Raylux Insights

Why Every Raylux Driver Is in the Base License

2026-10-05T00:00:00Z

We get asked, fairly, why the Raylux base license includes every driver and OPC UA when conventional SCADA pricing sells connectivity piece by piece. This post is the answer: what "included" means, what we charge for instead, and where the limits are.

What "included" means

The Base Gateway is $995, perpetual. It includes:

Every native driver: Allen-Bradley over EtherNet/IP, Siemens S7, Modbus TCP and RTU, AutomationDirect CLICK, Omron FINS, DNP3 and BACnet/IP. None is sold separately.
OPC UA as both a client and a server. There is no OPC server to license alongside the gateway.
Unlimited tags, devices and users.
Studio for every engineer, free, on as many machines as they like.
Alarm evaluation, the alarm journal and the audit trail.

The compatibility page lists every driver by device family, and each one is in every license. If your device is not on the list, the gateway reads anything that offers Modbus or an OPC UA server. If it offers neither, ask us and we will say so, as the page does.

Two things are not in the base license, and we would rather you read them here than discover them on a quote. Operator screens are the Spectrum module. Tag history is the historian module. The gateway records history either way, so licensing the historian later brings the whole archive with it instead of starting empty.

MQTT and Sparkplug B are planned, not shipped. They are on the roadmap with no date, and nothing here depends on them.

Why connecting to the plant is not where the charge sits

The pricing page puts it in one sentence: connecting to your plant is included, and you pay for what you do with it.

The base license is connectivity: drivers, OPC UA client and server, scripting and security. Screens are bought on top, as a module. That split is deliberate, and it means the base price buys nothing an operator sees. What it buys is a gateway that reads your devices, runs your logic, evaluates alarms and records an audit trail.

Per-engineer charges get the same treatment. Paying per designer seat is a tax on the people building the system, so Studio is free and unlimited. The same goes for per-protocol charges. A plant that speaks five protocols should not be penalized for the number of brands it was built from.

What we do charge for

Operator clients

The one metered axis is concurrent operator clients: Spectrum sessions in a browser, on a phone or tablet, and Lens panels. The Spectrum module is $1,950 with two clients included. Beyond two, each client is $195, up to nine.

The count is how many screens are open at once, not how many people have logins. A plant with forty operators across three shifts and six terminals needs six clients. Studio, the configuration console and your own REST and WebSocket clients are not counted.

Past nine you buy capacity instead of counting: $2,450 for up to 10, $4,950 for up to 25, $7,500 for unlimited. The price steps up at ten clients on purpose, so you can stop counting seats once you have a lot of them. The two included clients sit in the Spectrum module because a client is a Spectrum session. Two clients on a gateway that could not serve a screen would mean nothing.

One limit worth knowing: if the client limit is reached, the new session is refused and the message says which limit was hit. An established operator screen is never dropped for a licensing reason.

Add-ons

Priced separately, and shipping today:

Historian, $1,750, unlimited tags and connections.
Reporting, $1,950.
Alarm notification, $995 with email, then $495 for SMS and $495 for voice calls. All three together are $1,795.

The Support Plan

Optional, 20% of license value a year, which is $199 for a base gateway alone. Every license includes email support with no expiry. The plan adds a next-business-day response, a phone line during business hours, and generation upgrades. Let it lapse and the license keeps working.

We chose 20% because it is the industry norm, so you can compare it with what you already pay without doing arithmetic. It also scales with what you bought, so a single skid is not charged like a plant.

We are a small team, and the plan reflects that. Next business day is what we can keep. Four-hour, 24/7 and same-day cover are not offered, and there is no 3 a.m. number yet. If your plant needs that, tell us before you buy and we will say whether Raylux fits. A bug that affects a running plant is fixed and shipped to everyone, plan or no plan.

Edge

The Edge Panel ($995) and Edge skid ($495) are fixed packages for one machine: 45 days of history retained on the machine, and for the panel, three concurrent clients. They are a fixed scope, not a smaller product, and they do not take add-ons. The same contents bought as modules come to $4,695, so the scope cap is what the lower price pays for.

Why the prices are published

Every price is on the pricing page, with the modules broken out and a configurator that quotes your actual plant, including the cost over five or ten years against what you pay now. The comparison page lists the nine things a conventional stack bills for that we do not, without naming any vendor. You can work out the total yourself, before you talk to us.

What a perpetual license means for a running gateway

You buy the version you install and keep running it. There is no renewal that switches the plant off.

Updates within a generation are yours: a license entitles every release inside its platform generation, so a patch never forces you forward. Crossing a generation is an upgrade, free with the Support Plan and paid without it. And a license is a signed file, not a phone-home check, so a gateway on an isolated network activates and stays activated with no route to the internet.

Check it yourself

The downloads page has the installer, and the trial unlocks every driver, every module, unlimited tags and clients for two hours, restartable as often as you like. Point it at the PLC on your bench and read a tag before you decide anything.

Frequently asked questions

Is there a per-driver or per-tag charge in Raylux?

No. Every driver is in the base license and none is sold separately, and tags, devices, users and Studio engineers are unlimited. The metered item is concurrent operator clients.

Do I need a separate OPC server with Raylux?

No. OPC UA is built into the gateway as both a client and a server, so there is no OPC server to license alongside it.

What happens to a running gateway if I never buy the Support Plan?

It keeps running. The license is perpetual, and the plan is optional. Without it you have email support with no response commitment, updates within your generation, and no phone line. Crossing a generation is a paid upgrade.

What Does SCADA Software Cost? Licensing Explained

2026-10-05T00:00:00Z

SCADA software is priced by what the vendor counts, and that decides the total more than the list price does. Tags, operator clients, drivers, servers and modules each get charged differently, so two quotes with the same headline figure can describe very different systems.

This post is for whoever is comparing quotes: a plant or utility manager, or an integrator specifying for a client. The one question is what you are actually paying for, and how to line two quotes up so the comparison means something. If you are still getting oriented, what SCADA is covers the parts and how they fit.

The license metric decides the price

Every vendor picks something to count. The list price only means something once you know what is being counted and how many of it you have. These models all exist in the market, and a single quote often combines several.

Tags or I/O points

You buy a band: a few hundred tags, a few thousand, tens of thousands. It is easy to start small, and every time the plant grows past a band edge the price steps up. Find out what counts as a tag (a raw device address, an alarm, a calculated value, a history point) because definitions differ.

Concurrent clients or seats

You pay for operator screens. A concurrent model counts how many are open at the same moment, so forty operators on three shifts at six terminals need six. A named model counts people or machines that are allowed to log in. Ask whether phones, tablets and wall displays count as clients.

Devices or drivers

Some vendors charge per protocol, per device, or per connected controller. A plant with one PLC brand pays little and a plant with five brands pays more. This is where a missing driver turns into a surprise, so ask for every protocol your equipment speaks to be priced explicitly.

Servers and gateways

One license per server, per gateway or per site. This is simple to read. It matters when you need a second server for a remote site, a test system or a hot standby, so ask whether those are licensed again.

Functional modules

The base is priced low and the historian, alarm notification, reporting, a mobile client or a scripting layer are added one by one. Each can be reasonable alone. The sum is what you compare.

Engineering or development seats

Some vendors charge for each person who builds screens and logic. The charge looks small until a contractor, a second engineer and a laptop for the field are all involved.

Perpetual versus subscription

A perpetual license is bought once. The software you bought keeps running, and an optional annual plan covers support and, often, new versions. A subscription is paid every year for as long as you use the product.

The difference shows up on a timeline:

	Perpetual	Subscription
Year 1	The largest payment	A smaller payment
Year 5	Little or nothing beyond an optional support plan	Five annual payments made
If you stop paying	The software keeps running, and support or upgrades lapse	The license usually ends, so check what the system does

A subscription spreads the cost and can include upgrades, which suits some budgets. A perpetual license turns the cost into a one-time purchase, which suits others. What separates them is the last row: what does the running plant do on the day the payment does not arrive? Get the answer in writing, and ask it for the system as it will be after a power cut and a restart.

Support and upgrade plans

With a perpetual license the annual plan is usually a share of the license value, charged every year. Because it scales with what you bought, a small system pays a small amount. Before you accept the percentage, ask three things:

What lapses if I do not renew: support only, new versions, or the license itself?
Does the plan include moving to the next major version, or is that a separate purchase?
What is the response commitment, and who answers: an engineer, or a ticket queue?

Ask for the plan's yearly cost as a number on the quote. A percentage on its own makes the comparison harder.

Costs outside the software quote

The software line is rarely the whole project. Count these separately, because they can sit with a different party.

Databases and operating systems. Some stacks need a database server license for history, or a specific server OS, and that is a separate purchase. Ask what the historian stores to and whether a license is needed.
Server hardware. One or more servers, plus storage sized for the history you intend to keep.
Redundancy. A second server or gateway, with the license terms that come with it.
Integration labor. Building screens, tags, alarms and reports, then commissioning and testing. On many projects this is the largest line.
Training. Operators and maintenance staff both, and the time it takes them.

If a quote lists only the software, you have one line of the budget. Ask the integrator or vendor for the rest as estimates, even rough ones.

How to compare two quotes

Price the system you will have in five years

A quote built for day one is easy to win and easy to regret. Write down what the plant will probably look like in five years: more tags, more operators, another protocol, a historian you do not need yet. Price both vendors for that system.

Ask what growth costs

Put specific additions to each vendor and ask for a number:

What does it cost to add 500 tags?
What does it cost to add two more operator screens?
What does it cost to add one more protocol?
What does a second server for standby or a remote site cost?

The answers show you where the metric bites. Some additions are free on one quote and a line item on the other.

Put the support plan in as a number

Add the yearly support cost for each year you are comparing. Then decide whether you would actually buy it every year, and compare against that.

Questions to ask every vendor

What do you count? Tags, clients, drivers, servers, modules, engineers: say which of them meters my plant.
What does it cost to add 500 tags, two screens, one protocol? Get each as a figure.
Perpetual or subscription, and what does the plant do if I stop paying? In writing.
What does the support plan cost per year, and what lapses without it? Support, upgrades, or the license.
Is a major-version upgrade included, or priced separately?
Do I need a database or OS license from someone else?
Are test, standby and remote-site systems licensed again?
Is every protocol I use included, and what does one that is not cost?
What is the activation model? A file on the machine, or a check against a server.
Are engineers and designers charged?

Frequently asked questions

Is SCADA software priced per tag?

Sometimes. Per-tag or per-I/O-point bands are one common model, and in that model the band decides the price. Others charge per operator client, per server, per driver or by subscription, and many mix two or three of these. Ask which one meters your plant.

Is perpetual or subscription SCADA cheaper?

It depends on the horizon. A perpetual license costs more in year one and then mostly stops, apart from an optional support plan. A subscription costs less up front and is paid every year, so over five or ten years the totals can cross. Price both for the same number of years.

What happens to my SCADA if I stop paying?

Under a subscription, the license normally ends and the system stops or goes read-only, so check the terms. Under a perpetual license the software you bought keeps running, and what lapses is usually support, updates, or both. Ask the vendor in writing which one applies.

How much of a SCADA project is the software?

It varies by project, and there is no honest single figure. Integration labor is often the largest line, and hardware, database and OS licenses, redundancy and training add to it. Ask for the software quote and an estimate of the rest separately.

One worked example: a published price list

Raylux publishes its price list, so it makes a plain example of the models above. Every figure here is on the pricing page, where a configurator quotes a plant.

The license is perpetual. The $995 Base Gateway includes all eight protocols, OPC UA as both client and server, and unlimited tags, devices and engineering seats. What Raylux does meter is concurrent operator clients. The Spectrum HMI module is $1,950 with two clients included, then $195 for each client up to nine, with capacity tiers beyond that. Two screens with the gateway come to $2,945. The historian is $1,750, and reporting and alarm notification are priced add-ons.

The optional Support Plan is 20% of license value a year, which is $199 a year for a base gateway alone. If it lapses, the license keeps working. What you lose is the response commitment, the phone line and upgrades across a generation. Updates within a generation come with the license either way.

The comparison page lists, item by item, how this differs from a conventional stack, without naming any vendor. Whatever you are comparing, the method above works on it: price your five-year plant, ask what growth costs, and get the support plan as a number.

OPC UA vs Modbus: When to Use Which

2026-10-05T00:00:00Z

Modbus gives you numbered registers and nothing else. OPC UA gives you named, typed values with a timestamp, a quality code and security attached. Modbus is the easier protocol to start with and OPC UA is the richer one, and a lot of plants use both.

If you manage a plant or buy systems rather than configure them, the question is usually "what will we be able to trust, and what will it cost to set up?" The sections below answer both. Engineers can skip to the table.

What Modbus gives you

Modbus exposes a device as four tables of numbered coils and registers. Reading holding register 100 returns a 16-bit number. The protocol does not say what that number means: not the tag name, the engineering unit, the scale factor, or whether it is a signed integer, half of a 32-bit float or a bit field. That lives in the device's manual, and someone has to copy it into the SCADA configuration by hand. The details of the two Modbus variants are in Modbus TCP vs RTU.

There is also no timestamp and no quality. A register that returns 0 might mean zero flow or a dead sensor, and the protocol cannot tell you which. Data moves by polling: the client asks every cycle, whether or not anything changed. And there is no security. Anyone who can reach the device can read and write it.

In return, Modbus is nearly universal. Drives, power meters, flow computers, temperature controllers and a long tail of third-party equipment speak it, on serial or Ethernet. A device can be reading in minutes with a register map and a cable.

What OPC UA gives you

OPC UA is a family of specifications standardized as IEC 62541. Where Modbus gives you a table, OPC UA gives you an address space: a browsable tree of nodes with names, data types and relationships. A client can connect, browse to Pumps/P101/Discharge Pressure, see that it is a floating-point value in a stated unit, and read it without a register map.

Four things set it apart:

Subscriptions. A client creates monitored items, and the server reports a value when it changes by more than a deadband or at a set interval. The client does not poll. Traffic follows the process instead of the clock, which matters on slow or metered links.
Timestamp and status on every value. Each value arrives with a source timestamp and a status code, so a bad sensor reads as bad, not as a plausible zero.
Security built in. Applications identify themselves with certificates. Messages can be signed, or signed and encrypted, under a named security policy, and users can authenticate with a username and password or a certificate.
Structure. Nodes can be grouped into objects with typed members, such as a pump with a status, a speed and a fault flag, so a client can read a whole object and not scattered registers.

The default port for the opc.tcp protocol is 4840, though a server can use any port and publishes its endpoint URL.

The cost is setup

OPC UA takes more steps to set up than Modbus. Server and client each hold a certificate, and each side has to trust the other's before the connection is accepted. The endpoint's URL, security policy and security mode must match what both sides support. User credentials, firewall rules for the port and clock accuracy (certificates have validity dates) all need attention. A small device needs more memory and processing to host a server. That is why you meet OPC UA on newer controllers and gateways, and rarely on a 15-year-old power meter.

Side by side

	Modbus	OPC UA
Data model	Numbered coils and registers	Browsable address space of named, typed nodes
Names, types, units	Not in the protocol	In the address space
How data moves	Client polls	Subscriptions report on change, or polling
Timestamp and quality	None	On every value
Security	None	Certificates, signing, encryption, user authentication
Transport	Serial (RTU) or Ethernet (TCP, port 502)	Ethernet (opc.tcp, default port 4840)
Standard	Modbus Organization specifications	IEC 62541
Setup effort	Low: addresses and a cable	Higher: certificates, endpoints, security policy
Device support	Very wide, including old equipment	Newer controllers, gateways and software servers

When Modbus is the right choice

Simple devices. Drives, power meters, temperature controllers and similar devices expose a few dozen registers. The overhead of a full information model buys little.
Serial links. RS-485 trunks run Modbus RTU. OPC UA does not run on a serial line.
Legacy equipment. If the device is already installed and only speaks Modbus, that settles it.
A network you control. On an isolated segment with a firewall in front, the lack of security is a lower risk, though it is still a risk.

When OPC UA is the right choice

PLC to SCADA with structured data. If the controller has a tag structure, an OPC UA server lets the SCADA system browse it instead of retyping every address.
Crossing network zones. When data has to pass between a control network and a business network, you want authentication and encryption on the link. IEC 62443 is the series of standards most security programs follow for this.
System to system. Connecting a SCADA server to a historian, an MES or another SCADA system is easier when both sides share one vendor-neutral standard.
Anything where quality matters. If the receiving side must know whether a value is good, stale or substituted, quality codes and timestamps are the answer.

They are not rivals at the device level

The choice is rarely one or the other across a whole plant. A common shape is a gateway that polls a set of Modbus devices on the plant floor and serves the same values upward as OPC UA nodes. The devices stay simple, and everything above the gateway gets names, types, timestamps, quality and security. The gateway carries the work of mapping register 40001 to Pumps/P101/Discharge Pressure, with a scale factor, once, in one place.

If you build this, check two things. First, the quality the gateway reports. If a Modbus device stops answering, the OPC UA value should go bad and not hold the last number as good. Second, the polling rate: subscriptions make the upstream side efficient, but the gateway still polls the Modbus devices, and on a serial trunk the baud rate sets how fast.

For where both fit in a larger system, see What is SCADA?.

Where Raylux fits

Raylux's gateway, Nexus, is both an OPC UA client and an OPC UA server, and OPC UA and the Modbus drivers are included in the base license with no per-driver charge. See the OPC UA and Modbus compatibility pages and the Nexus page.

Frequently asked questions

Is OPC UA better than Modbus?

It carries more: names, data types, timestamps, quality and security. That does not make it the better choice for every link. Modbus is simpler, runs on almost every device, and is easy to troubleshoot. OPC UA fits best where the receiving system needs structured data, security or change-based reporting.

Can OPC UA replace Modbus?

At the system level it often does. At the device level it usually does not, because many meters, drives and small controllers only speak Modbus. A common design has a gateway that polls those devices over Modbus and offers the same values upward over OPC UA.

What port does OPC UA use?

The default port for the opc.tcp protocol is 4840. A server can listen on any port, so the endpoint URL in the server's settings is the real answer. Modbus TCP uses port 502.

Is OPC UA secure by default?

It has security built in: application certificates, message signing and encryption, and user authentication. A server can also offer an endpoint with no security at all, which is easy to leave switched on during testing. Check which security policy and mode each endpoint uses.

Do I need OPC UA to use Modbus data in SCADA?

No. A SCADA driver can read Modbus devices directly. OPC UA becomes useful when a second system also needs those values, or when the link crosses a network boundary where you want encryption and authentication.

Modbus TCP vs RTU: What Changes and What Breaks

2026-10-05T00:00:00Z

Modbus TCP and Modbus RTU speak the same language and differ in how the words are packaged and carried. The data model and function codes are shared. The wrapper and the wire are not, and most trouble when moving between them comes from that gap.

For a plant manager or integrator, the short version: RTU runs on a twisted-pair serial cable and TCP runs on Ethernet. Both read and write the same numbered registers. Pick by what the device has on its back, then read on for the places where people lose an afternoon.

Two documents define the details: the MODBUS Application Protocol Specification V1.1b3 (requests and data model) and the MODBUS over Serial Line Specification and Implementation Guide V1.02 (RTU framing and RS-485 wiring).

What is the same

Modbus keeps data in four tables:

Table	Access	Typical use	Read	Write
Coils	Bit, read/write	Outputs, run commands	FC 01	FC 05, FC 15
Discrete inputs	Bit, read only	Status contacts	FC 02	none
Input registers	16-bit, read only	Measurements	FC 04	none
Holding registers	16-bit, read/write	Setpoints, configuration	FC 03	FC 06, FC 16

FC 05 and 06 write one coil or register; FC 15 and 16 write many. A register map in a drive manual works the same on either variant. Nothing in the table says what a register means: names, scaling, units and data types live in the device manual, not on the wire.

What changes on the wire

Modbus RTU

RTU is serial, most often two-wire RS-485. One client (the master in older documents) polls up to 247 servers (slaves), each with a unit ID from 1 to 247. Address 0 is a broadcast that nobody answers.

A frame is binary: unit ID, function code, data, then a CRC-16. There are no start or end markers. The receiver finds frame boundaries by silence: at least 3.5 character times between frames. A gap longer than 1.5 character times inside a frame makes the receiver discard it, which is why a cheap USB adapter that stalls mid-frame produces CRC errors.

Every node must share baud rate, parity and stop bits. The serial line specification recommends even parity with one stop bit (two stop bits with no parity), 8 data bits, an 11-bit character either way.

RS-485 has a physical side too. Wire one daisy-chained trunk, not a star. Put a 120 ohm termination resistor at each end of the trunk and nowhere else. Add bias resistors, usually at one point, so the line has a defined state when nobody is transmitting.

Modbus TCP

TCP runs over Ethernet, normally on port 502. The unit ID and CRC are replaced by the seven-byte MBAP header: a transaction ID (2 bytes) to match answers to requests, a protocol ID (2 bytes, always 0), a length (2 bytes) and a unit ID (1 byte). The same function code and data follow. No CRC is needed, because TCP has its own checksum. Several clients can talk to one server at once, which RTU cannot do: two masters on one RS-485 trunk collide.

The unit ID matters again behind a gateway. The gateway has Ethernet facing you and RS-485 facing a string of serial devices, and it uses the unit ID in your request to pick which serial device gets the message. Many native TCP devices ignore the unit ID or want a fixed value such as 1 or 255. Check the manual.

The trap: Modbus RTU over TCP

Many serial device servers tunnel a serial port through a TCP socket. Often the result is raw RTU frames, unit ID and CRC included, inside TCP. People call it Modbus RTU over TCP, and it is not Modbus TCP: there is no MBAP header. A driver set to Modbus TCP gets silence or an unreadable answer from a tunnel expecting RTU, and the reverse is just as broken. A converter setting such as "Modbus TCP to RTU gateway" versus "transparent serial tunnel" decides which driver you need.

Addressing traps shared by both

Reference numbers vs protocol addresses

Documentation often lists holding register 40001. The protocol counts from zero inside each table, so 40001 is address 0 on the wire. The leading 4 only names the table: 0xxxx coils, 1xxxx discrete inputs, 3xxxx input registers, 4xxxx holding registers. Five-digit notation runs out at 9999, so larger devices use six digits (400001).

Tools disagree on whether they subtract the one for you. If your driver returns the neighbor's value, shift the start address by one and see whether the data lines up.

Values that span registers

A 32-bit integer or float takes two registers, and vendors disagree on which comes first. The float 1.0 is 0x3F800000. A device may send 3F80 then 0000 (big-endian word order) or 0000 then 3F80 (little-endian). Byte order within each word can differ too, giving four combinations. If a temperature reads 2.3e-41, suspect word order.

Request size

One FC03 or FC04 read returns at most 125 registers, because the response must fit in a frame of 256 bytes on RTU or 260 on TCP. FC01 and FC02 allow up to 2000 bits, and FC16 writes up to 123 registers. Many devices set lower limits of their own.

Timing

Serial: the baud rate sets the ceiling

An RTU character is 11 bits, so at 9600 baud it takes about 1.15 ms. Take a request for 10 holding registers: 8 bytes out (ID, FC, start, quantity, CRC) and 25 bytes back (5 of overhead plus 20 of data). That is 33 bytes, 363 bits, about 38 ms at 9600 baud. Add two 3.5 character gaps (about 4 ms each) and the device's turnaround, often 5 to 20 ms, and one poll takes 50 to 65 ms. Ten such devices make a scan of 0.5 to 0.65 seconds before any retry. A timeout on a missing node adds a second or more per cycle, so one dead device slows the line.

TCP: different limits

Small devices often accept only a few simultaneous connections, sometimes one, so a second client, or a restarted driver that has not closed its old socket, gets refused. Set sensible timeouts and reuse one connection. Behind a gateway, the serial side is still the bottleneck: a fast Ethernet link in front of a 9600 baud trunk does not speed the devices up, and many gateways serialize requests from all clients.

Security

Neither version authenticates or encrypts. Any node that can reach a device can read it and, with a write function, change it. That is a network design problem: isolate the devices, put a firewall in front, allow only known clients. The Modbus Organization publishes a Modbus/TCP Security specification that runs the protocol over TLS. Check a device's manual before assuming it supports it.

Which one to use

RTU when the device only has a serial port, the run is long and noisy (about 1000 m at 9600 baud per the serial line guide), or you have a bus of simple meters.
TCP when the device has Ethernet, more than one system must read it, or you poll many devices quickly.
A gateway for a serial trunk of older devices on an Ethernet network. Know whether it converts protocols or tunnels raw serial.

When a new device will not answer

Work down this list; the cheapest causes come first.

Match the transport. Modbus TCP, RTU, or RTU over TCP? Match the driver.
Check the physical layer. Serial: A and B wires (swap them if nothing answers), ground, termination, bias. Ethernet: can you ping it, and is port 502 open?
Match serial settings. Baud, parity, stop bits and data bits, on both ends. Nothing auto-negotiates.
Check the unit ID. The right number for a serial device, and the right value (often 1 or 255, or ignored) for a native TCP one.
Read something simple. One holding register the manual lists, FC03, count 1. Try address 0 and 1 for the off-by-one.
Check the table and limits. The value may be in input registers (FC04); lower the count per request.
Look at the traffic. A serial analyser or packet capture shows whether the request arrives and whether the device returns an exception code (01 illegal function, 02 illegal address, 03 illegal value, 04 device failure).

Where Raylux fits

Raylux's Nexus gateway has drivers for Modbus TCP and Modbus over a serial line, with unit ID, word order and byte order set per device. See the Modbus compatibility page and the full driver list. To weigh Modbus against OPC UA, read OPC UA vs Modbus; for the bigger picture, What is SCADA?.

Frequently asked questions

What is the difference between Modbus TCP and Modbus RTU?

They carry the same requests and the same function codes. RTU sends them over a serial line, usually RS-485, in a binary frame that ends with a CRC-16. TCP sends them over Ethernet on port 502, with a seven-byte MBAP header in front and no CRC, because TCP already checks the data.

Is Modbus RTU over TCP the same as Modbus TCP?

No. Modbus RTU over TCP puts raw RTU frames, address and CRC included, inside a TCP connection. Modbus TCP uses the MBAP header instead. The two look alike in a device menu but differ on the wire, and a driver set to one gets no useful answer from the other.

Why is Modbus holding register 40001 address 0?

The 4xxxx numbers are a reference convention that adds a table prefix. The protocol counts from zero inside each table, so the first holding register is address 0. Some tools subtract the one for you and some do not, which is the usual cause of values that are off by one register.

How many registers can I read in one Modbus request?

Up to 125 holding or input registers in a single FC03 or FC04 request, a limit set by the size of the response frame. A device may allow fewer, so check its manual. A 32-bit value takes two registers.

Is Modbus secure?

Not by itself. Neither Modbus TCP nor RTU authenticates the sender or encrypts anything, so any node that can reach the device can read and write it. Protection comes from network design: isolation, firewalls and access control. The Modbus Organization also publishes a Modbus/TCP Security specification that wraps the protocol in TLS.

What Is SCADA? How It Works, Parts and Costs

2026-10-02T00:00:00Z

SCADA stands for Supervisory Control And Data Acquisition. It is software that collects data from PLCs and other field devices across a plant or a wide area, shows it to operators, raises alarms, records history and lets people send commands back.

Think of a water utility with a dozen pump stations spread across a county. Each station has its own controller that runs the pumps. SCADA is how one person in one room sees all twelve, hears about a problem within seconds, looks at last Tuesday's flow, and starts a pump from a chair.

How a SCADA system works

Every SCADA system has the same shape, whatever the brand. Sensors and actuators sit at the bottom. Above them, controllers read the sensors and run the logic that keeps the process going. A network carries values from the controllers to a server, and the server turns raw values into screens, alarms and history.

Two things about this stack are worth knowing.

The controllers do the controlling

A PLC keeps running its logic whether or not the SCADA server is up. SCADA is supervisory: it watches, records and sends commands such as a setpoint change or a start request. If the server reboots, the process does not stop. This is a design rule worth testing on any system you buy.

The server talks to devices in their own language

A driver for each protocol reads registers or tags from the controller on a schedule, or receives reports the controller sends on its own. The server turns those into named values and passes them on to everything else.

The parts of a SCADA system

HMI screens

The screens are what operators see: a process graphic with live values, a pump with a color that shows if it is running, a button to start it. Good screens keep the normal state plain and make abnormal states easy to spot. A bright screen full of moving color tires people out and hides the one thing that matters.

Alarms

An alarm tells an operator that something needs attention now. The system watches a tag against a limit or a state, raises the alarm, keeps it on a list until someone acknowledges it, and logs who did and when. An alarm system turns annoying when alarms are not held to a rule: every alarm should need a response, have a priority and have a known action.

The reference standard is ANSI/ISA-18.2, Management of Alarm Systems for the Process Industries, which is aligned with IEC 62682. It describes an alarm life cycle: write a philosophy, rationalize each alarm, set priorities, then measure and improve. Features such as shelving (silencing one alarm for a set time, with a record) and alarm-rate reports are how a SCADA product supports it.

Historian and trends

The historian stores tag values over time so you can plot them. A trend is the plot. The questions it answers are the ones people ask after something goes wrong: what was the tank level in the hour before the overflow, and when did the pressure start to drift? Most historians store a value when it changes by more than a set amount, or on a fixed interval, to keep the data compact.

Reports

Reports turn history into documents: daily runtime and flow totals, a monthly summary for a regulator, a shift log. They are usually scheduled and sent as PDF or email. If a compliance report matters to your plant, ask any vendor to produce your real one during the demo.

Users and audit

Each person should have their own login and only the rights they need: an operator can acknowledge alarms, a technician can change setpoints, an engineer can edit screens. An audit trail records who changed what and when. After an incident, that record is the quickest way to find out what happened.

SCADA vs HMI vs PLC vs DCS

These four terms get mixed up constantly, but they do different jobs.

Term	What it is	Scope	Runs the process?
PLC	A rugged controller that reads inputs and runs logic in a fast scan	One machine or process area	Yes
HMI	A screen for operating a machine or area	One machine or one panel	No
SCADA	Software that supervises many controllers, with screens, alarms and history	A plant, or many sites	No, it supervises
DCS	An integrated control and operator system for a continuous process	One large plant	Yes

PLC

A programmable logic controller is a small industrial computer that reads inputs, runs your logic every few milliseconds and writes outputs. It is built for reliability and for predictable timing. Logic is usually written in ladder or structured text, per IEC 61131-3. A PLC has no screen of its own beyond what you attach.

HMI

A human-machine interface is the operator's window into a controller: a touchscreen on a machine, or a screen on a PC. An HMI shows values and sends commands, and it usually talks to one controller or a few.

SCADA

SCADA sits above the controllers. It collects from many of them, often from several vendors, stores history, manages alarms and users centrally, and serves screens to many operators. Its HMI part is only one piece.

DCS

A distributed control system is sold as one package: controllers, I/O, network, operator stations and engineering tools designed together. It has traditionally been the choice for continuous processes such as refining, chemicals and large power plants, where the control itself is the main product.

The lines blur. A large panel HMI can log history and raise alarms. A modern SCADA platform can run control scripts and serve a whole plant. A DCS can supervise remote sites. When a vendor says "SCADA" or "DCS," ask what it does in your project, and ignore the label.

Common SCADA protocols

A protocol is the language a controller speaks over the network. A SCADA server needs a driver for each one in your plant. These are the ones you will meet most.

Modbus TCP and Modbus RTU. A simple register-based protocol dating from 1979. RTU runs over serial lines such as RS-485, and TCP runs over Ethernet. You see it on meters, drives, small PLCs and a great deal of third-party equipment. It has no built-in security.
EtherNet/IP. The Rockwell Automation and ODVA protocol, built on the Common Industrial Protocol (CIP). It is how most SCADA systems read ControlLogix and CompactLogix PLCs, often by tag name.
OPC UA. A vendor-neutral standard that carries data and its description, with encryption and certificates built in. You see it as the common bridge between products from different vendors, and in newer controllers that include an OPC UA server.
DNP3. Common in water, wastewater and electric utilities. It was designed for remote sites on slow or unreliable links, and it can send timestamped events, so a breaker trip is recorded at the time it happened, not at the time it was polled.
S7. The protocol used to reach Siemens S7-300, S7-400, S7-1200 and S7-1500 controllers. Newer models need access settings enabled in the PLC before an outside system can read them.
BACnet. The standard for building automation: air handlers, chillers, boilers and VAV boxes. BACnet/IP runs over ordinary Ethernet.

If your equipment speaks something else, there is usually an OPC UA server or a gateway that converts it. Check the driver list before you buy, since a missing driver can cost more than the software.

Where SCADA is used

It is used anywhere something has to be watched and controlled from a distance, or from one place for many things. Five common settings:

Water and wastewater

A lift station pumps sewage from a low point to the next stage. Level sensors in the wet well start and stop pumps in a lead and lag order. SCADA shows the level, counts pump runtime, and alarms on high level or a failed pump, so a crew can get there before the well overflows. The station reports over radio or cellular to a central server.

Food and dairy

A dairy barn's ventilation needs fans staged by temperature and air speed so cows stay comfortable, and a failed fan matters on a hot day. SCADA runs the staging setpoints, shows each fan row, records temperatures and sends a text if the barn gets too warm. In processing, the same system records the temperatures and times that auditors ask for.

Oil and gas

A pipeline pump station is often unmanned and hours from the office. An RTU or small controller reads pressures, flows and motor status. SCADA polls it over radio, satellite or cellular, alerts on a pressure excursion and lets a controller in an office start or stop a unit.

Power

A substation has breakers, transformers and protective relays that report status, and a trip must be logged to the millisecond. SCADA gives the operator a one-line view of the network and a sequence of events after a fault. DNP3 is the common link.

Building systems

A campus has air handlers, chillers and boilers from several vendors on BACnet. SCADA gives facilities staff one set of screens, an alarm list and energy trends, so a stuck valve shows up as a trend and not as a complaint.

What SCADA costs and how it is licensed

Price depends mostly on how the vendor counts. The common models (the SCADA software cost post goes deeper):

Per tag. You buy a tag count, such as 500, 1,500 or 5,000. It is easy to start small, and cost rises as the plant grows.
Per client or seat. You pay for each operator screen, either concurrent (at the same time) or named (a specific person or machine).
Per server or per site. One license covers a server and whatever connects to it.
Per driver or module. The base is priced low and each protocol, historian or reporting feature is added on.
Subscription or perpetual. A subscription is paid every year and ends if you stop. A perpetual license is bought once and usually has an optional annual support or update plan.

Whichever model you compare, price your own plant: your tags, your operators, your drivers, your historian and five years of support. Also ask what happens if you grow, and what happens if you stop paying.

Raylux sells it this way. The gateway is a perpetual license at $995, with every driver included and unlimited tags. Operator screens and the historian are modules you add when you need them. The details are on the pricing page.

How to choose a SCADA system

Use this list when you compare products. Each item has caused real trouble when skipped.

Drivers for your PLCs. Confirm every protocol and model you have is supported natively, and find out what a missing one costs.
Historian. Check where the data is stored, how long it is kept, how it is queried and whether you need a separate database server.
Alarm handling. Look for priorities, acknowledgment, shelving, an alarm history and a way to report alarm rates, in line with ISA-18.2.
Security and audit. Look for individual logins, role-based rights, encrypted connections and an audit log of changes and commands.
Licensing model. Work out the total for your tag count, clients and years, and note what is metered.
Offline and edge. Ask what happens when the link to the server is lost. A site should keep running and keep logging.
Lock-in. Check that you can export your tags, screens and history in open formats, and that screens run in a browser rather than needing an installed client.
Support. Find out who answers the phone, how fast, and whether you can reach an engineer and not just a ticket queue.

Frequently asked questions

Is SCADA the same as an HMI?

No. An HMI is the screen an operator looks at. SCADA is the larger system behind it: the data collection, alarms, history and commands, plus the screens. Every SCADA system has HMI screens, but an HMI on a single machine is not SCADA.

Do I need SCADA if I already have a PLC?

Not always. A PLC runs the control logic by itself, and a small panel on the machine is often all one machine needs. You start to need SCADA when you want one view of several PLCs or sites, alarm history, trends over months, remote access, or records for audits.

What is a historian?

A historian is the part of a SCADA system that stores tag values over time, each with a timestamp and a quality flag, so you can trend them and report on them later. It is usually a time-series store built to take many writes per second and keep years of data compactly.

Is SCADA secure?

It can be, depending on how it is deployed. Protocols such as Modbus have no authentication at all, so the network design has to do the work: keep control networks off the public internet, separate them with firewalls, give every person their own login with only the rights they need, use encrypted connections such as OPC UA with security or HTTPS, patch the servers, and keep an audit log. IEC 62443 is the standard most programs follow.

Can SCADA run on a Raspberry Pi or an ARM panel?

In general, yes if the software is built for it. SCADA gateways need modest CPU and memory, and many run on ARM64 Linux. It comes down to whether the vendor ships an ARM build and whether the hardware is rated for the job: flash storage wear, power loss, heat and vibration are where hobby boards fail. Raylux's gateway, Nexus, runs on ARM64 Linux, and one described deployment runs on an ARM64 touchscreen panel. The ARM64 build is provided on request.

What is the difference between SCADA and a DCS?

A DCS is built to control a continuous process inside one plant, with the control and the operator system engineered together. SCADA is built to supervise many controllers, often spread over a wide area, on top of whatever PLCs and RTUs are already there. Modern products overlap, so the label matters less than what the system must do.

How much does SCADA cost?

It varies a lot, because vendors license it differently: by tag count, by client or seat, by server, by driver, or by subscription. Compare the total for your own tag count, number of operators, drivers and years of support, not the headline number.

Where to go next

I build and commission these systems for a living, and Raylux is the SCADA gateway we make. If you would rather see one running than read about it, the download is free to try, and the manual covers building a system.