HSMS Linktest Timeout While Data Still Flows: Close the Socket Anyway
A swallowed Linktest.req burns T6 while an S1F1 on the same socket answers with a full S1F2 in 0.3 ms, and the host should close the connection anyway.
Articles
Practical SCADA notes
Field-oriented references for HMI/SCADA systems, industrial communication, alarms, tags, historians, and project delivery.
An S1F4 Carries No SVIDs — Get the Names From S1F11 First
An S1F4 body carries no SVIDs at all. Real S1F11/S1F12 bytes showing where a host learns SVID numbers and names, and how S2F29 differs.
Your HSMS Session Is SELECTED and S1F3 Still Comes Back as S1F0
SELECTED is E37, COMMUNICATING is E30. Real bytes showing an S1F3 sent before S1F13/S1F14 aborted as S1F0, and the same S1F3 answered after.
Reading Equipment Constants From the Host: S2F29 for the Namelist, S2F13 for the Values
You asked S2F13 for one ECID and S2F14 came back with two values. Real S2F29 and S2F13 bytes, and the length check host code must run.
Why Your S6F11 Never Arrives: Getting S2F33, S2F35 and S2F37 in the Right Order
Your report is defined but S6F11 never arrives. Real S2F33, S2F35 and S2F37 captures from two equipments, and what a non-zero LRACK tells the host.
The Equipment Stamps Your S6F11, Not Your Host — Checking That Clock With S2F17 and S2F31
Equipment clock drift reorders S6F11 events while HSMS stays green. Reading the clock with S2F17, setting it with S2F31, and why TIACK 0 proves nothing.
Why Your S2F41 Comes Back HCACK 2 While the Tool Screen Says ONLINE
S2F41 START rejected with HCACK 2 while the equipment screen reads ONLINE. Separating the SEMI E30 communication state from the three control states, with a real HSMS capture showing the byte where HCACK flips from 2 to 0.
Prove a Full GEM Startup Handshake Without Any Equipment
Run all ten SEMI E30 startup steps — S1F13 through S2F31 — with one npx command against a simulator, with the equipment-side wire capture of the run, what each PASS proves, and what a refused Select actually prints.
Why Your SECS/GEM Host Can't Count on Getting an S9 Error Message
Five bad SECS-II messages pushed at a live HSMS listener. One drew a real S9F7, the rest came back as SxF0 aborts. What SEMI E5 stream 9 means and how to read MHEAD.
Why HSMS SystemBytes Uniqueness Is Your Host's Job, Not the Equipment's
A real capture where two HSMS requests share one SystemBytes and the replies come back byte-identical, plus the allocation rules that prevent it.
Which HSMS Timer Just Fired? Telling T3, T6, T7 and T8 Apart
One log line says timeout. A real HSMS capture separates T3 from T6, pins the SEMI E37 defaults (T3 45 s, T6 5 s, T7 10 s, T8 5 s) and shows the two timers your host has to enforce itself.
Why a SECS/GEM Recipe Upload Should Start With S7F1, Not S7F3
A 300-byte PPBODY is 330 bytes on the socket. A real S7F1 and S7F3 capture, and what a host loses by skipping the grant step.
HSMS Active vs Passive: Which Side Dials, and What Happens When Neither Does
Connection refused in 3 ms, or a TCP session where nothing ever arrives. Real captures that tell the two HSMS mode mistakes apart.
SELECTED Is Not Communicating: When S1F13 Never Gets an S1F14
The HSMS session is SELECTED and S1F13 draws only a T3 timeout, while Linktest answers on the same socket in 0 ms. A capture, and two state machines.
Your SECS-II Length Byte Counts Bytes — Unless the Item Is a List
An S1F3 body byte by byte: the item header packs format code and length-byte count, and one wrong length silences the whole connection.
Your HSMS Deselect.req Got No Reply, and the Session Is Still Up
A capture where Deselect.req, Reject.req and two unassigned STypes all draw silence, while Linktest answers instantly and the session stays SELECTED.
Two Hosts, One HSMS Port: Why the First Session Never Finds Out
A capture of two host connections into one passive HSMS listener. Both get Select Status 0, and the first is never told the second arrived.
Why Your SECS-II Message Gets No Reply: The W-Bit Shares a Byte With the Stream
S1F1 sent, no S1F2, T3 expires — and the tool did nothing wrong. Captures of Header Byte 2 showing what packing the W-bit and Stream together costs.
One TCP Read Is Not One HSMS Message: Framing on the Length Header
A host that only drops replies under load is usually a parser treating one recv() as one message. Four captures: two messages in one write, one split, a body short of its length field, and a prefix claiming 1 MiB.
Why Your HSMS Separate.req Never Gets a Reply, and What Happens If You Skip It
The host shut down but the tool still shows SELECTED. Two captures side by side: a session ended with Separate.req, and one where only the socket closed.
A Tool That Answers Linktest But Never Completes Select
In HSMS, alive and connected are different states. A real capture of Linktest and S1F13 sent before Select ever goes out, the Reject.req reason 4 that SEMI E37 asks for there, and why the timer that fires first is T6, not T7.
An Accepted Select and a Refused One Differ by a Single Byte
Real Select.rsp captures — accepted, refused with SEMI E37 Select Status 1/2/3, and answered under a different SessionID — and where 'select failed' loses the detail.
HSMS Select Timeout: Three Causes That Look Identical in the Host Log
Real captures of the three ways a Select gets no usable answer — silence, mismatched SystemBytes, and a wrong SessionID — and the SEMI E37 timers T5, T6 and T7 that decide what your log shows.
Your SECS/GEM Host Logs 'No Reply' and the Equipment Did Answer
A real HSMS capture from 127.0.0.1:5501: request and mismatched Select.rsp decoded byte for byte, what a host's SystemBytes-keyed pending reply table does with the frame, and why the timer that fires is T6 and not T3.
Getting WirelessHART Data Into SCADA Without Trusting a Stale Reading
Bringing WirelessHART gateway data into SCADA safely: update rate versus polling, stale-value detection, Modbus mapping pitfalls and join troubleshooting.
Designing SCADA Alarm Callouts That Actually Wake Someone Up
Remote notification is a delivery channel, not an alarm system. Picking which alarms page out, escalation timers that match humans, and proving delivery.
Standard Cubic Meters, Actual Cubic Meters, and the Gas Total Nobody Agrees On
Pressure and temperature compensation for gas flow: which meters need it, the absolute-pressure trap, where the math belongs, and a failed P transmitter.
Turning Tank Level Into Volume Without Getting the Inventory Wrong
Building a strapping table into SCADA: segment geometry, interpolation spacing, where the calculation runs, and the density trap in hydrostatic level.
Your Loop Isn't Badly Tuned — The Valve Is Sticking: Finding Stiction in Trend Data
A level loop still cycling after two retunes is usually the valve. Reading stiction off PV/OP trends, proving it with a step test, and monitoring it.
Your Valve Reports Closed but the Flow Says Otherwise: Limit Switch and Travel Timer Logic
Turning two limit switches and a travel timer into honest valve state: transit handling, discrepancy alarms, and catching a slowing actuator early.
Polling a Remote RTU Over Cellular Without Burning the Data Plan
Sizing polls, timeouts and keepalives for SCADA over LTE: the byte arithmetic, carrier NAT timeouts, report-by-exception, and why nobody dials in.
Ratio Control: Blending Two Flows When You Only Get to Control One of Them
In ratio control one stream sets the pace and you trim the other. Where the multiplier goes, why actual ratio drifts, and starting up without off-spec.
Split-Range Control: Handing Off Between Two Valves Without a Bump at the Split Point
One PID driving a heating and a cooling valve stalls or hunts right at the changeover. Setting the split point, killing overlap, and the gain jump.
Cascade Control: Why the Slave Loop Has to Be Faster Than the Master
Cascade loops fail when the two are tuned in the wrong order or the slave's limits never reach the master. Commissioning them so they stop fighting.
PRP and HSR Give You Zero-Gap Redundancy — and Hide a Dead LAN
How IEC 62439-3 PRP and HSR deliver bumpless redundancy for SCADA and IEC 61850, why a failed LAN goes unnoticed, and what to monitor at commissioning.
Where to Do the Square Root on Orifice Flow, and Why It Jitters at Low Flow
Orifice DP goes as the square of flow, so someone takes the root — transmitter, PLC or SCADA. Do it twice, or skip the low-flow cutoff, and it lies.
When NTP Is Fine for SCADA and When You Actually Need PTP
NTP holds most SCADA clocks within milliseconds, which is plenty — until you need 1 ms sequence-of-events across substations. Where PTP earns its cost.
Why Your Thermocouple Reads 3 Degrees High in the Panel and the RTD Doesn't
Where linearization and cold-junction compensation happen between sensor and SCADA tag, and why the wrong place quietly biases the reading you trust.
Filtering a Noisy Analog Input Without Hiding the Process You Need to See
Smoothing a jittery 4-20 mA reading with first-order and moving-average filters, where the filter belongs, and why the wrong tag delays your alarm.
Rate-of-Change Alarms: Catch a Runaway Before the High-High Ever Trips
Designing rate-of-rise and rate-of-fall alarms: window length, noise filtering, units, and the quality gating that stops them screaming on comms recovery.
Making Online PLC Edits Without Tripping the Running Process
Changing ladder logic in a running PLC safely: online edit versus download, scan-order traps, seal-in glitches, forces, and a pre-edit checklist.
Reading BACnet/IP Into SCADA Without Getting Stuck in the Priority Array
How a driver discovers BACnet devices, reads present-value and writes commandable objects: object identifiers, the 16-slot priority array, COV and BBMD.
Subscribing to IEC 61850 GOOSE in SCADA Without Missing a State Change
How GOOSE stNum/sqNum counters, allowedToLive and ConfRev decide whether SCADA sees a breaker trip in milliseconds or never — and proving it is alive.
IEC 61850 Reporting: Why Buffered and Unbuffered Reports Behave So Differently
How BRCB and URCB blocks feed substation data to SCADA: datasets, trigger options, buffer time, and the reservation fights that starve a client.
Why Your Breaker Position Flickers on DNP3 — and What Double-Bit Inputs Fix
DNP3 double-bit inputs (groups 3 and 4) encode 52a/52b contacts as four states, killing the OPEN/CLOSED flicker single-bit status shows mid-travel.
Turning On DNP3 Secure Authentication Without Locking Yourself Out of the Outstation
Commissioning DNP3 Secure Authentication (SAv5, IEEE 1815-2012): which functions to mark critical, aggressive mode on slow links, and key mismatches.
Why Your PID Loop Overshoots Every Time the Valve Hits a Limit
Reset windup is why a well-tuned loop overshoots after saturation or a manual-to-auto swap. What anti-windup and external reset actually fix in a PLC.
Getting a Legacy OPC DA Server Through DCOM Without Losing a Day to It
Why OPC Classic (DA/HDA) links fail across DCOM — RPC endpoint mapper on 135, dynamic port ranges, server identity — and the fastest way through it.
Why Your SCADA Client Shows an OPC UA Struct as a Blob — and How to Decode It
A PLC exposes a UDT over OPC UA and your client shows a ByteString. What an ExtensionObject actually holds, and how clients decode structured DataTypes.
Reading Logix Tags Over EtherNet/IP: Connections, RPI, and Batched Reads
Pulling ControlLogix and CompactLogix tags over EtherNet/IP: connected versus unconnected CIP, RPI, connection budgets, and why array reads win.
IEC 60870-5-104: Why the Link Connects but No Values Show Up
TCP to port 2404 is up, the RTU is reachable, every point still stale. It is almost always STARTDT and the general interrogation nobody sent.
Read the DNP3 IIN Bits Before You Blame the Outstation
The two IIN octets in every DNP3 response report restart, lost events, missing time and local control. Reading them, and clearing the ones that stick.
Your Smart Transmitters Already Know More Than SCADA Sees
How to pull HART secondary variables and diagnostics into SCADA beyond the 4-20 mA loop, using multiplexers, HART-enabled I/O, and WirelessHART gateways.
Why Your Standby Pump Didn't Start: Getting Lead/Lag/Standby Rotation Right
Building lead/lag/standby pump rotation so duty sharing, standby failover and role swaps stay predictable — and visible to the operator at 3am.
Why Your VFD Won't Start From SCADA (and How Control Words Actually Work)
A VFD is commanded through a packed control word and reports through a status word. Map either wrong and it won't start, or it clears a latched fault.
How DNP3 Deadbands and Event Variations Decide What Reaches Your Master
The deadband decides whether a change becomes an event; the Group 32 variation decides its size. Set both wrong and you flood the buffer or lose time.
What a Redundant PLC Actually Protects — and How to Commission One
A hot-standby pair earns its cost only if switchover is proven and sync loss is alarmed. What CPU redundancy covers, and testing both directions.
Getting Modbus RTU Through a Serial Device Server Without Dropping Frames
Commissioning a serial-to-Ethernet device server carrying Modbus RTU: operating mode, packing timers, TCP framing, idle timeouts and half-duplex control.
How to Run a 4-20 mA Loop Check That Catches Swapped Transmitters
Running loop checks from field instrument through PLC to SCADA so every 4-20 mA point is proven end to end, and swapped transmitters surface early.
Building a SCADA Totalizer That Survives Counter Rollover and Meter Resets
Computing usage across a wrapping counter without inventing phantom flow: register width, correcting the delta once, and rollover versus meter reset.
One Unmapped Register Can Fail an Entire Modbus Block Read
How drivers group Modbus registers into block reads, why gap tolerance and block size matter, and how one unmapped address takes down a whole block.
How OPC UA Republish Recovers Dropped Notifications Before They Become Trend Gaps
Sequence numbers and the Republish service turn a dropped notification into zero data loss — but only if the client watches them and the queue is sized.
Why a Dead Transmitter Still Reads a Valid Number, and How to Catch It
A broken wire or saturated loop still scales to a plausible value. Detecting over-range, under-range and stuck 4-20 mA inputs before an operator acts.
How to Commission a DNP3 Outstation Without Losing Events
Class 0/1/2/3 assignment, deadbands, unsolicited responses, event buffers, and the IIN bits that decide whether a master survives a comms gap.
When DNP3 Drops Frames, Stop Debugging the Application Layer
A DNP3 link that stalls or logs CRC errors gets fixed one layer down: addressing, confirmed service, retry and timeout tuning on radio and serial.
How Select-Before-Operate Stops a Bad DNP3 Command From Moving a Breaker
Select-before-operate versus direct operate, CROB trip/close codes, the select timeout that bites on slow links, and verifying feedback not the response.
How the DNP3 Need Time Bit Keeps Your Event Timestamps Honest
Why outstations stamp their own events, how the Need Time (IIN1.4) bit and delay-corrected clock writes work, and how bad sync turns an SOE log to fiction.
HMI Command Reset Behavior After PLC Restart
Designing and testing HMI command bits, acknowledgements and startup recovery so a stale command can't fire after a PLC or controller restart.
Report-by-Exception in SCADA: Why It Breaks When You Treat It Like Slow Polling
Running report-by-exception and change-of-state — DNP3 events, deadbands, heartbeats, integrity polls — without losing short events or stale values.
Alarm Help Text That Survives 02:00: Cause, Consequence, and the Action You Actually Want
Alarm help text is written once during rationalization and never read again. What belongs in cause, consequence and response for a 02:00 operator.
Newest-First Alarm Summaries Hide the Critical Alarm During a Flood
During a flood a newest-first summary pushes the critical alarm off screen, and a filter left on erases it. Picking a default sort that holds.
HMI Color and Shape Semantics for Operator Screens
Practical HMI notes for using color, shape, text, and state rules so operator screens stay readable during abnormal conditions.
Why Your HMI Trend Draws a Flat Line Through a Ten-Minute Outage
Held values, dropped quality codes and late samples inserted at arrival time each make a trend lie after an outage. Working out which one you have.
Poll These Switch Points Before You Blame the PLC
Intermittent bad quality usually starts at a switch port. Which SNMP objects are worth polling, why counters only mean anything as rates, and trap gaps.
Why Your Modbus Gateway Pings Fine but SCADA Still Goes Stale
A Modbus TCP-to-RTU gateway can answer ping and still drop requests. Finding the queue saturation behind stale tags, and tuning the driver for it.
OPC UA Browse Skipped Half Your Tags? You Dropped a Continuation Point
Browse returns success but the tag import is short. The OPC UA Part 4 v1.05 continuation point rules, MaxBrowseContinuationPoints, and how to find the cause.
OPC UA PubSub over UDP: Prove the Packet Path Before You Trust a Single Tag
Commissioning OPC UA PubSub (Part 14, UADP over UDP) without shipping stale values as live: dataset contracts, VLAN checks, and reboot-only failures.
Your HMI Breadcrumb Should Follow the Plant, Not the Project Tree
Making an HMI screen state its own identity: ISA-101.01 display hierarchy as the breadcrumb skeleton, command labels that show scope, and testing copied screens.
Your HMI Says Step 40 — It Should Say What Step 40 Is Waiting For
A sequence screen showing only a step number sends the operator hunting across four displays. Separate state, step, and hold reason, and latch the reason.
Setting Modbus RTU Timing So Radios and Old Meters Actually Answer
How to choose Modbus RTU baud rate, silent interval (t3.5), and turnaround delay so slow serial devices get a fair chance to reply on a SCADA link.
Why Your MQTT Dashboard Jumps Backward: Timestamps, Sequence Numbers and Replay
MQTT arrival order is not process order. Why the DUP flag never catches the duplicates that hurt, Sparkplug's 8-bit seq wrap, and the MQTT 5.0 properties that fix stale retained state.
Use MQTT Shared Subscriptions to Scale Consumers — but Keep the Historian Out of the Pool
Shared subscriptions split an MQTT stream across workers — and will quietly halve your historian feed and scramble trend order if you point them wrong.
How to Size an MQTT Wildcard Subscription Before It Floods Your Historian
Estimating the real load behind site/#, and the MQTT 5.0 features that actually contain it: Retain Handling, shared subscriptions, Receive Maximum, SUBACK reason codes.
Why an OPC UA Setpoint That Browses Writable Still Rejects the Operator
AccessLevel vs UserAccessLevel vs WriteMask: why a setpoint that browses writable returns BadUserAccessDenied, and testing with the production identity.
The Bypass Nobody Cleared: Making Maintenance Overrides Visible in SCADA
A maintenance bypass is an operating state, not a comment field. Tag naming, ISA-18.2 out-of-service handling, expiry rules, and the audit trail.
A Straight Line in Your Historian Isn't Always Data
How historians hide communication gaps behind interpolated lines and held values, and the quality rules that keep bad data out of a shift report.
Alarm Horn Silence Is Not Acknowledgement — Split the Buttons
Wiring horn silence to the acknowledge tag corrupts the event log from day one. Splitting silence, acknowledge, reset and shelve under ISA-18.2.
Why Is This Button Greyed Out? Making HMI Disable Reasons Answer That
How to split HMI button logic into authorization, mode, permissives, interlocks and quality — and show operators the actual reason a command is blocked.
How to Keep a Reusable HMI Faceplate From Commanding the Wrong Pump
Popup context passing for reusable faceplates: one stable equipment key, command binding that fails closed, and telling a broken binding from bad quality.
Which OPC UA Name Should Your SCADA Store: NodeId, BrowseName, or DisplayName?
NodeIds regenerate, browse paths move, DisplayName is a label. Picking the reference your HMI and historian store so firmware doesn't blank a screen.
How to Set OPC UA Deadbands Without Hiding a Drifting Transmitter
Choosing DataChangeFilter settings — absolute versus percent deadband, DataChangeTrigger, queue size — so a filter cuts noise, not real movement.
Backfilling a Historian Gap with OPC UA HistoryRead Without Double-Counting
Repairing a historian gap with OPC UA HistoryRead: scoping the window, letting returnBounds handle edges, keeping Bad quality, and paging safely.
How to Scale HMI Trend Pens So the Screen Doesn't Lie to the Operator
Take trend axis defaults from OPC UA EURange, not 0-100. Clamping at 100% hides NAMUR NE 43 fault currents that land at -2.5% and 106.25%, plus alarm lines and commissioning checks.
Historian Trend Annotations: Store Operator Events as Events, Not Fake Tags
Recording calibration, manual mode and bypass windows as event records separate from the sampled stream, joined back by asset ID and time window.
Pull the Cable: Proving an Industrial Ethernet Ring Actually Fails Over
A commissioning sequence for RSTP, MRP and PRP rings that measures what operators see: convergence time, dropped subscriptions, half-open sockets.
How Many Modbus TCP Clients Can One PLC Actually Take?
Modbus TCP devices cap simultaneous connections lower than you think. Inventorying clients, reading real socket behaviour, and protecting the HMI.
The Modbus TCP Bug Where the Socket Is Fine but the Values Are Wrong
How a mishandled transaction ID lets a Modbus TCP gateway hand your SCADA driver the wrong register's value — and how to prove it with a capture.
MQTT Client IDs Are Only Guaranteed to 23 Bytes: ACL Planning for SCADA Edge
Duplicate client IDs, wildcard rules nobody owns, retained commands that re-fire, and denied publishes that make no sound. What the MQTT spec actually guarantees at the edge.
Which OPC UA Timeout Actually Killed Your Session?
The secure channel, the session and the subscription each expire on their own clock. Which one fired tells you to blame the firewall, load or keepalive.
Good Quality, Stale Value: Reading OPC UA StatusCode and Timestamps
Using StatusCode severity bits, SourceTimestamp and ServerTimestamp to catch frozen data, cached gateway values and clock drift a value-only HMI hides.
Stop Scanning Every SCADA Tag at One Second
Why a flat 1-second scan overloads PLCs and gateways, and how scan classes and load shedding keep the data operators act on fast under stress.
Why Every Alarm Ends Up High Priority, and How to Rank Them by Response Time Instead
Building an alarm priority matrix that ranks by consequence and operator response time, with the EEMUA 191 targets that keep high priority rare.
Why Your Historian Missed the Pump Trip: Exception vs Periodic Collection
Exception and periodic collection store different truths. Picking per tag so a 300 ms interlock survives, and proving the choice during commissioning.
Why Adding a Rework Loop Made Our First-Pass Yield Go Up
Rework quietly breaks linear MES route models. How to bind visit numbers, dispositions, and equipment events to the right route step instance.
When a Modbus Float Reads 1.2e-41: Getting Byte and Word Order Right
Modbus has no standard endianness for 32-bit values, so two registers can decode to garbage. Proving byte and word order on site instead of guessing.
MQTT Payload Schema Versioning for SCADA Edge
Versioning MQTT telemetry payloads so historians, HMI clients, MES connectors and analytics survive a field change instead of breaking on one.
Why OPC UA Rejects a Server You Can Ping
Client won't connect though ping and port 4840 are open? Usually an endpoint URL, hostname SAN or ApplicationUri mismatch. Reading the status codes.
Acknowledged Isn't Cleared: How to Run a Standing Alarm Review
Standing alarms are acknowledged but still active. Reviewing them against the ISA-18.2 stale-alarm metric before they become summary wallpaper.
Renaming Historian Tags Without Losing Three Years of Trend
Historians key archive data to a point ID or a name string, so a rename can split a tag's history in two. What to verify before operators find the gap.
How to Catch an Intermittent SCADA Comms Fault in a Packet Capture
Where to tap, what to filter, and how to read the first thirty seconds of a capture when comms drop and recover before anyone can get to a keyboard.
An Equipment Constant Is a Recipe Change With a Different Name
The host wrote the EC, the tool returned EAC = 0, and nine lots ran on the old value. SEMI E5 EAC codes, a real S2F13 readback on the wire, the S2F29 namelist, and the SAT matrix.
How to Fix Bad Historian Data Without Overwriting the Original
A failed transmitter pegs a tag at full scale for eleven hours. Correcting the record with an audit trail that survives review, raw sample intact.
Why Polling a SCADA Tag Faster Won't Catch That One-Scan Pulse
A one-scan reject pulse lives for 20 ms. Poll every 250 ms and SCADA never sees it. Matching polling rates to PLC scan time, driver and historian.
What SECS/GEM Spooling Actually Saves When the Host Drops for an Hour
SEMI E30 spooling only covers streams the host enabled with S2F43. SPOOL LOAD vs UNLOAD, the S2F44 RSPACK and STRACK codes, S6F24 RSDA, and the S2F43 bytes on a real socket.
A Trend Cursor Only Proves What the Clocks Agree On
HMI, historian, PLC log and alarm list stamp one event seconds apart. Where each timestamp is born, and which one to trust during an incident.
Why the PLC and MES Shift Counts Never Match, and Which One to Trust
The shift report says 1,738 good parts and the HMI says 1,742. Where to look first: counter style, historian deltas, S6F11 event time, or the spool.
Modbus RTU Timeouts Are Usually a Wiring Problem: An RS-485 Commissioning Walkthrough
Commissioning a Modbus RTU link the right way: prove polarity, termination, biasing and grounding before you ever open the register map.
OPC UA Alarms & Conditions: Getting Retain, Acknowledge, and Reconnect Right in SCADA
Commissioning OPC UA Alarm & Condition subscriptions: event filters, the Retain flag, ConditionRefresh, and the failures that appear on reconnect.
How to Test SCADA Server Switchover Without Fooling Yourself
A green redundancy icon proves the heartbeat works and nothing else. What to check on clients, alarms, historian and background jobs during a failover.
How to Downsample Historian Data Without Losing the Trip That Mattered
Averaging old process data hides trips and flattens peaks. Classifying tags, picking a method per class, and testing a purge job before production.
The HMI Accepted the Setpoint. The PLC Didn't.
Why setpoint entry fails on the acknowledgment path, splitting display limits from PLC hard limits, and the tests that catch silent rounding.
Rotating an MQTT Broker Certificate Without Dropping Your SCADA Clients
A staged plan for rotating MQTT broker, client and CA certificates without breaking publishers, store-and-forward queues or Sparkplug birth sequences.
In OPC UA, a Trusted Certificate Is Not Permission to Write
How OPC UA separates certificate trust, user identity and Part 18 role mapping — and commissioning writes so the wrong session can't move a setpoint.
A Manual Override You Can't Audit Is a Fault You Can't Find
A forced valve and a substituted flow reading are different overrides, and one Manual bit can't tell them apart. Logging that survives a server restart.
Why Your Modbus TCP Gateway Reads the Wrong Slave
The Modbus unit identifier is 'useless' on TCP until a gateway is involved. How routing works behind serial gateways, and finding the slave that answered.
OPC UA Reverse Connect: When the Server Has to Dial the Client
How reverse connect flips the TCP direction through a cell firewall, and the certificate, endpoint and diagnostic traps that still bite afterward.
Bad Quality Isn't Zero: Handling SCADA Tag Quality Without Lying to the Operator
OPC DA quality words, OPC UA StatusCodes, DNP3 flags — and how to display, alarm and historize them so a dead signal never reads as a valid value.
Why the HMI Shows the New Recipe While the Machine Still Runs the Old One
Split selected, downloaded and active recipe state into separate tags, compare what the PLC echoes against what you sent, and give rejections a reason.
Your SCADA Backup Isn't a Backup Until It Restores on a Clean Machine
Running a restore drill: what falls out of the backup set, the OPC UA certificate traps, RPO and retention per artefact, and a measured RTO against the target.
Why Your OPC UA Client Drops Fast Tag Changes — and Which Queue Settings Fix It
How monitored item queues, discard policy and the Overflow status bit decide whether your client sees every fast tag change or only the latest one.
SCADA Service Account Password Rotation: Trigger It on Events, Not a Calendar
Nobody memorizes a service account password, so a 90-day policy buys little. What IEC 62443-3-3 SR 1.2 and NIST 800-63B actually ask for.
Why Alarm Acknowledge, Latch, and Reset Must Stay Separate Signals
One shared bit for acknowledge and reset is how alarms vanish while the fault is live. Separating active, latch, ack, return-to-normal and reset.
Why Your HMI Screen Is Slow: Measure Tag Load Before You Redraw Graphics
Split a five-second faceplate into first-load and update delay, then work down through tag counts, scan classes, trend queries and PLC load.
How to Keep MQTT Store-and-Forward From Punching Holes in Your Historian
Why an MQTT edge gateway loses data during a WAN outage, and how to buffer with source timestamps, sequence numbers and a replay policy that holds.
What HCACK=0 Really Tells You About a SECS/GEM Remote Command
Reading SEMI E5 HCACK and CPACK codes against a real S2F41 wire capture: why HCACK=4 exists, E30 control-state gating, and a retry that won't fire a second START.
Your Historian Event Frame Is Only as Good as Its End Trigger
Event frames pay off only if their boundaries hold. Where to take start and end triggers, what to capture as attributes, and frames that never close.
Every S6F11 Arrived and the Lot History Still Has Holes
Where lot traceability breaks when built from equipment events: missing lot context, GEM event time, spool replay order, and split/merge genealogy.
Why a Successful Modbus Write Doesn't Mean the Motor Started
A Modbus TCP write response says the transaction was accepted, not that the motor moved. Command discipline: permissives, readback, and the retry trap.
OPC UA Method Calls From the HMI: Why 'Good' Doesn't Mean the Command Ran
An OPC UA method call can return Good while the machine never moves. Wiring HMI calls so operators see acceptance, execution and a real failure reason.
How to Validate a Historian Calculated Tag Before Reports Depend On It
A calculated tag quietly becomes an official number. Checking formula, quality rules, period boundaries and counter resets before reports depend on it.
The Banner Was Empty and the Plant Was Not Quiet
Filtering an alarm banner is not suppressing an alarm, and ISA-18.2 draws that line for a reason. What the default view owes the operator during a flood.
If the Vendor VPN Lands on the PLC Subnet, You Don't Have a DMZ
Designing SCADA remote access against IEC 62443-3-3 SR 5.2 and SR 1.13, testing the denied paths at commissioning, and the port and timeout numbers that break it.
Why Two SCADA Screens Disagree About the Same Pump
One screen says the pump is stopped, the report says faulted. The fix is a derived status tag with a written priority order that every client shares.
How Long Should an Alarm Delay Be? Set It From Process Time, Not a Default
Setting on-delays, off-delays, debounce and deadband from process behaviour and ISA-18.2 — filtering nuisance alarms without hiding the first warning.
Finding the First-Out Alarm When Your SCADA Floods
Alarm floods bury the initiating cause. Preserving first-out, trusting sequence-of-events timestamps, and stopping comms failures becoming floods.
Make HMI Commands Prove They Worked, Not Just That You Clicked
How to drive HMI state from feedback instead of command bits, set timeouts from real actuator travel, and show operators why a command was rejected.
Your GEM Link Is Green and MES Still Can't Rebuild the Run
Linking SECS/GEM collection events with S2F33/S2F35/S2F37, why report content empties after a tool restart, and proving S6F11 matches the real sequence.
Commissioning SCADA Firewall Rules: Test the Application, Not the Port
Commissioning SCADA firewall rules from data flows rather than port lists — the supporting services that break at cutover, and proving each rule for real.
How to Test OPC UA Redundant Failover Before the Plant Depends On It
A field-tested procedure for OPC UA redundant failover: ServiceLevel, subscription recovery, certificates, and catching stale data before operators do.
It Connects with None but Fails with Basic256Sha256: Debugging OPC UA Trust
Why a client browses fine with security off but drops the secure channel, and how to fix trust stores, endpoints and certificate names in a project.
How to Commission Analog Scaling Without Trusting the HMI Number
A field walkthrough for analog scaling: ranges, engineering units, Modbus word order, NAMUR thresholds — so PLC, SCADA, HMI and historian agree.
Why Your Historian Shows the Pressure Dropping After the Trip
How historian timestamps go wrong — clock drift, NTP versus PTP, OPC UA source time, late data, DST — and catching it before a report dispute does.
Why One Slow Modbus TCP Device Can Freeze Your Whole Scan
Setting Modbus TCP poll rates, timeouts, retries and scan groups so one stalled device or saturated gateway can't drag the whole driver down with it.
MQTT QoS and Retained Message Notes for SCADA
Practical notes for choosing MQTT QoS levels, retained messages, clean sessions, and duplicate handling in SCADA and industrial telemetry projects.
OPC UA Sampling vs Publishing: Why Connected Doesn't Mean Good Data
How sampling interval, publishing interval, queue size, deadband and the KeepAlive/Lifetime pair decide whether your client and historian see the process.
How to Set a Historian Backfill Policy Before Late Data Rewrites Your Reports
Store-and-forward hands you hours-old samples when a link recovers. Which timestamp wins, what a late value may overwrite, and how to mark it.
HMI Permissive and Interlock Display Checklist
How to show permissives, interlocks, inhibits, bypasses, command readiness, and first-out causes on practical HMI screens.
Modbus Exception Codes: The Device Answered, It Just Said No
Reading Modbus exception responses on the wire, telling a refused request from a dead link, and chasing illegal-address and gateway causes.
OPC UA Connects Fine but Every Tag Reads Bad: the NodeId Moved
After a PLC download the session opens and every item returns Bad_NodeIdUnknown. How namespace indexes and client caches shift, and what to check first.
Alarm Rationalization Workshop Checklist
Running alarm rationalization sessions that produce usable priorities, causes and operator response guidance instead of another unread spreadsheet.
Why Operators Code Everything as "Other" — Fixing an MES Downtime List
Designing downtime reason codes operators pick correctly under pressure: prompt timing, auto-coding from PackML state, and the fields reports need.
Telling a Dead MQTT Gateway from a Quiet One on the HMI
Using Last Will, birth messages and retained state so a SCADA screen shows offline, stale and healthy as three things — not one green icon that lies.
OPC UA Certificate Renewal Checklist
A practical checklist for renewing OPC UA application certificates without breaking SCADA clients, historians, gateways, or production HMI connections.
Setting Historian Deadbands So Trends Aren't Noise or Lies
Picking historian deadbands and compression from the instrument and the process, not HMI decimal places, so trends keep movement without storing noise.
Why Your HMI Should Never Merge Mode and State Into One Field
Mode is who may command the equipment; state is what it is doing. SEMI E30's control state model splits them — here is how to split the HMI to match.
A Clean Modbus Poll Can Still Show the Wrong Number: Commission the Register Map First
Modbus connects, unit IDs respond, polls complete — and the operator still reads a swapped float. Proving a register map before the historian trusts it.
How to Catch a Frozen SCADA Value Before the Operator Trusts It
A SCADA screen shows a believable number long after the device stopped updating. Heartbeat, watchdog and stale-data tags that make freshness visible.
Things I Learned from Real HMI/SCADA Projects
Project notes about naming, alarms, screenshots, networking, commissioning, backups, and documentation habits that matter later.
Designing Sparkplug B Topics You Won't Have to Rename Later
Laying out Sparkplug B group, edge node and device IDs — plus birth certificates, aliases and STATE — so a rename doesn't break every subscription.
SCADA Network Troubleshooting Checklist
A layered checklist for troubleshooting SCADA communication problems from physical link to protocol behavior.
The One Bit That Decides Whether a SECS/GEM Alarm Is Set or Cleared
S5F1 carries ALCD, ALID and ALTX. Bit 8 of ALCD is set-versus-clear, and dropping it leaves an MES alarm list that never goes green. Plus the S5F5/S5F6 recovery after a host restart.
Historian Basics
What an industrial historian does, what to plan before collecting data, and common mistakes in historian projects.
OPC UA Client Commissioning Checklist
A practical checklist for commissioning OPC UA client connections from SCADA, HMI, historian, or gateway software to PLCs and automation servers.
Designing SCADA Trend Displays Operators Can Troubleshoot From
Trend screens that answer the operator's real question during an upset: grouping by loop, choosing scales, and drawing a comms gap as a gap.
From SCADA Signals to Operational State
How raw SCADA, HMI and protocol values become useful machine state, process state, alarm state and control state, and where each one is decided.
HMI Faceplate Design Checklist
A practical checklist for designing HMI faceplates that operators can use quickly, consistently, and safely during normal operation and troubleshooting.
Industrial Ethernet Switch Commissioning Checklist
A field checklist for commissioning managed industrial Ethernet switches used by SCADA servers, PLCs, remote I/O, drives, cameras, and protocol gateways.
Shelving vs. Suppression: Quieting SCADA Alarms Without Hiding Real Risk
How ISA-18.2 splits shelving, designed suppression, out-of-service and interlock bypass — and configuring them so every hidden alarm keeps an owner.
SCADA Commissioning Checklist
A commissioning checklist for validating HMI and SCADA screens, tags, alarms, trends, historians, users, backups and comms paths before handover.
SCADA Tag Naming Guide
A practical guide for creating readable, maintainable SCADA tag names across equipment, signals, alarms, trends, and reports.
Try a Live Operational State Tutorial
A short hands-on walkthrough that turns one temperature signal into alarm state, switch action, HMI feedback, and an event log using the StateX tutorial.
Common SCADA Alarm Design Mistakes
Practical alarm design mistakes that create nuisance alarms, floods, operator confusion, and poor incident response.
OPC UA vs MQTT
How to think about OPC UA and MQTT in industrial systems without turning the comparison into a vendor argument.
Modbus TCP Basics
A concise practical guide to Modbus TCP concepts: clients, servers, unit IDs, function codes, registers, polling, and mapping pitfalls.
What is a SCADA Tag?
A practical definition of SCADA tags and how they connect PLC addresses, alarms, trends, screens, and reports.
HMI vs SCADA vs MES vs Historian
A field-oriented comparison of common industrial software layers and where their responsibilities overlap.
What is SCADA?
A practical explanation of SCADA systems: what they do, where they fit, and what to watch for on real projects.