What Is an ICS? PLCs, RTUs, HMIs, SCADA and DCS in Plain Language
Industrial control systems come with an alphabet soup of acronyms that can make a simple conversation feel like a foreign language. If you're a plant manager, an IT manager who has inherited OT, or an executive trying to follow a security briefing, you don't need to know how to program a controller. You do need to know what each piece does and why it matters.
What "ICS" actually means
An industrial control system (ICS) is the collection of hardware, software and networks that monitors and controls a physical process. That process might be refining crude oil, moving gas through a pipeline, generating electricity, treating drinking water or running a packaging line. ICS is often used interchangeably with operational technology (OT), although OT is the broader term and covers any technology that interacts with the physical world.
Every ICS, whatever the industry, does the same basic things: it measures what's happening, decides what to do, acts on the process, and shows people what's going on.
Field devices: the eyes and hands
At the bottom of every control system are field devices. These are the instruments and actuators that touch the physical process:
Sensors and transmitters measure pressure, temperature, flow, level, vibration and more
Actuators such as valves, motors, pumps and variable frequency drives make physical changes
Analyzers measure composition or quality, such as gas chromatographs or water quality probes
Older field devices send simple analogue signals, often 4–20 mA. Newer ones use digital fieldbus or Ethernet-based protocols and may hold their own configuration and diagnostics.
Controllers: PLCs, RTUs and DCS
PLC
A programmable logic controller (PLC) is a rugged industrial computer that reads inputs from field devices, runs control logic, and writes outputs back to them, over and over, often many times per second. PLCs were originally built to replace banks of relays in manufacturing, and they're now everywhere: compressor stations, conveyor lines, wellsites, pump stations and packaging machines.
RTU
A remote terminal unit (RTU) does a similar job but is built for remote, spread-out sites. RTUs are common in pipelines, electric distribution, water networks and oil and gas fields. They're typically hardened for harsh conditions, can run on limited power, and communicate back to a central control room over radio, cellular, satellite or leased lines. The line between PLCs and RTUs has blurred over the years, as many devices can now do both jobs.
DCS
A distributed control system (DCS) is an integrated system from a single vendor, used to run large continuous processes such as refineries, chemical plants, power stations and oil sands facilities. Rather than many separate controllers stitched together, a DCS ties controllers, operator stations, alarms and configuration tools into one tightly coupled platform, usually within a single site.
SCADA and the HMI: where people meet the process
Supervisory control and data acquisition (SCADA) refers to systems that gather data from many controllers and RTUs, often spread over large geographic areas, and let operators supervise and control them from a central location. A pipeline company might use SCADA to watch hundreds of kilometres of line and dozens of stations from one control centre.
The human-machine interface (HMI) is the screen operators actually look at: graphics showing tanks, valves, pumps and trends, along with alarms and buttons to start, stop or adjust equipment. An HMI can be a panel mounted on a machine, a desktop operator station in a control room or a screen in a SCADA control centre.
The difference between SCADA and DCS is mostly about scope and geography. SCADA usually supervises widely spread assets over long-distance communications; a DCS usually controls a process within one facility. In practice, many organizations run both.
Supporting systems you should know
A few other components show up in almost every ICS, and they're often where security conversations focus:
Historian. A database that records process values over time, such as temperatures, flows and alarms. Historians feed reports, troubleshooting and business analytics, which is why they often sit at the boundary between the control network and the business network.
Programming workstation. Sometimes called a configuration workstation, this is the computer controls staff use to write and download PLC logic, configure DCS controllers and update HMI graphics. Because it can change how the process behaves, it's one of the most sensitive assets on the network.
Safety instrumented system (SIS). An independent system whose only job is to bring the process to a safe state when something goes dangerously wrong, such as closing a valve or tripping a compressor on high pressure. An SIS is kept separate from the basic control system so that a fault or compromise in one doesn't disable the other.
Communications equipment. Switches, routers, firewalls, radios and serial converters that connect everything together.
How the pieces fit together
Picture a gas compressor station. Transmitters measure suction and discharge pressure. A PLC reads those values and adjusts the compressor speed. An SIS watches the same pressures independently and will shut the unit down if limits are exceeded. A local HMI lets a technician see the station's status, while an RTU or the PLC itself reports back to a SCADA system in a control centre far away. A historian records everything, and the business network pulls summaries from it for production reporting. When logic needs to change, controls staff connect a programming workstation to the PLC.
Each connection in that chain is a path that needs to be understood and protected.
Key takeaways
An ICS measures, decides, acts and displays, using field devices, controllers and operator interfaces.
PLCs, RTUs and DCS controllers run the process; SCADA and HMIs let people supervise it.
Historians and programming workstations are high-value assets because they bridge networks or can change logic.
Safety instrumented systems are independent protection layers and deserve their own careful treatment.
How QBits Networks can help
You can't protect what you can't see, and many organizations don't have an accurate picture of the controllers, HMIs and workstations on their control networks. An OT visibility snapshot uses a time-boxed passive capture from a SPAN or mirror port to build that picture without touching the process. Tell us what you need through our contact page and we'll scope it with you.