SCADA Network Topologies: Control Centre LAN, Site Networks and WAN Telemetry Designs
On this page
A SCADA system uses several networks, each with its own topology: a local network in the control centre, networks inside larger sites, and a wide-area telemetry network that links the sites to the centre. Choosing the topology for each is a trade-off between availability, cost, distance and what the communication media allow. A topology that is ideal on a plant floor, such as a fibre ring, may be impossible across a hundred kilometres of countryside.
For the communication media and protocols (radio, cellular, satellite, DNP3, IEC 60870-5-104), see SCADA Telemetry Communications.
Basic topologies
| Topology | Structure | Strengths | Weaknesses |
|---|---|---|---|
| Point-to-point | One dedicated link per site | Simple, predictable, no sharing | Many links to manage; no redundancy unless doubled |
| Star (hub and spoke) | All sites or devices connect to a central point | Easy to manage and troubleshoot | The hub is a single point of failure unless redundant |
| Bus / multi-drop | Many devices share one medium (for example RS-485, a radio channel) | Cheap, few links | Shared bandwidth; one fault can affect all; polling delays grow with device count |
| Ring | Devices connected in a loop | Survives one break (with a redundancy protocol) | Two breaks isolate a segment; needs ring protocol support |
| Mesh | Multiple paths between nodes | Most resilient; self-healing (radio mesh) | More complex, harder to predict latency |
| Hybrid | Combinations of the above | Fits large, mixed systems | Needs careful documentation |
Control centre network
The control centre network connects SCADA servers, front-end communication servers, operator clients, historian and engineering stations.
- A redundant star with two independent switch sets (network A and network B) is common: servers and critical clients have a connection to each.
- Separate VLANs or physical segments for the SCADA servers, operator clients and management traffic.
- A firewall and industrial DMZ between the SCADA network and corporate networks. See OT Network Design Fundamentals.
- A backup control centre connects over its own links, with replication between the centres.
Site networks
Larger sites (treatment works, compressor stations, substations) have their own networks:
- Rings of managed industrial switches using MRP, RSTP or vendor ring protocols, so a single cable break does not stop communication.
- PRP or HSR (zero-recovery-time redundancy) in some substations using IEC 61850.
- Small sites often have just an RTU or PLC with a router or radio: effectively a star to the centre.
See DCS Network Topologies and Redundancy Protocols for MRP, RSTP, PRP and HSR in more detail.
WAN telemetry topologies
| Topology | Typical use | Notes |
|---|---|---|
| Point-to-point (leased line, fibre pair, licensed microwave) | Critical sites, backbone links | Predictable; cost rises with distance |
| Point-to-multipoint radio | Water and pipeline networks: one base station, many remote radios | Shared channel; polling or exception reporting must fit the bandwidth |
| Multi-drop serial | Legacy RTUs on a shared line or radio channel | Common in older systems; slow |
| Radio mesh | Areas without clear line of sight to a base station | Sites relay for each other; plan latency and hop count |
| Hub-and-spoke IP (cellular or private network with VPN) | Modern systems with many small sites | Centre acts as VPN concentrator; carrier network in between |
| Fibre ring | Utilities with their own fibre along pipelines, roads or power lines | High bandwidth and redundancy |
| Satellite star | Very remote sites | High latency; cost per data volume |
Redundancy and path diversity
For critical sites, a single link is a single point of failure. Options:
- Two different media, for example fibre or licensed radio as the primary path and cellular as the backup.
- Two carriers for cellular backup, where coverage allows.
- Diverse routes so that one construction accident does not cut both cables.
- Automatic failover at the router, with SCADA alarms when the site runs on the backup path.
Match redundancy to site criticality: a large pumping station supplying a city justifies it, a single monitoring point usually does not.
Choosing a topology
| Question | Implication |
|---|---|
| How many sites and how far apart? | Few, near: point-to-point or ring. Many, spread: radio point-to-multipoint or cellular hub-and-spoke |
| How much data and how fast? | Report by exception reduces bandwidth needs; video or large files need broadband links |
| What availability is needed per site? | Critical sites get redundant paths; others accept outages with local control and buffering |
| What does the utility own? | Own fibre or radio gives control; carrier services reduce capital cost but add dependency and lifecycle risks (for example network sunsets) |
| What will it cost over its life? | Include licences, carrier fees, maintenance and replacement cycles |
Design rules
- Keep real-time control local at each site; the WAN carries supervision, not control loops.
- Document every link: media, bandwidth, latency, owner and backup path.
- Size polling and exception reporting to the slowest shared link.
- Monitor the network itself: link quality, signal strength, latency and failover events appear as SCADA points.
- Protect the WAN as a conduit: encryption or VPNs, firewalls at both ends, no direct internet exposure. See ISA/IEC 62443.
- Plan for technology sunsets (for example retirement of 2G and 3G cellular) years ahead.
Troubleshooting network topology problems
| Symptom | Likely cause | First check |
|---|---|---|
| Many sites fail together | Shared element down: base station, VPN concentrator, carrier, hub switch | Common path of the failing sites |
| Slow updates on a radio channel | Too many sites or too much data on a shared channel | Poll cycle time; move to exception reporting; add a channel |
| Intermittent site drop-outs | Weak radio or cellular signal, interference | Signal strength and link error statistics |
| Ring network recovers slowly | Wrong ring protocol configuration, unmanaged switch in the ring | Ring manager status; switch configuration |
| Site on backup path unnoticed | No alarm on failover | Add router status points to SCADA |
Frequently asked questions
Which network topology is best for SCADA?
It depends on the level. Control centres typically use redundant star networks, larger sites use rings, and the WAN is often point-to-multipoint radio or hub-and-spoke IP over cellular or private networks, with redundant paths for critical sites.
What is point-to-multipoint radio in SCADA?
A design in which one base station communicates with many remote site radios on a shared channel. It is common in water and pipeline SCADA; the shared bandwidth limits how much data each site can send.
How do you make SCADA communication redundant?
Use a second path over different media or carriers, diverse routes, automatic failover and alarms on failover, and keep local control and event buffering at each site in case both paths fail.
Key takeaways
- SCADA uses different topologies in the control centre, at sites and across the WAN.
- Redundant stars in the centre and rings at sites are common; the WAN depends on distance and media.
- Give critical sites diverse, monitored backup paths; accept simpler links elsewhere with local control.
- Keep control local and protect the telemetry network as a security conduit.
Related tutorials
Before you apply this in a plant: this article is for education. Always check the current edition of the relevant standards, the manufacturer's documentation for your exact product and version, and your site's procedures. Safety-related work needs qualified personnel. See our editorial policy.