SCADA

What it is (precise)

SCADA is a layered architecture, not a single box. At the top sits a central server and an operator HMI (human-machine interface) running in a control room or a remote network operations center. Beneath it, a Power Plant Controller and plant-level controllers execute the closed-loop regulation, while RTUs (remote terminal units), PLCs and protocol gateways translate between the SCADA network and the equipment.

At the bottom, the Battery Management System in each rack, the PCS controls, the HVAC, the fire panel and the revenue and POI meters all publish data upward into the same tag database. One of those RTUs is not like the others: the utility RTU sits on the interconnection boundary, is usually specified — and often owned and locked — by the interconnecting utility, and presents the DNP3 outstation that the control center polls. It commonly carries hard-wired points as well, so a transfer-trip or curtailment contact reaches the plant without depending on the plant data network at all.

The data flow is bidirectional. Telemetry — cell voltages, module temperatures, SOC, SOH, AC power, breaker status, alarms — flows up for monitoring and historization; each Setpoint and command (active and reactive power dispatch, mode changes, start/stop, breaker operations) flows down. Communication typically uses Modbus TCP at device level, DNP3 and increasingly IEC 61850 inside the plant, and DNP3 or ICCP/TASE.2 to the utility or ISO/RTO.

Not all of that traffic is polled, and the difference matters for the record: Modbus is scan-based and shows only the value at the instant you asked, while DNP3 class 1/2/3 event objects and IEC 61850 buffered reports push each change with the timestamp at which it happened. A time-synchronization source (GPS clock distributing NTP or IEEE 1588 PTP) stamps every event so sequence-of-events records line up across the plant to well under a second.

The layer boundaries matter because the functions are genuinely different. The Battery Management System protects cells, racks and contactors; the Energy Management System decides what the plant should do — schedules, state-of-charge management, market optimization; the Power Plant Controller closes the fast regulation loop at the point of interconnection; SCADA supervises, visualizes, historizes and routes.

Vendors bundle these functions differently — some sell an integrated "EMS/SCADA" — so the label on the box is less important than knowing which system owns which loop, at what speed, and what happens when the link between them drops.

Why it matters in a real grid-scale project

SCADA is where the plant earns revenue and meets its obligations. A market Dispatch — frequency regulation, energy arbitrage, capacity, ancillary services — arrives as a Setpoint that the SCADA/PPC chain must execute and verify inside the market's response window, often just seconds.

Telemetry and historized data also feed the availability and performance guarantees written into the EPC contract and O&M agreement: if the plant cannot prove it delivered, it does not get paid. Data integrity, point mapping and timestamp accuracy are therefore commercial issues, not just engineering ones, and disputes over liquidated damages frequently come down to whose historian is trusted.

It is also a safety and compliance interface. Grid codes and interconnection agreements require the plant to follow POI setpoints, ride through disturbances and curtail on command; the SCADA layer is what the interconnecting utility audits. Because it reaches deep into the plant and out to the grid, SCADA is a primary cybersecurity surface — segmented networks, NERC CIP obligations where applicable, and IEC 62443 practices are expected.

A critical design rule: SCADA supervises but must never be the sole safety path. Fast protection — anti-islanding, overcurrent, the BMS contactor-opening logic, fire and gas detection — must act locally and independently, because the SCADA link can be slow or lost.

Typical values and standards

Know the timing stack. Plant polling and HMI updates run on the order of 1–4 seconds; ISO/RTO telemetry to the market operator is commonly on a 2–6 second cadence, and AGC/regulation signals typically arrive every ~2–6 seconds.

SCADA is not the millisecond loop — PCS inner controls and BMS protection act in sub-cycle to tens-of-milliseconds timeframes, and the Power Plant Controller closes the POI regulation loop typically in hundreds of milliseconds to a few seconds. Confirm the required telemetry rate and response time for your specific market, because they drive controller tuning and network design.

Know the scale. A utility-scale BESS commonly exposes several hundred to a few thousand points per container once the BMS, PCS, HVAC, fire panel and auxiliary meters are mapped, so a 100 MW-class plant easily reaches tens of thousands of tags — filtering and alarm rationalization are real design tasks, not afterthoughts.

On protocols and safety standards: IEEE 1815 (DNP3) and IEC 61850 dominate plant and utility communication, with Modbus common at device level. IEEE 2030.5 and the IEEE 1547-2018 smart-inverter functions increasingly govern how grid-support behavior is exchanged for distribution-connected assets. For safety boundaries, NFPA 855 is the US installation standard and UL 9540A is the fire-propagation test method whose data informs the gas and fire detection SCADA monitors — SCADA alarms and annunciates, but the protective trip must be hard-wired, never a software command.

On cybersecurity, IEC 62443 is the industrial baseline everywhere: IEC 62443-3-3 defines system security levels SL 1 to SL 4, IEC 62443-4-2 pushes equivalent requirements down onto individual components, and the zone-and-conduit model is the architecture a reviewer will ask to see drawn.

In North America, NERC CIP sits on top wherever the plant is a bulk-power-system asset, and which obligations bite turns on impact rating rather than on the word "SCADA": CIP-002 rates commissioned generation Medium impact once a single plant location aggregates more than 1,500 MW in one Interconnection, so most individual storage plants sit at Low impact — still owing the CIP-003 Attachment 1 controls (security awareness, physical and electronic access control, incident response, transient cyber asset handling) but not the Medium-impact regime in which CIP-005 forces every interactive remote session through an intermediate system with multi-factor authentication.

Elsewhere the obligation set is national — the EU NIS2 directive as transposed by each member state, or a network operator's own security annex — so read the interconnection documents rather than assuming your home market's rules travel.

Historian, alarms and event records

The historian is the part of SCADA an engineer touches years later. It stores time-series tags at 1-second to 1-minute resolution, with contracts often requiring multi-year retention — three to seven years is common — to support warranty, degradation and dispute analysis. Two mechanics decide whether that archive is worth anything.

The first is compression: historians normally store by exception against a per-tag deadband, and a deadband loose enough to shrink the archive is also loose enough to erase the excursion you later need to prove, so set it tight on POI power, SOC and cell extremes and loose on ambient temperature.

The second is gap handling: DNP3 outstations and most gateways buffer events and forward them with their original timestamps once the link returns, so a communications outage need not become a hole in the record — but the buffer is finite, and a long outage overflows it and drops the oldest events, which DNP3 reports with an event-buffer-overflow indication.

Note what the historian is not. It is the analysis record, not the settlement record: settlement runs off the revenue meter's own registers, class 0.2S under IEC 62053-22 or class 0.2 under ANSI C12.20 depending on the market — separate standards with separate class systems, not two names for one thing.

An alarm is a signal that demands an operator response, which means most of what a battery plant can report is not an alarm. Map every BMS warning from every rack straight to the operator HMI and you get thousands of nuisance annunciations that bury the one that matters. ISA-18.2, published internationally as IEC 62682, is the alarm-management lifecycle standard: rationalize each candidate against a defined consequence and a defined operator action, set priority from that consequence rather than from the vendor default, and then measure what the operator actually receives.

The benchmark those documents and EEMUA 191 are quoted for is on the order of one alarm per ten-minute period per operator in steady state, with a few hundred a day the practical ceiling; more than ten in ten minutes meets ISA-18.2's own definition of an alarm flood.

On a BESS the usual offenders are per-rack SOC-imbalance and temperature-deviation warnings, HVAC status chatter, and communication-loss alarms raised per device instead of per gateway. The fix is aggregation and suppression logic designed into the point list — a container-level summary alarm with drill-down beneath it — not an operator who has learned to ignore a flashing tile.

Events are the third data class and the one most often shortchanged. Sequence-of-events records are discrete state changes — breaker trips, relay pickups, contactor openings, protection targets — timestamped at the device rather than at the server, typically to 1 ms resolution at protection relays and RTU binary inputs and all referenced to the plant clock.

Relays and disturbance recorders add waveform captures exported as COMTRADE files (IEEE C37.111), which is what a ride-through or fault investigation actually consumes: a 1-second trend tells you the plant tripped, and only the SOE list and the COMTRADE record tell you in what order.

Specify three things up front — which devices produce SOE, where those files are collected automatically, and how long they are retained — because the alternative is learning after an event that the record lived in a relay's volatile buffer and has already rolled over. The same test applies to the alarm log: an alarm history that cannot be exported with its timestamps and acknowledgements is not evidence.

How it shows up in specs, studies and contracts

In procurement, SCADA appears as a points list (I/O list), a protocol and network architecture drawing, and a division-of-responsibility matrix — who supplies the plant SCADA, who integrates the battery vendor's controllers, and who owns the utility RTU.

Read the points list against your market and interconnection telemetry requirements early: missing signals (POI reactive power, per-container SOC, breaker status) discovered at commissioning are expensive to add. The interconnection study and agreement specify the exact telemetry set, cadence and protocol to the utility, and often a dedicated communication path carrying a 99%-or-better availability requirement — a number that lands straight in the O&M scope.

In execution, SCADA is proven at factory and site acceptance tests: point-to-point verification of every mapped tag, failover tests, loss-of-communication behavior, and end-to-end dispatch tests against the market operator. The SAT report is where a student sees SCADA made concrete.

Ask three questions of any integrator: what does the plant do when the SCADA or market link drops (hold last setpoint, ramp to zero, or follow a local default — the grid code usually dictates); how are firmware and point-map versions controlled across hundreds of devices; and whose historian is contractually authoritative for availability and capacity-test calculations. The answers separate a bankable controls package from an integration risk.

Common pitfalls

The most common trip-wire is scope confusion between SCADA, the Energy Management System and the Power Plant Controller. Battery suppliers, PCS vendors and third-party integrators each arrive with their own controller and their own definition of "EMS"; without a single responsibility matrix, functions like state-of-charge balancing across containers or POI power-factor control end up implemented twice or not at all.

Watch time synchronization and units. Unsynchronized clocks make post-event analysis nearly impossible — a fault ride-through review needs BMS, PCS and POI meter records aligned to well under a second. Unit and sign-convention mismatches between vendors (kW versus MW, absorb-versus-inject reactive sign, displayed versus absolute SOC) are routine integration defects that only surface during commissioning.

Finally, treat remote access with suspicion: vendor VPNs for warranty diagnostics are a legitimate need but a classic attack path, and they belong inside the documented IEC 62443 zone-and-conduit architecture, not bolted on afterwards. The same rule settles how vendor dashboards get their data — replicate the historian outward into a DMZ, or push it across a unidirectional gateway, rather than letting an inbound session reach into the control network.