Topic
Standards
79 guides across the knowledge base.
IEC 61131-3
The standard behind PLC programming languages: the five languages, the common elements of data types, variables, and program organization units, what conformance actually means, and how the standard shows up in real platforms.
9 min readUpdated Sep 5, 2026
Structured Text
The text language of IEC 61131-3: syntax, control structures, how it fits alongside ladder, the conventions that keep it readable for the next person, and the mistakes that make structured text a liability in a plant that troubleshoots online.
10 min readUpdated Sep 5, 2026
Function Block Diagram
The graphical data-flow language of IEC 61131-3: how blocks, pins, and wires work, execution order, where FBD beats ladder and structured text, building reusable equipment blocks, and the habits that keep a diagram readable.
9 min readUpdated Sep 5, 2026
Alarms in the Controller
Generating alarm conditions in the controller rather than in the graphics: why the PLC should own the alarm state, a standard alarm block with setpoints, deadband, and delays, equipment alarms, and packing alarm bits for SCADA.
9 min readUpdated Sep 5, 2026
Sequential Function Chart
The IEC 61131-3 language for sequences: steps, transitions, actions and their qualifiers, alternative and simultaneous branches, where it fits in water and wastewater, and the rules that keep a chart from sticking in a step.
9 min readUpdated Sep 5, 2026
Control Expert
Field notes on Control Expert, the Schneider Electric engineering software for the Modicon M340 and M580: project structure, the five languages and derived function blocks, versions and files, online changes, upload information, and security settings.
8 min readUpdated Sep 5, 2026
Siemens
Field notes on Siemens controllers in water and wastewater: the S7-1200 and S7-1500 with TIA Portal, the older S7-300 and S7-400, PROFINET and PROFIBUS, the block model and memory cards, protection levels, and why it arrives inside packaged equipment.
8 min readUpdated Sep 5, 2026
ISA-101: Human Machine Interfaces
What the ISA-101 standard for human machine interfaces covers, its lifecycle from philosophy to maintenance, the display hierarchy, and what adopting it changes on a project.
8 min readUpdated Sep 5, 2026
Alarm Servers
The part of SCADA that turns a condition into an alarm and manages its life: where detection happens, the alarm state machine, priority, deadband and delays, acknowledgment across clients, the journal, notification, redundancy, timestamps, and flood behavior.
10 min readUpdated Sep 5, 2026
Alarm Shelving
The operator tool for temporarily silencing a nuisance alarm: what shelving is and is not, the rules a philosophy sets, who may shelve what and for how long, automatic unshelving, the shelved list, the record, and how to implement it on any platform.
8 min readUpdated Sep 5, 2026
Alarm Suppression
Suppressing alarms by design: state-based logic that removes alarms that mean nothing in the current state, parent-child logic that stops a flood at its source, out-of-service suppression for maintenance, the rules that keep it safe, and how to test it.
9 min readUpdated Sep 5, 2026
Long-Term Storage
Keeping historian data for years: a retention policy by data class that follows the record rules, tiered storage from online to offline copies, downsampling, archive management, exports that outlive the historian, and the annual proof that old data reads.
9 min readUpdated Sep 5, 2026
Turbidity Measurement
Nephelometric turbidimeters for filter effluent and raw water: how 90-degree scattering is measured, the methods and the NTU, low-range versus high-range instruments, bubbles and the debubbler, formazin calibration and verification standards, and the compliance record the instrument exists to produce.
11 min readUpdated Sep 5, 2026
Calibration Procedures
How a utility calibrates its instruments consistently: the as-found and as-left discipline, tolerance from the loop rather than the data sheet, the reference standard and its traceability, the five-point check with hysteresis, adjusting only when needed, intervals set from history, and the procedure written once per instrument type.
9 min readUpdated Sep 5, 2026
Calibration Documentation
The records a calibration program produces and what each is for: the calibration certificate per event, the instrument history, the reference standard file, the schedule, the tolerance and interval register, and how the records are organized so a regulator, an auditor, or the next technician can find what they need.
8 min readUpdated Sep 5, 2026
Pressure Calibration
What calibrating a pressure transmitter means: as-found and as-left, the five-point test and hysteresis, tolerance and the reference standard, sensor trim versus output trim versus reranging on a smart transmitter, gauge versus absolute, and intervals.
10 min readUpdated Sep 5, 2026
Ammonia Analyzers
Online ammonia measurement in water and wastewater: ion-selective probes, gas-sensing electrodes, and wet-chemistry analyzers, what each is good for, the interferences that decide accuracy, and the maintenance and calibration it demands.
9 min readUpdated Sep 5, 2026
Nitrate Analyzers
Online nitrate measurement: ultraviolet absorbance probes and analyzers, ion-selective electrodes, and wet chemistry, the interferences from organics, turbidity, and chloride, the uses in denitrification and source monitoring, and maintenance.
8 min readUpdated Sep 5, 2026
NFPA 70 and the Control Panel
The National Electrical Code inside an industrial control panel: Article 409 and the listing it points to, the short-circuit current rating, overcurrent protection for control circuits, grounding and bonding, working space, and what an inspector asks.
9 min readUpdated Sep 5, 2026
UL 698A
Industrial control panels for hazardous locations: what UL 698A adds to UL 508A, a panel in a classified area or a safe-area panel with intrinsically safe circuits, barriers and isolators, the control drawing, and where utilities meet classified areas.
8 min readUpdated Sep 5, 2026
Filtration
Controlling gravity and pressure filters: effluent rate and level control, head loss and turbidity on every filter, the backwash triggers and sequence, filter-to-waste and ripening, the turbidity rules that filter monitoring answers to, and the operator view.
11 min readUpdated Sep 5, 2026
Finished Water Storage
Storage inside the plant: the clearwell that provides contact time and high service suction, backwash supply tanks, and how their levels drive production and pumping. The contact time calculation and the minimum level it demands, water age, and alarms.
9 min readUpdated Sep 5, 2026
Nanofiltration
Nanofiltration from the controls side: how it differs from reverse osmosis in pressure, recovery, and what it removes, the softening and color removal applications where it dominates, and trends that are shared with reverse osmosis and the ones that differ.
8 min readUpdated Sep 5, 2026
Clean-in-Place
Cleaning membranes in place: the triggers from the normalized trends, the low pH clean for scale and the high pH clean for organics and biofouling, the sequence of flush, heat, recirculate, soak, and rinse, and how automation makes cleaning repeatable.
9 min readUpdated Sep 5, 2026
Concentrate Systems
Handling the concentrate a membrane plant produces: the concentrate valve and the recovery it sets, flow and quality monitoring for the permit, the disposal routes, surface discharge, sewer, and the alarms and records a concentrate permit expects.
8 min readUpdated Sep 5, 2026
Biological Treatment
The biological process from the controls side: activated sludge and its common forms, conventional, extended aeration, oxidation ditch, sequencing batch reactor, and membrane bioreactor, and the alarms that give an operator time.
9 min readUpdated Sep 5, 2026
Chemical Systems in Wastewater Treatment
The chemical feeds of a wastewater plant and their controls: coagulants for phosphorus, polymer for thickening and dewatering, hypochlorite and sulfite for disinfection and dechlorination, and the alarms that keep the plant in its permit.
9 min readUpdated Sep 5, 2026
Effluent Disinfection
Disinfecting the effluent and proving it: chlorination with contact time and residual control, dechlorination with sulfite controlled by ORP or a residual analyzer, ultraviolet systems with dose control from flow, and the records the discharge report needs.
9 min readUpdated Sep 5, 2026
Effluent
Effluent from the controls side: the flow measurement the permit is built on, the composite samplers it paces, the parameters measured online, flow, pH, dissolved oxygen, residual, turbidity, and the data integrity that makes the record defensible.
8 min readUpdated Sep 5, 2026
Residuals
Solids handling from the controls side: thickening by gravity, flotation, or drum, aerobic and anaerobic digestion with their temperature, mixing, and gas systems, dewatering by belt press, centrifuge, and the records that biosolids regulation requires.
9 min readUpdated Sep 5, 2026
IEC 62443
The international standard series for industrial automation and control system security: how it is organized, what security levels and foundational requirements mean, and how a utility or integrator actually uses it.
11 min readUpdated Sep 5, 2026
Zones and Conduits
The IEC 62443 way to segment a control system: grouping assets into zones with a shared security level, inventorying every conduit between them, and turning the drawing into firewall rules. With a worked water utility example.
12 min readUpdated Sep 5, 2026
OT Risk Assessment
Ranking what could go wrong in a control system and what it would cost: the consequence-first method for utilities, the assets and scenarios to list, likelihood without pretending to know it, the risk matrix, and turning the ranked list into a work plan.
10 min readUpdated Sep 5, 2026
Server Hardening
Reducing what an attacker can do with a SCADA server: a baseline from the vendor guide and a benchmark, unused services removed, the host firewall on, application allowlisting, controlled media, separate administrator accounts, and logs sent off the box.
10 min readUpdated Sep 5, 2026
User Accounts and Roles
Who can do what on the SCADA and how it is enforced: roles from view-only to administrator and their permission matrix, individual accounts including the operator console, service and vendor accounts, same-day offboarding, and the quarterly review.
9 min readUpdated Sep 5, 2026
Patch Management
Applying updates to SCADA servers and clients without breaking the plant: vendor qualification, a monthly cycle with a test system, priority from the exposed edge inward, backups and rollback, emergency patches, and handling software that cannot be patched.
9 min readUpdated Sep 5, 2026
Third-Party Software
Everything on a control system machine that is not the SCADA: drivers, databases, runtimes, reporting tools, agents, remote support utilities. Why each is an attack surface, the inventory and approved list, rules for installs, and removing what is unused.
8 min readUpdated Sep 5, 2026
Shared Account Problems
Why the shared operator login, the vendor account everyone knows, and the single PLC password are the weakest point in most utilities: no accountability, no offboarding, no detection. Containing what cannot be avoided and migrating the rest.
8 min readUpdated Sep 5, 2026
Password Policy for OT
A password policy that fits a control system rather than an office: length over complexity, rotation on events, screening against breached lists, multi-factor authentication, no lockouts that take control from an operator, and unique vaulted device passwords.
8 min readUpdated Sep 5, 2026
Credential Storage
Where the passwords and keys of a control system are kept: a vault with individual access and a log, break-glass copies in a safe, platform credential stores for service accounts, and the places they must not be, from spreadsheets to project files.
8 min readUpdated Sep 5, 2026
Security Program Basics
What a control system security program is for a utility that has never had one: a named owner, an inventory, a risk assessment, a few policies, baseline controls, training, vendor rules, an exercised incident plan, and a first-year plan for a small staff.
10 min readUpdated Sep 5, 2026
SCADA Backups
What a SCADA backup must contain to bring a system back: the project export, an image of each server, the databases, historian archives, licenses, certificates, scripts, and network device configurations, with frequency, retention, and the restore procedure.
9 min readUpdated Sep 5, 2026
Backup Testing
Why backups that have never been restored fail when needed, and how to find out: spot restores, full restores of a server to an isolated machine, controller program restores to a spare, archive reads, timing each one, and the findings and record that follow.
8 min readUpdated Sep 5, 2026
Configuration Baselines
A known-good record of how every part of the control system is configured, captured at acceptance and kept current through change management: what to baseline, how to capture and store it, how to compare on a schedule, and what an unexplained difference means.
8 min readUpdated Sep 5, 2026
Change Management for OT
A change process sized for a utility control system: what counts as a change, the request with risk and rollback, owner approval, the window, backup before and verification after, the baseline update, the emergency path, and the record.
9 min readUpdated Sep 5, 2026
Isolating a Compromised System
Cutting a compromised machine, segment, or site off from the control system without stopping the process: who may decide, isolation points planned in advance, disconnecting the network rather than the power, running on manual control, and preserving evidence.
9 min readUpdated Sep 5, 2026
Recovery and Restoration
Bringing a control system back after a compromise without reintroducing it: controllers verified against baselines first, servers rebuilt from clean media and project exports, every credential changed, hardening, staged reconnection, and end-to-end tests.
9 min readUpdated Sep 5, 2026
Reporting Requirements
Who a water or wastewater utility must tell about a cyber incident, how fast, and what to say: the federal critical infrastructure reporting rule, state laws, the drinking water regulator, public notification, law enforcement, the sector center, and insurers.
9 min readUpdated Sep 5, 2026
Building an OT Asset Inventory
The list of everything in the control system with a network interface or a program, and how to build one that is right: what counts, the fields to record, the site walk, the switch tables and passive listening that find the rest, and keeping it current.
9 min readUpdated Sep 5, 2026
Advisories and Alerts
Where a utility learns its equipment has a known vulnerability and what to do with the news: the government and vendor advisory feeds, the sector center, the exploited catalog, subscribing by product, a weekly triage on exposure and consequence, and records.
8 min readUpdated Sep 5, 2026
Risk-Based Patching
Deciding what to patch first when everything cannot be patched at once: priority from exposure, exploitation, and consequence rather than scores, tiers with timelines, different rules for servers, network gear, and controllers, and the written accept decision.
8 min readUpdated Sep 5, 2026
Compensating Controls
What to do about a vulnerability that cannot be patched now or ever: restricting who can reach it, disabling the service, blocking dangerous protocol functions, allowlisting, monitoring, physical and procedural controls, matched to the attack path.
8 min readUpdated Sep 5, 2026
AWIA Requirements
What the 2018 water infrastructure act requires of community water systems: a risk and resilience assessment and an emergency response plan, certified on a schedule by size and repeated every five years, with cybersecurity named in both, and who is covered.
9 min readUpdated Sep 5, 2026
EPA Guidance
What the federal environmental agency provides to water and wastewater utilities on cybersecurity and what it expects: the free assessment, the checklist aligned with federal goals, joint incident response guidance, the enforcement position, and how to use it.
8 min readUpdated Sep 5, 2026
CISA Resources
What the federal cybersecurity agency provides to utilities without charge: the performance goals, regional advisors, external vulnerability scanning, control system advisories, the exploited catalog, a self-assessment tool, exercises, and incident reporting.
8 min readUpdated Sep 5, 2026
VLAN Segmentation
Using VLANs to build the zones of a control network on shared switches: what a VLAN separates and what it does not, the zone-to-VLAN mapping, trunks and the native VLAN, routing only through a firewall, and where separate hardware begins.
9 min readUpdated Sep 5, 2026
Data Diodes
Hardware that lets data flow one way only, from the control network outward, with no physical return path: what a data diode and a unidirectional gateway are, where they belong, what they can and cannot carry, and when a firewall is enough instead.
8 min readUpdated Sep 5, 2026
VPN Design
How a VPN fits remote access for a control system: it terminates in the DMZ and lands on a jump host, never the control network; site-to-site tunnels carry telemetry; user tunnels require multi-factor and individual accounts; the concentrator is patched fast.
9 min readUpdated Sep 5, 2026
Multi-Factor Authentication
Requiring a second proof of identity beyond a password, where it matters most in a control system and how to do it without locking an operator out: the factor types, where it is mandatory, where it does not fit, enrollment and recovery, and vendor accounts.
8 min readUpdated Sep 5, 2026
Session Logging
Recording every remote session into the control system: who connected, from where, when, to what, and what they did, from the VPN log through jump host session recording to the SCADA audit trail and controller change log, stored off the systems and reviewed.
8 min readUpdated Sep 5, 2026
Firewall Logging and Review
Making the firewall log useful: logging on every rule including sensitive permits, sending logs to a collector off the firewall, what denials and unexpected permits mean, a weekly review a small utility can sustain, and the alerts worth waking someone for.
8 min readUpdated Sep 5, 2026
Disabling Unused Services
Every service a device runs is a way in, and most ship with more running than the plant uses: web servers, file transfer, shells, discovery, management protocols, unused ports. Finding what is listening, deciding what the plant needs, and turning off the rest.
8 min readUpdated Sep 5, 2026
How to Configure a Historian
Set up a process historian that collects what matters and keeps it: decide the tags and their classes, set collection intervals and deadbands per class, size the storage and the retention, and hand the operators a working trend on day one.
8 min readUpdated Sep 5, 2026
How to Configure Remote Access
Give operators and engineers a way into the SCADA system from outside that does not give it to anyone else: a virtual private network with multi-factor authentication terminating in a demilitarized zone, and a test that proves the path works and that the.
8 min readUpdated Sep 5, 2026
Interference on Channel
Data lost on a strong-signal path: another system on the frequency, a nearby transmitter overloading the receiver, intermodulation on a shared tower, drive noise, or a stuck transmitter. How to measure the noise floor, find the source, and cure it.
8 min readUpdated Sep 5, 2026
Duplicate or Missing History
A historian with two records for one moment, or none: a redundant pair both collecting, a buffer that forwarded twice, a tag under two names, a daylight saving shift, or a source that resends on reconnect. Cleaning the record without inventing data.
8 min readUpdated Sep 5, 2026
ISA Standards for Controls
The International Society of Automation standards a controls practitioner meets: ISA-5.1 symbols and tags, ISA-18.2 alarm management, ISA-101 HMI design, ISA-88 and ISA-95 for batch and enterprise integration, ISA-99 which became IEC 62443, ISA-20 specification forms, and how each is used on a water or wastewater project.
8 min readUpdated Sep 5, 2026
IEC Standards for Controls
The International Electrotechnical Commission standards a controls practitioner meets: IEC 61131 for programmable controllers and their languages, IEC 62443 for security, IEC 61511 for safety instrumented systems, IEC 60529 ingress protection ratings, the telemetry protocols, and how IEC and North American standards fit together.
8 min readUpdated Sep 5, 2026
NFPA Standards for Controls
The National Fire Protection Association documents that reach into a control system: NFPA 70, the National Electrical Code, and the articles that govern panels, motors, and instrumentation; NFPA 70E for electrical safety at work; NFPA 79 for industrial machinery; NFPA 820 for wastewater plant hazardous area classification; and NFPA 110 where standby power meets the controls.
9 min readUpdated Sep 5, 2026
UL Standards for Controls
The UL listings behind the components and the panels: UL 508A for industrial control panels and its SCCR supplement, UL 508 and UL 60947 for the components in them, UL 489 and UL 1077 for breakers and supplementary protectors, UL 248 fuse classes, UL 50 and 50E for enclosures, UL 698A for hazardous-location panels, and what a listing, a recognition, and a mark actually mean.
9 min readUpdated Sep 5, 2026
Design Checklist
A review checklist for a control system design at each stage from concept to issued for construction: documents, architecture, controllers and I/O, panels and power, instruments, networks and security, SCADA and alarms, deliverables, and commissioning.
11 min readUpdated Sep 5, 2026
Calibration Checklist
The checklist for one calibration event, from work order to the sticker on the instrument: notify operations, loop in manual, alarms inhibited, the reference standard, as-found, adjustment, as-left, the loop check, restoration, and the record.
8 min readUpdated Sep 5, 2026
NIST Publications for Control Systems
The National Institute of Standards and Technology documents a control engineer will meet: the Cybersecurity Framework, the operational technology security guide, the control catalog, the digital identity guideline, and the incident handling guide.
9 min readUpdated Sep 5, 2026
CISA Guidance as a Reference
How the federal cybersecurity agency publications serve as reference standards for a utility: the performance goals as a baseline for policy and procurement, the water sector goals, secure-by-design principles for vendors, and the advisories.
8 min readUpdated Sep 5, 2026
EPA Rules and Their Control System Implications
The federal environmental agency rules that shape what a water or wastewater control system must measure, record, and report: the surface water rules, residual and byproduct rules, groundwater and lead rules, discharge permits, and record retention.
10 min readUpdated Sep 5, 2026
AWWA Standards and Manuals
What the American Water Works Association publishes that a control engineer uses: the instrumentation and control manual, the risk and resilience standard behind the act assessments, the security and emergency standards, and the cybersecurity tool.
8 min readUpdated Sep 5, 2026
Calibration Is a Program, Not an Event
An instrument calibrated once at startup and again when someone complains is an instrument whose readings cannot be trusted in between. What a calibration program is, and how a small utility runs one without a full-time instrument technician.
8 min readUpdated Sep 5, 2026
UL 508A Industrial Control Panels
What the listing actually covers, what has to appear on the label, and the requirements that most often cause a panel to fail inspection.
9 min readUpdated Aug 25, 2026
ISA-18.2 Alarm Management
The lifecycle standard for alarm systems, the rate targets that define a workable system, and why alarm rationalization is the step nobody wants to fund.
10 min readUpdated Aug 15, 2026
Other topics
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.