SCADA, MES, Digital Twins & OT Cybersecurity

Who does what

ISA-95 sorts a plant’s systems into levels with different jobs and time scales ¹:

• Control (PLCs, drives, robot controllers): milliseconds. Runs the machine.
• Supervisory (HMI and SCADA): seconds. Shows operators what’s happening, raises alarms, lets them start and stop things, and feeds a historian that records values over time.
• Operations (MES): minutes to hours. Which work order is running, how many good parts, which material lot went into which part.
• Business (ERP): days. Orders, inventory, purchasing, costs.

The drill cell’s PLC knows a bracket was drilled. SCADA shows the count climbing and the alarm when the clamp fails. MES records that bracket 4,512 was drilled from steel lot 23-118 on work order 7731 at 10:42. ERP knows the customer order is 60% complete.

The rule from the first lesson holds: each level must keep working if the one above it fails. If MES goes down, the cell finishes parts and holds the records locally until it’s back.

Tags with context

A raw tag like N7:42 = 18.6 is useless six months later. The same value with context is data:

Synchronize every controller’s clock. Without it, the robot’s fault log and the PLC’s alarm log can’t be lined up to see which came first.

History that helps

Historians save space by recording values only when they change by more than a deadband, or by averaging. That’s fine for a tank level. It’s not fine for the drill spindle current: a bit that breaks shows as a spike lasting a fraction of a second, and a one-minute average smooths a 200 ms spike to almost nothing. For anything you’ll want to diagnose, log events (state changes, alarms, the first-out cause, commands and their proof) and peaks, with the part and work order they belong to.

A digital twin with one job

NIST describes a manufacturing digital twin as a virtual model kept in sync with a real machine and used to diagnose, predict, or optimize it, and stresses verification, validation, and uncertainty ². The useful ones start with one decision.

For the drill cell: when should the drill bit be changed? The twin takes spindle current and feed time for every hole, compares them with a model of how current rises as a bit dulls, and predicts how many holes are left. Before anyone trusts it:

• Validate it against real data: run bits to failure, record current, and check the predictions.
• State its uncertainty: “replace within the next 150 ± 40 holes.”
• Limit its authority: it recommends a bit change on the HMI; it doesn’t command the machine.

A 3D model that moves on screen is a visualization, not a twin.

Securing the plant

Operational technology runs physical equipment, so NIST’s guide puts safety, reliability, and availability ahead of everything else and warns that ordinary IT practices (patching on a schedule, scanning aggressively, forcing reboots) can disrupt a running process ³. The basics for a cell like this one:

• Know what you have. A list of every PLC, HMI, robot controller, drive, and switch, with firmware versions and who’s responsible.
• Separate the networks. Machines on a plant network; office computers on another; a DMZ in between holding the historian copy and anything the business side reads. No direct path from an office PC or the internet to a PLC.
• Control remote access. Vendors connect through one managed gateway, with individual accounts and multi-factor login, turned on only when needed.
• Back up and test. Keep a copy of every PLC and robot program, versioned, off the machine. Practice restoring one to a spare controller; an untested backup isn’t a backup.
• Change control. Every program change logged with who, when, what, and why. NIST’s manufacturing example builds in file-integrity checking and application allowlisting so unexpected changes are noticed ⁴.

Never run disruptive security tests on a live production line; use a spare controller or test bench.

Try it

Draw the drill cell’s data path from spindle current sensor to the ERP report. Mark each network boundary, what crosses it, and what happens at each level if the link above it goes down. Then write the validation plan for the bit-wear twin: how many bits, what you’d measure, and what accuracy you’d need before letting it schedule bit changes.