SCADA over 4G LTE: Designing a Reliable Monitoring Architecture for Remote Sites

· 9 min read
9 min read
Lucas Moreau
Lucas Moreau
OT/IT Network Engineer

Modern SCADA systems work perfectly well with LTE connectivity—provided the architecture is designed correctly. Here are the key factors to consider for reliable monitoring of your remote sites.

Why 4G LTE Is Suitable for Industrial Monitoring​

SCADA monitoring does not require high bandwidth. Refreshing 1,000 tags every 5 seconds uses less than 50 kbps of uplink bandwidth. Even degraded LTE networks (-100 dBm RSRP) can easily provide this throughput.

What matters for SCADA:

  • Latency: must remain < 200 ms for synchronous polling
  • Availability: 99.9% SLA = maximum 8 hours of downtime per year
  • Security: encrypted connection, authentication, no direct exposure to the Internet

LTE with Dual SIM failover meets all three of these criteria.

Critical Network Settings for SCADA​

LTE Latency vs. SCADA​

Typical LTE Cat 4 latency in France (measured in the field):
- Ping median        : 18–35 ms
- Ping 95e centile   : 55–90 ms
- Peak congestion: up to 200 ms in high-traffic areas during rush hour

For traditional SCADA protocols:

  • Modbus TCP: default timeout of 500 ms → widely compatible
  • OPC-UA: configurable session timeout, typically 30 seconds → OK
  • DNP3: designed for low-speed serial connections → perfectly suited
Strict Real-Time SCADA

If your application requires latency < 10 ms (process control, servo control), 4G LTE alone is not suitable. Use 4G for monitoring and maintenance, with local embedded logic (Edge PLC) for control loops.

Bandwidth: A Practical Calculation​

Polling every 5 seconds, 1,000 2-byte Modbus registers:
→ 2000 octets / 5s = 400 octets/s ≈ 3,2 kbps (remontant)
→ With TCP/IP overhead: ~8 kbps

Alarmes (bursty) :
→ 20 simultaneous alarms: ~1 kbps additional

Historical Context (5 min for 500 points):
→ 500 × 4 bytes × 12 per hour ≈ 3.3 kbps on average

Estimated total: < 15 kbps → compatible with any LTE network

Option A: Centralized SCADA with VPN​

Advantages: simple architecture; only one SCADA system to maintain.

Split-tunnel VPN configuration:

# VPN Routing (OpenVPN) — Only SCADA traffic passes through the tunnel
route 10.0.0.0 255.0.0.0          # internal SCADA network
route 192.168.50.0 255.255.255.0  # monitoring network
# 'redirect-gateway' disabled: the rest of the traffic (MAJ, NTP) goes directly over LTE

Option B: Edge computing + cloud monitoring​

Advantages: Maximum resilience. If LTE connectivity is lost, local operations continue (local alarms, control functions, buffered logs). As soon as the connection is restored, the buffered data is automatically uploaded.

Eziwan supports Edge Apps: lightweight Docker containers that run directly on the gateway, access the local RS485 bus, and publish data to the cloud when they reconnect.

Dual SIM: A Last Resort​

Dual SIM with automatic failover is key to an LTE SCADA SLA. Here's how Eziwan works:

Normal state: SIM1 (Orange) active, SIM2 (SFR) in standby mode
              RSRP SIM1 = -78 dBm, latence = 22 ms

Deterioration: RSRP SIM1 drops to -98 dBm
              3 pings watchdog KO sur 10 (8s)
              → Initiating the failover procedure

Switch: SIM2 SFR activated, new IP lease obtained
              Tunnel OpenVPN renégocié (< 2s)
              VPN restored: latency = 28 ms

Durée totale de l'interruption : < 30 secondes

For a SCADA system that polls every 5 seconds, a 30-second interval represents 6 missed cycles. Depending on the level of criticality, this may be acceptable (monitoring) or unacceptable (control).

Configuring SCADA Timeouts​

To avoid false positives and false alarms during an LTE failover, adjust your protocol timeouts:

ProtocolRecommended TimeoutRetries
Modbus TCP3,000 ms3
OPC-UASession keepalive: 30 sAuto
MQTTKeep-alive: 60 s, reconnect: 5 sAuto
DNP3Link timeout: 10 s3

Example: Monitoring a Pumping Station​

Architecture deployed across 35 drinking water pumping stations:

  • Hardware: Eziwan Gateway, 24V DC power supply, outdoor magnetic antenna
  • PLC connection: RS485 Modbus RTU to Schneider TM3 (22 registers)
  • Polling: every 30 seconds (pump status, pressure, flow rate, level)
  • Alerts: SMS + email within < 2 minutes in case of a fault (pressure out of range, pump failure)
  • VPN access: Technician accesses the TM3 via the SoMachine tool from their office
  • Data collection availability: 99.7% over 12 months

The 0.3% outage is due to scheduled maintenance on telecommunications towers.

Integration with Commercially Available SCADA Software​

Ignition (Inductive Automation) on LTE​

Ignition is particularly well-suited for monitoring over LTE thanks to its native "store-and-forward" architecture.

Recommended configuration:

Ignition Gateway (serveur central)
  └── Remote Agent → Site LTE (mode polling)
      ├── OPC-UA Client → Gateway Eziwan → PLC
      └── Session settings:
          Session timeout: 60,000 ms (60 s to handle an LTE failover)
          Keep-alive : 30 000 ms
          Max subscription delay : 5 000 ms

With Ignition's transaction history, data collected locally at the site is automatically synchronized when the connection is reestablished after an LTE failover—no data is lost during the SIM switchover.

AVEVA (formerly Wonderware) InTouch on LTE​

AVEVA InTouch, together with the DA Server (Device Access Server), communicates via SuiteLink or OPC-DA:

OPC-UA Configuration over 4G VPN:
  DA Server → OPC-UA Server → Eziwan Gateway → Modbus RTU
  
  Registry key to adjust:
  HKEY_LOCAL_MACHINE\SOFTWARE\Wonderware\DAServer
    RequestTimeout = 10000    (10 s vs. 3 s by default)
    RetryInterval = 5000      (5 s entre tentatives)

Note: SuiteLink is not designed for variable WAN connections. Use OPC-UA instead of SuiteLink for connections via LTE VPN.

Codesys Runtime with Remote Access​

For Codesys PLCs (Wago, Beckhoff, Phoenix Contact), the Codesys Gateway protocol supports connection via VPN:

TIA Portal / Codesys Engineering Tool
  → Eziwan VPN (active OpenVPN tunnel)
  → Eziwan Gateway (172.16.x.x, site VPN IP)
  → Codesys PLC (192.168.1.10, local IP address of the site)
  
  OPC-UA timeout to be configured: 30,000 ms
  Timeout Codesys Gateway : 20 000 ms

Offline Data Management: Store-and-Forward​

An LTE-based SCADA site must be designed to handle network outages. The golden rule: no data should be lost during a failover.

Protective layers:

1. Automate (PLC)
   └── Internal buffer: 100–1,000 values, depending on the model
       (S7-1500: 1,024 events in the history buffer)

2. Gateway Eziwan
   └── Local store-and-forward: data in flash memory
       Capacity: 72 hours to 24 hours, depending on the data volume
       Automatic Transmission Upon Reconnection

3. Broker MQTT (cloud)
   └── Session persistante (Clean Session = false)
       QoS 1 messages held during client disconnection

With this three-tier architecture, a 30-second LTE failover or a network outage lasting several hours results in no data loss—data is collected locally, buffered, and then transmitted as soon as connectivity is restored.

In Summary​

LTE is ideally suited for SCADA monitoring of remote sites:

  1. Calculate your bandwidth requirements—typically < 20 kbps
  2. Adjust your protocol timeouts to accommodate variable latencies
  3. Use Dual SIM to ensure availability
  4. Separate the control logic (local) from monitoring (cloud)
  5. Encrypt traffic systematically using OpenVPN/IPSec VPN

FAQ​

Can SCADA Ignition or Wonderware be used with Eziwan over LTE? Yes. These platforms communicate via OPC-UA or Modbus TCP—protocols natively supported by the Eziwan Gateway. The Eziwan VPN creates a transparent tunnel between the SCADA server and the remote site. LTE latency (20–60 ms) is well below OPC-UA timeouts and does not interfere with normal operation.

How much bandwidth should be allocated for real-time alarm transmission? SCADA alarms are short messages (a few dozen bytes) sent sporadically. Even an LTE network degraded to -105 dBm RSRP provides sufficient throughput for alarms. The critical bandwidth is that required for data polling: allow 1 to 10 kbps per site for standard polling (30 seconds to 5 seconds, depending on criticality).

How does Wonderware/AVEVA communicate over the VPN? The AVEVA InTouch or SCADA server on the central network connects to the private VPN IP address assigned to the remote site. For AVEVA, the SuiteLink or OPC-DA/UA protocol passes transparently through the VPN tunnel. No special configuration is required on the SCADA side—the VPN is invisible.

Does Dual SIM failover interrupt a current SCADA session? During the 10- to 30-second failover period, the TCP session is interrupted. Robust SCADA software (Ignition, AVEVA, CODESYS) automatically handles the reconnection. Set SCADA session timeouts to at least 60 seconds to accommodate an LTE failover without triggering an untimely connection loss alarm.

Is DNP3 supported on the Eziwan Gateway? DNP3 is supported on Eziwan models with extended firmware (water and energy sectors). Please check with our team to confirm compatibility for your gateway version. The Modbus RTU, Modbus TCP, MQTT, and OPC-UA protocols are available as standard on all gateways.

Further Reading​

See the Eziwan architecture in detail → · Discuss your SCADA project →

Additional Resources​