In short. Control power is the supply that lets protection, breakers and controllers act when the main supply is gone. If it fails, the plant cannot trip, close or start. A good design has redundant supplies, monitored batteries and a defined safe state for every device on loss of power or signal.
Why it matters
A breaker that needs power to trip is useless in a blackout with a dead control battery. A generator that needs a charged battery to crank has zero capacity if that battery is flat. Control power is often the real single point of failure.
Architecture
| Element | Good practice |
|---|---|
| DC system | Two chargers and battery sets, or a battery with redundant chargers, with diode or ORing isolation |
| AC control supply | From UPS or inverter backed by the DC system |
| Distribution | Separate circuits for protection, control and signalling, with fuses or breakers |
| Monitoring | Voltage, earth-fault detection, charger status, battery temperature |
| Starting batteries | Separate from control batteries or with isolation, monitored |
Battery sizing
Size for the load during an outage: continuous control and relay load plus the momentary load of tripping and closing, with ageing and temperature allowances. Test capacity periodically, as voltage alone does not prove health.
Fail-safe states
- Define for each output whether loss of power means open, close or hold.
- Prefer trip-on-loss only where it does not create a worse hazard.
- Use normally-energised signals where wire break should be detected.
- Define PLC output state on controller failure.
- Define generator behaviour on loss of control signal: continue, shed or stop.
Earth faults on DC
An undetected DC earth fault can cause a mal-operation on the second fault. Use earth-fault monitoring and alarm.
Common-cause risks
- Both chargers fed from one source.
- Both battery sets in one hot cabinet.
- One DC distribution board feeding both redundant breakers.
See single-point-of-failure analysis and battery starting system.
Illustrative example
During a long outage, a plant’s control batteries discharge while chargers have no supply. After a year, the batteries had aged, and the control power lasted only 40 minutes instead of 8 hours. A load test of the battery set, a monitored charger on the generator-backed supply and a low-voltage alarm close the gap.
Control power is the weakest link
Everything in a control system depends on its power. A well-designed PLC with a failing supply is not available. Design control power as carefully as the power it controls.
| Element | Practice |
|---|---|
| DC battery and charger | Sized for autonomy, with alarms and supervision |
| Redundant supplies | Two chargers and batteries for critical sites, diode-OR or A/B feeds |
| Separate circuits | Protection, control, closing, alarms and communications on separate fused circuits |
| UPS for PLC and network | Short autonomy plus orderly shutdown |
| Supervision | Earth fault detection, undervoltage alarm, fuse-failure alarm |
Fail-safe design
Choose what each device does when power or signal is lost.
- Breakers: hold their position, or trip, depending on function.
- Generators: fail to run for a standby set, or fail to stop only where safety demands it.
- Valves: fail open or closed according to the hazard, for example a fuel shutoff valve closes.
Autonomy calculation (illustrative)
Battery capacity (Ah) ≥ load current × hours ÷ (usable fraction × ageing × temperature factors)
A 10 A load for 8 hours needs 80 Ah. With a 0.8 usable fraction, 0.8 ageing and 0.9 temperature factors, capacity is 80 ÷ 0.576 ≈ 139 Ah, so select 150 Ah.
See DC control power and degraded modes.
The master engineering question
If every main supply is lost for the full design outage, can the plant still trip, close and start, and how do we know the batteries can do it?
What to send us
Send control-power drawings and battery data. Send your application details.
Questions engineers ask
How long should control batteries last?
Set by the outage philosophy; many sites design for several hours.
Why monitor DC earth faults?
A second fault can cause false operation or block operation.
Can control and starting batteries be shared?
Better separate, or with isolation, so cranking does not disturb controls.
How often to test?
Capacity and function tests per manufacturer and site policy.
This guide gives general principles. Follow manufacturer data and standards.