Updating a supervisory control and data acquisition (SCADA) system has its benefits, but it can be risky, especially with critical infrastructure or in industries where downtime is rare because of cost or safety issues.
Likewise, if any part of a facility’s critical infrastructure is outdated or obsolete, including the SCADA system, industrial PCs, the operating systems, the control software, human-machine interfaces (HMIs) or programmable logic controllers (PLCs), this poses business and operational risks.
The risks include compatibility issues and cybersecurity threats; plus, maintaining and supporting old systems can be difficult.
System integrator George T. Hall has assisted on many SCADA system upgrades, including a recent project with a gold mining company to reduce risk and downtime during modernization. The company is also a member of the Control System Integrators Association.
George T. Hall identified many of the risks to running an outdated SCADA system:
• Old and new compatibility—An old PC will eventually need to be replaced with a newer PC, and, the older the PC, the more you may experience compatibility issues between old and new. You may be able to create workarounds in your operating system to fix compatibility issues, but your software may still not be able to run as intended.
• Piecemeal system updates—Instead of a full modernization, companies may be inclined to do one-off updates and repairs to the SCADA system as components break one by one. If the legacy industrial PC using older communication ports and protocols goes down, facilities have two options: track down an older PC with the same outdated communication infrastructure or purchase a new computer and adapter and converters to communicate between the outdated hardware and the new computer. It is often more expensive to buy older parts than it is to buy new, if they are available at all; and a cobbled-together system gets complex quickly. Both options may face communication issues between older PCs and the newer SCADA system hardware or newer PCs and older SCADA system hardware.
• Operating system updates/patches—If a facility is running an older operating system (OS), that OS vendor will eventually stop supporting with updates and patches. Without critical security updates, the plant floor or enterprise network can be exposed to cybersecurity risks.
• Changing workforce—As operators, plant engineers and maintenance staff retire, it could become increasingly difficult to find new workers who understand how to operate and maintain an aging SCADA system.
Three more reasons to upgrade outdated SCADA systems include the following:
• Time and cost—An outdated SCADA system will cost more to run: more maintenance issues and more time finding the right resources to address the problem. Vendors may no longer support legacy software or components, or new engineers and maintenance personnel often need to spend time learning old SCADA software. In addition, this can all add to the time it takes to troubleshoot problems.
• Productivity—Old SCADA systems have productivity issues. Older PCs cannot consistently connect to industrial networks, or, if they can, they may be opening the industrial system to many cyber risks. Without a continuous connection, the PC cannot communicate real-time production data. If you want to optimize motor control throughout the plant with variable frequency drives, it may be difficult to do with outdated SCADA systems with older protocols and ports.
• Backups and security issues—Older PCs may also have issues performing backups, which can be catastrophic if the system goes down. Old legacy SCADA systems may have a hard time communicating with other OT and enterprise systems, or, if they do connect with a SCADA system that includes an unsupported OS, the PC can no longer receive critical security updates from the vendor. A single outdated PC/OS could expose the entire OT network.
