In short. A control philosophy states, for each device, who can operate it in each mode, which mode wins when they disagree and how the plant moves between modes safely. Without it, operators and automation can issue conflicting commands at exactly the wrong time.
The four modes
| Mode | Who commands | Typical use |
|---|---|---|
| Local manual | Person at the equipment | Maintenance, testing, emergency |
| Local automatic | Device controller | Standby, AMF, protection |
| Remote | Operator through SCADA or HMI | Control room operation |
| Supervisory automatic | Plant controller or EMS | Dispatch, sequencing, scheduling |
Priority rules
- Protection and emergency stop override all modes.
- Local manual overrides remote and supervisory, so a person at the equipment is never surprised.
- Remote overrides supervisory automatic, with an alarm.
- Supervisory automatic works within permissives set by device controllers.
Mode changes
- Changes should be deliberate, visible and logged.
- When local manual is selected, remote commands are blocked and the plant knows it.
- When returning to automatic, the controller checks the state first, for example breaker positions and source availability, before resuming.
- A device left in manual after a test is a common cause of failed standby. Raise an alarm when a standby generator is not in AUTO. See ATS and AMF logic.
Safety and maintenance
Lock-out and isolation must work independently of the mode. A remote start command should be impossible while a maintenance lock is applied. See interlocking and permissives.
Authority at the boundary of the plant
Decide who owns decisions at the points where a person, a controller and a utility meet. For example, utility instructions on export or parallel operation may limit what the plant controller can do. See interconnection studies.
Illustrative example
A technician selects manual on a generator for a test. The control room, unaware, tries to start the set for a scheduled run. Because the philosophy blocks remote commands in local manual and displays “LOCAL” on the mimic, the command is refused with an alarm, and the technician is not at risk.
Four ways to control the same breaker
| Mode | Where the command comes from | Typical use |
|---|---|---|
| Local (at device) | Push button or selector at the panel | Maintenance, commissioning, emergency |
| Remote (manual) | Operator at HMI or control room | Planned switching |
| Automatic | Programmed logic responds to conditions | Mains failure, load changes |
| Supervisory | Higher system sets targets or schedules | Energy dispatch, demand limits |
Rules for a clean philosophy
- Only one mode is active per device at a time.
- Mode changes are deliberate, logged and visible.
- Local mode blocks remote and automatic commands, and raises an alarm so that a unit left in local is not forgotten.
- A return to automatic after maintenance follows a checklist, with the controller confirming healthy status.
Bumpless transfer between modes
Switching from manual to automatic should not cause a jump in output. The controller picks up the present state and then adjusts.
Common failure
A generator left in manual after a test, so the next mains failure finds no automatic start. The remedy is a persistent alarm, an automatic return timer where safe, and a pre-event checklist.
See control hierarchy and interlocking and permissive logic.
The master engineering question
At this moment, in this mode, who has the authority to operate this device, and does everyone who could be affected know it?
What to send us
Send your operating modes and any site safety rules. Send your application details.
Questions engineers ask
Should remote start always be possible?
Only when permissives and safety conditions allow it, and never against a local lockout.
What if the control room loses communication?
The plant should continue in local automatic, as defined.
Who may change modes?
Authorised persons only, with access control and a log.
How do I stop a set staying in manual?
Add a standby-not-ready alarm and test AUTO state in routine checks.
This guide gives general principles. Mode rules should match site safety procedures.