Eleven Million Dollars for SCADA and PLCs

The US Environmental Protection Agency is providing $11.75 million in grants to ten midsize and large drinking water systems under its Midsize and Large Drinking Water System Infrastructure Resilience and Sustainability Grant Program. The funded work covers SCADA improvements, programmable logic controller replacement, pump control modernisation, backup generators, well facilities, dam upgrades and smart water monitoring, addressing hazards including cyberattacks, hurricanes, wildfires, drought and flooding. Bloomington, Indiana and San Diego, California received among the largest awards at $2.375 million each — Bloomington for facility upgrades, backup generators and SCADA improvements, San Diego to replace programmable logic controllers. Other funded work includes SCADA and pump control modernisation in Lake City, Florida, a new well facility in Bay City, Texas, dam upgrades in Denver, and smart water monitoring and tank replacement in Anderson, California.

San Diego spending $2.375 million to replace PLCs is the line worth dwelling on, because it says something about the state of water sector automation that no advisory does. Controllers are replaced when they can no longer be supported — when spares are unobtainable, when the programming software will not run on a supported operating system, when the vendor has ended support, or when the device cannot be secured because it predates the concept. A utility serving well over a million people needing a federal grant to do it indicates that the replacement was not affordable from the operating budget, which is the ordinary condition of water utilities rather than an exception.

That funding structure is the underlying story for anyone selling into or working with this sector. Water systems are typically municipally owned, rate-regulated, and politically constrained in how fast rates can rise, so capital spending competes against pipe replacement and treatment compliance — both of which are visible and legally mandated in a way that a controller upgrade is not. The consequence is a sector with a large installed base of automation that is a decade or more past where an industrial manufacturer would have replaced it, and which is simultaneously being asked to meet rising cybersecurity expectations.

The grant list is also a fair description of what resilience actually consists of in this sector, and it is worth noting how unglamorous it is: generators, wells, a dam, pump controls and SCADA. There is no artificial intelligence in that list and no new category of technology. The hazards named — cyberattack alongside hurricane, wildfire, drought and flood — are treated as one class of problem, which is the correct framing: the utility's obligation is continuity of supply, and whether it is lost to an intrusion or a storm is a distinction that matters to the response and not to the customer. For vendors, the practical implication is that proposals in this sector are judged on whether they keep water moving during a failure, and are funded on a grant cycle rather than a procurement one.