In short. Power control is a stack: protection and interlocks at the bottom, local automatic control above them, then supervision, energy management and analytics. The lower layers must keep the plant safe and running when the upper layers are lost. Intelligence is added on top, never in place of, basic protection.
The control stack
| Layer | Function | Must work if the layer above fails? |
|---|---|---|
| 1. Protection and interlocks | Detect faults, prevent unsafe switching | Always |
| 2. Device control | Generator controller, ATS controller, breaker control | Yes, in local automatic mode |
| 3. Plant control | PLC, synchronising, load sharing, load shedding | Yes, with degraded features |
| 4. Supervision | SCADA, HMI, alarms, events | Plant continues; operators lose visibility |
| 5. Energy and asset intelligence | EMS, dispatch, trends, prediction | Plant continues on fixed settings |
Sequence of thinking
A useful way to design or review a control system follows the chain: signal → decision → command → action → feedback → verification. Each link can fail on its own. A voltage sensor gives a signal, logic decides, a relay commands, a breaker acts, an auxiliary contact reports back, and the controller verifies the result before moving to the next step.
Design principles
- Fail to a known safe state. A lost signal should lead to a defined result, not an undefined one. See fail-safe architecture.
- Keep safety hard-wired. Interlocks that prevent paralleling out of phase or closing onto earth should not depend on software alone. See interlocking.
- Separate control from supervision. A SCADA failure must not stop a generator from sharing load.
- Define modes. Local, remote, automatic and manual, with clear authority. See control philosophy.
- Design for the degraded case. See degraded modes.
Where intelligence adds value
- Choosing how many generators to run for the present load.
- Coordinating batteries, solar and generators. See EMS architecture.
- Detecting drift in start time, fuel use or temperature before a failure.
- Recording sequences of events for investigation.
Illustrative example
A site has an AMF panel, a generator controller and a SCADA screen. During a test the SCADA server is down. Because the AMF logic and generator controller are independent, the generator still starts and transfers on mains failure; only remote monitoring is lost. In a second site, transfer logic lives only in a central PLC, and a PLC fault stops transfer entirely. The first design follows the stack; the second does not.
Five layers, one chain of command
| Layer | Typical devices | Time scale |
|---|---|---|
| Protection | Relays, breaker trip circuits | Milliseconds |
| Local control | Generator controllers, ATS controllers, synchronisers | 10 ms to seconds |
| Plant control | PLC, power management system | Hundreds of ms to seconds |
| Supervision | SCADA, HMI, alarms, historian | Seconds to minutes |
| Optimisation | Energy management, analytics, scheduling | Minutes to hours |
The rule that keeps the stack safe
Faster layers must never depend on slower ones. Protection works without the PLC. Local generator control works without SCADA. If SCADA is lost, the plant keeps running in its last safe mode. Each layer adds intelligence but removes nothing from the layer below.
Where automation earns its cost
- Faster, repeatable transfers and starts than an operator can achieve.
- Coordinated load shedding before the generator stalls.
- Efficient dispatch: fewer sets running, each at a healthier load.
- Event data that turns every trip into a lesson.
Where automation adds risk
- Over-complex logic nobody can maintain.
- Software changes made without testing or records.
- Network connections that create cyber exposure.
Selection logic
Choose the simplest architecture that meets the availability and operating need. A single generator with an ATS needs a good controller, not a plant-wide PLC. A multi-set plant with paralleling needs a power management system. See the selection guide and control hierarchy.
The master engineering question
If any one controller, network link or power supply fails at the worst moment, which functions continue, which degrade and which stop, and is that what the site has decided it can accept?
What to send us
Send your single-line diagram and a list of existing controllers. Send your application details.
Questions engineers ask
Do I need a PLC for a standby generator?
Not for a single set with an AMF controller. PLCs help when several sources and loads must be coordinated.
Is SCADA required?
No, but it helps with trends, alarms and records for larger or critical sites.
Where does protection sit?
At the bottom, independent of the automation above it.
Can control be upgraded in stages?
Yes, if the lower layers are kept stable and interfaces are defined. See brownfield modernisation.
This guide gives general principles. Specific designs need engineering review.