Telemetry and Remote SCADA Solutions

1. Telemetry and Remote SCADA Solutions Presented by Alan Hudson Smart Water for Smart Cities Workshop 10:00am Tuesday May 20, 2014

2. Questions: • What is Telemetry? • What is SCADA? • What is Remote SCADA? • What is a Telemetry and Remote SCADA Solution? Communication with Remote Devices over a medium like radio, telephone, satellite, etc. Supervisory Control and Data Acquisition. Often an incorrect synonym for host software. SCADA for Remote Devices All of the above as a solution. Schneider Electric – Session Title – Smart Cities for Smart Water: A Workshop

3. By End of This Session, You Will Know… • The many components of TRSS* • The current trends for TRSS • The meaning of communication protocols • The latest in TRSS technologies • New applications for TRSS *TRSS = Telemetry and Remote SCADA Solutions

4. Understanding the basics

5. Telemetry & Remote SCADA Solutions Products & Systems Operation / Business Systems Host SCADA Integrated SCADA Software, Ready-to-Use Telemetry and Configuration Wide area SCADA for critical Infrastructures Wide range of open protocols / interfaces: Modbus, DNP3, Ethernet, OPC, SQL, … Communication Medium Radios (Licensed / non-licensed), phone, cell Serial / Ethernet connection Support of Modbus / DNP3 protocols RTU / PLC Cost effective, scalable, environmentally rugged Modbus / DNP3 communications Programmable or configurable Field Devices Rapid-deploy, self contained: Instruments, transmitters, meters, VFDs, intelligent power systems, etc.

6. RTU = Remote Telemetry Unit Definite purpose PAC Rack-based PLC with Networking SMART RTUs Variable Speed Drive or Intelligent Power Systems with Networking Due to technology, Dumb RTUs are not typical anymore “Brick” PLC Dedicated Communication Host Intelligent Overload / Motor Management System RTU/Web Gateway “DUMB" RTUs Remote I/O with Networking

7. Trends in PAC Technologies Process Automation Controllers Industrially hardened #2 – “Battery-less” Processor protects data from loss. Remote communication #2 –Ethernet connectivity to field devices, Modbus, DNP3 and others. Industrial hardened #1 – Designed for remote locations, extended temperatures, high reliability Remote communication #1 – Ethernet or serial over phone, leased line, radio and GPRS/3G mobile networks Integrated Security Suite –DNP3 protocol may be fitted with data encryption and/or authentication IEC 1131 Programming – Same as plant-based PLCs. Expandable I/O - Traditional Rack mount (like a PLC) or expansion I/O modules Optimized for WWW – integrated PLC/RTU, respond to multiple hosts, routing between communication ports

8. Market trends and challenges

9. Remote System Challenges • Typical WWW System • Geographically dispersed pump/booster stations • Regulatory compliance & reporting • Critical Infrastructure – heightened security • Relatively low bandwidth communication • Solution Requirements • Real-time database, multi-layer vector graphics • Extensive event logging, audit trail & alarm redirection • Triple redundancy, integrated video surveillance • Ability to handle communication failure/congestions

10. Municipality Interests Operator Efficiency • Centralization of operations to monitor and control remotely • Analyzing increasing amount and different types of data • Allowing new generation of operators to make the right decisions • Integration with business systems Engineering Efficiency • Reducethe time to build and maintain automation systems • Simplify configuration and deployment • Standardization across facilities • Continuing support for open standards promoting interconnectivity Process Optimization • Operator responsibility for process optimization (e.g. Downtime) • Reduce energy usage through improved energy management • Real time metrics to facilitate faster decisions

11. Key Market Trends Demand for Ethernet connectivity and awareness Increased bandwidth and greater efficiency Improved security Open standards and protocols Easy of configuration, implementation & execution Speed of deployment Convergence of WWW, SCADA, Communications and IT departments Alternative technologies: DSL, Cell

12. Communication Drivers #1 • Optimized design & implementation • Reduction of project implementation risks through proven technology and rapid deployment • Protocol agnostic communication layer • Solutions obstacles & distances • Reduced infrastructure expense • Optimized operational costs • Minimal ongoing operational costs • Minimal maintenance costs • Remote diagnostics & configuration

13. Communication Drivers #2 • Reliable and secure data communication • Minimized vulnerability and preventative diagnostics • Scalable redundancy of radios, network paths • Network and Data security and protection • Ownership and control of the network • Simple and rapid system re-configuration • Consistent & dependable network performance • Long term reliability & availability

14. Radio Trends • Licensed band – 380 to 520 MHz (UHF) • standard & redundant base / repeater stations • Unlicensed - 915 MHz / 2.4GHz Spread Spectrum • open frame & board only versions • Ethernet & serial connectivity • Point to Point and Multi-Point networks • Simultaneous multiple applications/protocols on one radio system • Support polling and unsolicited reporting • Network wide diagnostics from anywhere in the system including any remote radio • Remote diagnostics

15. Communication protocols: Conversations among the electronics

16. DNP3 vsModbus • Transmits changed data • Stores data on communication loss • Packet optimization • Security And encryption • Supported by a growing number of RTUs Modbus • Most common protocol used • Transmits range Of registers • No storage on commloss • Limited security or encryption • Supported by most RTUs DNP3

17. Latest trss technologies

18. Securing Your SCADA System Who’s in charge of securing our infrastructure • NIST - US National Institute of Standards and Technology.  • FIPS standards (Federal Information Processing Standards). • FIPS defines, among other things, security standards for IT. FIPS-120 defines encryption and other security things. • FIPS is specified in just about every IT security related field, including SCADA security nowadays. As you would know, Critical Infrastructure Protection (CIP) includes a focus on IT and now SCADA security. The National Electric Reliability Commission (NERC) and Federal Energy Regulatory Commission (FERC) are both requiring CIP programs to be instituted in every North American electricity authority (by legislation). •  Homeland Security will require CIP implementation. • So in summary FIPS from NIST is required by NERC and FERC for CIP

19. Critical Infrastructure Protection Act • The standards are: • CIP-002-1: Critical Cyber Asset Identification • CIP-003-1: Security Management Controls • CIP-004-1: Personnel and Training • CIP-005-1: Electronic Security Perimeter • CIP-006-1: Physical Security of Critical Cyber Assets • CIP-007-1: Systems Security Management • CIP-008-1: Incident Reporting and Response Planning • CIP-009-1: Recovery Plans for Critical Cyber Assets

20. ENCRYPTED (randomised) DATA SCADA Message to be sent SCADA Security • Here are two common security mechanisms for SCADA systems: • Encryption – Hide the data content • Authentication – challenge the sender of data to prove identity • Both can be used concurrently

21. DNP3 Secure:Authentication & Challenge Non-critical messages operate as usual Critical messages are “Challenged” Operation is only carried out if challenge “Passes” Master RTU Non-critical message Perform operation Standard protocol response Critical Message Authentication challenge Authenticate & perform operation Authentication response Standard protocol response Unique to DNP3 IEC62351-5 Standard

22. CLEARTEXT DATA CIPHERTEXT (randomised) DATA Ciphertext & Signature packaged in AGA12 protocol wrapper DNP3 Message to be sent qmwnebrthgjalpso1m46kd SESSION KEY is dynamic & changes periodically. Generated from Update Key SIGNATURE UPDATE KEY (Secret) How Encryption WorksSending a message after the session is open • AGA12 suite - also known as IEEE 1711 standard SECURED MESSAGE time-limited, then sent to authenticated receiver

23. Ciphertext & Signature packaged in AGA12 protocol wrapper CIPHERTEXT (randomised) DATA CLEARTEXT DATA qmwnebrthgjalpso1m46kd DE-CRYPT DNP3 Message to be sent SECURED MESSAGE time-limited, received by authenticated receiver = SIGNATURE extracted SIGNATURE calculated Session periodically CLOSED and REOPENED to re-authenticate the partner devices and to change the “on-air” keys UPDATE KEY (Secret) SESSION KEY is dynamic & generated from Update Key How Encryption WorksReceiving a message after the session is open

24. Solar Power = Low Power Features • Sleep Mode • Slower CPU Clock Speed • Reduced Power Consumption • Shut Down Certain Comm Ports • Communications Scheduling • Disconnect Of Diagnostic LED’s

25. Simplicity: Battery Powered Wireless Sensors • Long-life, self-powered wireless field devices • Integrated instrumentation / communications • Stranded measurement points • Hazardous locations

26. The Schneider Electric Accutech Portfolio

27. Wireless Basics

28. Typical Architectures – Point to Point REMOTE ACCESS POINT RTU or PLC HOST • Direct cable replacements • Applications requiring continuous communication in both directions

29. Typical Architectures – Point to Multipoint REMOTE REMOTE RTU or PLC RTU or PLC ACCESS POINT(Entry Point) HOST • Wide area SCADA networks • Access point (Base) REMOTE RTU or PLC

30. Typical Architectures – Point to Multipoint via Repeater REMOTE RTU or PLC REMOTE (Entry Point) ACCESS POINT(Repeater) REMOTE HOST RTU or PLC • Repeater located at high site (i.e. water tank) for maximum coverage

31. Unique trio features that make the difference

32. Licensed Trio MultiStreamTM License-free Trio DNP Host Remote Radio Sites MODBUS Host Creates virtual serial channels on same radio network by routing packets to ensure protocols are not mixed on same system. Remote Radio with Secondary Application Secondary Application Site

33. Licensed Trio ChannelShareTM License-free Trio Collision Remote Radio Sites SCADA Host A common problem with SCADA networks occurs when multiple remote sites need access to RF channel at the same time

34. Licensed Trio ChannelShareTM License-free Trio Collision Avoided Remote Radio Sites SCADA Host ChannelShareTM collision avoidance manages remote channel access to avoid collisions between remote sites

35. SmartPathTM License-free Trio Preferred Alternative Master orAccess Point • Enhances radio link reliability by providing mesh type connectivity between sites. • Offers higher bandwidth and lower latency than traditional mesh network implementations as network only reconfigures when path problem occurs HOST APPLICATION

36. KwikStreamTM License-free Trio Remote ACCESS POINT Peer to Peer Repeater KwikStream™ Repeater Remote Remote HOST APPLICATION • Useful when only a single repeater is required • Access point repeats data with low latency during the same hop (does not have to wait for next hop) • Supports Host to Remote and Peer to Peer (Remote to Remote) connectivity

37. LinkXTendTM License-free Trio REMOTE REMOTE REMOTE REMOTE BRIDGE BRIDGE ACCESS POINT • LinkXTendTM provides wide area coverage by connecting multiple radio networks with bridges • Some radio links may require additional antenna gain – LinkXTendTM allows system designer to use directional AND omni directional antennas on one bridge to maximise signal reliability • Bridge networks are segmented so that network traffic on “green” network can occur simultaneously as network traffic on “grey” network • Bridges use time division multiplexing to swap between networks – 50% of the time they behave as a remote, the other 50% like an access point HOST APPLICATION

38. Telemetry & Remote SCADA Solutions Products & Systems Business Systems ClearSCADA Object oriented, wide area SCADA for critical Infrastructures in WWW, O&G and Electrical Energy integrated SCADA and ready to use Telemetry features Wide range of open protocols and interfaces: DNP3, IEC60870-5, WITS, Modbus, OPC, SQL, … Trio Licensed/license-free radios for serial and Ethernet communication, support of Modbus, DNP3 and IEC60870-5-101/104 protocols SCADAPack Cost effective, scalable, Smart RTU Modbus-centric and DNP3/IEC60870-centric Accutech Rapid-deploy, self contained, battery-powered Wireless Instruments

39. Typical applications

40. Applications Wastewater • Application: • Lift/Booster Station for 4 pumps • Realized Value: • Reduced cost of ownership through remote configuration & diagnostics • Improved operation & compliance through time stamped data & priority reporting

41. Applications Water • Application: • Demand billing • Realized Value: • Accurate billing information improving revenues • High availability through multiple communications links • Improved security through over-the-air data encryption

42. Applications: Wireless Sensors • Reservoir level monitoring • Municipal storm water monitoring • Dissolved oxygen, pH level, data monitoring • Pressure monitoring • Tank level and pressure • Others?

43. Scenario: Stormwater Monitoring Municipalities all over the world face the constant challenge of managing storm water drainage systems that are built through communities and outlining areas. These systems are used to prevent erosion and are necessary to control wastewater pathways through the water system during extreme weather events. Monitoring points for these systems are often in disparate locations and are difficult to install.

44. StormwaterMonitoring StormwaterMonitoring The City of Houston StormwaterMaintenance branch has a big challenge when managing the large amounts of water that fill their ditches and bayous during frequent weather events. Environmental concerns and influx rates at treatment facilities must be monitored continuously throughout the system including points where no networking provisions are in place. Solution • Numerous points in Houston’s stormwatermanagement system had level meters that were no longer connected through to the host. • Analog input devices were mated to the level meters • The base radio was located at the branch headquarters and connected to their host • The system was up and running in two days with the installation of an Accutech network.

45. Conclusion

46. Conclusion • Telemetry and Remote SCADA Solutions entail many components • The current trends and technologies will continue to change and improve • Protocol development (like DNP3) will continue to help address current needs • Schneider Electric continues to lead the industry in TRSS applications

47. Questions? Alan Hudson Solutions Architect Water Wastewater Competency Center 8001 Knightdale Blvd. Knightdale, NC 27545-9023 Office: 919.266.8360 | Mobile: 919.824.9114 JeffM.Miller@Schneider-Electric.com www.schnedier-electric.com

48. Appendix

49. Leak Management - Calculation • The system performs leakage calculations based on real-time and historical data analysis in both distribution and transmission networks.

50. Leak Management - Calculation • The WMS: Leak Management (LM) runs several distribution monitoring methods that can detect possible leaks: • Flow Balance, comparing pipeline inlet and outlet flows. • Mass Balance, comparing pipeline inlet and outlet volumes. • Minimum Night Flow, tracking DMA nightly consumption. • Hydraulic Supervision, comparing measured hydraulic parameters with simulated values. • Alarm Limits based on fixed thresholds, adaptive limits or logic rules.