TL;DR:
- Water utilities are using edge computing to bridge legacy SCADA systems (running Modbus, DNP3, IEC 60870) with modern cloud analytics without exposing OT networks directly to the internet
- Real-time acoustic leak detection and pressure zone monitoring at the edge reduces non-revenue water losses by 15–30% in documented deployments
- OT/IT network segmentation with edge-native data mediation is the security architecture — not VPN-to-cloud
Water infrastructure is a critical national asset running on some of the oldest operational technology in any industry. SCADA systems installed in the 1990s and early 2000s monitor pumping stations, treatment works, and distribution networks across hundreds or thousands of remote sites. These systems work, but they predate modern connectivity, cloud analytics, and the cybersecurity threat landscape they now operate in.
Edge computing is the practical modernisation path for water utilities that can’t replace the underlying control systems but need better data, better security, and better operational intelligence.
The Water Utility SCADA Problem
A typical UK water utility manages tens of thousands of assets: pumping stations, service reservoirs, pressure reducing valves, flow meters, and quality sensors distributed across a geographic area. Most communicate via legacy protocols — Modbus, DNP3, IEC 60870-5-101/104 — to SCADA systems that aggregate data in a control room.
The problems are structural:
Data latency: Legacy SCADA polling intervals of 15–60 minutes mean that slow leaks, pressure transients, and water quality events aren’t detected until they’ve already caused significant loss or risk.
Connectivity gaps: Remote assets — rural pumping stations, isolated service reservoirs — may have unreliable or expensive cellular connectivity. SCADA systems designed around fixed polling schedules break down when connectivity is intermittent.
Cloud integration complexity: Utilities want to run analytics, asset management, and predictive maintenance on cloud platforms. Sending raw OT data to the cloud from legacy SCADA creates security risks, protocol conversion complexity, and data volume problems.
Cybersecurity exposure: Post-2020, the cybersecurity threat to water infrastructure has intensified. The 2021 Oldsmar water treatment attack — where an attacker accessed a Florida facility’s HMI via TeamViewer and briefly increased sodium hydroxide levels — demonstrated that exposed OT systems are realistic targets. Many utilities added remote access capabilities during COVID without hardening the underlying security architecture.
Edge Architecture for Water Utilities
The effective pattern is an OT/IT DMZ with edge gateways sitting at the boundary. The edge gateway does four things:
- Speaks the legacy protocol to the existing RTU or PLC (Modbus TCP, DNP3, IEC 60870)
- Translates to modern data standards (OPC-UA, MQTT, Sparkplug B) for northbound transmission
- Runs local processing — anomaly detection, alarm logic, data quality checks — without requiring cloud round-trips
- Enforces network segmentation — the OT network never has a direct route to the internet or corporate IT network
Hardware at this layer includes purpose-built industrial gateways from vendors like Moxa, Advantech, Red Lion, and HMS Networks, as well as ruggedised embedded computers running containerised software. The choice depends on environmental requirements (IP rating, temperature range, DIN rail mounting) and processing requirements for local analytics.
Protocol Translation in Practice
A pumping station with a 20-year-old RTU communicating Modbus RTU over RS-485 gets an edge gateway that terminates the serial connection, polls the RTU on its native protocol, and publishes the data northbound over MQTT to a local edge server or directly to cloud. The RTU firmware doesn’t change. The SCADA system can continue to poll the RTU directly if needed for operational continuity. The edge gateway is additive, not replacement.
For sites with DNP3 over TCP (more common in newer installations), the edge gateway acts as a DNP3 outstation towards the control room SCADA and as a northbound MQTT publisher simultaneously. The Unified Namespace (UNS) pattern — where all site data publishes to a structured MQTT topic hierarchy — is gaining adoption among utilities that want to standardise data access across their estate.
Local Edge Processing
Running analytics at the edge rather than in the cloud matters for water utilities for three reasons: connectivity reliability, latency, and security.
Pressure zone monitoring: Distribution networks are divided into pressure zones, each with inlet flow and pressure monitored. At the edge, a simple water balance calculation (inflow minus legitimate consumption) identifies zones with unexpected losses in real time. This runs on the edge gateway or a local edge server with no cloud dependency — the alert is generated locally and transmitted when connectivity is available.
Pump health monitoring: Pump vibration, temperature, and electrical signature analysis identifies bearing wear, cavitation, and impeller degradation before failure. Edge AI inference — running a lightweight anomaly detection model against sensor time series — can flag developing faults for maintenance scheduling. The model runs locally; only alarms and summarised health scores are transmitted.
Water quality alerting: Turbidity, chlorine residual, and pH sensors at service reservoirs and network points feed into local quality monitoring logic. Threshold breaches generate immediate alarms without waiting for SCADA polling cycles.
Acoustic Leak Detection at Scale
Non-revenue water (NRW) — water produced but not billed, primarily due to network leakage — is a major operational and financial problem for water utilities. UK Water Services Regulation Authority (Ofwat) targets have driven significant investment in leak detection, and acoustic methods are the most scalable approach for distribution network monitoring.
The architecture uses acoustic leak noise correlators deployed on fire hydrants, gate valves, and other network access points. Traditional correlators are collected manually; modern systems transmit acoustic signatures to an edge processing node or cloud platform for continuous correlation.
At the edge:
- Acoustic sensors log noise signatures at 15-minute intervals overnight (when pipe noise is lowest)
- An edge gateway collects signatures from multiple sensors over LoRaWAN, NB-IoT, or cellular
- Correlation algorithms run locally or in a nearby edge server to identify leak noise patterns between sensor pairs
- Suspected leaks are ranked by estimated flow rate and location probability
- Field crews are dispatched with prioritised work lists
Thames Water’s implementation of smart network monitoring — part of its £3.3 billion investment programme — uses this architecture across its London distribution network. Documented NRW reductions of 15–30% are achievable with comprehensive acoustic monitoring, though the exact figure depends on baseline leak levels and network age.
OT Cybersecurity Architecture
Water utilities are explicitly named in UK and US critical infrastructure legislation as high-priority targets for cybersecurity hardening. The National Cyber Security Centre (NCSC) and CISA have published joint guidance for water sector OT security since 2021.
The security architecture that works:
Air-gap with managed data diodes: For the most critical control systems (treatment chemical dosing, primary pumping), a data diode enforces one-way data flow from OT to IT. The control system cannot receive any traffic from the IT or internet-facing network. Industrial data diodes from Waterfall Security and Owl Cyber Defense implement this at the hardware level.
DMZ with edge mediation: For sites where bidirectional communication is required (remote configuration, firmware updates), a DMZ with an edge gateway as the broker limits what protocols and commands can cross the boundary. The edge gateway validates and logs all inbound configuration commands; direct access to RTU or PLC command interfaces from the internet is not possible.
Network segmentation enforcement: OT VLANs, OT-specific firewalls (Claroty, Dragos, Nozomi Networks), and no lateral movement between OT and corporate IT. Authentication for OT access uses MFA with just-in-time provisioning — the access window is time-limited and logged.
Anomaly detection for OT traffic: Passive monitoring of OT network traffic to baseline normal communications patterns. Tools like Nozomi Networks Guardian and Claroty Continuous Threat Detection profile normal Modbus and DNP3 traffic, detecting commands that are unusual in type, frequency, or source. Because these tools are passive (read-only span ports), they add no risk to OT availability.
Secure remote access: VPN is the minimum; certificate-based authentication with hardware tokens and privileged access workstations is better practice. TeamViewer and similar consumer-grade remote access tools — often installed during COVID as emergency measures — should be removed. Vendor remote access for maintenance follows the same controls as internal access, not a separate less-controlled path.
The Connectivity Layer
Remote water utility assets exist in a connectivity desert by design — pumping stations are in the ground or in isolated plant rooms, not in data centres. The connectivity architecture for edge nodes varies by site:
4G/5G cellular: The standard for most remote pumping stations and service reservoirs. Redundant SIM cards from different carriers (Vodafone and EE, for example) provide availability during single-carrier outages. Edge gateways with built-in cellular modems and dual-SIM support are standard in modern deployments.
LoRaWAN: For battery-powered acoustic sensors and low-bandwidth asset monitoring across large distribution network areas. LoRaWAN’s long range (up to 15km line of sight) enables coverage of rural distribution networks with a small number of gateways. Data rates are low (under 1kbps), which limits it to telemetry rather than bulk data transfer.
Satellite (Starlink/OneWeb): Increasingly viable for genuinely remote sites where cellular coverage is inadequate. Latency and cost have both improved; for a pumping station in a cellular dead zone, satellite backhaul is now a realistic option rather than a last resort.
Fibre and leased lines: For treatment works and major pumping stations where bandwidth requirements justify it — full SCADA telemetry, video for physical security, and bulk data transfer for operational systems.
Getting Started: Priorities for Water Utilities
Utilities with legacy SCADA infrastructure and modernisation ambitions benefit most from a sequenced approach:
First: Deploy edge gateways at high-value sites (large pumping stations, water treatment works) for data collection and OT/IT network segmentation. This delivers immediate security improvement and begins building operational data history.
Second: Add pressure and flow monitoring to distribution network pressure zones. The water balance data identifies high-leakage areas without requiring any additional sensor deployment in most networks.
Third: Add acoustic monitoring infrastructure to the identified high-leakage zones. The combination of pressure zone data (where) and acoustic monitoring (which pipe section) significantly improves leak detection efficiency versus acoustic monitoring alone.
Fourth: Integrate edge data with cloud asset management and analytics platforms for predictive maintenance and long-term network planning.
The investment case is strong. Non-revenue water has a direct financial cost (treatment cost of lost water, regulatory penalty risk), and cybersecurity incidents at critical infrastructure carry operational, financial, and reputational consequences that dwarf the cost of preventive architecture. The regulatory direction — from Ofwat’s investment periods and NCSC guidance alike — is towards this architecture, not away from it.