Remote monitoring of pumping stations and reservoirs

At a glance

Item	Typical answer
Problem	Unmanned pumping stations and reservoirs report only to local panels, so trips, overflows and power cuts are found late.
What is connected	Reservoir level, pump run and fault states, pressures, flow, energy and station housekeeping signals, read by a licensed gateway in each station panel.
Who uses it	Control room operators, the on-duty field crew, the maintenance planner and the operations manager.
Typical first scope	Two to four stations and the reservoirs they feed, in one pressure zone.
Time to first screen	Typically a few days after the first gateway is wired, because the Water site solution gives a starting dashboard. Budget two to four weeks for a pilot that the operators trust.

The situation

A water utility typically runs dozens of unmanned booster and transfer stations and the reservoirs they fill. Each has a small PLC or relay logic that runs duty and standby pumps on reservoir level, and a local panel. Existing telemetry is often a mix of old radio outstations, a few modems and stations with nothing.

A pump trips on Friday night and the reservoir drains until a district loses pressure on Saturday. A level transmitter freezes and water spills from the overflow for hours. After a power cut nobody knows whether a station restarted. Crews drive fixed rounds to read counters, and most visits find nothing wrong.

The aim here is one shared picture: every station reporting to Hermetry, alarms that reach the person on duty, and a history good enough to plan maintenance and energy from.

Goals and measures

Agree the measures before wiring, because they decide which signals are worth connecting. Typical ones, computed from the point list below:

• Station availability = time the station could deliver its duty flow ÷ total time in the period. In practice: time with at least one healthy pump available and mains present, divided by hours in the month.
• Pump run hours and starts per pump per day, from the PLC's run-hour and start counters (increase); without counters, send the run contact as a 0/1 number so hourly averages give run hours. Starts per hour above the motor's limit (for example 6 to 10 starts per hour, agree it with the motor supplier) point to a level band set too narrow.
• Specific energy = kWh used by the station ÷ m³ pumped, per day. A rising value at the same head usually means impeller wear or a partly closed valve.
• Reservoir security = lowest level reached each day as a percentage of capacity, and hours spent below a minimum operating level.
• Time to acknowledge and time to resolve per alarm type, read from the alarm timeline.

Hermetry keeps one-minute, hourly and daily aggregates (sum, count, minimum, maximum, last) of every key, so daily energy and daily minimum level need no calculation in the field.

Architecture

Each station gets one licensed gateway running Hermetry Edge in the existing panel. It reads the PLC and instruments over Modbus RTU (RS485) or Modbus TCP, reads dry contacts on its digital inputs and sends everything over MQTT with TLS on one outbound connection; nothing on site accepts connections from the internet. See Hermetry Edge and the licensed devices list for which models offer which inputs and links.

Reservoirs that sit away from a station and have only a level instrument do not need a full gateway. A battery LoRaWAN level sensor, heard by a LoRaWAN gateway at a nearby station, joins Hermetry's own LoRaWAN network server. The codec library turns its radio frames into values such as level_m.

Component	Role	Notes
Licensed gateway with Edge	Reads Modbus and contacts, publishes telemetry	One per station. Leaves the factory with an identity; your organisation claims it, nobody types credentials on site.
Licensed 4G or 5G router	Uplink where there is no fixed line	Use your own SIM and operator. eSIM management from the platform is in development (Hermetry Connect).
Station PLC or pump controller	Keeps controlling the pumps	Read-only from the gateway in the first phase.
Level, pressure and flow transmitters	Process values	4-20 mA into the PLC or the gateway's analog inputs, or Modbus where the instrument has it.
Energy meter	kWh, voltage, current, power factor	Modbus RTU on the same RS485 line.
LoRaWAN level sensor and gateway	Remote reservoirs	EU868, OTAA, class A for battery sensors.
Hermetry	Storage, alarms, rules, dashboards, SCADA	Hosted in the EU, US or Türkiye region, or on your own servers.

Licensed devices authenticate with an X.509 certificate from the platform's own authority; other devices with an access token or user name and password. The profile can require TLS and pin allowed source networks. If a station has several Modbus devices that you want as separate devices in Hermetry, the gateway can report them as child devices of itself, each with its own readings and alarms, over the one connection.

Point list

A typical two-pump booster station with one reservoir. Register numbers are examples from a common PLC map; use your own map. Intervals are starting values to adapt.

Point	Telemetry key	Unit	Source	Interval	Notes
Reservoir level	res_level_m	m	4-20 mA via PLC, holding register 40001	60 s	Declare range 0 to max depth in the profile.
Reservoir level, percent	res_level_pct	%	Computed in PLC, 40002	60 s	Used for alarms so one rule fits reservoirs of different depths.
Inflow	inflow_m3h	m³/h	Magnetic flow meter, Modbus	60 s
Outflow	outflow_m3h	m³/h	Magnetic flow meter, Modbus	60 s
Totalised outflow	outflow_total_m3	m³	Flow meter totaliser	15 min	Daily volume comes from the increase.
Suction pressure	suction_bar	bar	Pressure transmitter, 40010	60 s	Low suction protects pumps from running dry.
Discharge pressure	discharge_bar	bar	Pressure transmitter, 40011	60 s
Pump 1 running	p1_run	0/1	Run contact, gateway DI1	on change	Report by exception plus a 15 min heartbeat. Send as a 0/1 number, not true/false, for history.
Pump 1 fault	p1_fault	bool	Overload or VFD fault contact, DI2	on change
Pump 1 in auto	p1_auto	bool	Selector switch contact, DI3	on change	Tells operators when a pump is left in hand.
Pump 1 motor current	p1_current_a	A	VFD or current transducer, Modbus	60 s
Pump 1 run hours	p1_hours	h	PLC counter, 40020	15 min
Pump 1 starts	p1_starts	count	PLC counter, 40021	15 min	Starts per day from the increase.
Pump 2 running, fault, auto, current, hours, starts	p2_run, p2_fault, p2_auto, p2_current_a, p2_hours, p2_starts	as pump 1	as pump 1	as pump 1
Mains present	mains_ok	bool	Phase monitoring relay, DI6	on change
Station active energy	energy_kwh	kWh	Energy meter, Modbus RTU	15 min
Station active power	power_kw	kW	Energy meter	60 s
Phase voltage L1-L3	u_l1_v, u_l2_v, u_l3_v	V	Energy meter	60 s
Panel door	door_open	bool	Reed contact, DI7	on change
Panel temperature	panel_temp_c	°C	Gateway or small sensor	5 min
Overflow float	overflow_float	bool	Float switch, DI8	on change	Independent of the level transmitter.
PLC communication	plc_comm_ok	bool	Gateway Modbus status	60 s	False when the gateway cannot read the PLC.

Declare every key in the profile's Telemetry keys tab with label, unit, decimals and range; gauges take the range as their scale.

Asset model

Build the tree in Sites & Assets so that it mirrors how the network is operated, not how it was built. A common shape:

• Region (free kind, for example North) with attributes crew_phone_group and region_code.
• Pressure zone (Zone) with design_pressure_bar and population_served.
• Station (Site) with location, time zone, criticality (A, B or C), duty_flow_m3h and has_standby_generator.
• Reservoir (Area) with capacity_m3, overflow_level_m and min_operating_level_m.
• Pump 1, Pump 2 (Machine) with rated_kw, max_starts_per_hour and install_date.

Place the gateway on the station asset and child devices on what they measure, and add Feeds relations from station to reservoir to zone. Placement decides which site's status and alarm counts include a device and which rules of a place may act on it. Attributes such as overflow_level_m can also be written as server attributes on the device, so alarm rules use per-site limits while the rule itself stays the same for every station.

Device setup

Device profiles

Create one profile per kind of station, for example Booster station, 2 pumps, and one for Reservoir level sensor (LoRaWAN). A profile holds the transport and login rules, the online rule, rate limits, telemetry keys, configuration keys, alarm rules and the command catalog, so every station of the kind behaves the same. Use the Recent message online rule for stations, with an expected interval that matches the heartbeat, and the built-in LoRaWAN profile for the battery sensors.

Provisioning

Licensed gateways leave the factory with their own identity. The installer mounts the gateway and the administrator claims it into the organisation by scanning its code or typing its claim details, then picks the station profile. For larger rollouts, devices can be imported in a batch. A device that registers itself through a profile's provisioning key waits in quarantine until an administrator activates it.

Settings, intervals and report by exception

On licensed gateways, remote device settings show every setting of the model with its current value: Modbus addresses, serial parameters, polling intervals and input configuration. Change one station from its Settings tab, or create a baseline for the station type and apply it to all stations with a bulk job that runs in waves and pauses itself if too few devices apply the change. Devices that do not describe their settings can take desired values as cfg.* shared attributes, for example cfg.report_interval_s.

Send contacts on change plus a periodic heartbeat, and analog values on a fixed interval. If the gateway model has a deadband setting, set it there. If not, a block in the profile's root flow can pass a value only when it moves by more than a set amount or percentage before it is stored. Keep the deadband smaller than any alarm hysteresis.

Time and buffering

Synchronise the gateway clock before it sends its own time stamps; a device without a reliable clock should omit ts and let Hermetry stamp the arrival. Licensed gateways can keep readings locally while the link is down and send them when it returns; how much they keep depends on the model, so check it for your outage profile. Buffered readings arrive in order with their original time stamps. Hermetry stores them and evaluates alarm rules on them as a backfill: an overflow that started and ended during the outage appears in the alarm history, marked Backfilled, without paging anyone for the past.

Firmware

Signed gateway firmware is assigned to the station profile and rolled out in waves: a few low-criticality stations, a soak time, then the rest. A failed wave gate pauses the rollout. Devices on mobile data wait unless metered downloads are allowed.

Dashboards

Start from the Water site ready solution, which installs a board with tank levels, pump stations, zones, an alarm list and a station diagram, and adapt it. A typical set of boards:

Board	Audience	Widgets and what they show
Network overview	Control room, managers	Map with each station as a marker in the colour of its status; site table with status, devices, open alarms and last seen; stat cards for stations online and open critical alarms; alarm table filtered to Critical and Major. Also shown on a control-room screen through a read-only display link.
Station page	Operators, crews	Gauges for reservoir level and pressures; state cards for each pump (running, fault, auto); line chart of level, inflow and outflow over 48 hours; the station's process drawing; activity feed of recent events. Opened from the overview by clicking a station (drill-down with the station as a parameter).
Pump performance	Maintenance planner	Run hours and starts per pump per day; motor current against discharge pressure; heatmap of running by hour.
Energy	Operations manager	Bar chart of daily kWh per station; stat with trend of specific energy (kWh/m³) against the previous period; table of stations sorted by specific energy, downloadable to Excel.

Entity parameters let one board serve every station: the station page takes the station asset as a parameter and every card follows it.

SCADA screens

Draw one process drawing per station type, not one per station. A booster station drawing holds the reservoir, suction header, two pumps with check and isolating valves, discharge header, meters and the energy meter, joined by pipe and cable connections. Tank, pump and valve symbols come from the core set and the Water pack, which covers water and wastewater and city networks; see the SCADA library.

• States: a pump symbol shows running, stopped and fault from p1_run and p1_fault; the tank fills with res_level_pct; a rule makes the level text blink red above the overflow level and greys a pump that is not in auto.
• Second readings: pumps print motor current beside the run state; the flow meter prints instantaneous flow and the total.
• Conversions: a one-line expression adapts raw values, for example value / 10 for a level sent in decimetres.
• Reuse: attach the drawing as a view from the station profile's Views button and every station of the profile gets its own view, each with its own device bindings. Match everything proposes a device for every unbound symbol.
• 3D: make a 3D view from the 2D drawing for walkthroughs and training; it keeps the same bindings.

Check the designer's Problems tab, which lists unbound symbols and rules that never match, before applying.

Rules and alarms

Alarm rules live on the station profile, so every station gets the same rules. Thresholds that differ between sites read a device attribute (for example overflow_level_m) instead of a fixed number.

Alarm	Condition	Delay and hysteresis	Severity	Notified	Escalation
Reservoir overflow	overflow_float == true, or res_level_m >= attribute overflow_level_m	Debounce 60 s raise, 120 s clear	Critical	On-duty operator group, SMS and push	Reminder every 15 min until acknowledged
Reservoir high	res_level_pct > 95	Debounce 120 s; hysteresis 3 %	Major	Control room, push and in-app	Reminder every 30 min
Reservoir low	res_level_pct < 25 (Major), < 15 (Critical)	Debounce 300 s; hysteresis 5 %	Major / Critical	Control room; Critical also SMS to zone supervisor	Severity rise notifies again
Pump fault	p1_fault == true	Debounce 2 samples	Major	Maintenance group, e-mail and push	Reminder every 30 min
Pump left in hand	p1_auto == false	Debounce 30 min	Warning	Control room, in-app	None
Low suction pressure	suction_bar < 0.5	Debounce 30 s; hysteresis 0.2 bar	Major	Control room, push	Reminder every 15 min
Mains failure	mains_ok == false	Debounce 20 s	Critical	On-duty operator, SMS	Reminder every 10 min
Station offline	Inactivity rule, no message for 15 min		Major	Control room, push	Reminder every 30 min
Door open out of hours	door_open == true, raised by a rule only outside working hours		Minor	Security contact, push	None

Lifecycle. An alarm opens when its condition holds through the debounce, is acknowledged by the person who takes it and resolves by itself when the condition clears. Only one alarm is open per device and type, so a pump that keeps tripping counts occurrences on one alarm. Acknowledging needs the User role; resolving by hand needs Admin. Each rule can carry a runbook text, for example the reset procedure for the pump's overload relay, shown with the alarm.

Time-dependent alarms. Alarm rules on profiles compare values; they do not know the time of day. For the door alarm, write a rule in the station's Rules card: when door_open becomes true, only if the time is outside 07:00 to 17:00 on weekdays, then raise a Minor alarm and notify security.

Maintenance. Mute a station before planned work. A muted device still records its alarms, marked as muted, but nobody is paged; a mute ends by itself after the set time and never lasts more than 90 days.

Floods. A regional power cut can trip twenty stations in a minute. Above the storm threshold (20 alarm notifications a minute by default) Hermetry collects the rest into a five-minute digest. Design for it anyway: mains failure at Critical, its consequences (pump stopped, pressure low) at lower severities with longer delays, and dampening on any chattering signal.

Automation and integrations

Control stays in the station PLC. Hermetry supervises and, where the team wants it, sends commands that the PLC accepts.

• Commands: define a catalog on the station profile, for example pump.reset_fault (basic tier) and station.inhibit (critical tier, high impact, with a typed confirmation). Which methods a gateway can carry out depends on its model and firmware. Every command is stored and followed from queued to successful, failed or timed out, and high-impact commands are written to the audit log. A board control sends only basic-tier commands; a SCADA symbol can run a command behind a confirmation that names the symbol, the command and the values.
• Rules as a fallback: a station's Rules card can hold a supervisory rule such as: when res_level_pct stays above 98 for 5 minutes and the feeding pump still runs, then send station.inhibit and notify the control room. Switch the station to Manual when operators want to take over; every rule of that place then stops, and the switch is audited.
• Flows: a flow can send each new Critical alarm to a ticketing or maintenance system through an HTTP endpoint you configure, or publish it to an MQTT broker.
• Webhooks: alarm.created, alarm.acknowledged and alarm.cleared, signed with HMAC, feed a CMMS or an operations log. rpc.completed and rpc.failed report command outcomes.
• Reporting: history tables download to Excel for monthly energy and run-hour reports. Scheduled, e-mailed reports are not built in today.

For site work, an engineer can open a licensed router's web panel from the device page through router remote access: no fixed IP or VPN, sessions limited in time and audited.

Roles and access

Who	Role or group	Can
Control room operator	User + IoT operator group	See all stations, acknowledge alarms, send basic commands, switch a place to Manual.
Field crew	User	See stations and alarms of their region, acknowledge alarms.
Maintenance planner	User + IoT viewer group	Read everything, export history, no changes.
SCADA engineer	Admin	Edit profiles, alarm rules, drawings, rules and the command catalog; mute devices; roll out firmware.
Utility IT owner	Owner	Members, sign-in policy, signing keys for firmware, raw commands.

Attribute-based policies can narrow access down to single devices, for example a regional crew that sees only its own stations. A utility that operates for several municipalities can run each as its own organisation, isolated by row-level security in the database, with one account holding memberships in several. The audit log records sign-ins, role changes, high-impact commands, firmware actions and setting changes in a hash chain that can be verified and exported.

Sizing and data

As an order of magnitude, for 40 stations and 10 remote reservoirs:

• Analog values: about 18 keys per station every 60 s. If the gateway sends all of them in one message per minute, that is 40 × 1,440 = 57,600 messages a day; if it reports Modbus devices as child devices, count one message per child per reading.
• Contacts and counters: allow about 200 change and heartbeat messages per station per day, another 8,000 messages a day.
• LoRaWAN reservoirs: one uplink every 15 minutes is 10 × 96 = 960 messages a day.
• Total: roughly 67,000 messages a day, or about 2 million a month. Only telemetry and attribute messages count toward the monthly allowance; commands, alarms and connection events do not.
• Values: about 1.1 million a day, around 400 million a year.

Storage per value depends on the deployment, so confirm the estimate with us. The retention class of your plan decides how long raw rows are kept; long-range charts read the minute, hour and day aggregates, which are much smaller. Raw readings are kept for at most 90 days (7 to 90 depending on the class); hourly and daily aggregates, kept for the full class, carry multi-year energy and run-hour trends. The default per-device rate limits (10 messages a second, 300 a minute) leave ample headroom for this design. For larger fleets, see how the platform is load-tested.

Rollout plan

Phase	Weeks	Work	Exit criteria
0. Survey	1-2	Collect PLC register maps, panel drawings and existing signals per station; choose the station types; agree measures and alarm limits.	Signed point list per station type.
1. Pilot	3-6	Two to four stations and one LoRaWAN reservoir. Profiles, alarm rules, Water site board, one drawing.	Two weeks of data without gaps; every alarm tested end to end; operators confirm values against the local panel.
2. Zone	7-10	All stations of one pressure zone. Baselines for gateway settings; first firmware wave.	Station availability and energy figures accepted by operations; alarm noise under an agreed level (for example under 5 nuisance alarms a station a week).
3. Network	11-20	Remaining zones, one per week or two. Webhooks to the CMMS; display links in the control room.	All stations online; on-duty list and escalation tested on a weekend.
4. Supervisory control	After 3	Command catalog and fallback rules, if the team wants them.	Commands tested on each station type with the PLC in a safe state.

Commissioning checklist

1. Gateway claimed, on the right profile, placed on the right station asset, certificate active.
2. Each analog value compared with the local panel at two points of its range (for example empty and half-full level); scaling and units correct.
3. Each contact toggled on site and seen in Hermetry with the right sense (running = true).
4. Time stamps checked: a reading taken on site at a known time appears at that time in the chart, in the station's time zone.
5. Every alarm forced once: overflow float lifted, pump fault simulated, door opened. The alarm opens, the right people are notified on the right channels, acknowledgement and clearing work.
6. Offline test: uplink unplugged for 20 minutes. The offline alarm opens; after reconnection the buffered readings fill the gap.
7. Command test (if used): each catalog command sent with the PLC in a safe state; result reported as successful.
8. SCADA view bound with no unbound symbols in the Problems tab.
9. Runbook texts filled in on the alarm rules.

Pitfalls

• Different key names per station. level here, res_lvl there, and no rule fits both. Fix the key list per station type before the first gateway is configured.
• Alarming on the level transmitter only. A frozen transmitter hides an overflow. Wire the independent overflow float and alarm on it separately.
• Everything Critical. Reserve Critical for loss of supply, overflow and mains failure, or people stop answering at night.
• No heartbeat on contact-only devices. A station that only reports on change looks healthy while it is dead. Send a heartbeat and use the Recent message online rule with an inactivity alarm.
• Unsynchronised clocks. Records more than ten minutes in the future are dropped.
• Commands before trust. Start read-only until operators trust the values.

What Hermetry does not replace

Hermetry is a monitoring and supervision platform. Pump control, dry-run protection, overload trips and any safety interlocks stay in the station PLC, motor protection and hard-wired circuits, and must keep working when the link or the platform is unavailable. Supervisory commands from Hermetry are requests that the PLC may accept or refuse. Water quality compliance records, billing and the asset register stay in the systems that hold them.