Fundamentals Of SCADA Security – 3

Introduction to RTU

The remote terminal unit abbreviated as RTU is an electronic device that is controlled through the use of a microprocessor. It helps interface the objects that are present in the physical world to a SCADA system by means of transmitting the telemetry data to any master system and then using the messages that are sent from that master supervisory system to the other connected objects so as to apply a means of control over those mentioned connected objects. RTU can also be represented as “remote telemetry unit” or “remote telecontrol unit”.
The RTU keeps on monitoring field analog as well as digital parameters and then transmits the data to a central monitoring system. It carries setup software so as to make a connection between the data input streams with the data output streams, define specific protocols in relation to communication and also troubleshoot any sorts of problems related to installation.
Any RTU may include 1 complex circuit card that consists of multiple, varied sections that would be needed for doing a custom fitted functionality or may hold many cards that includes CPU or sort of processing with the communication interfaces along with 1 or more of the things such as; analog input (AI), digital (or status) input (DI), digital or control relay output (DO/CO), or analog output cards (AO).
RTUs can also be any small kind of process control units that have a small database for alarming, filtering, etc. which can be complemented along with few of the BASIC (that is, the programming language) tasks. These RTU components are used in fields such as; pipelines, grid guarding systems, etc. So, the point to make a note here is that the RTUs can operate in these environments with such harsh conditions (-50 to 70 degrees celcius).

Power Supply:
For functioning or operation of the RTUs, the power supply would be included from AC mains for multiple, varied purposes such as; CPU, interface cards and status wetting voltages. This might also incorporate AC to DC convertors during situations when operated with respect to any station battery system.
At times when station battery isn’t available, the RTUs might consist of a battery as well as a charger circuitry so as to move ahead with its operation during the times of any AC power failures in relation to certain critical applications.

SCADA or Control room
Defined communication protocols: MODBUS

Digital I/O


Analog I/O

Control Panel

Hard wiring

RTU Architecture

Digital (or status) inputs:
Almost all the RTUs consist of an input section or something called as input status cards so as to maintain or acquire a kind of two states real-world information. This is said to be generally achieved by making use of any isolated voltage or a current source so as to know or sense position of a open or closed remote contact at RTU site. This mentioned position of contact might indicate multiple and varied devices which includes; liquid valve positions, devices’ mechanical positions, electrical breakers and alarm conditions. The counter inputs are said to be optional.
Analog inputs:
Any RTU can do monitoring of analog inputs in relation to varied types that includes; 0 to 1 mA, 4 to 20 mA (current loop), 0 to 10 V, ±2.5 V, ±5.0 V, etc. There are many RTU inputs that buffer huge quantities through the help of transducers so as to convert as well as isolate the real-world quantities from the sensitive levels of RTU inputs. RTUs also can get analog data through use of any communication system from the master or an “intelligent electronic device” (IED) sending the data values to it.
Then RTU or any of the host systems translate as well as scale this received raw data to the needed and appropriate units in ways like; the quantity of water left, temperature in degrees or maybe megawatts, even before displaying or presenting data to the users through the help of HMI.
Digital (or control relay) outputs:
The RTUs might drive the high current capacity relays into a specified digital output board so as to either switch the power on or off of devices present in field or floor. The mentioned DO board then switches the voltage to coil existing in relay, that closes off high current contacts and which then completes power circuit to device concerned.
The RTU outputs might also include driving a sensitive logic input existing on an electronic PLC or any other sort of electronic device that uses sensitive 5 V of input.
Analog outputs:
These are not that commonly used but these can be included within the control devices that need varying quantities like that of the graphic recording instruments (or strip charts). The summed or the processed quantities of data might be produced or generated in a specific master SCADA system and the output for display either locally or remotely, wherever required.
Software and logic control:
The modern RTUs are mostly capable as of executing any simple programs by themselves (or autonomously) by not having to involve any of the host computers in relation to SCADA systems so as to make deployment easy enough as well as provide any means of redundancy due to safety purposes. A RTU in any modern water management system would generally hold code so as to modify its own behaviour at times when the physical override switches present on RTU are toggled at times of maintenance done by the maintenance personnel. All this is done so as to maintain safety. Any kind of miscommunication between system operators and maintenance personnel would by default cause the system operators to unknowingly enable the power to the water pump while its being replaces (example).
The maintenance personnel working on any of the equipments should have it disconnected from the power as well as locked too in order to prevent any sort of damage or injury.
The RTU helps provide remote monitoring of functions as well as instrumentation for;

  • Oil and gas (such as; offshore platforms, pump stations on pipelines or maybe onshore oil wells, etc.)
  • Networks of pump stations (such as; waste water collection or maybe for water supply purposes)
  • Environmental monitoring systems (such as; quality of air, monitoring of emissions or pollution, etc.)
  • Mine sites
  • Air traffic equipments like; navigation aids (such as; DVOR, ILS, GP and DME)
  • The RTU also helps provide remote monitoring as well as control over functions and instrumentation for;

  • Hydro-graphic (such as; reservoirs, water supply or sewage systems)
  • Electrical power transmission networks along with any associated equipments
  • Natural gas networks along with any associated equipments
  • Outdoor warning sirens
  • The Biosphere II project
  • The RTUs find their significance by being part of the systems that are used in multiple processes such as; petrochemical (or oil) as well as refineries, nuclear power plants, agriculture, quality control, chemical plants, sewage treatment plants, food processing, automobile manufacturing, pharmaceutical manufacturing, water treatment plants.


  • Concept of flexible as well as scalable hardware
  • Flexible means of communication to IEDs
  • Ability of performing complex functions in relation to PLC
  • Integrated HMI to have station monitoring
  • Modern engineering tools along with data exchange interface
  • Archive functionality
  • Diagnostic as well as maintenance functionality
  • Highest reliability
  • Robustness against any sorts of cyber security attacks
  • Data transferring via RTUs:
    The modern RTUs are actually microcomputers that have special equipment in one end which has been designed so as to interface along with communication link and with special equipment in other end so as to have interfacing with sensors, actuators as well as calculations in the ongoing process.
    The information which is got at RTU by use of modem is in the form of 0s and 1s but which is modulated along with carrier frequency. This carrier frequency is helpful in transferring data frequency over communication channel. The establishment of message in relation to RTU has got two sub fields namely; sync-octet and remote address.
    The function of the first sub field indicates or refers to type of responses which RTU must take in. The “internal address” sub field refers or signifies the registered address within RTU where data needs to be stored. For example; the sub field might show “24” which means memory register 24 is actually the location so as to store the data.
    Generally the messages moving from MTU to RTU are short, so at times when MTU would need to send a pretty long message; it would send what is called as an alert to RTU.

    From MTU From Field Devices
    Discrete control order 4-20 mA field analog signals
    Analog setting instruction 0 or 24 V alarm, switch, signals
    Supply motor pulses 0 or 24 V equipment status signal
    Orders to respond Pulse train meter signal
    RS-232 serial message from field equps

    Input data types into RTU

    To MTU To Field Devices


    Field analog signals Contact closures or 0-24V control
    Alarms 4-20mA analog control
    Equipment status Pulse train stripping meter control
    Totalized meter signals RS232 serial message to field control
    Equipment messages

    Output data from RTU
    Connection between RTU and SCADA

    To have a successful communication via a successful connection, a RTU might be interfaced to many master stations as well as “intelligent electronic devices” (abbreviated as IEDs) through use of different mediums of communication such as; serial RS232, serial RS485, serial RS422 or Ethernet. A RTU might also provide support to standard protocols such as; MODBUS, IEC 60870-5-101/103/104, DNP3, IEC 60870-6-ICCP, IEC 61850, etc. so as to interface with any of the third-party software.
    The data transfer can be started (or initiated) from either of the ends by making use of varied techniques so as to insure the concept of synchronization along with very minimum data traffic. The master might poll its own sub-ordinate unit in relation to changes of data on periodic basis. Any of the changes in relation to analog values would generally be only reported if there are only changes which are outside a specific set limit from last value transmitted. The digital (or status) values tend to observe a similar enough technique and are said to only specifically transmit groups that are in form of bytes, if only 1 included point (that is, bit) tends to change. Yet another way or method that is put to use is when a specific sub-ordinate unit starts or initiates an update in relation to data only upon any predetermined changes to analog or else digital data. This periodic complete way of data transmission should be put to use on a periodic basis, with the help of either of the methods so as to insure existence of complete synchronization as well as elimination of any kind of stale data. Most of the protocols in relation to communication tend to support both the methods which are programmable by installer.
    There can be cases when multiple RTUs as well as multiple IEDs might have to share a communication line as in multi-drop scheme as because the units tend to be addressed in an unique fashion and are said to only be responding to their own commands and polls.
    There is existence of both IED as well as master communications. The master communications are generally in relation to a much larger control system present in any control room or maybe any data collection system which is incorporated to larger system. Data might be moved by making use of copper or fibre optic or maybe radio frequency communication system. There can exist multiple units that might share the communication lines.
    During earlier times, the SCADA networks used to communicate over radio or modem or maybe dedicated serial lines. But nowadays, it’s a established trend so as to put data within SCADA on Ethernet as well as IP over SONET. When security comes into picture, the data within SCADA must be kept on the closed LANs/WANs, by not exposing any of the sensitive data to outside (that is, open internet).
    The real or actual SCADA systems do not just talk with use of simple electrical signals either. The data within SCADA is first encoded in form of protocol. The earlier or older versions of SCADA systems used to depend on the closed proprietary based protocols, whereas the trend nowadays is towards an open standardized protocols as well as protocol mediation.
    The devices such are sensors or the control relays are pretty much simple electrical devices which cannot interpret or maybe generate any kinds of protocol communications by their own. So, for such scenarios the RTU is responsible for encoding the sensor inputs to protocol format and thereby forwarding them to SCADA master; then in turn, RTU is also involved in receiving the control commands in protocol form from master and thereby transmitting the electrical signals to appropriate control relays.

    The all plausible means of connection so as to induce communication are as follows;

  • Ethernet – It’s a system that is used for making a connection to many computer systems so as to form a LAN, with required protocols to help control the passage of information.
  • Telephone Line – It’s a system which utilizes the electrical signals so as to help transmit data over a certain distance by making use of a single pair of traditional copper wires.
  • Optical Fibre Line – It is in a way similar to traditional copper used telephone lines, but differs in the sense of having to utilize the optical fibres that are made of plastic or glass and makes use of light so as to transmit data, which is for sure faster and endures pretty less losses when compared to the copper wires.
  • Radio/Wireless – It’s a system that makes use of radio transmitters as well as receivers so as to send data over distance lengths. It generally needs line-of-sight for having best application.
  • Cellular – It’s based on cellular phone technology in order to transmit the data regardless of any distances, but having dependency over cellular signal coverage.
  • Satellite – It is kind of similar to cellular phone platform but makes use of satellites rather than ground based cellular towers.
  • Wi-Fi – It’s a technology which has been becoming popular and helps allow an electronic device so that data can be exchanged wirelessly (by making use of radio waves) over computer network that includes high speed internet connections.
  • Microwave – It’s a system built to provide connectivity in relation to long ranges which is in between two sites by making use of either the inexpensive public frequencies or the FCC—licensed spectrum. There exists some units of microwave that are an extension of the Wi-Fi, but in cases of long range (20+ miles), others make use of proprietary tools.
  • Finally, it is to be kept in mind that the technologies mentioned above aren’t mutually exclusive. Any site can readily make use of any sort of combination with respect to Wi-Fi as well as Ethernet locally and thereby transmit whole of site’s data to a specific central point via fiber, or microwave or any other long range technology.
    All of the discussed communication methods tend to fall under either the hard wire or the wireless category. The former option of communication includes dedicated hard wire (that is, Ethernet cable), fibre optic (that is, light pipe), coaxial cable or maybe telephone wire (that is, copper wire). The options relating to wireless transmission of data include but rather aren’t restricted to cellular, satellite, Wi-Fi and radio. The currently observed industry trends inform that the systems relating to wireless communication would continue to gain larger and larger market sectors of SCADA communication platforms which is especially in relation to large distributed networks like, water distribution system where there exists requirement to have vast coverage areas and maybe mostly in the remote areas which isn’t easily accessible to the existing hard wires. This same industry trend indicates that the Ethernet is becoming preferred standard of communication for the local area SCADAs which can be found in water treatment plants.
    So, both wireless as well as hard wire options can be put to use either alone or in tandem on the basis of size and the nature of the system under consideration. The most recent and modern SCADA systems make use of communication options which is within a system so as to meet their respective needs. To say, typically, there is never a concept of one size that would fit all solutions and therefore SCADA communications must be customized or tailor made in order fit any utility’s needs or requirements.
    The factors to consider while selecting the communication options consist of;

  • The coverage area of the SCADA system
  • Size as well as the terrain of the system in place
  • Cost (or budget)
  • Local availability of the infrastructure and its proximity to the system concerned
  • Performance parameters
  • Time and effort invested for establishing the selected communication option
  • Future expandability and ability of survival for the selected option