In short. A control hierarchy defines what each level decides and who may override whom. Field devices act, bay or device controllers protect and sequence, plant controllers coordinate, and supervision observes and sets targets. Conflicts arise when two levels command the same thing.
Levels
| Level | Typical equipment | Decides |
|---|---|---|
| 0 Field | CTs, VTs, breakers, sensors, actuators | Nothing; measures and acts |
| 1 Device | Protection relays, generator controllers, ATS controllers, AVR, governor | Local protection and basic sequences |
| 2 Plant | PLC, PMS, synchronising and load-sharing controllers | Coordination across devices |
| 3 Supervisory | SCADA, HMI, historian | Operator commands, set points, alarms |
| 4 Enterprise | EMS, analytics, maintenance systems | Strategy, scheduling, reporting |
Authority rules
- A lower level always keeps protection authority. Higher levels may request, never force, an unsafe action.
- Each controllable object has one owner at a time. If both a plant PLC and a generator controller command the breaker, define which wins in each mode.
- Mode selection (local, remote, automatic) is visible at each level and recorded.
- Command from higher levels is checked against permissives at the lower level.
Interfaces
Every interface between levels should be defined: which signals, which protocol, which update time, and what the lower level does if the signal stops. Hard-wired signals suit trips and permissives. Network signals suit status, measurements and set points. See communication protocols.
Typical conflicts
- PLC load sharing fighting the generator controller’s own sharing.
- SCADA set point overwritten by an EMS schedule.
- Two sync-check devices with different windows.
- Remote command accepted while local maintenance mode is on.
Documenting the hierarchy
- Draw a control architecture diagram with all controllers and networks.
- List each function and its owner at each level.
- Write a cause-and-effect table. See cause and effect.
- Define fallback behaviour on loss of each link.
Illustrative example
Three generators have their own controllers with built-in sharing. A new PLC is added to run automatic start and stop. Instead of taking over the sharing, the PLC only sends start, stop and set point requests, and the generator controllers continue to share load. When the PLC is switched off, the generators remain stable.
Who decides what
A control hierarchy assigns each decision to one level and gives the other levels a clear role: command, permit or monitor.
| Decision | Owner | Others |
|---|---|---|
| Trip a breaker on fault | Protection relay | PLC monitors |
| Close generator breaker on dead bus | Generator controller with permissive from PLC | Protection can block |
| Start next generator on rising demand | Power management system | Controller executes |
| Change operating mode | Operator at HMI | PLC enforces permissives |
| Dispatch by price or schedule | Energy management | Plant control accepts or rejects |
Design principles
- Single authority per decision. Two controllers commanding the same breaker produce conflicts.
- Local overrides remote. A person at the equipment can always take control.
- Hardwired for safety. Emergency stop and key interlocks do not pass through software.
- Defined fallback. Each level states what it does if the level above fails.
Control mode matrix
Define every mode (local, remote, automatic, test) and who may change it. Display the active mode clearly on the HMI. See control philosophy.
Document before you build
Write a functional design specification and a cause-and-effect chart before programming. See cause-and-effect engineering.
The master engineering question
For every command that can change the state of the plant, who is allowed to issue it, who is allowed to refuse it, and what happens if both do something different?
What to send us
Send controller lists and any existing diagrams. Send your application details.
Questions engineers ask
Should the PLC replace generator controllers?
Usually not. Use the PLC to coordinate and keep device controllers for local protection and control.
What is an override?
A command or mode that takes priority over normal automation, such as emergency stop or local manual.
How many levels do I need?
As many as the plant complexity justifies. A single set needs only levels 0 and 1.
Hard-wired or network?
Hard-wire safety and fast signals. Use networks for the rest.
This guide gives general principles. Confirm with a project-specific design.