SCADA

SCADA is the layer through which people watch and steer an industrial process: a power plant, a solar farm, a battery site, a substation network or a factory. As the name says, SCADA supervises. Fast closed-loop control runs in local controllers next to the equipment. SCADA collects what they measure, shows it to operators, raises alarms and passes on commands such as start, stop, open or a new setpoint.

A typical SCADA system has these parts:

• Field devices. Sensors, meters, inverters, protection relays and actuators.
• Local controllers. Programmable logic controllers (PLC) and remote terminal units (RTU) that read the field devices and run local control loops.
• Communication. Industrial protocols carry data between controllers and the SCADA servers: Modbus at device level, IEC 60870-5-104, DNP3 and IEC 61850 in grid and substation work, OPC UA between systems.
• SCADA servers. They poll or receive data, keep the current state of every signal (tag), evaluate alarms and route commands.
• Historian. A time-series database that keeps measurements for reports, analysis and investigations.
• Human-machine interface (HMI). The screens operators use: plant schematics, trends, alarm lists and command dialogs.

Older SCADA systems ran on closed networks with desktop clients. Newer ones often add a web interface and send data to a cloud platform for analytics, a digital twin or fleet monitoring, while control stays on site.

Whether you buy a SCADA system, build a monitoring platform or connect an EMS to an existing SCADA, the same issues decide the cost and the risk. Requirements worth writing into the specification:

• A signal list comes first. Every device model needs its register or point map, units, scaling and naming. Agree on the tag naming convention before integration starts; renaming thousands of signals later is expensive.
• Time is part of the data. Store timestamps from the source in UTC, record whether a value is measured, estimated or stale, and handle daylight saving changes in displays.
• Alarms follow a written philosophy. Each alarm has a priority, a clear text and an action. A screen that shows hundreds of active alarms trains operators to ignore them. A device that stops reporting is an alarm of its own.
• Commands are controlled. Writes to equipment require a role with the right permission and a confirmation, are read back from the device and are logged with who sent them and why.
• The HMI is designed for the control room. Operators read it all day and react in seconds, so it needs a conservative palette tied to statuses, a schematic that shows where a fault is, and no decoration that competes with live data.
• Control never depends on the cloud. Local controllers and safety functions keep working when the connection to the platform is lost; the cloud receives data and sends configuration, never real-time control.
• The OT network is separated from IT and the internet. Remote access goes through a controlled path with multi-factor authentication, and every change to the system is recorded.

Electricity companies in the EU that are large enough fall under NIS2, Directive (EU) 2022/2555. Electricity undertakings, distribution and transmission system operators, producers and market participants providing aggregation, demand response or energy storage services are all listed in Annex I. Article 21 requires them to take cybersecurity risk-management measures, including incident handling, supply chain security, access control and multi-factor authentication, and SCADA is usually the system where those measures matter most.

NIST Special Publication 800-82 Rev. 3, the Guide to Operational Technology Security, is a widely used reference for securing SCADA and other operational technology. It covers network segmentation, remote access, patching where downtime is costly and monitoring of control networks. The IEC 62443 series sets security requirements for industrial automation and control systems and their suppliers, and buyers often ask vendors to show how they meet it.

For Kyoto Group we spent three and a half years on software for a molten-salt thermal energy storage plant, which grew into a SCADA-based system that monitors and controls the flow of energy in real time. Our scope included control of the thermal store integrated with the plant's SCADA layer, surveillance with infrared cameras and image recognition working alongside it, and augmented reality elements in the operator's camera view that present key plant data. The lessons on the data platform and access control from the same project are under digital twin; the one that applies to any SCADA project is to design operator roles at the start.

On Skyfri's platform SCADA and EMS are separate layers. Skyfri's own SolarSCADA handles site-level hardware control and monitoring, and the EMS we designed and built holds the control logic for charging, discharging, peak shaving, trading and export limits, running fully offline at each site.

For Global Green's battery storage sites we added an alarm for a battery in the off state in July 2026, and as of October 2026 we are separating batteries and meters in the web monitoring.