended list. Comparing them is discovery at first and detection afterward: a device or a conversation the sensor sees that the schedule does not have is either a schedule error or an intrusion.
Functional Descriptions
Read the guide →- How long should a functional description be?
- As long as the system needs and no longer: a lift station is a few pages, a treatment plant is a hundred or more. The equipment sections follow a template and are terse; the length comes from the count of equipment, not from prose. A document that is long because it explains theory is a document that is not read.
- Who owns it after the project?
- The utility. The integrator writes the first revision with the utility and hands it over; the utility keeps it under change management and gives the current revision to the next integrator. A utility that lets the integrator keep the only copy has outsourced its own understanding of its plant.
- What is the difference between this and a control narrative?
- A narrative describes one process in prose, often early and often for one purpose. The functional description is the complete, structured statement for the whole system, and it absorbs the narratives as sections. Small projects sometimes use the terms interchangeably; the structure and the completeness are what matter.
- Should the functional description contain code?
- No. It says what the system does, in language the owner can read and the tester can check; the program says how. A tag name or a setpoint tag reference is useful; a rung is not. When the code and the description disagree, the description is the reference and the code, or the description, is corrected through change management.
Design Checklist
Read the guide →- Who runs the review?
- The utility control engineer or its consultant, with operations in the room for the functional description and the HMI sections and the electrical reviewer for the panels and power. The integrator presents and answers; the utility decides. A review run by the integrator alone reviews the integrator.
- Is this checklist enough on its own?
- It is the frame; the utility standard fills in the specifics, such as its panel conventions, its tag naming, its alarm priorities, and its security baseline. A utility without a standard uses the checklist to write one, section by section, as the questions get answered the same way on every project.
- How long does a detailed design review take?
- A day for a lift station package, several days for a treatment plant, spread over a week with the findings written up between sessions. The time is small against the construction cost of what it finds.
- What is the most common finding?
- Documents that disagree: the I/O list and the drawings, the functional description and the alarm list, the network drawing and the addressing. The second most common is the missing failure behavior: nobody wrote what happens when the level transmitter fails. The checklist asks both.
Startup Checklist
Read the guide →- How is this different from commissioning?
- Commissioning proves the system piece by piece: loop checks, factory and site tests, sequence tests. Startup is the day the process runs on it. Commissioning produces the records that the startup checklist verifies; startup is shorter and repeated after every outage or major change.
- Do we need the full checklist after a power outage?
- The verification section, shortened: controllers in run with the right program, no faults, communications good, forces none, setpoints retained, alarms enabled, modes as expected. Then the process in manual and back to auto. Retentive data lost in an outage is the usual finding, and the setpoint check catches it.
- Who says the process may start?
- The operations supervisor, on the word of the engineer that the control system is verified and of the process engineer that the plant is ready. The control system engineer does not start the process; the operator does, and the checklist is what they agree on before it happens.
- What if the startup goes wrong?
- The operator takes the affected equipment to manual or off, the plant runs on the manual operation procedure, and the engineer diagnoses with the trends and the alarm journal from the startup. The pre-startup backup lets the controller be returned to the state before any last-minute change. The record says what happened and the startup is repeated when the cause is fixed.
Calibration Checklist
Read the guide →- Can the operator just watch the HMI instead of inhibiting alarms?
- The operator will be distracted, the notification system will page the on-call person, and the journal will fill with alarms that were not real. Inhibit with a record, restore with a record. It takes a minute each way.
- What if the reference standard is out of date?
- Do not calibrate with it. A calibration against an uncertified standard proves nothing and can make a good instrument worse. Get the standard calibrated or use another, and put the standard calibration on a schedule so this does not recur.
- Do we adjust an instrument that is barely within tolerance?
- No. Adjusting a passing instrument loses the drift record and adds its own uncertainty. Note the trend, and if it is approaching the limit, shorten the interval so it is checked before it fails.
- Who signs the record?
- The technician who did the work, and where the plant requires it, a reviewer. The record is the evidence for the regulator and the investigation, and an unsigned record is a claim.
Troubleshooting Checklist
Read the guide →- What is the most common mistake?
- Changing something before looking. A restart, a recalibration, a setpoint change, a re-download, done in the first five minutes, destroys the evidence and often adds a second problem. The trend and the journal were there; they are read first.
- How do I keep track during a long search?
- On paper: the hypotheses tried, the tests, the results, and every temporary change made, with times. When a second person joins or a shift changes, the sheet is the handover, and when the fault is found, the sheet is the record and the list of things to restore.
- The problem went away on its own. Is it fixed?
- No; it is intermittent, and it will return. Record what was observed, set up to catch it: a fast trend on the tag, a communication statistic, an alarm on the condition, and keep the sheet open. The next occurrence with better evidence is when it gets solved.
- When is it a cyber incident rather than a fault?
- When the evidence shows a change nobody made, a login nobody recognizes, a controller program that differs from the baseline, or behavior that no fault explains. At that point the incident response plan takes over from the troubleshooting checklist, starting with isolation and preservation of evidence rather than repair.
NIST Publications for Control Systems
Read the guide →- Is the framework mandatory for a water utility?
- No. It is voluntary guidance that most regulators, insurers, and sector organizations accept as the reference structure, and the water infrastructure act assessment and the sector guidance align with it. Using it is the path of least resistance when anyone asks how the program is organized.
- Which document should a small utility read first?
- The sector performance goals and the environmental agency checklist, which distill the framework for a utility, and then the operational technology guide for the control system specifics. The framework itself is read when the program is ready to be assessed formally.
- Do we need the control catalog?
- As a reference, when a requirement has to be traced to a control or a specification has to cite one. Nobody reads it front to back. The operational technology guide overlay is the part that matters for a plant.
- How do these relate to the industrial security standard series?
- The institute documents are American guidance organized around risk management and controls; the international industrial security standard series is a standard organized around zones, conduits, and security levels for owners, integrators, and products. They are compatible, the operational technology guide references the standard series, and a utility commonly uses the framework for its program and the standard series for its network design and its vendor requirements.
CISA Guidance as a Reference
Read the guide →- Are the performance goals a standard?
- They are voluntary guidance, not a standard in the formal sense, and they say so. They function as a baseline standard because they are specific, prioritized, and widely referenced, and a utility can adopt them as its own standard by policy, which is what makes them binding on the utility and its contractors.
- How do the goals relate to the water infrastructure act assessment?
- The act requires an assessment and a plan that address cybersecurity without prescribing a method. The sector guidance points to the goals and the environmental agency checklist as the way to do the cyber portion; a utility that assesses against the goals has the cyber content of its assessment.
- Can we require a vendor to meet the goals?
- The goals that apply to products and services can be written into a specification as requirements: unique credentials, no default passwords, logging, multi-factor support, vulnerability disclosure, and so on. The secure-by-design principles and the industrial standard series product requirements give more detail for the product itself.
- Where are the services, the advisors, the scanning?
- On the cybersecurity resources page for the agency. This page is about the documents as references; the services are how a utility gets help using them.
EPA Rules and Their Control System Implications
Read the guide →- Does the SCADA historian count as the official record?
- It can, if the data is complete at the required interval, retained for the required period, protected from alteration, and producible on request. Many states accept electronic records; some require specific formats or certifications. Ask the primacy agency, and keep the exported compliance records as a backstop.
- What happens if the historian loses fifteen minutes of turbidity data?
- It is a monitoring gap. The rule and the state say how much gap is tolerable and what replaces it; a brief gap with grab sample data may be acceptable, a long one is a violation to report. The turbidimeter local memory, where the instrument has one, may fill the gap; that is a reason to buy instruments that log.
- Which turbidity values trigger action?
- The rules define combined filter effluent limits and individual filter values with durations that trigger reporting, a filter profile, a self-assessment, or a comprehensive performance evaluation. The values and durations are in the rule and the state version of it, and the control system alarms at them; the alarm description tells the operator what the trigger requires.
- How do wastewater plants meet the reporting clock for an overflow?
- With alarms that reach a person immediately, a time-stamped record of the high level and the overflow indication, and a procedure that names who calls the state and when. The clock starts when the utility knows, and the SCADA record is when the utility knew.
AWWA Standards and Manuals
Read the guide →- Do we need the association standards if we follow the federal rules?
- The rules say what to achieve; the association documents say how the sector does it. The risk standard and the security and emergency standards are the accepted methods for the act deliverables, the instrumentation manual is the sector practice for control design, and the product standards are what a meter or a tank specification cites. A utility without them writes its own methods from scratch.
- Is the association cybersecurity tool the same as the federal assessment?
- They are aligned: both map to the institute framework and the sector goals. The association tool is a self-assessment that produces a prioritized list; the federal agency offers an assessment performed with the utility. Many utilities use the tool annually and the federal assessment once, and reconcile the results.
- Which meter standard applies to a magnetic flowmeter in the plant?
- The association publishes a standard for electromagnetic and ultrasonic meters used as water meters, and a separate one for transit-time flowmeters in closed conduits. A plant process meter is often specified by the manufacturer standard and the utility requirements with the association standard cited for the meter class; check the current standard list.
- Where does the association fit beside the instrument society and the electrical standards?
- The association covers the water side: process practice, water quality, risk, and water products. The instrument society covers instrumentation and control practice across industries, and the electrical standards cover panels and wiring. A water utility control standard cites all three, each for its part.
Where the Logic Should Live: Controller, SCADA, or Relay
Read the guide →- The SCADA platform has a good scripting engine. Why not use it for control?
- Because the script runs on a server that reboots, patches, fails over, and loses its connection, and none of those events should change how a pump behaves. Use the scripting for reports, calculations across the plant, and presentation.
- Our controllers are small and the program is full. Can SCADA take some of the load?
- Take the reporting and the calculations to SCADA, and buy a larger controller for the process. A controller that is too small for the interlocks is a controller to replace, not a reason to move the interlocks.
- Is a smart relay or a safety relay a controller for this purpose?
- A safety relay is a relay: it does one function without software and belongs to the dead-controller case. A programmable smart relay is a small controller and should be treated as one, with a program that is backed up and documented.
- What about logic in a drive?
- Drives can run PID and simple sequences, and the same rule applies: the drive is below the controller, so logic in it must be something that should work with the controller gone, such as a hardwired run at a preset speed in backup mode. Normal control comes from the controller.
What a Small Utility Should Ask Before Buying SCADA
Read the guide →- Should a small utility consider a hosted or cloud SCADA?
- It can, with the same questions asked harder: where the data lives, what runs locally when the internet is down, how the field connection is secured, and what the contract says at termination. Local control must never depend on the cloud, and the security review is the decision.
- How much should we budget for the integrator?
- More than the software. Over the life of the system the labor to add sites, change screens, and build reports exceeds the license cost at most utilities. Choose a platform with an integrator base within driving distance and ask for hourly rates for routine changes.
- Is unlimited licensing always better?
- It removes the tag and client anxiety and it also removes the incentive to keep the system tidy. It is better for a utility that will grow and worse for one that will let a system sprawl without standards. The standards matter more than the license model.
- We already own a platform we do not like. Replace it?
- Ask the six questions of the current system first. If the answers are acceptable, the problem may be the implementation, not the platform, and a rebuild on the same product with standards is cheaper than a migration. If the answers are not acceptable, plan the migration with the exit plan you should have had.
The Tank Level Trend Tells the Whole Story
Read the guide →- What if the system has several tanks?
- A trend per tank, and one chart with all of them on the same scale for the overview. Tanks in the same pressure zone should move together; one that does not has a valve or a pump problem between it and the others.
- How deep should the daily swing be?
- Deep enough to turn the tank over in a few days while keeping the fire reserve and the outage reserve. The residual at the tank outlet is the check; if it is falling through the week, the swing is too shallow.
- The trend is smooth but the water age is still high.
- A smooth sawtooth that only uses the top few feet is the sign: the fill starts before much has left. Lower the lead-on level, deepen the swing, and consider a mixer if the tank stratifies.
- Can the controller read the trend for me?
- Partly. A rate-of-change alarm catches a fast fall and a transmitter fault, a night flow calculation catches a growing leak, and a fill-time calculation catches a source losing capacity. Those alarms are worth building; they still do not replace an operator who looks at the trend.
The Lift Station That Overflowed With Everything Working
Read the guide →- Would a triplex station have prevented it?
- Not with no power. A third pump helps when the pumps are the limit; here the limit was the generator and the callout. Redundancy in the pumps does nothing for a failure in the path to a person.
- Is a cellular text alert reliable enough to count as a second path?
- As a second path, yes: it is independent of the radio and the plant callout system, and independence is what a second path is for. As the only path, no, for the same reason a radio alone is not.
- How much response time is enough?
- The time it takes to get a person and a portable pump or generator to the site at night in bad weather, plus margin; often thirty to sixty minutes. If the wet well cannot provide it at storm inflow, the station needs storage, a permanent generator, or a lower high alarm with a different response.
- Who owns the callout roster?
- Someone named, with the roster on a review schedule and a test call procedure. A roster nobody owns is a list of numbers that used to work.
Calibration Is a Program, Not an Event
Read the guide →- How many instruments should be on the list?
- All of the compliance and control instruments, which at a small plant is a few dozen. Monitoring instruments go on with long intervals. Local gauges stay off; replace them when they disagree with the transmitter beside them.
- Can operators do the calibrations?
- Yes, with the written procedure, the right standards, and the template. Many small utilities have an operator who owns the program alongside their other duties. What does not work is a program with no owner.
- Does the online analyzer need calibrating if we take laboratory samples anyway?
- Yes: the analyzer runs the control and feeds the record between samples, and the laboratory samples are the verification. The calibration program uses the sample comparisons as the as-found record and adjusts the analyzer when the difference exceeds the tolerance.
- What tolerance should a wet well level transmitter have?
- Whatever the control needs: a few inches on a well with feet between the bands. Its calibration is a check against a tape at two levels, annually, with the record kept. It does not need a traceable standard; it needs to be checked.
The Panel You Can Troubleshoot at Two in the Morning
Read the guide →- Our panels were built years ago without any of this. Where do we start?
- With the drawings and the labels. An afternoon per panel to verify the schematic against the wiring, number what is not numbered, and put a laminated set in the pocket is the highest return. Indicating fuse holders and fused loop terminals can follow at the next outage.
- Do door indicators violate high-performance HMI thinking?
- No. The screen follows the high-performance rules; the door shows physical state for the technician standing at the panel. They serve different people at different moments.
- Is a touchscreen on the panel enough?
- It helps, and it fails, and it depends on the controller being alive. Physical indication for control power, fuses, supplies, and pump status remains, because those are the things you need to know when the touchscreen is dark.
- Who should do the two in the morning test?
- The utility technician who will maintain the panel, at the factory acceptance test. It is the best training they will get on the panel and the best review the panel will get.
Fiber Between Buildings, Every Time
Read the guide →- What about a surge protector on each end of the copper?
- It reduces the surge and does nothing for the ground loop, the noise, or the distance. Protectors on a copper link between buildings are a mitigation for a link that should not exist; fiber removes the problem they mitigate.
- We have a fiber link and it keeps failing.
- Almost always a dirty connector, a bend, or a transceiver, and all three are found in an afternoon with a scope and a power meter. A copper link between buildings fails for reasons that take a storm to reproduce.
- Multimode or single-mode?
- Single-mode for anything between buildings; the cable is cheap, the reach is unlimited for plant purposes, and the plant then has one fiber type. Multimode is acceptable inside a building where the existing plant is multimode.
- Can we use wireless instead?
- Wireless is also non-conductive and it is a fine second path. As the only path for a plant network it brings interference, weather, and security questions that fiber in a conduit does not. Between two buildings on one site with a conduit, fiber wins.
The Cellular Router Is the Front Door
Read the guide →- Is a private cellular network expensive?
- Carriers offer private addressing and tunnels to the plant for a modest monthly premium, and some utilities negotiate it into the data plan. Against the alternative, it is the cheapest security control available.
- Our router has a firewall built in. Is that enough?
- If it is configured to drop every inbound connection except the tunnel from the plant, management is off on the outside, the password is changed, and the firmware is current, yes. Shipped with defaults, no.
- How do we know if a router has already been reached?
- The router logs if it keeps any, unexpected configuration changes, port forwards nobody made, and setpoint changes at the site with no operator record. When in doubt, reset the router to a known configuration with a new password and put it behind the design above.
- What about the SCADA polling itself over cellular?
- Inside the tunnel, the polling is as private as the tunnel. Outside one, a control protocol over the internet is readable and writable by anyone in the path; the tunnel is not optional.
Measure Before You Replace
Read the guide →- The measurement takes longer than swapping the relay.
- One measurement takes a minute. The swap takes ten and answers less. Over a career, the technician who measures spends less time at faults, because the faults stop coming back.
- What if I do not have a drawing?
- The method still works: the interfaces are physical, terminal strips, module terminals, field devices, and the meter finds the disagreement between two sides of one of them. Then make the drawing, because the next fault deserves one.
- How do I know when the cause is really found?
- When it explains every observation including the ones that seemed unrelated, and when the fix verified by the same measurement removes the symptom. A cause that leaves a loose end is a partial answer.
- Is it wrong to keep suspect parts?
- It is wrong to keep them unlabeled. A part removed on suspicion goes on the bench, is tested, and is either returned to stock as good or discarded as bad, with a note. A box of maybes is a box of future faults.
The Control Narrative Is the Contract
Read the guide →- How long should a narrative be?
- As long as it takes to describe every behavior once, and no longer. A lift station is a few pages; a treatment plant is a chapter per process area. Length is not the measure; testability is.
- We have a project starting next month with no narrative. What now?
- Write one now, before programming, even a short one, and make its review the first milestone. A late narrative is far better than none, and the review will find the decisions nobody has made.
- The integrator says the narrative is in the program comments.
- Program comments describe the program; the narrative describes the behavior in language the utility can review and test against. The comments are welcome; they are not the contract.
- Who keeps it current?
- The utility, as the owner of the system, with the change procedure requiring a narrative revision for any change in behavior. The engineering library holds the current revision beside the drawings.
The Knowledge That Leaves With the Retiring Technician
Read the guide →- We cannot afford a second person on everything.
- A utility that cannot afford a second person can afford a narrative, verified drawings, backups, and a credential vault, which cover most of the risk. The second person is the remaining part, and a shared technician with a neighboring utility is one way small systems get there.
- Can an integrator capture this instead?
- An integrator can verify as-builts and write a narrative from the program, which is valuable. The reasons and the judgment come only from the person who has them, and the integrator would have to interview them anyway.
- What if the technician already left?
- Do the as-built verification and the settings review without them, treat every unexplained setting and relay as a question, and call them. Most retired technicians will spend an afternoon on the phone for the plant they built.
- How do we know the capture worked?
- Have the successor run a site alone for a month before the retirement and keep a list of every question they had to ask. Each question is a gap; fill them while the answer is still in the building.
What Integrator Consolidation Means for a Small Utility
Read the guide →- Our integrator is a one-person firm. Is that riskier than a large one?
- It is a different risk: illness or retirement instead of acquisition. The protections are the same, and the conversation about succession is easier to have with one person than with a corporation.
- The new firm wants to migrate us to their preferred platform. Should we?
- Only for the reasons a platform change would be right anyway: support life, staffing, cost over ten years, data portability. A migration proposed because the firm prefers the platform is a proposal to become dependent again.
- Can we maintain the system ourselves instead?
- Many small utilities do the routine work themselves with a technician who has the software and training, and keep an integrator for projects. Owning the work product and the standards is what makes that possible.
- What if the old programs were never handed over and the firm is gone?
- Upload what the controllers hold, which recovers logic and often names and comments; rebuild the documentation from the upload and the panels; and put the ownership language in every agreement from now on.
The Backup That Would Not Restore
Read the guide →- The integrator keeps our programs. Is that enough?
- It is a copy, and copies are good, but it is a copy the utility does not control. Integrators change hands, lose staff, and go out of business, and the file they hold may be the one from startup rather than what is running now. Keep your own, and ask for theirs after every change.
- How often should the program be uploaded from the controller?
- After every change, and on a fixed schedule regardless: quarterly for a stable plant, monthly for one where an integrator is active. The schedule catches the online edits nobody wrote down.
- Should we store the backup in the cloud?
- A cloud copy is fine as one of the copies, provided the plant network cannot overwrite or delete it automatically and the account is not shared with the SCADA server. It should not be the only copy; a drive in a safe still works when the internet does not.
- Does the same apply to the HMI and the SCADA server?
- Yes, and more so. SCADA projects, historian configuration, and the operating system image are larger and change more often. They need the same kit: project files, the software version, licenses, and a proven restore, on the same schedule.
Alarms Nobody Answers
Read the guide →- Is it safe to remove alarms? What if we need one later?
- An alarm that is not answered is not protecting anything. Removing it from the banner and keeping the condition as a logged event loses nothing, and the event history is there if the condition turns out to matter. Add it back with proper settings if it does.
- Where should alarm limits be set, the controller or SCADA?
- The condition is best evaluated in the controller, so it survives a SCADA outage and drives local logic. SCADA presents, prioritizes, records, and notifies. Whichever side holds the limit, only one should, and the other reads it.
- We have one operator for six sites. Do the benchmarks still apply?
- They apply per operator, which means the six sites together should be inside them. That usually means each site has to be quieter than a single plant would be, and it makes consequence suppression and delays more important, not less.
- Do we need alarm management software to do this?
- No. The alarm history in SCADA and a spreadsheet are enough for the counts, and the rationalization is a conversation. Software helps at large plants with thousands of alarms; a small plant needs the discipline more than the tool.
The Chlorine Residual Loop Is Slower Than You Think
Read the guide →- Why not just put the analyzer right at the injection point?
- Because the chemical is not mixed there. A sample taken before mixing reads the streaks of dosed and undosed water and is noise. The tap belongs at the first point where mixing is complete, which is often ten pipe diameters past a static mixer or a few bends, and no farther than that.
- Our loop works fine at night and hunts during the day. Why?
- Daytime flow changes are the disturbance, and the residual loop is being asked to correct them six minutes late. Add flow pacing, or check that the flow signal driving it is right, and the daytime hunting usually stops.
- Would a Smith predictor or model-based control help?
- It can, and some controllers offer dead time compensation. Most small plants get more from flow pacing, a shorter sample line, and patient tuning, all of which are simpler to maintain. Reach for dead time compensation after those are done, not instead of them.
- How much residual variation is acceptable?
- Enough to stay inside the plant's operating band and permit at all times, which for most plants means a few tenths of a milligram per litre around setpoint. A loop that swings a full milligram per litre is not controlling; it is oscillating.
Inflow and Infiltration Shows Up in the Pump Runtime
Read the guide →- How accurate is runtime-based flow compared with a meter?
- Within perhaps ten to twenty percent of a meter on an ordinary day when the pump rate was recently tested, and worse when pumps run in parallel or the rate has drifted. That is more than accurate enough to rank stations against each other, which is what the method is for.
- We have start counts but not runtime. Can we still do this?
- Start counts alone show the pattern but not the volume, because a start can be a short or long run. If the controller has the start and stop events in history, runtime can be rebuilt from their timestamps. Adding a runtime accumulator to the controller program is a small change worth making.
- How much rain data do we need?
- A daily total from a gauge within a few miles is enough to line up storms. A tipping bucket gauge on SCADA at the plant gives hourly resolution that separates inflow from infiltration more clearly, and it costs little.
- What ratio justifies pipe work?
- There is no fixed threshold; the ranking tells the utility where to look first. As a rough guide, a station peaking at more than three times its dry-weather flow in a moderate storm has a problem that smoke testing and a camera will usually locate quickly.
When the Transmitter and the Gauge Disagree
Read the guide →- Which one should the operator act on in the meantime?
- The transmitter, corrected for elevation, unless there is a specific reason to distrust it, because it is the better instrument and the one the control system uses. If the transmitter is suspect, the gauge is a rough check and the decision should be made conservatively until the reference is applied.
- How far apart is too far apart?
- Beyond the sum of the two accuracies plus the elevation correction. For a 2.5 percent gauge and a 0.25 percent transmitter on a 160 psi range that is about 4.5 psi after correction; a larger difference means something is wrong with one of them.
- Does the transmitter need recalibration if it matches the reference?
- No. Record the as-found agreement and leave it. Adjusting an instrument that is within tolerance adds error more often than it removes it.
- What about differential pressure across a filter or strainer?
- The same rules, with the added trap of two impulse lines that must be at the same elevation or corrected. A DP reading that changes when one line is bled had air in it, and that is the most common cause of a filter that appears dirty when it is clean.
Heat Kills Panels Slowly
Read the guide →- Is a stainless enclosure better or worse for heat?
- Stainless sheds internal heat slightly less well than painted steel and, unpainted, absorbs less sun than a dark finish but more than a white one. The difference is small compared with shade and with what is inside. Choose stainless for corrosion and deal with heat separately.
- Can we just leave the door open on hot days?
- It lowers the temperature and removes every rating the enclosure has, exposes energized parts, and invites water, insects, and rodents. It is a diagnosis, not a fix: if opening the door is the only way the panel survives, the panel needs cooling.
- What temperature should the alarm be set at?
- Below the lowest rated ambient of any component inside, with some margin: often 50 °C for a panel with drives rated at 40 that are already derated, or 55 for a controls-only panel. Check the datasheets; the alarm should fire before anything is outside its rating.
- Do heaters matter as well?
- Yes, for condensation and for cold-rated components in winter. An enclosure heater with a thermostat keeps the inside above the dew point, which prevents the corrosion and tracking that a cold, damp panel develops. Heat in summer and heat in winter are two different problems in the same box.
One Flat Network Is One Big Fault Domain
Read the guide →- Can we segment with VLANs on one switch, or do we need separate switches?
- VLANs on one managed switch are real segmentation of broadcast domains, and that is what contains the faults. Separate physical switches add resilience if a switch fails, and are worth it between the controls segment and everything else, but one good managed switch with VLANs already ends the flat network.
- Will segmentation slow SCADA down?
- No. The traffic crossing between segments is small, and a firewall or layer 3 switch handles it without visible latency. What operators notice is that the screens stop going stale when something unrelated goes wrong.
- What about remote I/O that uses multicast?
- Keep the controller and its I/O in the same segment and enable IGMP snooping with a querier on that VLAN. Multicast I/O across a routed boundary is possible but is a complication a small plant does not need.
- Our integrator says the plant network should stay flat for simplicity. Is that wrong?
- It was reasonable advice twenty years ago. A plant that intends to meet current water sector cybersecurity guidance, or that has ever lost SCADA to a fault in another building, needs segmentation, and a handful of VLANs and one firewall are not complicated to maintain once documented.
The Vendor Laptop Is on Your Network Now
Read the guide →- We have one operator on shift. Who watches the vendor?
- The operator, for the parts that matter: the connection, the scope, and the sign-off. For a long job, the compare afterward does most of the watching. What the utility cannot do is leave a vendor alone with a flat network and no backup and hope.
- The vendor needs remote access to support us under contract. Is that allowed?
- Yes, through the utility's access path: a jump host or VPN with multi-factor authentication, a named vendor account enabled per session, and logging. A permanent vendor-owned tunnel is a permanent open door, and the contract should say the access is the utility's to grant.
- What if the vendor refuses to hand over the program files?
- The files that run the utility's equipment belong with the utility, and the purchase order should say so. Proprietary libraries can be protected in other ways. A vendor who withholds the program the plant runs on has made the utility dependent on them, and that is a procurement problem to solve before the next visit.
- Does this apply to the integrator who built the system?
- Especially to them. The integrator has the deepest access and the most reason to work quickly, and the same backup, scope, compare, and handover discipline protects both parties when a question arises later about what changed and when.
The Intermittent Fault Is a Data Problem
Read the guide →- How long should we record before drawing conclusions?
- Until the fault has happened enough times for a pattern to be a pattern: for a daily fault, a couple of weeks; for a weekly one, a couple of months. Two events are a coincidence; five with the same signature are a cause.
- Our historian compresses data. Does that matter?
- Yes. Compression discards the samples that would show the minute before the fault. Turn it off for the tags in question while hunting, and set a fast scan rate on them; the extra storage is trivial for a few tags for a few weeks.
- What if the fault stops on its own?
- Leave the instrumentation in and keep the log. Faults that stop on their own come back, usually with the season or the next change, and the record from the first episode shortens the second hunt.
- Is it acceptable to replace a part on suspicion?
- When the part is cheap and the record supports it, yes, but replace one thing at a time and note the date, so the record can show whether the fault stopped. Replacing three things at once solves nothing you can learn from.
As-Built Means Someone Walked the Panel
Read the guide →- Our old panels have no drawings at all. Where do we start?
- With the panels that matter most: the ones that control the process and the ones that fail. A technician with a camera, a label maker, and a blank schematic template can document a duplex panel in a day. It is not elegant and it is far better than nothing.
- Who should do the walk-down, the integrator or the utility?
- The integrator, on a new project, because it is their deliverable and their errors to find. The utility should spot-check it, because the utility lives with the result. For existing panels, the utility's own technician, who will also learn the panel in the process.
- What software do we need for the master set?
- The one the drawings were made in, or one that opens it. For a small utility a general CAD package and a disciplined folder structure are enough; document control software is a later step. The discipline matters far more than the tool.
- How do we handle drawings for a change the vendor made?
- The vendor's change record and redline are part of the service call, and the utility updates the master from them. A vendor who leaves without documenting a change has left the utility a fault to find later.
Wet Well Level Control
Read the guide →- How wide should the level band be?
- Wide enough that at the lowest expected inflow the pump still runs long enough to satisfy minimum run time and stay within its starts-per-hour rating, and narrow enough that detention time at that same low flow does not turn the well septic. Calculate both, then use the widest band that satisfies the detention limit.
- What level technology is best for a wet well?
- Non-contact radar is the usual answer for raw wastewater because nothing touches the liquid and it is unaffected by vapor and temperature. Submersible pressure transducers are common and less expensive but sit in the liquid and foul. Ultrasonic drifts with temperature and struggles with vapor and foam.
- Do I still need floats with a good level transmitter?
- Yes. The floats are not there because the transmitter is unreliable. They are there because they fail independently. A single measurement with a single path to the pumps has no fallback when it reports a wrong but plausible value.
- Why does my station short cycle at night?
- Because inflow is at its lowest, so the well takes a long time to fill and the pump empties the band just as fast as always. The run is short, and if the band is narrow the pump exceeds its starts-per-hour rating. Widen the band, subject to the detention time limit.
4-20 mA Current Loops
Read the guide →- Why is 4 mA used instead of 0 mA for zero?
- So that a genuine zero measurement is distinguishable from a failure. At 4 mA the loop is proven intact and the transmitter is powered. At 0 mA something is broken. A 0-20 mA scheme cannot tell those apart.
- What is the maximum distance for a 4-20 mA signal?
- Distance is limited by total loop resistance, not by a fixed length. Calculate available voltage divided by 0.020 amps to get the maximum resistance, subtract the receiver and any devices, and the remainder is your wire budget. In practice, several thousand feet of ordinary instrument cable is routinely fine.
- Can I read a 4-20 mA signal with a voltage input?
- Yes, by placing a precision resistor across the input. 250 ohms converts 4-20 mA to 1-5 V, and 500 ohms gives 2-10 V. Use a precision resistor with a low temperature coefficient, and include the resistor in your loop resistance budget.
- Why does my analog signal jump when a VFD starts?
- Almost always induced noise coupling into the signal cable, or a ground loop that the drive is exciting. Confirm the signal is quiet with the drive stopped, verify the cable shield is grounded at exactly one end, and check that the signal cable is not sharing a tray or conduit with drive output conductors.
- What does it mean if the loop reads 21 mA or higher?
- On a NAMUR-compliant transmitter it means the device has detected an internal fault or lost its measurement and is deliberately reporting out of range. Read the transmitter diagnostics rather than assuming the process is above full scale.
- Should I use 4-20 mA or a digital protocol for new work?
- Both have a place. 4-20 mA is simple, well understood by every technician, and fails in obvious ways. Digital protocols carry more data per device and less wire. A common approach is HART transmitters on 4-20 mA loops, which gives the robustness of analog with digital diagnostics available when you need them.
Water and Wastewater Utility Threat Landscape
Read the guide →- Are small water systems really targeted?
- Most reported incidents were not targeting a specific utility. They were opportunistic access to whatever was reachable and weakly protected. Being small offers no protection when the exposure is discoverable by automated scanning.
- What is the single highest-value thing to do first?
- Eliminate direct internet exposure of control systems, and put multi-factor authentication on every remote access path. That combination addresses the initial access method in the large majority of publicly reported water sector incidents.
- Does cyber insurance cover a control system incident?
- It depends entirely on the policy, and many policies have requirements or exclusions relating to remote access controls and multi-factor authentication. Read the policy with your broker before you need it.
- Do we have to report an incident?
- Reporting obligations vary by state, by system type, and by federal rule, and they have been changing. Confirm the current requirement with your state primacy agency and have the reporting path written down before an incident, not during one.
Duplex Lift Station Controls
Read the guide →- Why are floats still used when a level transmitter is installed?
- Because they fail differently. A float is a mechanical switch on its own circuit that does not depend on the transmitter, the analog card, or the controller. When the primary measurement fails in a way that looks plausible, the float is what keeps the station from overflowing.
- Should a lift station use variable frequency drives?
- Sometimes. VFDs allow level to be held steadily and reduce starts, and they are valuable where the force main or the downstream plant benefits from a smooth flow. They add cost, heat, harmonics, and a maintenance item at an unattended site. Many utilities use across-the-line starters at typical stations and reserve drives for large or hydraulically sensitive ones.
- How long can a station run without SCADA?
- Indefinitely, if it is designed correctly. The panel controls the pumps. SCADA provides visibility, alarming, and history. Losing communication means the utility is blind, which matters a great deal, but it should never mean the station stops pumping.
- What causes a high level alarm at a station that seems to be working?
- In rough order of frequency: a rag-bound pump that is running without moving water, a level measurement reading low, an inflow event exceeding station capacity, a partially closed discharge valve, and a check valve stuck shut. Trend level against pump run status and the answer usually becomes obvious.
OT Security vs IT Security
Read the guide →- Should OT and IT networks be completely separated?
- Physically air-gapped networks are rare and often less secure in practice, because data still moves by USB drive and remote support still happens, just without controls. A segmented architecture with a controlled, monitored boundary is the realistic and generally recommended approach.
- Can I run antivirus on an HMI or SCADA server?
- Sometimes, and only with the control vendor guidance on exclusions and versions. Real-time process software has been disrupted by on-access scanning. Application allowlisting is often a better fit for a machine whose software set never changes.
- How do we handle an unsupported operating system on a control workstation?
- Treat it as unfixable and wrap it: strict segmentation, no internet path, no email or browsing, removable media controls, tight firewall rules, and monitoring. Then plan its replacement with a real budget line rather than an intention.
- Who should own OT cybersecurity?
- It has to be shared, with a single accountable owner named. The failure mode is a gap where IT assumes operations handles the plant network and operations assumes IT handles security. Write down who owns the boundary.
UL 508A Industrial Control Panels
Read the guide →- Does every industrial control panel have to be UL 508A listed?
- Not universally. Requirements depend on the authority having jurisdiction and the project specification. NEC 409.110 requires the SCCR marking on industrial control panels regardless. Many municipal specifications require the listing outright, and it is common practice for public work.
- Can I build a UL 508A panel myself?
- You can build to the standard, but you cannot apply the label unless your shop holds the listing and operates under the associated program with periodic audits. A panel built to the standard without the label is not a listed panel.
- What is the default SCCR if nothing is calculated?
- Panels frequently default to 5 kA, which is very low for anything fed from a substantial service. Determine the actual available fault current at the installation and design the panel to exceed it, using the supplement SB method or a high-fault-rated combination.
- Does the listing cover the PLC program?
- No. UL 508A is entirely about construction and safety. Program correctness, sequence of operation, and control performance are separate and belong in the functional specification and the factory acceptance test.
How to Program Lead/Lag Pump Control
Read the guide →- Should alternation happen on start or on stop?
- On cycle completion, meaning when all pumps stop. Alternating at start means the roles change mid-cycle when the lag pump joins, which produces confusing behavior and uneven wear.
- What if both pumps are called and one fails?
- The remaining available pump should keep running and the failed one should drop out of the rotation. Alarm the failure and the loss of redundancy separately, because they need different responses.
- How long should minimum run time be?
- Long enough that the motor stays within its starts-per-hour rating at the worst case, which is the lowest inflow. Ninety seconds to several minutes is common for municipal lift stations. Calculate it from the wet well volume and pump capacity rather than guessing.
- Do I need lead/lag logic if the panel has a mechanical alternator?
- A mechanical or dedicated alternator will run the station, but the utility cannot see the alternation state, cannot see run hours per pump, and cannot change the strategy without a site visit. Any station on SCADA is better served with the logic in the controller.
4-20 mA Signal Is Unstable
Read the guide →- Why does my analog signal only get noisy when a pump runs?
- Either the drive output cable is coupling into the signal cable, or the motor current is exciting a ground loop. Check cable routing and separation first, then shield grounding, then add an isolator if the second ground cannot be removed.
- How much filtering is acceptable?
- Enough to remove measurement noise without hiding a real process change the control loop needs to see. On a wet well level a few seconds is usually harmless. On a pressure loop controlling a pump, heavy filtering will destabilize the control.
- Can a bad power supply cause an unstable analog signal?
- Yes. A loop supply with excessive ripple or one operating near its current limit puts that variation directly into the loop. Measure the supply output with a meter on AC volts to check for ripple, and confirm it is not overloaded.
- The reading is stable at the panel but jumps on the HMI. What now?
- The field is fine. Look at the controller scaling, any filtering, the update rate between controller and SCADA, and the SCADA tag configuration. A slow poll rate showing a fast-changing value can look like instability that is not there.
What Is a PLC?
Read the guide →- What does PLC stand for?
- Programmable logic controller. The name describes what it replaced: hardwired relay logic that could only be changed by rewiring, replaced by logic you can change by programming.
- What is the difference between a PLC and a microcontroller?
- A microcontroller is a chip. A PLC is a finished industrial product built around a processor, with rated I/O, a power supply, diagnostics, an environmental rating, and a standardized programming environment. You can build a controller from a microcontroller, but you would be rebuilding everything a PLC already provides.
- Do I need to know how to program a PLC to work with one?
- No, but you need to be able to read one. Technicians who can follow a rung and see which condition is holding a pump off resolve calls far faster than those who can only check voltages.
- How long does a PLC last?
- Processor and I/O hardware routinely runs fifteen to twenty-five years. The practical limits are usually spare parts availability, software that no longer runs on a supported operating system, and communication protocols the rest of the plant has moved past.
Modbus Device Intermittently Offline
Read the guide →- How do I know if termination is correct?
- Power down the bus and measure resistance across the A and B pair. Approximately 60 ohms indicates two 120 ohm terminators, which is correct for a properly terminated segment. Higher suggests one or none; much lower suggests several devices have termination enabled.
- Do I need the signal common on RS-485?
- Yes, in practice. The differential pair carries the data but every transceiver has a common-mode voltage limit. Without a shared reference, ground potential difference between devices can exceed it, and the bus works until it does not.
- Why does the bus fail only when a pump starts?
- Because the drive output cable is coupling into the communication cable, or the motor current is shifting ground potential between devices. Check routing and separation first, then the signal common, then consider an isolated repeater.
- Should I lower the baud rate?
- It can help as a diagnostic and sometimes as a workaround, because lower rates tolerate reflections and marginal cabling better. Treat a bus that only works at a reduced rate as an installation defect to be corrected, not as a solution.
The Purdue Model
Read the guide →- Is the Purdue model outdated?
- The strict hierarchy is dated; the boundaries it identifies are not. Most current guidance still starts from these levels and then adapts for cloud, remote sites, and vendor connectivity. It remains the most widely shared vocabulary for discussing industrial network architecture.
- Do I need a DMZ for a small utility?
- You need the boundary. It may be a single firewall with a small DMZ segment holding one replica server rather than a large architecture. The principle that no business host connects directly to a control device applies at every size.
- What is Level 3.5?
- A commonly used informal name for the DMZ between site operations and business networks. It is not part of the original model but it is universally understood in industrial security discussions.
- How does this relate to ISA/IEC 62443?
- IEC 62443 uses zones and conduits, which is a more flexible way of expressing the same idea: group assets with similar security requirements into zones, and control every communication path between zones. The Purdue levels are a common starting point for defining those zones.
PID Control for Pumps and Valves
Read the guide →- Do I need the derivative term?
- Usually not, in water and wastewater. Flow, pressure, and level signals carry enough noise that derivative action mostly amplifies it. Derivative earns its place on slow processes with real thermal or transport lag.
- Why does my pressure loop oscillate only at low flow?
- Process gain changes with operating point. A pump and a system curve are not linear, so tuning that suits high flow is often too aggressive at low flow. Tune at the worst-case condition, or use gain scheduling if the platform supports it.
- Can I use one set of tuning constants for both pumps?
- If the pumps and drives are identical and piped symmetrically, usually yes. Verify by running each individually and watching the response, because impellers wear at different rates and a station rarely stays symmetric.
- What is the difference between proportional band and gain?
- They are reciprocals scaled by 100: proportional band equals 100 divided by gain. A gain of 2 is a 50% proportional band. Increasing gain and decreasing proportional band mean the same thing, which is why copying a number between platforms without checking the convention can invert your intent.
- Should the PID run in the PLC or in the drive?
- In the PLC for anything the plant depends on. The controller has the full process picture, the interlocks, and the historian. A drive-resident PID is convenient for a standalone booster but leaves the control strategy invisible to SCADA and difficult to change.
Lead/Lag Pump Control
Read the guide →- How often should pumps alternate?
- For a duplex station, every cycle is the usual default and it produces the most even wear. Where cycles vary greatly in length, alternating on accumulated run hours balances wear better.
- What triggers the lag pump?
- Most commonly a higher wet well level, meaning the lead pump is not keeping up. It should also start on lead pump failure, and it may start on a high-level condition regardless of the normal sequence.
- Should alternation survive a power failure?
- Yes. Store the alternation state in retentive memory. Otherwise every power blip resets the station to pump 1 as lead, and over years that pump accumulates significantly more wear.
- How many starts per hour is too many?
- Check the motor nameplate and manufacturer data. For the submersible motors typical at municipal lift stations, six to ten starts per hour is a common limit. If your station exceeds that, widen the level band rather than accepting the cycling.
- Should lead/lag logic live in the PLC or in a pump controller?
- In the PLC for any station on SCADA. A dedicated pump controller is fine for a standalone station, but it puts the alternation state, the run hours, and the failure logic somewhere the utility cannot see or change.
Ethernet Device Drops Offline
Read the guide →- What causes late collisions on a full-duplex link?
- A duplex mismatch. One end is running half duplex, almost always because it is auto-negotiating against a hard-set partner. Set both ends the same way.
- How do I find a duplicate IP address?
- Look for ARP conflict messages in device or switch logs. The simplest field test is to disconnect the suspect device and ping its address. If something answers, another device is using it.
- Should I hard-set speed and duplex on industrial devices?
- Only if both ends are hard-set identically and it is documented. Auto-negotiation on both ends is reliable on modern equipment and avoids the mismatch that causes most of these problems.
- Why does my network fail when I add more devices?
- On an EtherNet/IP network, usually multicast flooding without IGMP snooping. It can also be controller connection limits, or a genuinely saturated uplink. Check switch port utilization and multicast rates.
ISA-18.2 Alarm Management
Read the guide →- What is the difference between an alarm and an event?
- An alarm requires a timely operator response. An event is recorded but requires nothing. A pump starting is an event. A pump failing to start when commanded is an alarm.
- How many alarms should a system have?
- The standard sets rates, not counts. A large plant may have thousands of configured alarms and still be well within rate targets, because most are rarely active. A small plant with forty alarms can be unusable if six of them chatter constantly.
- Is ISA-18.2 mandatory?
- It is a consensus standard, not a regulation, and it is not generally mandated for municipal water and wastewater. It is widely treated as good practice, and it is often referenced in specifications. Where a regulator or insurer asks how alarms are managed, this is the framework they expect to hear about.
- Where do I start on an existing system nobody has ever rationalized?
- Measure for thirty days. Rank alarms by frequency. Take the top ten and address each one by fixing the underlying cause, adding a delay or deadband, changing the setpoint, or reclassifying it as an event. That work alone typically removes most of the volume, and it builds the case for funding a full rationalization.
How to Size a Control Panel Power Supply
Read the guide →- How much headroom should a control power supply have?
- At least 25% above the calculated steady-state load, and more where spare I/O capacity exists. The step to the next catalog size is usually inexpensive relative to the cost of diagnosing an intermittent brownout later.
- What are the symptoms of an undersized supply?
- Intermittent controller resets, communication modules dropping out, analog readings shifting when relays energize, and faults that cluster around specific sequence steps. All of these look like other problems, which is why they take so long to find.
- Should the PLC and field devices share a supply?
- Preferably not. Separating them means a shorted field wire does not take down the processor, and it makes fault isolation far quicker. Where a single supply is used, distribute through individually protected branches.
- Do I need to derate for altitude?
- Above roughly 2000 metres, yes, because reduced air density lowers convective cooling. Check the datasheet. For most water and wastewater work in low-lying areas this is not a factor, but it matters for mountain installations.
How to Scale a 4-20 mA Input in a PLC
Read the guide →- Should I use the built-in scaling instruction or write the math?
- Either works. The built-in instruction is fine if you understand its parameters, which differ between platforms. Writing the arithmetic explicitly makes the constants visible to whoever opens the program next, which has real maintenance value.
- What raw value corresponds to 4 mA on my card?
- Read the module manual and then verify by injection. There is no universal answer, and assuming one is the most common cause of a scaling error.
- Do I need to clamp the output?
- Yes. Without clamping, a transmitter at 3.9 mA produces a slightly negative level and a fault at 21.5 mA produces a level above the top of the well. Downstream logic will act on both.
Ladder Logic Fundamentals
Read the guide →- Is ladder logic still used?
- Yes, heavily. It remains the dominant language in water, wastewater, and most discrete manufacturing, largely because the people who maintain these systems can read it online while the process is running.
- What is the difference between a normally-open contact in the field and in the program?
- A field contact is a physical device state. A program instruction examines a memory bit. If a normally-closed field contact is wired to an input, the input bit is on when the device is at rest. Whether you use examine-if-closed or examine-if-open in the program depends on what you want to detect, and getting it backwards is a very common commissioning error.
- Why does my output flicker?
- Usually because the same output address is written by more than one rung, or because the condition driving it is oscillating around a threshold with no deadband. Search the whole program for duplicate destructive writes to that address first.
- What is a one-shot and when do I need one?
- A one-shot is true for a single scan when its condition transitions from false to true. You need one any time an action should happen once per event rather than continuously: incrementing a counter, sending a message, or capturing a value at the moment something happened.
Ground Loops in Instrumentation
Read the guide →- Should a cable shield be grounded at one end or both?
- One end, for analog instrumentation signals, normally the panel end. Grounding both ends creates exactly the path this article is about. High-frequency network cabling follows different rules; do not apply this guidance to Ethernet.
- Which end should the shield be grounded at?
- The end where the signal reference is established, which for a loop-powered transmitter is the panel supplying the loop. Be consistent across the site and document it, because mixed practice is worse than either convention.
- Can a ground loop damage equipment?
- Usually it degrades a reading rather than causing damage. During a fault or a lightning event, however, the same path can carry very large current and destroy analog inputs. Surge protection and isolation on circuits leaving a building are worthwhile for this reason.
- How do I tell a ground loop from induced VFD noise?
- They often occur together and both correlate with drive operation. Induced noise couples into the cable and responds to routing, distance, and shielding. A ground loop responds to how many points the circuit is earthed at. Lift one shield end: if the reading settles, it was a loop.
How to Test a 4-20 mA Loop
Read the guide →- Can I measure loop current without breaking the loop?
- Yes, in two ways: measure voltage across the known sense resistor and calculate, or use a true milliamp clamp meter. Transmitter test jacks also insert a meter without opening the circuit.
- Why does my meter read zero when the loop is clearly working?
- Check the meter fuse on the milliamp range first. A blown fuse reads zero and looks exactly like an open loop. Also confirm the red lead is in the milliamp jack, not the volts jack.
- What if the reading is correct at the panel but the HMI is wrong?
- The field and the input card are fine. The problem is scaling in the controller or configuration in the SCADA system. Check the card range setting first, then the scaling constants, then the SCADA tag.
- How do I test a loop-powered transmitter on the bench?
- Supply 24 VDC through a 250 ohm resistor in series with the transmitter, then measure voltage across the resistor to read current. That is a complete loop simulator built from two parts.
What Is SCADA?
Read the guide →- Does SCADA control the plant?
- Not directly. Controllers execute the control logic. SCADA supervises: it displays, records, alarms, and lets an operator adjust setpoints or issue commands that the controller then acts on.
- What happens if the SCADA server fails?
- In a correctly designed system, the process keeps running on controller logic while you lose visibility, alarming, and history. If equipment stops when SCADA stops, control logic that belongs in the controller is living in the wrong place.
- How often should SCADA poll a remote site?
- Fast enough that an operator can act on a change, slow enough that the communication path stays healthy. For a lift station on licensed radio, every fifteen to sixty seconds for analog values with immediate reporting of alarms and state changes is typical.
- What is the difference between SCADA and a historian?
- SCADA maintains current values and operator interaction. A historian stores values over time and answers questions about the past. They are frequently sold together but they solve different problems, and history requirements should be specified separately.
Magnetic Flowmeters
Read the guide →- Can a magnetic flowmeter measure a partially full pipe?
- A conventional one cannot; it will read low and give no obvious indication. Purpose-built partially-filled meters exist with additional electrodes for level, but for a standard mag meter, a full pipe is a requirement.
- Do magnetic flowmeters work on drinking water?
- Yes. Potable water is conductive enough. Verify the liner and electrode materials are approved for potable contact for your jurisdiction.
- Why does my mag meter read flow when the pump is off?
- Either there is genuine flow, such as backflow through a check valve, or the measurement has no proper ground reference. Close an isolation valve to establish true zero flow and observe. If it still reads, look at grounding and electrode condition.
- How often should a mag meter be calibrated?
- The electromagnetic measurement itself is stable and does not drift the way a mechanical meter does. Most utilities verify annually and clean electrodes as needed. Where the meter is used for billing or regulatory reporting, follow the requirement that applies to you.
The PLC Scan Cycle
Read the guide →- What is a typical PLC scan time?
- For a small to medium water or wastewater application, 5 to 20 milliseconds is typical. Large plant controllers with heavy communications may run 30 to 80 milliseconds. What matters is not the number itself but whether it is stable and comfortably under the watchdog setting.
- Why did my output not turn on immediately when the input closed?
- Because outputs are written at the end of the scan and inputs are read at the beginning. Depending on where in the scan the input actually changed, the response takes between one and two full scans plus input filter time and output device switching time.
- Does putting logic in a subroutine make the scan faster?
- Only if the subroutine is conditionally called and is often not called. Moving code into a routine that runs unconditionally every scan changes nothing except organization.
- What causes a watchdog fault?
- A scan that did not complete within the configured watchdog time. Look for loops without a bounded exit, recursive routine calls, a message instruction blocking on an unresponsive device, or an unexpectedly large array operation.
Modbus TCP
Read the guide →- What port does Modbus TCP use?
- TCP port 502 by default. Some devices allow it to be changed, and some vendors additionally offer Modbus over a secure transport on a different port.
- Do I need a CRC in Modbus TCP?
- No. TCP provides error detection and retransmission, so the Modbus CRC is omitted. Sending a request with an RTU CRC appended to a TCP connection produces an error, which is a common mistake when adapting serial code.
- What unit identifier should I use?
- For a native Ethernet device, try 1 or 255; many ignore the field. For a gateway fronting serial devices, use the serial slave address of the target device. This is the correct answer far more often than people expect.
- Can Modbus TCP and Modbus RTU coexist?
- Yes, with a gateway. It presents a TCP server on the Ethernet side and acts as the single serial master on the RS-485 side, using the unit identifier to select the slave. This is extremely common in retrofits.
High Performance HMI Design
Read the guide →- Is ISA-101 required?
- No. It is a consensus standard describing a lifecycle for HMI design. It is often cited in specifications and is treated as good practice, but it is not a regulation for municipal water and wastewater.
- Will operators accept grey screens?
- Usually yes, once they have worked a shift on them, and the objection almost always comes before the trial rather than after. Involving operators in the design and converting one area first makes the difference between adoption and resistance.
- Should running pumps be green?
- Under this approach, no. Green fill on every running pump spends your most attention-grabbing resource on the most common and least interesting state. Use a subtle outline or fill difference for running, and keep saturated color for conditions that need action.
- How many displays should a system have?
- As few as will cover the plant with a clear hierarchy. Large numbers of near-duplicate displays are a symptom of missing reusable templates, and they multiply the cost of every future change.
Modbus RTU
Read the guide →- What is the difference between Modbus RTU and Modbus ASCII?
- RTU sends binary data with a CRC-16 and relies on silent intervals for framing. ASCII sends hexadecimal characters with a start and end delimiter and an LRC check. ASCII is more tolerant of latency but roughly half as efficient. RTU is far more common.
- How many devices can be on one RS-485 segment?
- The protocol addresses up to 247 slaves. The electrical limit is typically 32 standard unit loads on a segment, though many modern transceivers present a fraction of a unit load and allow more. Practically, keep segments small; a bus with forty devices is slow and hard to diagnose.
- Why does my device respond intermittently?
- In order of likelihood: missing or incorrect termination, missing bias, no signal common, cable routed near drive output conductors, a timeout shorter than the device response time, and polling faster than the device can answer.
- Can I have two masters on a Modbus RTU bus?
- Not on the same segment. Modbus RTU is single-master by design. Two masters will transmit over each other. If two systems need the data, use a gateway or a data concentrator that presents itself as a slave to both.
Analog Scaling: Raw Counts to Engineering Units
Read the guide →- Why does my level read correctly at zero but wrong at full?
- That is a span error, not an offset error. The two ranges disagree about what 20 mA means. Compare the transmitter calibrated upper range value against the EU_max constant in the program, and check the analog card is configured for 4-20 mA rather than 0-20 mA.
- What raw count corresponds to 4 mA?
- It depends entirely on the module and its configuration. Do not assume. Read the manual, then verify by injecting 4 mA with a calibrator and observing the raw value online.
- Should scaling be done in the PLC or the SCADA system?
- In the PLC. The controller makes the control decisions, so it needs the correct engineering value regardless of whether SCADA is running. Scaling in SCADA leads to two different numbers for the same measurement, which is a very hard problem to unwind later.
- How do I handle a transmitter with a suppressed zero?
- A transmitter ranged 2 to 27 feet simply means EU_min is 2 and EU_max is 27. The formula handles it without modification. The mistake is leaving EU_min at zero, which produces an error of exactly the suppression amount at every point.
Radar Level Measurement
Read the guide →- Does foam affect radar level?
- Light foam is usually transparent to radar and it measures the liquid beneath. Dense, wet foam can absorb enough energy to weaken the return. Guided wave radar handles heavy foam better than non-contact.
- Why does my radar level freeze at one value?
- Almost always a false echo. The instrument has locked onto a fixed reflection from a ladder, a pipe, a bracket, or a build-up on the wall. Run a false echo suppression scan with the vessel empty, and check the mounting position against obstructions.
- Can radar measure through a plastic tank wall?
- Sometimes, for some frequencies and materials, but it is not a general-purpose solution. It is sensitive to wall thickness and material, and it degrades unpredictably. Mount through a proper nozzle where the application matters.
- What is the minimum measurable level?
- Set by the near-field blanking distance, which excludes reflections from the antenna and nozzle. It is typically a few inches to a foot depending on the instrument. Account for it when you set the low level pump-off point.
Interlocks and Permissives
Read the guide →- Should interlocks be in the PLC or hardwired?
- Both, for different purposes. Anything protecting people must be hardwired or in a rated safety system. Process interlocks belong in the PLC where they can be documented, alarmed, and historized. Critical equipment protection is often done in both, with the hardwired circuit as the enforcement and the PLC providing indication.
- What is a first-out indication?
- A record of which condition tripped first when several trip nearly simultaneously. Without it, a trip that cascades leaves you looking at five alarms with no way to tell which was the cause and which were the consequences.
- Can a permissive be bypassed?
- Sometimes it must be, for maintenance or commissioning. If you build a bypass, it should require a deliberate action, be visible on the HMI while active, be alarmed, be logged, and ideally time out on its own. A silent permanent bypass is how interlocks quietly stop existing.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.
Content on CurryControls.com is general technical reference information provided for educational and reference purposes only. It is not engineering advice for a specific installation. All information must be independently verified against current codes, standards, manufacturer documentation, project requirements, and qualified professional judgment before it is relied upon or applied.