Getting WirelessHART Data Into SCADA Without Trusting a Stale Reading
Bringing WirelessHART gateway data into SCADA safely: update rate versus polling, stale-value detection, Modbus mapping pitfalls and join troubleshooting.
Articles
Practical SCADA notes
Field-oriented references for HMI/SCADA systems, industrial communication, alarms, tags, historians, and project delivery.
Polling a Remote RTU Over Cellular Without Burning the Data Plan
Sizing polls, timeouts and keepalives for SCADA over LTE: the byte arithmetic, carrier NAT timeouts, report-by-exception, and why nobody dials in.
PRP and HSR Give You Zero-Gap Redundancy — and Hide a Dead LAN
How IEC 62439-3 PRP and HSR deliver bumpless redundancy for SCADA and IEC 61850, why a failed LAN goes unnoticed, and what to monitor at commissioning.
When NTP Is Fine for SCADA and When You Actually Need PTP
NTP holds most SCADA clocks within milliseconds, which is plenty — until you need 1 ms sequence-of-events across substations. Where PTP earns its cost.
Reading BACnet/IP Into SCADA Without Getting Stuck in the Priority Array
How a driver discovers BACnet devices, reads present-value and writes commandable objects: object identifiers, the 16-slot priority array, COV and BBMD.
Subscribing to IEC 61850 GOOSE in SCADA Without Missing a State Change
How GOOSE stNum/sqNum counters, allowedToLive and ConfRev decide whether SCADA sees a breaker trip in milliseconds or never — and proving it is alive.
IEC 61850 Reporting: Why Buffered and Unbuffered Reports Behave So Differently
How BRCB and URCB blocks feed substation data to SCADA: datasets, trigger options, buffer time, and the reservation fights that starve a client.
Why Your Breaker Position Flickers on DNP3 — and What Double-Bit Inputs Fix
DNP3 double-bit inputs (groups 3 and 4) encode 52a/52b contacts as four states, killing the OPEN/CLOSED flicker single-bit status shows mid-travel.
Turning On DNP3 Secure Authentication Without Locking Yourself Out of the Outstation
Commissioning DNP3 Secure Authentication (SAv5, IEEE 1815-2012): which functions to mark critical, aggressive mode on slow links, and key mismatches.
Getting a Legacy OPC DA Server Through DCOM Without Losing a Day to It
Why OPC Classic (DA/HDA) links fail across DCOM — RPC endpoint mapper on 135, dynamic port ranges, server identity — and the fastest way through it.
Reading Logix Tags Over EtherNet/IP: Connections, RPI, and Batched Reads
Pulling ControlLogix and CompactLogix tags over EtherNet/IP: connected versus unconnected CIP, RPI, connection budgets, and why array reads win.
IEC 60870-5-104: Why the Link Connects but No Values Show Up
TCP to port 2404 is up, the RTU is reachable, every point still stale. It is almost always STARTDT and the general interrogation nobody sent.
Read the DNP3 IIN Bits Before You Blame the Outstation
The two IIN octets in every DNP3 response report restart, lost events, missing time and local control. Reading them, and clearing the ones that stick.
Your Smart Transmitters Already Know More Than SCADA Sees
How to pull HART secondary variables and diagnostics into SCADA beyond the 4-20 mA loop, using multiplexers, HART-enabled I/O, and WirelessHART gateways.
How DNP3 Deadbands and Event Variations Decide What Reaches Your Master
The deadband decides whether a change becomes an event; the Group 32 variation decides its size. Set both wrong and you flood the buffer or lose time.
Getting Modbus RTU Through a Serial Device Server Without Dropping Frames
Commissioning a serial-to-Ethernet device server carrying Modbus RTU: operating mode, packing timers, TCP framing, idle timeouts and half-duplex control.
One Unmapped Register Can Fail an Entire Modbus Block Read
How drivers group Modbus registers into block reads, why gap tolerance and block size matter, and how one unmapped address takes down a whole block.
How OPC UA Republish Recovers Dropped Notifications Before They Become Trend Gaps
Sequence numbers and the Republish service turn a dropped notification into zero data loss — but only if the client watches them and the queue is sized.
How to Commission a DNP3 Outstation Without Losing Events
Class 0/1/2/3 assignment, deadbands, unsolicited responses, event buffers, and the IIN bits that decide whether a master survives a comms gap.
When DNP3 Drops Frames, Stop Debugging the Application Layer
A DNP3 link that stalls or logs CRC errors gets fixed one layer down: addressing, confirmed service, retry and timeout tuning on radio and serial.
How Select-Before-Operate Stops a Bad DNP3 Command From Moving a Breaker
Select-before-operate versus direct operate, CROB trip/close codes, the select timeout that bites on slow links, and verifying feedback not the response.
How the DNP3 Need Time Bit Keeps Your Event Timestamps Honest
Why outstations stamp their own events, how the Need Time (IIN1.4) bit and delay-corrected clock writes work, and how bad sync turns an SOE log to fiction.
Report-by-Exception in SCADA: Why It Breaks When You Treat It Like Slow Polling
Running report-by-exception and change-of-state — DNP3 events, deadbands, heartbeats, integrity polls — without losing short events or stale values.
Poll These Switch Points Before You Blame the PLC
Intermittent bad quality usually starts at a switch port. Which SNMP objects are worth polling, why counters only mean anything as rates, and trap gaps.
Why Your Modbus Gateway Pings Fine but SCADA Still Goes Stale
A Modbus TCP-to-RTU gateway can answer ping and still drop requests. Finding the queue saturation behind stale tags, and tuning the driver for it.
OPC UA PubSub over UDP: Prove the Packet Path Before You Trust a Single Tag
Commissioning OPC UA PubSub (Part 14, UADP over UDP) without shipping stale values as live: dataset contracts, VLAN checks, and reboot-only failures.
Setting Modbus RTU Timing So Radios and Old Meters Actually Answer
How to choose Modbus RTU baud rate, silent interval (t3.5), and turnaround delay so slow serial devices get a fair chance to reply on a SCADA link.
Why Your MQTT Dashboard Jumps Backward: Timestamps, Sequence Numbers and Replay
MQTT arrival order is not process order. Why the DUP flag never catches the duplicates that hurt, Sparkplug's 8-bit seq wrap, and the MQTT 5.0 properties that fix stale retained state.
Use MQTT Shared Subscriptions to Scale Consumers — but Keep the Historian Out of the Pool
Shared subscriptions split an MQTT stream across workers — and will quietly halve your historian feed and scramble trend order if you point them wrong.
How to Size an MQTT Wildcard Subscription Before It Floods Your Historian
Estimating the real load behind site/#, and the MQTT 5.0 features that actually contain it: Retain Handling, shared subscriptions, Receive Maximum, SUBACK reason codes.
Pull the Cable: Proving an Industrial Ethernet Ring Actually Fails Over
A commissioning sequence for RSTP, MRP and PRP rings that measures what operators see: convergence time, dropped subscriptions, half-open sockets.
How Many Modbus TCP Clients Can One PLC Actually Take?
Modbus TCP devices cap simultaneous connections lower than you think. Inventorying clients, reading real socket behaviour, and protecting the HMI.
The Modbus TCP Bug Where the Socket Is Fine but the Values Are Wrong
How a mishandled transaction ID lets a Modbus TCP gateway hand your SCADA driver the wrong register's value — and how to prove it with a capture.
MQTT Client IDs Are Only Guaranteed to 23 Bytes: ACL Planning for SCADA Edge
Duplicate client IDs, wildcard rules nobody owns, retained commands that re-fire, and denied publishes that make no sound. What the MQTT spec actually guarantees at the edge.
Which OPC UA Timeout Actually Killed Your Session?
The secure channel, the session and the subscription each expire on their own clock. Which one fired tells you to blame the firewall, load or keepalive.
Stop Scanning Every SCADA Tag at One Second
Why a flat 1-second scan overloads PLCs and gateways, and how scan classes and load shedding keep the data operators act on fast under stress.
Why OPC UA Rejects a Server You Can Ping
Client won't connect though ping and port 4840 are open? Usually an endpoint URL, hostname SAN or ApplicationUri mismatch. Reading the status codes.
How to Catch an Intermittent SCADA Comms Fault in a Packet Capture
Where to tap, what to filter, and how to read the first thirty seconds of a capture when comms drop and recover before anyone can get to a keyboard.
Why Polling a SCADA Tag Faster Won't Catch That One-Scan Pulse
A one-scan reject pulse lives for 20 ms. Poll every 250 ms and SCADA never sees it. Matching polling rates to PLC scan time, driver and historian.
Modbus RTU Timeouts Are Usually a Wiring Problem: An RS-485 Commissioning Walkthrough
Commissioning a Modbus RTU link the right way: prove polarity, termination, biasing and grounding before you ever open the register map.
Rotating an MQTT Broker Certificate Without Dropping Your SCADA Clients
A staged plan for rotating MQTT broker, client and CA certificates without breaking publishers, store-and-forward queues or Sparkplug birth sequences.
In OPC UA, a Trusted Certificate Is Not Permission to Write
How OPC UA separates certificate trust, user identity and Part 18 role mapping — and commissioning writes so the wrong session can't move a setpoint.
Why Your Modbus TCP Gateway Reads the Wrong Slave
The Modbus unit identifier is 'useless' on TCP until a gateway is involved. How routing works behind serial gateways, and finding the slave that answered.
OPC UA Reverse Connect: When the Server Has to Dial the Client
How reverse connect flips the TCP direction through a cell firewall, and the certificate, endpoint and diagnostic traps that still bite afterward.
SCADA Service Account Password Rotation: Trigger It on Events, Not a Calendar
Nobody memorizes a service account password, so a 90-day policy buys little. What IEC 62443-3-3 SR 1.2 and NIST 800-63B actually ask for.
How to Keep MQTT Store-and-Forward From Punching Holes in Your Historian
Why an MQTT edge gateway loses data during a WAN outage, and how to buffer with source timestamps, sequence numbers and a replay policy that holds.
If the Vendor VPN Lands on the PLC Subnet, You Don't Have a DMZ
Designing SCADA remote access against IEC 62443-3-3 SR 5.2 and SR 1.13, testing the denied paths at commissioning, and the port and timeout numbers that break it.
Commissioning SCADA Firewall Rules: Test the Application, Not the Port
Commissioning SCADA firewall rules from data flows rather than port lists — the supporting services that break at cutover, and proving each rule for real.
How to Test OPC UA Redundant Failover Before the Plant Depends On It
A field-tested procedure for OPC UA redundant failover: ServiceLevel, subscription recovery, certificates, and catching stale data before operators do.
It Connects with None but Fails with Basic256Sha256: Debugging OPC UA Trust
Why a client browses fine with security off but drops the secure channel, and how to fix trust stores, endpoints and certificate names in a project.
Why Your Historian Shows the Pressure Dropping After the Trip
How historian timestamps go wrong — clock drift, NTP versus PTP, OPC UA source time, late data, DST — and catching it before a report dispute does.
Why One Slow Modbus TCP Device Can Freeze Your Whole Scan
Setting Modbus TCP poll rates, timeouts, retries and scan groups so one stalled device or saturated gateway can't drag the whole driver down with it.
MQTT QoS and Retained Message Notes for SCADA
Practical notes for choosing MQTT QoS levels, retained messages, clean sessions, and duplicate handling in SCADA and industrial telemetry projects.
Modbus Exception Codes: The Device Answered, It Just Said No
Reading Modbus exception responses on the wire, telling a refused request from a dead link, and chasing illegal-address and gateway causes.
Telling a Dead MQTT Gateway from a Quiet One on the HMI
Using Last Will, birth messages and retained state so a SCADA screen shows offline, stale and healthy as three things — not one green icon that lies.
OPC UA Certificate Renewal Checklist
A practical checklist for renewing OPC UA application certificates without breaking SCADA clients, historians, gateways, or production HMI connections.
How to Catch a Frozen SCADA Value Before the Operator Trusts It
A SCADA screen shows a believable number long after the device stopped updating. Heartbeat, watchdog and stale-data tags that make freshness visible.
SCADA Network Troubleshooting Checklist
A layered checklist for troubleshooting SCADA communication problems from physical link to protocol behavior.
Industrial Ethernet Switch Commissioning Checklist
A field checklist for commissioning managed industrial Ethernet switches used by SCADA servers, PLCs, remote I/O, drives, cameras, and protocol gateways.
Modbus TCP Basics
A concise practical guide to Modbus TCP concepts: clients, servers, unit IDs, function codes, registers, polling, and mapping pitfalls.