Oil and Gas Satellite Communications: Engineering and Procurement Guide

Oil and gas satellite communications should be specified from the operating process outward, not from an advertised data rate inward. A deployable system connects named applications at a defined field asset through authorized radio equipment, engineered power and mounting, controlled OT/IT boundaries, monitored transport, and an accountable support chain.

This guide covers portfolio-level planning across upstream, midstream, and downstream operations. For protocol timing and telemetry design, use SCADA using satellite communication. For the physical and network design of a single rig, see oil rig satellite internet. For an independent protection path, see satellite backup for offshore operations.

Scope note: This page is an engineering and procurement framework, not a process-safety determination, hazardous-area classification, functional-safety assessment, radio licence, structural design, cybersecurity authorization, or provider recommendation. The asset owner and competent engineering, safety, regulatory, and security parties must approve the actual system.

Quick Answer

A qualified oil and gas communications design has seven linked evidence sets:

accepted service = asset and application dossier
                 + local autonomy and safe degraded mode
                 + authorized satellite path and terminal
                 + engineered power and physical installation
                 + segmented and secured network
                 + failure, support, and lifecycle plan
                 + witnessed application acceptance tests

Do not award from an orbit label, provider brand, “VSAT” label, public coverage map, or one speed test. None of those alone defines the purchased capacity, application behavior, site authorization, hazardous-area suitability, path independence, or recovery time.

Separate the Oil and Gas Operating Contexts

The same connectivity package should not be copied across every asset. Start by classifying the operating context and the consequence of lost communication.

Segment or asset	Typical communication functions	Design questions
Exploration camp or seismic program	Temporary field IT, survey data, voice, logistics, remote support	How quickly must the site move, what local data buffering is required, and which services remain after relocation?
Well pad or remote production site	Telemetry, alarms, historian transfer, maintenance access, surveillance	Which functions are supervisory, which must remain local, and how long may the site operate disconnected?
Drilling rig or offshore platform	OT data, company IT, vendor access, voice/video, crew welfare, logistics	Is the asset fixed or moving, where are hazardous areas, and which shared dependencies affect both WAN paths?
Pipeline valve, pump, or compressor station	Telemetry, leak-detection inputs, commands, maintenance	What reporting and command timing is required, and how are power, access, and sparse field maintenance handled?
Refinery, terminal, or tank farm	Terrestrial primary with satellite protection, remote sites, emergency coordination	Which terrestrial failures must the satellite path survive, and can the backup carry the defined degraded load?
Corporate or regional operations center	Fleet monitoring, security edge, application access, NOC and incident coordination	Where are the gateways, VPN concentrators, identity, DNS, logging, and application dependencies?

Satellite transport should not be treated as the control or protection function itself. Define which operations remain autonomous at the RTU, PLC, safety system, or local control layer when the WAN is delayed, degraded, or unavailable.

Build the Asset and Application Dossier

Issue every bidder the same dated input pack:

asset coordinates, operating area, fixed or moving status, lifecycle, ownership, and regulatory jurisdictions;
process function, operating modes, shutdown state, outage consequences, and approved local degraded operation;
applications, endpoints, protocol versions, initiation direction, authentication, time, DNS, and external dependencies;
normal and peak transaction rates, packet sizes, polling or subscription behavior, alarm bursts, file transfer, voice, video, and welfare demand;
maximum tolerable detection, transport, transaction, and recovery times for each application;
existing fiber, microwave, cellular, radio, satellite, or private-network paths and their common facilities;
OT zones, IT services, third-party access, logging, incident response, and data-handling requirements;
grid, generator, UPS, battery, renewable source, protection, environmental control, and measured load profile;
hazardous-area drawings, installation boundaries, structural and access constraints, lifting and permit requirements, and maintenance windows;
support locations, technician and spare availability, travel constraints, and required restoration time.

Convert the inputs into a traffic and criticality matrix:

Flow	Source and destination	Pattern and peak	Delay/loss requirement	Security zone	Outage consequence	Degraded mode
Telemetry and alarms
Supervisory commands
Historian replication
Remote maintenance
Voice and coordination
Video or large data
Enterprise and welfare
Network management

Do not infer capacity from a generic “SCADA bandwidth” value. Packet overhead, polling design, simultaneous events, encryption, retransmission, application timeouts, and competing traffic must be measured or reproduced for the actual system.

Map the End-to-End Service

An oil and gas satellite path normally crosses several owners:

instrument / RTU / PLC / application
        |
local OT network and security boundary
        |
site router, firewall, and satellite terminal
        |
satellite or constellation
        |
gateway, provider core, and terrestrial handoff
        |
enterprise security edge and application services

For every boundary, name the owner, configuration authority, monitoring source, support organization, acceptance point, and recovery method. An end-to-end outage can occur while the satellite carrier remains healthy, and a provider SLA may exclude the site LAN, power, public internet, enterprise VPN, or application.

Use the end-to-end architecture, terminal architecture, and ground segment references to build the responsibility map.

Treat SCADA as an Application, Not a Generic Traffic Class

SCADA is a system architecture, not one protocol or one traffic profile. Record the actual Modbus, DNP3, IEC telecontrol, OPC UA, proprietary, serial-gateway, or vendor implementation and its configured behavior.

The Modbus Organization publishes separate application, TCP/IP implementation, serial-line, and security documents. The DNP Users Group maintains DNP3 specifications and implementation material. The OPC Foundation publishes the multi-part OPC UA specifications, including security, alarms, historical access, PubSub, and role-based security. A protocol name therefore does not prove timeout, security, reporting, or interoperability behavior for a particular device pair.

For each master, outstation, gateway, and intermediate device, test:

connection establishment, keepalive, idle timeout, retry, duplicate handling, and reconnect behavior;
polling, event or report-by-exception, unsolicited reporting, subscription, alarm burst, and time synchronization;
transaction identifiers, sequence behavior, acknowledgement, buffering, timestamp retention, and replay after an outage;
authentication, encryption, certificates or keys, role enforcement, logging, and failure response;
maximum safe command age, operator feedback, stale-data indication, and local control behavior during isolation.

The detailed worksheet and acceptance sequence are in SCADA using satellite communication.

Keep Process Safety and WAN Availability Separate

A satellite link can transport supervisory data and commands. It should not silently become a safety dependency that the approved process design cannot tolerate losing.

Document:

which protective and closed-loop functions execute locally;
what happens when data is delayed, duplicated, reordered, stale, or unavailable;
how operators distinguish a communication failure from a process event;
which commands are blocked, confirmed, expired, or require local authorization during degraded conditions;
how buffered events preserve timestamps and are reconciled after reconnection;
the maximum communication outage permitted before an operational response is required.

NIST SP 800-82 Rev. 3 describes OT systems as having performance, reliability, and safety requirements that differ from conventional IT and provides guidance on architectures and countermeasures. Apply the relevant process-safety, functional-safety, company, and national requirements in addition to cybersecurity guidance.

Define the Hazardous-Area Boundary Before Selecting Hardware

Do not write “ATEX/IECEx required” as a global shortcut. First obtain the asset's approved area-classification drawings and the applicable legal and company requirements. Then determine what equipment, component, enclosure, gland, cable, installation activity, inspection, maintenance, and personnel competence fall inside that boundary.

The IECEx Certified Equipment Scheme covers conformity assessment of equipment for explosive atmospheres through approved certification bodies and laboratories. IECEx also states that certification of a service facility is not certification of a particular installation or area classification. In the European Union, Directive 2014/34/EU addresses equipment and protective systems intended for use in potentially explosive atmospheres. These are related but not interchangeable approval claims.

Require an equipment schedule that records:

exact manufacturer, model, revision, certificate and schedule, marking, protection concept, group, category or equipment protection level, temperature class, ambient range, and special conditions of use as applicable;
proposed installation zone and location, enclosure and interface details, cables and glands, earthing or bonding, inspection, maintenance, and repair requirements;
certificate validity and online verification, responsible designer, installer and inspector, deviations, and acceptance evidence.

Moving electronics outside a classified area can simplify the design, but only the approved site engineering can establish whether the antenna, RF equipment, cables, penetrations, and maintenance activities remain compliant.

Select Orbit, Band, and Service from Measured Requirements

GEO, MEO, and LEO can all be candidates. C-, Ku-, and Ka-band can all appear in oil and gas networks. None is a universal answer.

Compare exact offers using:

authorized countries, coordinates, offshore zones, fixed or in-motion operation, and terminal eligibility;
satellite or constellation path, coverage geometry, gateway and terrestrial routing where disclosed, and planned changes;
committed and maximum rates, contention, precedence, data policy, congestion treatment, and measurement method;
delay, variation, loss, availability, and recovery distributions at named end-to-end points;
terminal model, environmental limits, power states, software lifecycle, management access, and spares;
public, private, or shared addressing; IPv4/IPv6; inbound behavior; VPN compatibility; and persistence conditions;
NOC ownership, alarm visibility, support hours, field response, restoration, and change control.

The ITU Radio Regulations, 2024 edition provide the international spectrum and radio-service framework but do not replace national authorization. For Earth-space propagation prediction, use ITU-R P.618-14 with the applicable companion recommendations and actual site, frequency, geometry, and availability inputs. Do not copy a generic rain margin or band recommendation from another field.

Engineer Power and the Physical Site as Part of Availability

Build a measured load schedule for normal startup, transmit, standby, degraded, recovery, and environmental-control states. Include the terminal, RF chain, router, firewall, switch, local computing, instrumentation gateways, cooling or heating, and conversion losses.

Specify:

primary and alternate generation, transfer logic, UPS or battery boundary, autonomy, recharge, maintenance bypass, and load shedding;
earthing or bonding, isolation, surge and lightning protection, cable routing and entry, and interaction with site protection systems;
structural loads, foundation or mount, antenna horizon, obstruction, RF exposure, safe access, lifting, and work permits;
temperature, dust, water, salt, corrosion, vibration, drainage, condensation, enclosure heat rejection, and inspection regime;
spare holdings, storage limits, configuration and certificate control, replacement time, and return logistics.

Avoid universal terminal diameter, power draw, temperature range, material, ingress rating, or battery-duration claims. Use the actual datasheet, link budget, environmental study, electrical design, area classification, and maintenance strategy.

Secure the OT Boundary and Third-Party Access

Treat every satellite and terrestrial WAN as untrusted transport. Segment process-control, safety-related, site operations, enterprise IT, welfare, vendor access, and network management according to the approved architecture.

NIST SP 800-82 Rev. 3 provides OT security guidance, while CISA's ICS recommended practices include defense-in-depth and remote-access material. Apply them through the asset's risk-management and safety processes rather than as a generic configuration recipe.

For remote support, define:

accountable owner and approval for each access path;
authenticated user, managed device, jump point, destination, permitted action, and time window;
least-privilege policy, encryption, credential and certificate lifecycle, and vendor offboarding;
session logging or recording where required, alarm and review workflow, and emergency revocation;
an independent recovery method that does not bypass the security boundary.

Public addressing is not automatically required. A vessel- or site-initiated overlay, managed private network, or provider-assigned public service can each fit different needs. Record the actual route, translation, reachability, and failover behavior.

Design Resilience from Failure Domains

List the service-affecting events and the approved degraded response:

Failure event	Evidence required
Terminal or RF component	Spare or alternate path, alarm, replacement procedure, and restoration time
Antenna obstruction or physical damage	Diverse view or accepted outage, structural protection, and inspection response
Satellite, beam, or constellation path	Authorized alternate service and tested application recovery
Gateway or terrestrial handoff	Provider path-diversity evidence or accepted common dependency
Site power, rack, router, firewall, DNS, identity, or VPN	Independent protection or safe local degraded operation
Propagation or environmental event	Site-specific link evidence and path diversity appropriate to the event
Provider NOC, account, or support chain	Alternate escalation, configuration ownership, spares, and manual recovery
Cyber incident	Isolation, local operations, evidence preservation, restoration, and reauthorization plan

Two terminals are not independent if they share the failure being protected: mount, view, cable tray, power board, router, security edge, provider core, gateway, account, or support organization.

For protection-path engineering, use satellite backup for offshore operations, satellite diversity, and gateway diversity.

Procurement and Contract Schedule

Attach these items to the RFP and final service order:

Asset, process, application, traffic, environment, power, security, and support dossiers.
Exact service plan, authorized operating scope, terminal and software baseline, installation scope, and service chain.
Capacity and performance definitions with measurement points, sampling, aggregation, time basis, and access to raw evidence.
Availability, planned maintenance, exclusions, incident ownership, response, restoration, chronic-failure remedy, and termination rights.
Addressing, routing, VPN, DNS, identity, logging, data location and handling, third-party access, and cybersecurity responsibilities.
Hazardous-area and physical-installation deliverables, certification evidence, inspections, permits, training, spares, and lifecycle records.
Change control for satellite, gateway, terminal, software, plan, price, policy, service area, upstream provider, and security edge.
Ownership, warranty, renewal, suspension, data export, configuration handover, equipment return, removal, and site restoration.

Compare total cost over one operating scenario:

TCO = surveys, engineering, licences, and approvals
    + terminal, RF, network, power, enclosure, and civil works
    + freight, travel, lifting, installation, and commissioning
    + capacity, data, support, licences, and management
    + spares, inspections, maintenance, repairs, and field visits
    + changes, overage, escalation, relocation, and renewal
    + removal, restoration, data export, and exit obligations

Do not publish or rely on universal hardware, monthly-service, installation, or NOC cost ranges. Site access, certification, capacity, geography, term, tax, logistics, and service boundaries can dominate the comparison.

Acceptance Test Plan

Write test methods, safe conditions, pass/fail thresholds, witnesses, data ownership, and remedies before installation.

Document and Installation Acceptance

verify authorization, equipment identity, certificates, drawings, configuration, software, power, protection, mounting, cables, environmental controls, labels, inventory, spares, and inspection records;
confirm network zones, flows, firewall, routes, VPN, identity, DNS, time, logging, remote access, and recovery documentation;
demonstrate monitoring, alarms, support contacts, escalation, manuals, training, backup, and configuration restoration.

Application and Performance Acceptance

reproduce normal, peak, alarm-burst, maintenance, and degraded traffic states;
test polling or subscriptions, alarms, commands, historian transfer, voice, remote support, enterprise use, and welfare policy as applicable;
measure RF, terminal, IP, tunnel, transaction, and application outcomes at synchronized points;
confirm stale-data indication, buffering, timestamp retention, duplicate handling, reconnect, and safe local operation.

Failure and Recovery Acceptance

remove each approved dependency in a controlled manner, including WAN, terminal, router interface, power feed, VPN endpoint, DNS, or management path;
measure detection, policy decision, packet restoration, application recovery, alarm, escalation, repair, and failback separately;
verify that restricted traffic remains blocked and that restoration does not create an uncontrolled OT connection.

Operating-Period Evidence

Retain representative RF, network, power, environment, traffic, application, incident, and support data. Record unobserved conditions as open limitations; a short clear-weather test cannot prove an annual availability objective.

FAQ

What is the best satellite service for oil and gas operations?

There is no universal best service. Compare exact, purchasable offers against the asset's authorization, applications, safety boundary, hazardous-area design, power, environment, security, support, failure, and acceptance requirements.

Is VSAT suitable for oil and gas SCADA?

It can be, but “VSAT” does not define latency, capacity, availability, addressing, security, or application behavior. Test the actual protocol implementation and service between the real endpoints, including outage and recovery states.

Should an energy site use GEO or LEO?

Choose from measured application and service evidence. GEO and NGSO paths have different geometry and propagation characteristics, but the result also depends on the plan, terminal, gateway, routing, congestion, authorization, support, and contract.

Does satellite equipment need ATEX or IECEx certification?

The applicable site classification, jurisdiction, equipment location, and protection design determine the requirement. Verify the exact equipment certificate and schedule, special conditions, marking, installation, inspection, and lifecycle obligations. Do not treat IECEx, ATEX, an enclosure, or a component certificate as blanket approval of the installation.

How much bandwidth does a remote oil site need?

Calculate it from the actual traffic matrix, protocol behavior, reporting intervals, simultaneous events, encryption, retransmission, and competing voice, video, enterprise, and welfare loads. Preserve critical traffic under the purchased degraded capacity.

Does a second satellite terminal guarantee resilience?

No. Prove independence across antenna view, mount, power, cables, router, security edge, satellite path, gateway, terrestrial handoff, provider operations, and support. Then test the required applications during the failure.

SCADA Using Satellite Communication — protocol behavior, traffic design, security, and application testing
Oil Rig Satellite Internet — single-rig site, terminal, network, and acceptance design
Satellite Backup for Offshore Operations — failure domains, health checks, degraded traffic, and recovery
Offshore Satellite Connectivity — cross-industry fixed platforms, remote islands, and archipelago sites
Remote Site Network Monitoring — RF, terminal, IP, and application telemetry
Satellite Provider Evaluation — SLA, contract, support, and evidence comparison
Desert Infrastructure — heat, dust, off-grid power, access, and remote maintenance