Water and wastewater: telemetry that crosses the fence line

A treatment works has a fence, a gate and a control room. Most of its network does not live inside them. The pumps that push water into town, the lift stations that bring sewage back, and the reservoirs on the high ground each have a cabinet of their own, and each cabinet has a link to the works. The plant is the district.

The perimeter is the district

On most sites of this kind the works is the smallest part of the network. A distribution system of any size has intake pumping, booster stations, lift stations, reservoirs and valve chambers spread across many kilometres, each with an RTU or a small PLC in a cabinet beside the road. They report level, flow, pressure and pump status back to the SCADA system at the works, and they take commands from it: start a pump, open a valve, change a setpoint.

Every one of those cabinets is a small network. It has a controller, a radio or a cellular modem, often a local panel or a service port, and sometimes a switch that nobody remembers fitting. The fence around the works does not reach any of it. The padlock on the field cabinet is the perimeter, and the link inside it is the way in. That is the shape of the sector, and it is why we describe water and wastewater as a wide area rather than a plant.

How the links work

Three kinds of link are usual. Radio, licensed or unlicensed, often a point-to-multipoint network installed by the SCADA integrator and protected by a shared key, if by anything. Cellular modems, one per site, each with a SIM and an address on the carrier’s network that may or may not be private. Leased lines or fibre where the budget allowed, usually only to the largest sites.

The radio network was designed for reach and reliability, not for strangers. Any device with the right radio, the right channel and the shared key can join it, and the key is written in the integrator’s commissioning file. Cellular is worse in one specific way: a modem that was given a public address so the integrator could reach it from the office is reachable from everywhere else as well, and it answers whoever connects. Telemetry is the word for all of this, and it is worth remembering that the word only means measuring from a distance. Commanding from a distance came along for the ride.

Readings and commands on the same wire

The protocols that carry telemetry were written when the only thing on the wire was the utility’s own equipment. DNP3 is the most common in water, with Modbus and IEC 60870-5-104 close behind, and all three carry a read and a write in the same frame. The SCADA master polls an outstation for its readings, and in the same session it sends the command that starts the pump. The outstation does not ask who is sending.

In the form that most sites run them, these protocols have no authentication of their own. DNP3 has had a secure authentication option for years, defined in IEEE 1815, but it needs support at both ends and an upgrade to outstations that have run unchanged since commissioning, so the usual pattern is that it is not switched on. Modbus has no such option at all. The result is that being on the telemetry network is being in control of the district, and that single fact should shape how a water operator thinks about its perimeter.

On a telemetry network a reading and a command travel the same way. Whoever can hear one can send the other.

IEEE 1815 · DNP3, including the secure authentication option

What the head end shows

Every remote site’s traffic arrives at one place: the telemetry head end at the works, where the radio base station or the cellular aggregation router hands it to the SCADA server. A passive capture at that point hears every outstation without a visit to any of them. It is the one place where the whole district is on a single cable.

What it shows is concrete. Which outstations are polled and how often, which addresses they answer from, and which protocol and which function codes are in use, which tells the operator which sites are only read and which are written to. It shows the devices that talk on the telemetry network without being outstations: a service laptop, a modem’s management interface, an integrator’s remote session that was meant to be temporary. And it shows the traffic that leaves the telemetry network for the office, for billing, for a dashboard or for a vendor, which is the list of crossing points any segmentation design will need.

Listening changes nothing. A mirror port on the head-end switch is the usual arrangement, and no packet is sent to an RTU. For controllers that were commissioned long ago and have run since without a restart that is not a courtesy: an active scan can stop one. We listen first, and anything beyond listening waits for written authorisation and a named person from the operator beside us. The method is the same on every site; here it simply covers more ground.

Sample

What good looks like for a small team

A water operator’s security team is often the same two or three people who programme the RTUs and keep SCADA running, and any design has to fit them. Nothing that follows needs a round-the-clock watch.

First, a list: every remote site with its controller, its link, its address and whether it is ever written to. The passive capture produces most of it and the integrator’s commissioning records fill the gaps. Second, the telemetry network becomes a zone of its own, in the language of ISA/IEC 62443-3-2, with one conduit into SCADA and no other route toward the office. The head end is the natural place for that boundary, because the traffic already passes through it.

Third, the cellular modems lose their public addresses, through a private APN from the carrier or a VPN that terminates at the head end, so that a modem answers only to the works. Fourth, the integrator’s remote access becomes a brokered session: opened on request, time-boxed, logged and closed. Fifth, the capture is repeated, once or twice a year or after any integrator visit, to see whether the list still matches the district.

ISA/IEC 62443-3-2 · zones, conduits and risk assessment

None of this requires new RTUs. It puts the protection around equipment that cannot change rather than inside it, and it leaves the small team with a drawing of the district as it is and a short list of things to keep true. That is the whole aim: the network that exists, mapped before anything is changed, and changed only at the operator’s pace.

Sources · NIST SP 800-82 Rev. 3 (OT security, SCADA and distributed sites); ISA/IEC 62443-3-2 (zones and conduits); IEEE 1815 (DNP3).