What is SCADA? How supervisory control works

SCADA stands for supervisory control and data acquisition. It is the system that lets operators in one control room watch and run equipment spread across a plant, a city or a whole region. It collects readings from pumps, valves, meters and breakers, shows them on screens, stores them, raises alarms, and sends setpoints and commands back out. The control loops themselves run in PLCs and remote terminal units at the sites, and SCADA supervises them. This guide explains what each part of a SCADA system does, how data moves between the parts, which protocols carry it, how SCADA differs from an HMI, a PLC and a DCS, and where industrial IoT and security fit in. It is part of the industrial IoT guides and builds on what a PLC is and what an industrial IoT system is made of.

What SCADA means

Supervisory control means the system’s decisions are passed to other controllers rather than wired straight to a motor. NIST’s glossary in SP 800-82 Rev. 3 defines supervisory control as a term “used to imply that the output of a controller or computer program is used as input to other controllers.” In practice, the SCADA server tells a pump station’s controller to hold a reservoir between two levels, and the controller decides when to start and stop the pump.

Data acquisition is gathering readings from the field into one place and keeping them.

The same NIST glossary, quoting the ISA dictionary, calls SCADA a generic name for a computerized system that gathers and processes data and applies operational controls over long distances, with power transmission and distribution and pipelines as typical uses. Elsewhere NIST says SCADA systems control dispersed assets for which centralized data acquisition is as important as control, and let an operator monitor or control an entire system from a central location in near real time.

The idea is older than the name. Inductive Automation, which makes SCADA software, dates telemetry for monitoring to the 1960s and the term “SCADA” to the early 1970s. Its list of industries runs from water and power to manufacturing and food and beverage, so the word also covers supervisory software over the PLCs in one factory.

The layers of a SCADA system

NIST describes typical SCADA hardware as a control server at a control center, communications equipment, and one or more geographically distributed field sites with remote terminal units or PLCs that control actuators and monitor sensors. From the bottom up:

Field devices. The sensors and actuators on the equipment: level and pressure transmitters, flow meters, pump starters, valve actuators, circuit breakers.

Field controllers: RTUs, PLCs and IEDs. These run the local process. NIST defines a remote terminal unit (RTU) as a computer with radio interfacing used in remote situations where communications via wire is unavailable, and notes that PLCs with radio are also used in place of RTUs. In a SCADA system, it says, PLCs may provide similar functionality to RTUs. An intelligent electronic device (IED), such as a protective relay, may report straight to the control server or be polled by a local RTU, and in most cases has local programming that lets it act without instructions from the control center.

Communications. NIST lists telephone line, cable, fiber, and radio frequencies (e.g., broadcast, microwave, satellite) as the links between control center and field sites, carrying standard and proprietary protocols over serial and network connections. NIST adds that large systems with hundreds of RTUs often use a sub-control server to take load off the primary one.

The SCADA server. NIST’s glossary says that in a SCADA system the control server is often called a SCADA server, MTU, or supervisory controller. MTU stands for master terminal unit. It stores and processes the field data, and its software says what to monitor and when, which ranges are acceptable, and what to do when a value leaves them.

The HMI. The human-machine interface is the hardware or software through which an operator interacts with a controller. In a SCADA control room it is the set of screens showing the network, the alarms and the trends.

The historian. A data historian is, in NIST’s words, a centralized database that supports data analysis using statistical process control techniques. It keeps each value against its tag and time.

Alarms. NIST makes the control center responsible for centralized alarming, trend analyses, and reporting.

Because the whole system depends on the control center, NIST notes that SCADA systems are usually built to be fault-tolerant with significant redundancy, often including a backup control center.

How data moves: polling and report by exception

There are two basic ways for readings to get from the field to the control center.

Polling. The server asks each field device in turn and the device answers. NIST’s example system has the control center poll field devices for data at defined intervals (e.g., 5 seconds, 60 seconds), send new setpoints when needed, and also watch for priority interrupts from field site alarm systems. Serial Modbus works only this way: as the Modbus RTU guide explains, a slave device never speaks unless asked. Polling is simple and confirms every cycle that each site is alive. The cost is traffic whether anything changed or not, and a delay of up to one interval before a change is seen.

Report by exception. The field device sends a value only when it changes. The Sparkplug specification for industrial MQTT describes the origin of this approach in SCADA over satellite links, where it was not feasible to use a poll/response protocol because of propagation delay and cost, so remote sites published data only when it changed. The catch, the same document notes, is that the host must always know whether the device is still connected. DNP3 offers a version of this too. Inductive Automation’s driver documentation describes unsolicited messaging as an event-driven method in which the outstation reports event updates whenever changes occur, alongside polls for each event class and a periodic integrity poll. It also warns that not all outstations support unsolicited messaging.

Real systems usually combine the two: exception reports for speed, and a slower full poll so the server can confirm each site is still there and its picture of the field is complete.

Common SCADA protocols

One SCADA system often uses more than one protocol. NIST names Modbus, Distributed Network Protocol 3 (DNP3), and Inter-Control Center Communications Protocol (ICCP) as OT protocols that some intrusion detection and prevention vendors have added attack signatures for.

Modbus. A simple request and response protocol: one master polls numbered registers in each device. It runs over serial lines such as RS-485 and over Ethernet as Modbus TCP, and the Modbus RTU guide covers it in detail.

DNP3. The DNP Users Group describes DNP3 as an open and public protocol built for communication between substation computers, RTUs, IEDs and master stations in the electric utility industry. The protocol has become widely used in adjacent industries such as water and wastewater, and it was first adopted as IEEE Std 1815 in 2010. The IEEE’s page for the 2012 edition says the protocol is suitable for operation on a variety of communication media. In DNP3 the field device is called an outstation.

IEC 60870-5-104. An International Electrotechnical Commission standard whose title describes it as network access for IEC 60870-5-101 using standard transport profiles. The IEC’s summary says it is for monitoring and controlling geographically widespread processes, which is the SCADA job.

OPC UA. The OPC Foundation describes OPC UA as a platform independent service-oriented architecture with security controls built in. It is common between SCADA software and controllers or gateways, and the OPC UA and MQTT guide explains how it works.

MQTT, with the Sparkplug conventions on top, is covered under industrial IoT below.

SCADA vs HMI vs PLC vs DCS

The PLC guide has a short comparison of PLC, DCS and SCADA. The table below adds the HMI.

HMI vs SCADA. An HMI is a component, and SCADA is a system that contains one. NIST describes SCADA as integrating data acquisition systems with data transmission systems and HMI software. A standalone HMI shows one machine’s PLC; SCADA adds the server, long-distance communications, historian and central alarms across many sites.

SCADA vs PLC. A PLC controls. SCADA collects, displays, records and sends instructions. NIST says that small PLC-based systems generally lack a central control server or HMI and mainly provide closed-loop control with little human involvement, which is why a PLC can run with no SCADA at all.

SCADA vs DCS. NIST describes a DCS as controlling production systems within the same geographic location, with refineries, water and wastewater treatment, power generation and chemical plants among its examples. SCADA covers dispersed assets. The two are often networked together: a generating plant runs on a DCS, which talks to the grid’s SCADA system to match output to transmission and distribution demand.

Examples of SCADA systems

NIST lists the classic uses as water distribution and wastewater collection systems, oil and natural gas pipelines, electrical utility transmission and distribution systems, and rail and other public transportation systems.

Water and wastewater. A water utility has wells, treatment plants, pump stations, reservoirs and tanks across its service area, and a wastewater utility has lift stations along its collection network. Each site has an RTU or PLC that runs its pumps locally and reports levels, pressures, flows and pump states to the control center. Operators adjust setpoints, such as the level at which a tank refills, and respond to alarms. DNP3, built for electric utilities, is also widely used in water and wastewater.

Oil and gas pipelines. Compressor or pump stations and valve sites sit along long stretches of pipe. SCADA gathers pressures and flows from each site and lets the control center open and close valves remotely.

The electric grid. NIST describes SCADA systems that monitor and control electricity distribution by collecting data from and issuing commands to geographically remote field control stations from a central location. NIST notes that losing the microwave network a transmission SCADA system depends on could take a large generating unit offline and start a cascading failure.

Rail. NIST’s rail example has a control center that polls each rail section for the status of the trains, signal systems, traction electrification systems, and ticket vending machines, and can act on conditions, for instance stopping a train before it enters a flooded or occupied section.

A single plant line. Inside one factory the same parts appear at a smaller scale. Each machine on a bottling or packaging line has its own PLC and often its own HMI panel. A supervisory server reads all the PLCs over the plant network, shows the whole line on one screen, raises alarms and logs production to a historian. NIST’s PLC example shows this arrangement, with data stored in a data historian on the same network as the engineering workstation. The same pattern fits irrigation pumps spread across farmland or refrigeration across a group of warehouses.

SCADA and industrial IoT

SCADA and industrial IoT now overlap. NIST defines the Industrial Internet of Things as sensors, instruments, machines, and other devices that are networked together and use internet connectivity to improve industrial processes. It describes a three-tier IIoT model with an edge tier, a platform tier and an enterprise tier, and says the platform tier can run in an on-site data center, an off-site data center or the cloud.

MQTT has its roots in SCADA. The Sparkplug specification says MQTT was originally designed as a message transport for real-time SCADA systems. Plain MQTT leaves the topic names and the payload format up to each project, so Sparkplug defines both, plus a way for the host to track whether each edge node is online. In Sparkplug the SCADA host is one of several host applications, alongside historians, manufacturing execution systems and analytics tools. The MQTT guide covers the protocol itself.

IoT can reach an existing SCADA system in three places:

• At the field site, where a gateway reads the same PLCs and RTUs and publishes their values over MQTT. The IoT gateway guide explains what that box does.
• At the control center, where the SCADA server or historian forwards data to a broker or a cloud platform for analytics and longer storage.
• Below the field controllers, where new wireless sensors report to a gateway that SCADA reads like any other device.

NIST’s caution applies to all three: adding IIoT can increase connectivity and information exchanges with enterprise systems and cloud-based systems, and may mean changing network boundaries or exposing more interfaces.

SCADA security in outline

SCADA systems control physical processes, and some of their protocols have no security of their own: serial Modbus has no authentication, as the Modbus RTU guide notes. Three sources set out most of the guidance.

NIST SP 800-82 Rev. 3. Guide to Operational Technology (OT) Security, published September 2023, covers OT threats, typical system layouts including SCADA, and recommended countermeasures. For SCADA it recommends separating networks into zones with firewalls between them, secure connections such as VPN tunnels between remote stations and control centers, a DMZ between the control centers and the business network, and disabling services a device does not need, such as a web or SSH server on a PLC or HMI.

ISA/IEC 62443. The ISA describes this series as addressing the security of industrial automation and control systems (IACS) throughout their lifecycle, with requirements for asset owners, automation product suppliers, and the integrators who build and maintain control systems. NIST SP 800-82 maps several of its own tasks to parts of IEC 62443.

CISA. In May 2025 CISA published five primary mitigations for OT: remove OT connections to the public internet, change default passwords, secure remote access to OT networks, segment IT and OT networks, and practice and maintain the ability to operate OT systems manually.

The IoT device security basics and the guide to putting IoT devices on a separate VLAN cover passwords, updates and segmentation for connected equipment in general.

For more on the plant floor, read what a PLC is, the OPC UA and MQTT guide, and the rest of the industrial IoT guides.