10 | <strong>Texas</strong> WET May 2009WET Tech Talk Continued from page 8fail-over capabilities were built into the systemdesign. During this phase, the new DRC systemwas also evaluated against other existing andplanned SCADA and communications systems todetermine its appropriate switch over and recoveryprocedures.• l Development/Acquisition Phase. During thedesign phase significant emphasis was given to theredundancy and robustness <strong>of</strong> the DRC systemarchitecture to optimize reliability, maintainability,and availability during the operation/maintenancephase. By incorporating those factors into theearly stages <strong>of</strong> the DRC design, implementationcosts were reduced and issues relating to futureplanned system upgrades were dealt with as well.Continuous data replication and mirroring wasplanned to take place to ensure that the DRCwas ready to take over when needed. DRC datacommunication system reliability and availabilitywere one <strong>of</strong> the major concerns during thedesign phase, as the City wastewater SCADAcommunications components, services and pathshad to be carefully examined. SCADA power supplysystems (regular feed and UPS) had to be reviewedand appropriately sized for load balancing.l Implementation Phase. The City WastewaterSCADA DRC system implementation was plannedto be accomplished in two steps. The initialimplementation phase included the installation <strong>of</strong>the DRC with new and upgraded communicationcomponents but utilized mostly spare CitySCADA equipment currently installed at variouswastewater treatment plants. By doing so, theinitial cost <strong>of</strong> the DRC was reduced substantiallywhen the target <strong>of</strong> fully tested and operationalDRC were achieved. The second and final DRCimplementation phase included the replacement <strong>of</strong>the outdated wastewater SCADA system hardwareand s<strong>of</strong>tware, and the addition <strong>of</strong> networksecurity devices and s<strong>of</strong>tware. Test proceduresand forms were developed to ensure that the DRCcontingency plan technical features and recoveryprocedures are fully functional and respond tothe City requirements. Once the DRC system wastested and approved for operation, the developedprocedures were documented and distributed tothe dedicated DRC team.l Operation/Maintenance Phase. Duringthe operational phase, the City DRC team,administrators, and managers are required tomaintain training and awareness <strong>of</strong> the DRCplan procedures. The SCADA team exercises andperiodically tests the system to ensure that thesystem functions per the DRC procedures. It isalso the DRC team’s responsibility to update theprocedures and DRC documentation to reflectchanges based on hardware or s<strong>of</strong>tware changesbut also on lessons learned.l Disposal Phase. As the City DRC projectwas carried out in two consecutive steps,considerations were given to the process <strong>of</strong> retiringthe currently installed computer system and theinstallation <strong>of</strong> the system replacing it.Conduct Business Impact AnalysisThe BIA objective is to verify the City wastewaterSCADA system components with the critical servicesthat they provide, and based on that information,to determine the impact and consequences <strong>of</strong> thedisruption <strong>of</strong> that system in case <strong>of</strong> a component failure.The results from the BIA analysis were then incorporatedinto the development <strong>of</strong> the COOP and the DRC designand implementation.The City SCADA system is very complex. The systemmonitors and controls a large number <strong>of</strong> wastewaterfacilities dispersed over a large geographic area, withnumerous components, interfaces, and processes. Thefirst step taken to evaluate the SCADA system was todetermine the critical functions performed by the systemand to identify the specific system resources required toperform them.The City and Engineer’s DRC team had identifiedand coordinated with the City and AT&T personnel thesystem dependency on various communications links,and external support in case <strong>of</strong> disruption Continued and the on need page 12to switch over to the DRC. This coordination suppliedthe DRC design team with the needed information tocharacterize the full range <strong>of</strong> support provided by thesystem, including security, managerial, technical, andoperational requirements.While performing the Business Impact Analysis,the DRC team followed the contingency plan policyrequiring the City wastewater SCADA system to berecovered immediately (within 15 minutes, but notmore than 8 hours in case <strong>of</strong> a major catastrophe). Bydocumenting and reviewing the recovery strategies, theDRC design team could make well informed, tailoreddecisions regarding contingency resource allocations andexpenditures, saving time, effort, and costs. Based on theBIA, it was defined that:l The DRC system is to have all the functionality<strong>of</strong> the existing SCADA system, excluding thebackup redundancy, and to have at the minimum,necessary hardware, s<strong>of</strong>tware and communicationequipment to access the current WWTPs and fieldsites.l The DRC system is to be designed based on thecurrent SCADA system, including the necessaryhardware, s<strong>of</strong>tware and configuration for a fullyfunctional and operational system. To save the Citycost, it was decided that several <strong>of</strong> the currentlyinstalled but not used servers be utilized for theDRC, following a hardware upgrade. Databasetags and graphic screens were to be identical toboth sites, when new LCD wide display screens will
May 2009 <strong>Texas</strong> WET | 11be installed at the DRC to complete mirroring <strong>of</strong>the SCADA control system.l It is anticipated that during normal operation,database values collected by the system willbe exported to the DRC via the existing Citycommunication system, and will be stored at thelocal DRC servers as well for future use.l In the case <strong>of</strong> a SCADA system failure, the switchoverto the DRC is to be performed manually byAT&T or by the dedicated City DRC designatedand authorized personnel utilizing the suppliedNetwork Management Console / Workstationwith the appropriate s<strong>of</strong>tware, for communicationsystem configuration, testing and switch-overcapabilities.l Per the developed BIA it was also defined that theswitchover is not to be considered “hot transfer”however AT&T is guaranteeing that such transferwill take place within 15 minutes but not morethan 1 to 8 hours in a worst case scenario.l The SCADA communication and WAN/LANhardware components were also upgraded perthe BIA, in a manner to make the communicationsystem compatible with the DRC-AT&Tcommunication system.Develop Recovery Strategy and Operation ProceduresRecovery strategies provide the required means torestore the SCADA operations quickly and effectivelyfollowing a service disruption, in the allowable outagetimes identified in the BIA. Several alternatives wereconsidered when developing the City wastewater SCADAstrategy, including cost, allowable outage time, andrequired systems’ security, but initially without theintegration with the larger, City- level contingency plans.The selected DRC strategy addressed the potentialimpacts identified in the BIA and therefore wasintegrated into the system architecture during the designand implementation phases <strong>of</strong> the system life cycle.The DRC design included a combination <strong>of</strong> methodsto provide wastewater SCADA monitoring and controlrecovery capabilities over a full spectrum <strong>of</strong> incidents.One <strong>of</strong> the major tasks was to select the <strong>of</strong>fsite DRCfacility, where the following criteria were considered:l Geographic Area: Distance from the City SCADAcenter mainly trying to avoid the probability <strong>of</strong>the DRC site being affected by the same disaster(flood, terrorist attack, long term power orcommunication outage).l Accessibility: Length <strong>of</strong> time necessary to have theDRC operating team access this facility, have thecommunications switched over to DRC, and havethe DRC facility fully operational.l Security: Security capabilities <strong>of</strong> the designatedDRC facility and employee confidentiality, whichmust meet the data’s sensitivity and securityrequirements.l <strong>Environment</strong>: Structural and environmentalconditions <strong>of</strong> the DRC facility (i.e., temperature,humidity, fire prevention, and power managementcontrols).l Cost: Design, construction, and operation andmaintenance costs to have the disaster responseand recovery services.Searching for the appropriate site to support the DRCsystem operations as defined in the plan and followingthe BIA, several site types were studied during the DRCdesign:l Cold Sites typically consist <strong>of</strong> a facility withadequate space and infrastructure (electricpower, telecommunications connections, andenvironmental controls) to support the SCADAsystem. The space may have raised floors and otherattributes suited for computer operations. This sitedoes not contain SCADA equipment and usuallydoes not contain <strong>of</strong>fice automation equipment,such as telephones, facsimile machines, or copiers.Should the cold site alternative be selected, the Cityhas to provide and install the necessary SCADAequipment and telecommunications capabilities.l Warm Sites are partially equipped <strong>of</strong>fice spacesthat contain some or all <strong>of</strong> the system hardware,s<strong>of</strong>tware, telecommunications, and power sources.The warm site is maintained in an operationalstatus ready to receive the relocated SCADA DRC<strong>Texas</strong> Ad:Layout 1 12/9/08 1:37 PM Page 1Continued on page 12