Solutions · Energy and manufacturing
Energy SCADA that has to be auditable
In energy the question is rarely "can you monitor it" — it is "can you prove who did what, and when". Bella SCADA ships with a hash-chained audit log, a permission catalogue and an IEC 62443-4-2 mapping.
In energy, the first technical meeting starts with security
On the substation, distribution and generation side, the first meeting usually opens with regulation rather than protocols. Turkey's energy control systems (EKS) information security regulation placed a compliance obligation on licence holders, and access control, log integrity and zone/conduit separation clauses now appear in specifications.
The second question is redundancy: what happens when the SCADA server goes down. The third is evidence: who issued the breaker-open command, at what time, under which permission.
Bella SCADA answers all three architecturally. The field side runs in a process (ScadaRuntime) separate from the web surface; the audit log is hash-chained, so altering an entry breaks the chain; and writes can require an electronic signature per tag or per operation — with a policy in place, an unsigned write is rejected.
The full mapping table and the open list of gaps we have not closed are on the security and compliance page. Items still open, such as the code-signing certificate, are written there rather than hidden.
Typical architecture
The field layer and the user layer are separate processes; the only path between them is an audited channel.
1 · Field
Protection relays and IEDs over IEC 61850 (MMS), telecontrol RTUs over IEC 60870-5-104, auxiliary systems and power meters over Modbus TCP.
2 · Runtime layer
Polling, alarm evaluation and buffering run in their own process. That split corresponds to the IEC 62443 zone-and-conduit model: the field loop keeps running even if the web interface goes down.
3 · Record and evidence
Hash-chained audit log, permission catalogue, 2FA, session lock, hashed API-key storage. Where a write policy exists, a request without a signature id is rejected with HTTP 428.
4 · Output
Control screens built in the editor, alarm history, load and voltage trends, scheduled report e-mails, and a REST API key for downstream systems.
Protocols used in this vertical
On the energy side the direction column matters: a protocol may read without being able to write. You can put this table straight into a specification comparison.
| Protocol | Typical device | Direction | Field validation |
|---|---|---|---|
| IEC 61850 (MMS) | Protection relays and IEDs | Read only — write not implemented | Not done |
| IEC 60870-5-104 | Telecontrol RTUs across distribution | Read + write (single/double command, set-point) | Not done |
| Modbus TCP | Power meters, generator controls, auxiliary systems | Read + write | Not done |
| OPC UA (client) | Third-party OPC UA servers | Read + write | Not done |
The IEC 61850 driver cannot issue commands today; a write request returns an error. If relay control is mandatory in your specification we say so up front — write support is on the roadmap. The drivers are verified by build and simulation tests; none has yet been tested against real field hardware. We say this at quotation stage: the first task in a pilot is a connection test against your own device. The current matrix lives on the protocols page.
What ships in the box
Control screen
A process or single-line view built in the editor. Access is granted per screen: a monitoring-only user cannot open the control screen.
Alarms and events
Active alarms by priority, acknowledge and shelve, alarm history, and ISA-18.2 indicators: flood detection, chattering-alarm suppression, bad-actor ranking.
Audit log and signature ledger
Who wrote which value and when. Electronic signatures are kept in their own append-only ledger, and signature-gated operations reference it.
Trends and reports
Historical charts; alarm history and trend reports as Excel or PDF on a schedule. There is no free-form report designer.
Recommended package
Critical Plant — everything in Plant plus hot-standby redundancy, the OPC UA server, UNS / Sparkplug B publishing, the electronic signature policy, the IEC 62443 compliance dossier and a priority SLA. The price band is on the pricing page.
For manufacturing installations that do not need redundancy, Plant is enough; signature policy and the audit log work there too.
Source code escrow can be arranged separately for public sector and critical infrastructure projects.
Frequently asked
Can you send a breaker-open command over IEC 61850?
No. The IEC 61850 driver reads only today; a write request returns an error. If control is required, it is solved either through IEC 60870-5-104 or by developing write support. We say this in the first meeting because if it is mandatory in your specification, it changes scope.
Are you IEC 62443 certified?
No certificate. What we have is a compliance mapping and evidence table prepared against the IEC 62443-4-2 SL-2 target. The open gaps are written in the same document — the code-signing certificate, for instance, has not been purchased yet. We offer an evidence table instead of a certification claim.
If the server goes down, does monitoring stop?
With hot-standby enabled a second node takes over leadership, elected through an atomic Redis lease. Honest caveat: that scenario has not been run in the field with two physical nodes, so we do not commit to a measured takeover time. We suggest measuring it together during the pilot.
How do we prove an operator change in an audit?
The audit log is hash-chained: each entry carries the digest of the previous one, so a later edit breaks the chain. Where a signature policy is bound to a write, the ledger also holds user, reason and timestamp. Exporting to a central WORM store is not implemented yet.
Can we push our data into another system (MES, ERP, a historian archive)?
Yes: read through the REST API key, expose tags as variable nodes through the OPC UA server, or publish over UNS/MQTT and Sparkplug B. The last three ship disabled and none has been validated against a real external client or broker — they are tested against your client during commissioning.
Ask for the compliance dossier
We share our IEC 62443-4-2 mapping together with the list of gaps we have not closed. Let us walk your specification's security clauses against it.