AJapps

SCADA Troubleshooting & Escalation Assistant

Pick the symptom, answer a few questions, and get the likely cause, what to do yourself and which tool to use. When the fix needs the network, IT or security team, the assistant writes the ticket for you — with the checks you made and the evidence to attach — so the request is understood the first time.

Tool guide · know before you use

What this tool is, how it works and how far to trust it

A guided troubleshooting assistant: it asks the questions an experienced engineer would ask, in the right order, and ends with the likely cause, what to do, the tool to use and — when another team must act — a ready escalation ticket.

Read this before relying on a result. Every method, formula, assumption and limit is stated here, so you can check the answer yourself instead of accepting it blindly.

What it can do

  • Guide seven common symptoms: no communication with a device, IEC 104 drops, wrong time, slow workstation, logon and domain problems, disk full, GOOSE not received.
  • Explain why each question matters and what each answer means.
  • Give the likely cause with the actions and links to the right tool.
  • Write an escalation ticket with site details, the checks made, the likely cause, a precise request and an evidence checklist.

Why you need it

  • Support requests from site often wait because they arrive without basic checks or evidence and go back and forth.
  • Following a fixed order of checks avoids skipping the simple causes (cable, address, VLAN) that cause most problems.

Understand this first

  • The assistant cannot see your network; it relies on your answers. Make each check before answering.
  • Work from the bottom up: physical link, addressing, Ethernet (ARP), IP (ping), then the service port and the application.
  • A conclusion is the most likely cause given your answers, not a certainty; confirm it with the evidence it lists.

What you need before you start

  • Access to the device, the laptop or server, and the ability to run basic commands (ipconfig, ping, arp, netstat, w32tm).
  • The device's expected IP address, VLAN and switch port from the IP register or SCD.
  • A current browser (Chrome, Edge, Firefox or Safari). Nothing is installed and your data is never uploaded; it is processed on your own computer.

How to use it

  • Choose the symptom card that matches the problem.
  • Answer each question after making the check it describes; use Back to change an answer.
  • Read the likely cause, do the actions you can, and use the linked tools.
  • If escalation is needed, fill in the site fields, replace the <placeholders>, and copy or download the ticket with the evidence attached.

What you get

  • The path of questions and answers, the likely cause and actions, the tools to use, and an escalation ticket as text.

How to read the results

  • Red results are faults to fix; amber results are probable causes to confirm; green means the area checked is healthy and the problem lies elsewhere.
  • If the actions do not fix it, go back one question and check your answer again before escalating.

Technical basis

  • Layered troubleshooting order (physical, link, network, transport, application) and the behaviour of ARP, ICMP and TCP (RFC 826, 792, 9293).
  • IEC 60870-5-104 link timers, IEC 61850-8-1 GOOSE subscription and supervision, Windows Time, Group Policy and Netlogon behaviour.

Limits: when not to rely on it

  • Covers the common causes, not every possible fault; rare or vendor-specific faults need the vendor.
  • It does not test anything itself.

For preliminary engineering use. Results must be checked by a qualified engineer against the project's standards. How results are checked · Terms & disclaimer · Build 5da9168 · 2026-11-13