Historian

A process historian is a specialised time-series database purpose-built for recording operational data from industrial control systems. In a power-system context, it captures every SCADA measurement (voltage, current, power flow, transformer temperature, breaker state), every alarm, and every operator action — typically at intervals of one to thirty seconds — and retains the data for years or decades.

Why it matters

The historian is the long-term memory of the grid. Real-time control systems like ADMS and EMS work with a rolling window of minutes to hours. The historian stores the full operational record — the dataset that post-incident analysis, regulatory reporting, asset-condition trending, and load forecasting all depend on.

Common products

• AVEVA PI System (formerly OSIsoft PI) — the dominant historian in the power and process industries, with a proprietary compression algorithm (swinging-door trending) optimised for high-frequency time-series data.
• Honeywell PHD (Process History Database) — common in refining and generation.
• GE Proficy Historian — often found alongside GE protection and control equipment.
• Open-source alternatives — InfluxDB and TimescaleDB are increasingly used for new-build analytics platforms, though rarely as the primary SCADA historian.

Architecture and security context

Historians sit at a sensitive boundary in the IEC 62443 zone model. They need to receive data from the control zone (Z-OPS or Z-RTU) and make it available to the corporate/analytics zone — which means they straddle the industrial DMZ (Z-IDMZ). The conduit between the control zone and the historian is one of the most scrutinised paths in any substation security assessment:

• Inbound data typically arrives via OPC UA (new builds) or OPC Classic/DCOM (legacy), or via DNP3 / IEC 60870-5-104 poll data forwarded by the RTU.
• Outbound replication to cloud analytics, business intelligence, or regulatory reporting systems crosses the IT/OT boundary — the conduit where directional enforcement or a hardware data diode is most commonly required.
• The historian server itself is a high-value target: it holds a complete record of grid operations, and compromise of the historian’s write interface could allow an attacker to inject false historical data or mask evidence of an intrusion.

Historians are increasingly deployed as virtual machines on the same vSphere or KVM clusters as the control-centre ADMS and EMS platforms, which places them inside the same lifecycle-management and microsegmentation framework as the rest of the virtualised control centre.