SCADA over MPLS, SDH or Radio: Choosing a Network for Remote Sites

What SCADA traffic actually needs

SCADA protocols such as Modbus, DNP3 and IEC 60870-5-104 carry small messages, and polling generally tolerates delay measured in tens or hundreds of milliseconds. On its own, SCADA is an undemanding passenger. What makes a network hard to design is everything riding with it:

• Teleprotection. Line differential protection needs low, stable delay, with matched send and receive paths.
• Voice and CCTV. Voice needs low jitter and video needs bandwidth.
• Legacy interfaces. Serial links, E1 and other TDM circuits need timing and often need emulation on packet networks.
• Engineering and remote access, which is a security concern as much as a capacity one.

That is why we start network design from the traffic, as described in our guide to SCADA communication networks for remote sites.

The options at a glance

SDH: what it still does well

SDH gives each service a dedicated, fixed-rate channel, so there is no queueing and no variation in delay. Its protection schemes are mature: SNCP and MSP 1+1 restore traffic in about 50 ms, fast enough that SCADA polling and most voice calls ride through unnoticed. TDM interfaces are native, and hybrid multiplexers let new Ethernet services and old low-speed interfaces share one platform. Our metro railway project used an STM-16 SDH backbone to carry SCADA, CCTV, passenger information and legacy telephony on a single converged platform. The case study has the details.

The weakness is that fixed-rate channels waste capacity on bursty Ethernet traffic, and equipment support, spares and skills are shrinking in many markets. Public-carrier TDM leased lines are also being withdrawn in many countries, so check what is available to you. If your SDH network works and has headroom, there is rarely a reason to replace it for its own sake. Replace it when support, spares, skills or capacity force the issue.

IP/MPLS: one network for many services

IP/MPLS forwards traffic along labelled paths. It lets one network carry many services, keeps them apart with Layer 2 and Layer 3 VPNs, and prioritises them with quality of service. Traffic engineering and fast reroute (RSVP-TE, RFC 4090) can restore service in tens of milliseconds in a well-designed network. MPLS-TP, the transport profile, adds connection-oriented operation and management that SDH operators will recognise.

Two areas need care when SCADA moves onto a packet network:

• Legacy interfaces. E1 and serial circuits ride over packets using circuit emulation (SAToP, CESoPSN). That needs accurate clock distribution, using Synchronous Ethernet or IEEE 1588 precision time protocol, and a plan for how long the legacy interfaces must live.
• Teleprotection. The channel must have low, stable delay, and the send and receive paths must match. Co-route the forward and return directions, prioritise the traffic, measure delay and asymmetry, and test under fault conditions, not only in normal operation.

Radio and microwave: when there is no fibre

Pipelines and remote assets often run where no telecommunications backbone exists. At Karbala Refinery we built the network from UHF/VHF radio links and microwave backhaul so every measurement point had a low-latency path to the control room. Radio is also a sensible second path for a fibre route, because it fails in different ways. Choose the technology from distance, line of sight, capacity and availability, and allow for fade margin and licensing early in the project.

Satellite and cellular links reach sites that radio cannot, but latency, shared capacity and carrier dependence make them better suited to backup and non-critical sites than to protection or fast control.

A VPN is not a security design

MPLS VPNs keep services logically separate. They do not encrypt traffic, and they do not make a network secure on their own. Treat security as a separate part of the design:

• Group assets into zones and control the paths between them, as described in ISA/IEC 62443.
• Keep protection and control traffic apart from general traffic.
• Restrict remote access, and log it.
• Encrypt across links you do not fully control, such as leased circuits and radio.

Our communication systems page shows how zones and conduits are applied to an operational network.

Questions that decide the choice

• What do you already own, and who can run it? A working SDH network and a team that knows it is an asset. A new packet platform needs people who can operate it.
• Which services have strict timing? Teleprotection and legacy TDM set the hardest requirements.
• How many legacy interfaces remain, and for how long?
• How fast is IP traffic growing? CCTV and new digital services tend to favour packet.
• Is fibre available to every site? Where it is not, radio is the plan, not the exception.
• Who owns the network? A private network and a carrier service with a service level agreement carry very different risks.
• What happens when a fibre is cut? Physical path diversity matters more than the technology label.

Migrating without risking the process

Moving from SDH to packet is usually a staged migration, not a switch-over:

• Run the new network in parallel with the old one.
• Move non-critical services first and learn from them.
• Keep teleprotection and critical control on the existing network until delay and asymmetry have been measured on the new one, including during fault conditions.
• Test protection switching on the live design, and keep a way back until the new network has proved itself.
• Train operators on the new management tools before cut-over, not after.

If you are planning a network for remote sites, our team can help from design through commissioning, including remotely. See our communication systems page or get in touch.

Frequently asked questions