In short. Every control system will eventually fail in some way. The design question is what happens next. Degraded modes define which functions continue, which stop and what operators must do, so that a failed controller or network never becomes an unplanned outage.
Failure modes
| Failure | Typical consequence | Desired degraded mode |
|---|---|---|
| PLC fault | Loss of coordination functions | Device controllers continue; manual sequences available |
| Network loss | Loss of remote and PMS commands | Local automatic operation |
| SCADA loss | Loss of visibility | Plant continues; local panels used |
| Control power loss | Breakers cannot operate | Backed up supply. See control power |
| Sensor fault | Wrong decisions | Voting or plausibility checks; block rather than act |
| Software error | Unexpected actions | Safe state on watchdog; independent protection |
Defining degraded modes
- List each control function and its dependencies.
- For each failure, decide which function remains.
- Define manual procedures that operators can follow.
- Define alarms that tell operators the plant is in a degraded mode.
- Define limits during degraded operation, such as maximum load or no paralleling.
- Define recovery steps back to normal.
Detecting lost redundancy
A redundant system running on one path looks normal. Monitor and alarm: single controller running, one network ring broken, one power supply down. See redundant control.
Manual operation
Provide local manual controls and written procedures for key actions: start, synchronise, transfer, shed. Train operators and drill. Keep keys, tools and procedures accessible.
Fail tests
- Remove each controller, network link and power supply in turn.
- Test combinations that happen together, such as a network fault during an outage.
- Check recovery: no unexpected breaker operations on return.
See acceptance framework.
Illustrative example
A plant tests loss of its PMS during a utility outage. Generators continue to share load via their own controllers, the ATS continues to transfer, and operators receive a “PMS offline” alarm and a checklist that sets manual load limits. Loads are restored by hand, and the PMS rejoins safely when repaired.
Plan the failures
Every control system will have a failure at some point. The question is whether the plant degrades safely or collapses. Define degraded modes in advance.
| Failure | Degraded mode |
|---|---|
| SCADA offline | Local HMI and controllers continue, operators use local panels |
| PLC fails | Redundant PLC takes over; if both fail, generator controllers use stand-alone logic |
| Communication bus fails | Sets revert to droop sharing and local protection |
| Control power loss | Breakers hold or fail to defined safe state |
| Sensor failure | Alarm, use redundant sensor, fall back to conservative logic |
| Controller software fault | Watchdog restart, hold last state |
Design rules
- Each level can operate without the level above.
- Critical signals duplicated or voted two out of three.
- Watchdogs between controllers with defined actions.
- Manual operation always possible at the equipment.
Test the degradation
At FAT, deliberately disconnect each component and record the plant response. Repeat after major changes. A degraded mode that has never been tested is an assumption.
Operator procedures
Write short procedures for each degraded mode and train staff. Include contact details for support. See redundant PLC architecture and fail-safe architecture.
The master engineering question
For each control component, what happens to the plant in the first second, the first hour and the first day after it fails?
What to send us
Send the control architecture. Send your application details.
Questions engineers ask
Is full redundancy always needed?
No. Good degraded modes can be better than complex redundancy.
Who writes manual procedures?
Engineering with operations, then tested by drills.
How do I know the plant is degraded?
Through explicit alarms and a status display.
What about cyber incidents?
Treat as a failure mode with its own response plan.
This guide gives general principles. Confirm with a project design.