Real telemetry. Real protocols. Replayable physics.
Continuous, physics-honest sensor telemetry over Modbus/TCP, OPC-UA, BACnet, MQTT and DNP3 — captured to pcapng + parquet + alarms and cryptographically sealed.
Driven by a deep library of plant templates and a disturbance library, ready to feed an IDS, an analytics pipeline, an operator trainer — or an ICS attack mix on top.
- Status
- Succeeded
- Kind
- Simulation
- Engine
- Virtual SCADA
- Rows
- 3,289
- Duration
- 0m 32s
- Rows
- 3,289
- Seed
- 0x47F73FB3
- Contract Hash
- 2f457591abd7876a…
- Artifacts
- 18
- Has output
- Yes
- Plant templates
- 67
- Protocols (live)
- 6
- Min cycle
- 2 ms
- Streams
- Live + sealed
Six things every SCADA run guarantees.
These behaviours aren't toggles — they're built into the engine. Every motif, every protocol, every disturbance respects them, so a run from a junior engineer ships with the same evidence quality as a run from the platform team.
Physics anchors every signal
Every analog tag is driven by a calibrated physics-honest response model; every discrete equipment state is driven by an event-driven state machine with safety interlocks. Telemetry doesn't just look right on a chart — it satisfies the physical constraints your IDS or analytics expect.
Real protocols on the wire
Six SCADA protocols in the engine today — Modbus TCP, OPC-UA, BACnet/IP, MQTT, DNP3, IEC 61850 (MMS/GOOSE/SCL). Standard produces batch frame traces for all six (NDJSON / Parquet / pcapng records of what went on the wire); Enterprise VPLC upgrades them to live TCP servers on real ports inside a real-time-capable Docker container on your infrastructure.
A deep plant-template library
A broad library of pre-built plant templates; each carries the response models and state machines for every loop in the plant, mapped to the right protocol surface — and any plant you describe is calibrated the same way.
Realistic disturbance library
Realistic disturbances bake in: storm-surge inflow, blower failure, sensor drift, valve seize, breaker trip — all on a deterministic schedule that replays byte-equal across runs.
Composable with ICS Security
A Virtual SCADA run is a first-class input to the ICS Security engine. Inject MITRE ATT&CK for ICS classes against a live process; the truth file labels the result; one bundle ships both telemetry and adversary ground truth.
The same evidence chain as the rest
pcapng + signals.parquet + alarms.json + commands.json + asset_inventory.json, all hashed and chained into a sealed .tar.zst. Verifiable offline, replayable forever.
| Timestamp (UTC) | Signal Name | Value | Unit | Asset ID | Asset Type | Quality | Sequence | Labels |
|---|---|---|---|---|---|---|---|---|
| 2026-01-01T00:00:00.000Z | feed_pump.flow_rate | 14.97 | — | pump_0 | pump | good | 0 | attempt_outcome=executed; fres… |
| 2026-01-01T00:00:00.000Z | feed_pump.speed | 2950.0 | — | pump_0 | pump | good | 0 | attempt_outcome=executed; fres… |
| 2026-01-01T00:00:00.000Z | feed_pump.status | on | — | pump_0 | pump | good | 0 | attempt_outcome=executed; fres… |
| 2026-01-01T00:00:00.000Z | pump_rated_power_kw | 10.0 | kW | pump_0 | pump | good | 0 | attempt_outcome=executed; fres… |
| 2026-01-01T00:00:00.000Z | pump_rated_power_kw | 15.0 | kW | pump_1 | pump | good | 0 | attempt_outcome=executed; fres… |
| 2026-01-01T00:00:00.000Z | inlet_source.flow_rate | 10.0 | — | source_0 | source | good | 0 | attempt_outcome=executed; fres… |
| 2026-01-01T00:00:00.000Z | storage_tank.level | 3.003562 | — | tank_0 | tank | good | 0 | attempt_outcome=executed; fres… |
| 2026-01-01T00:00:00.000Z | storage_tank.mass | 11990.22 | — | tank_0 | tank | good | 0 | attempt_outcome=executed; fres… |
| 2026-01-01T00:00:01.002Z | feed_pump.flow_rate | 14.97 | — | pump_0 | pump | good | 1 | attempt_outcome=executed; fres… |
| 2026-01-01T00:00:01.002Z | outlet_valve.position | 0.4 | — | valve_0 | valve | good | 1 | attempt_outcome=executed; fres… |
Every row is physics-honest — and carries its own ground truth.
A scada_telemetry artifact straight off a run. Each tick is a calibrated signal on a real asset, with the label an IDS or detection model needs to score against.
- Real signal names on real assets — feed_pump.flow_rate, storage_tank.level, outlet_valve.position — with units and per-tag quality flags.
- A ground-truth Labels column on every row: sensor state, integrity state, freshness, and attack attribution when an adversary mix is present.
- 780 telemetry rows here; the full run seals 18 artifacts including protocol traces, an alarm log, and a MITRE validation file.
Six industrial protocols. Batch frames on Standard, live servers on Enterprise VPLC.
Standard Virtual SCADA records every protocol as batch wire frames (pcapng + NDJSON + Parquet). The Enterprise VPLC tier upgrades the same six protocols to live servers on real TCP/UDP ports inside a real-time-capable Docker image on your infrastructure — never synthetic packet replay. Bind only the ones you need; air-gapped registries supported.
Modbus / TCP
:502Holding/input registers, coil semantics, function-code coverage 1–6, 15, 16. Batch frames on Standard; live server on Enterprise VPLC.
OPC-UA
:4840Anonymous and certificate auth, address space generated per plant motif. Batch frames on Standard; live server on Enterprise VPLC.
BACnet / IP
:47808AHU / VAV / chiller object models, COV subscription, Read/WriteProperty round-trip. Batch frames on Standard; live server on Enterprise VPLC.
MQTT 3.1.1 / 5
:1883Sparkplug-B compatible payloads; configurable QoS and retained-message behaviour. Batch frames on Standard; live broker on Enterprise VPLC.
DNP3 (IEEE 1815)
:20000Master/outstation, integrity polls, unsolicited responses, CRC-16 frame integrity. Batch frames on Standard; live outstation on Enterprise VPLC.
IEC 61850 MMS
:102Substation IED scenarios on the Enterprise VPLC tier; report control blocks supported.
Six stages from motif to sealed bundle.
The same six stages as the synthetic-data engines, with two domain-specific steps: a wire capture (pcapng) and an optional adversary mix.
Pick a plant template
Choose a pre-built template or describe your own; each declares its tags, protocol bindings, regime schedule, and disturbance hooks. Overrides land as JSON on the run request.
Configure run options
Duration, sample cadence, jitter (p50 + p95), which protocols to bind, where the evidence volume lives. Defaults are sensible; everything is overridable.
Drive the process
The motif schedule plays out: setpoints move, regimes change, disturbances hit on the pinned schedule. Live protocol traffic mirrors the process in real time.
Capture wire + state
pcapng captures the wire exactly as it appeared on the LAN; signals.parquet captures the per-tag time series; alarms.json records what an operator would have seen.
Quality + chain seal
Distribution checks, cycle-time accounting, and protocol conformance are verified before sealing. A hash-chained .tar.zst lands in your bucket.
Optional ICS attack mix
Compose with the ICS Security engine to inject MITRE ATT&CK for ICS classes on the same SCADA run. Truth labels travel inside the same bundle.
Not a fixed catalogue — any plant you can describe.
There is no menu of supported industries to fit your site into. Describe the process and the engine calibrates a physics-honest model for it, mapped to the right protocol surface — from a stock template or a P&ID you bring.
Describe the plant
Your process, the analog loops, the discrete states, the protocols — from a stock template, a P&ID, or plain English.
Calibrated per loop
A calibrated response model is fit for every analog loop; event-driven state machines with safety interlocks cover discrete equipment state — no random-walk telemetry.
Sealed pack
pcapng + signals.parquet + alarms.json, byte-stable under the seed, sealed into one verifiable bundle mapped to the right protocol surface.
Six rungs above random-walk telemetry.
Each rung is a published mechanism, not a marketing claim: an authorable dwell-time regime scheduler, a cross-signal coupling graph with analytic ρ→g inversion, diffusion-form-aware integrator dispatch, adaptive dynamics calibration, swing-equation substation load flow, and a unified live/batch integrator that keeps stream and sealed bundle byte-equal.
Authorable regime scheduler
Per-plant dwell-time distributions (LogNormal/Weibull/Gamma/Deterministic) drive the regime timeline. Setpoints are regime-conditional — DO sags in fault, pumps cycle in high-load, valves lean in maintenance. No geometric-Markov artifacts.
Cross-signal coupling
Catalogued archetypes wire signal-to-signal influence (flow→pressure, DO→NH₄⁺, P→voltage-sag) through an analytic coupling graph. Target correlation converts to edge gain in closed form — no hand-tuned knobs.
Diffusion-form aware integrators
Each signal declares its process class (additive, multiplicative, CIR). The integrator dispatcher picks Euler-Maruyama, log-Euler, or Milstein per signal, with Strang splitting when a block is stiff and coupled. Feller-safe CIR keeps dissolved-oxygen, reaction rates, and frequency deviations off boundary pins.
Adaptive dynamics calibration
A short pre-roll measures observed utilisation per signal; one Newton correction retunes the stochastic scale to the authored target. The same 1-hour substation run reaches realistic coefficient-of-variation without human parameter-fitting.
Grid-aware substation load flow
Substation V/f/P/Q are driven by a swing equation + AVR + voltage-dependent load block at IEEE C37.010 nominals. Stochastic noise rides on the deterministic load-flow solution — not the other way round.
Unified live + batch
The same integrator feeds a per-tick stream and the sealed batch bundle. Consumers subscribe at /v1/client/runs/{run_id}/stream; late joiners replay from the ring buffer. A missed frame never silently drops — the sealed transcript is the source of truth.
Every run seals into a verifiable audit trail.
Not a PDF report — a cryptographically sealed bundle you (or your auditor) can verify offline, with a ground-truth command timeline and a reproducibility hash.
- A command timeline attributes every write — clean, poisoned, executed, blocked, divergent — from the bundle's own commands.ndjson, no sampling, no hardcoded values.
- Reproducibility is a hash match: re-running the job under the same seed produces an identical output hash.
- Constraint checks (hard + soft), a privacy-risk estimate, and the data-contract fingerprint travel in the same bundle.
Train on your real plant without shipping raw rows.
Bring a CSV, Parquet, or PI System export; the engine fits a sanitised statistical summary under a differential-privacy budget with Rényi-DP accounting. Multi-site deployments aggregate across facilities under MPC, TEE, or trusted-aggregator modes — the coordinator never sees raw tuples, and every run ships a privacy_evidence.json audit trail.
Bring your historian
Point at a CSV, Parquet, or PI System export; the Differentially-Private Historian Extension fits a sanitised statistical summary under an (ε, δ) budget with Rényi-DP accounting. Raw rows never leave the ingest boundary.
Federate across sites
k-site aggregation runs under MPC additive secret sharing (three-server), SGX/SEV/Nitro TEE, or trusted-aggregator mode. Each site publishes only its sanitised summary; the coordinator sees the aggregate, never the raw tuples.
Privacy evidence travels with the bundle
Every run ships a privacy_evidence.json carrying the epsilon/delta ledger, per-signal sensitivity bounds, aggregation backend, and participant receipts. Audit-ready on the first read.
Where Virtual SCADA earns its keep.
IDS / NDR vendor benchmarking
Generate reproducible, labelled traffic for detection-rule training and regression-testing. Same bundle, different runs, same outputs from your detector — that's the test.
Digital-twin & analytics
Drive your real analytics pipeline against synthetic-but-honest telemetry. Catch the bug before it points at production.
Operator training
A behaviourally-identical plant the trainee can stress, mis-operate, and recover — without ever touching the live process.
PLC / vendor PoC sandbox
Stand up a clean SCADA + Virtual PLC environment per vendor evaluation; reset to the sealed baseline between PoCs.
Posture you don't configure.
Tenant-isolated
Per-tenant Fernet at rest, per-tenant artefact prefix, ORM-level row filtering — same as the rest of the platform.
Real protocols
Batch-mode wire frames on every tier; the same six protocols run as live TCP/UDP servers on the Enterprise VPLC tier — never synthetic packet replay.
Physics honest
Per-tag calibrated response model; event-driven state machines with safety interlocks for discrete equipment state. No random-walk telemetry.
Sealed by default
Every run produces a hash-chained .tar.zst; the offline verifier flags any in-place mutation.
Bring a P&ID. We'll ship a sealed run.
A 45-minute working session: tell us the plant, the protocols, and one disturbance you want to drive. We'll cut the contract, run the SCADA engine, and walk you through the bundle.