SCADA, PLCs, DCS, HMIs and RTUs explained
In short: Industrial control systems are built from a few key parts. PLCs and RTUs run control logic close to the equipment, SCADA and DCS supervise whole processes, HMIs let operators see and act, and historians store the data. Each part has its own security weak spots, especially engineering workstations and remote links.
The building blocks
Industrial control systems (ICS) look complicated, but most are assembled from the same few components. Knowing what each does helps you understand both how a plant runs and where an attacker might try to interfere.
| Component | What it does | Example |
|---|---|---|
| PLC (programmable logic controller) | A rugged computer that reads sensors, runs control logic and drives outputs in real time | Starting a conveyor when a box breaks a light beam |
| RTU (remote terminal unit) | A field device for remote sites that gathers data and executes commands over long-distance links | A pumping station reporting levels to a water utility |
| DCS (distributed control system) | An integrated, vendor-supplied control system for one large continuous process at a single site | A refinery or power station unit |
| SCADA | Supervisory software that collects data from many, often widely spread, sites and sends set points and commands | Monitoring a gas pipeline or power grid |
| HMI (human-machine interface) | Screens that show the process and let operators acknowledge alarms and change set points | A touch panel next to a packing machine |
| Historian | A database optimised for time-series process data | Storing tank temperatures every second for years |
| Engineering workstation | The PC with vendor software used to program and configure PLCs and other controllers | Downloading new logic to a PLC |
How a PLC works
A PLC runs a simple loop called the scan cycle. It takes a snapshot of all inputs, runs the user program against that snapshot, writes the results to outputs, handles communication, and repeats. Programs are written in languages defined by IEC 61131-3, such as ladder diagram (which looks like electrical relay drawings), function block diagram and structured text. A safety PLC or SIS is a separate, certified controller whose only job is to bring the process to a safe state when something goes wrong.
SCADA and DCS
The line between SCADA and DCS has blurred, but a useful distinction remains. SCADA supervises geographically spread assets over slower, sometimes unreliable links such as radio or cellular, so local devices handle most control themselves. A DCS controls a single site with fast, reliable networks and tight integration between controllers and operator stations, usually from one vendor.
Security weak spots
- Engineering workstations are high-value targets: whoever controls one can change PLC logic. Keep them in their own zone, harden them, and allow programming only from them.
- Controllers trust the network. Many PLCs accept program changes and commands from anyone who can reach them, because older protocols have no authentication. Use the controller's key switch or software protection settings where available.
- HMIs often run older Windows versions that cannot be updated easily. Use application allow-listing and remove internet access.
- Remote sites with RTUs may use cellular routers exposed to the internet. Use private APNs or VPNs and strong authentication.
- Historians connect to both OT and IT, so place a replica in the DMZ rather than opening paths inward.
Tip: back up PLC programs and configuration regularly and store a known-good copy offline. If logic is changed maliciously or by accident, you can compare and restore quickly.
Practice
What are the main steps of a PLC scan cycle?
When would you choose SCADA rather than a DCS?
Why is an engineering workstation a prime target?
Key takeaways
- PLCs and RTUs run control logic close to the equipment.
- SCADA supervises spread-out sites; a DCS controls one large process.
- HMIs serve operators; historians store time-series data.
- Engineering workstations can reprogram controllers, so protect them closely.
- Back up controller logic and keep a known-good offline copy.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.