Control hierarchy

The layers, bottom to top

Start at the cell and climb. Module boards inside each battery module measure per-cell voltage and temperature. A rack or string controller aggregates those boards, computes the string's state of charge and its charge and discharge current limits, and owns the DC contactors. A system- or bank-level master — badged a battery control system in some product lines — consolidates the racks in one enclosure into a single reported envelope. That three-tier stack is the Battery Management System, and its internals belong to that entry.

Beside it sits the PCS controller: converter firmware running the inner current and voltage loops plus the grid-support functions that carry the certification, UL 1741 SB against IEEE 1547-2018 for North American installations. Above both, the Energy Management System decides what the plant should do over minutes and hours, the Power Plant Controller makes the plant hit that decision at the point of interconnection, and SCADA supervises, historises and gives the operator a screen.

At the fence a remote terminal unit or protocol gateway translates the plant's tags into whatever the utility speaks, and beyond it arrives the system operator's dispatch instruction, automatic generation control signal or curtailment order.

The list reads like a ladder and it is not one. Two chains run in parallel with different jobs. The protection chain — cell sensing, rack controller, contactors, and alongside them the DC fuses, the protection relays and the fire and gas detection — exists to stop things, acts locally, and is deliberately built so it needs no permission from above. The dispatch chain — EMS, PPC, per-PCS setpoints — exists to start things and to size them, and it is the only chain that carries a target.

SCADA belongs to neither: it watches both, records both, and injects an operator's command into the dispatch chain, which is why the SCADA entry insists it must never be the sole safety path. Holding those two chains apart is the most useful thing this map does, because a good share of the arguments on a commissioning site are really arguments about which chain a particular function belongs to.

One more distinction before the rules. The control path and the data path are not the same route even where they share a cable: a command travelling down carries authority and needs an acknowledgement, while telemetry travelling up carries evidence and needs a timestamp. A plant can have complete telemetry and no working control path, and that failure presents as a healthy screen above a plant that ignores its setpoint.

Commands descend, limits ascend

The downward path is a chain of clipping. A market instruction or a schedule arrives at the EMS, which turns it into a plant-level request weighed against state of charge, contracted throughput and whatever export limit the interconnection agreement imposes. The PPC takes that request as its POI target and trims the sum of the inverter setpoints to cover step-up, collector and auxiliary losses.

Each PCS receives its share and its own firmware clips again — against DC bus voltage, ambient temperature, grid voltage and its own thermal state. What finally reaches the cells is the smallest number any layer in that chain was willing to pass. Nothing in the descent can enlarge a number, and that single property is what makes it safe to assemble a plant's controls from four suppliers.

The upward path is aggregation, and it aggregates by worst case rather than by average. The rack controller derives its charge limit from the highest and coldest cell it can see and its discharge limit from the lowest and hottest, because every cell in a series string carries the same current — weakest-cell limitation in its control form. The bank master reports the combined envelope of the healthy strings.

The PCS reports its availability and its derates. The PPC assembles those into a P-Q envelope at the POI, and that envelope is what the EMS is permitted to plan against. Every one of those numbers is published as a bound and never as a target: a rack controller reporting 157 A of charge headroom — 0.5C on a 314 Ah string — is not asking for 157 A, it is saying that more than 157 A is not allowed.

Which gives the arbitration rule, and it is short: the most restrictive limit wins, and among protective limits the lowest layer's is unappealable. Unappealable for a physical reason rather than a procedural one — the layer nearest the hazard holds both the measurement that detects it, at millivolt cell-voltage and one-to-two-degree temperature resolution, and the actuator that stops it, the rack contactors rated for the full DC bus (typically up to 1500 VDC). Nothing above can reach that contactor faster than the controller wired to it.

A restriction imposed from above wins for the mirror-image reason: a curtailment order, an operator stop or a transfer trip from the substation all make the number smaller, and making a number smaller is always permitted. The case with no clean answer is two layers commanding the same quantity in the same direction — a PPC voltage loop and a PCS local volt-var loop regulating the same bus — and that is not an arbitration problem but a design error, with the loop separation that prevents it covered under the Power Plant Controller.

Every layer is slower than the one below it

Speed decides what a layer can be trusted with, and the layers differ by orders of magnitude. Inside the PCS, current control acts in sub-cycle to tens-of-milliseconds timeframes. Battery management scans cell voltages every 100 ms to 1 second and reports consolidated data upward every 1 to 5 seconds — an asymmetry that is deliberate, since protection decides locally and only summaries need to travel the plant network.

A Power Plant Controller executes on a 50 to 200 millisecond cycle and settles a P or Q step in roughly 1 to 5 seconds, with fast frequency products commonly asking for full response inside 0.25 to 1 second. SCADA polling and HMI updates land around 1 to 4 seconds. Above that, AGC and regulation signals refresh roughly every 2 to 6 seconds in most North American markets — ERCOT and PJM regulation signals on roughly a 2 to 4 second cadence — and EMS scheduling works in minutes and hours.

Set those against the events. Total fault clearing is a relay decision inside a cycle plus the breaker's interrupting time, commonly three or five cycles at medium voltage, which is 50 to 83 ms on a 60 Hz system and 60 to 100 ms at 50 Hz. IEEE 1547-2018 requires a North American distribution-connected resource to detect an unintentional island and cease to energise within 2 seconds. A cell entering thermal runaway does not wait for a poll cycle.

The rule that follows belongs in a specification: no protective function may live on a layer slower than the event it must catch, and no protective trip may depend on a message crossing a network. Detection is reported upward; the trip itself is local or hard-wired.

That is the same reasoning that keeps island detection inside the converter and keeps the fire and gas trip out of the SCADA server, and in the United States it is the layered chain NFPA 855 assumes exists beneath the control layers, with UL 9540 certifying the storage system as a product and the separate UL 9540A test method supplying the fire-propagation data.

Speed also decides what the records are worth. Because the layers sample at different rates, a sequence of events reconstructed after a trip is orderable only if every device shares one clock, which is why a GPS-disciplined source distributing NTP or IEEE 1588 PTP is a hierarchy requirement rather than a SCADA convenience — time synchronization owns that argument. Without it the honest answer to which device acted first is that nobody can tell, and on a plant where that answer decides who pays, the gap is expensive.

Where the boundaries get drawn is a scope decision

The functional layers are real; the boxes are negotiable. EMS and PPC frequently ship as two software layers on one hardened server, and some vendors sell an integrated EMS/SCADA. Bundling does not remove the split — it moves the interface inside a product, where it stops appearing on a scope matrix and starts being a support question.

So read the scope matrix and the points list rather than the brochure: which supplier provides which function, which signals each layer reads and writes and at what rate, which protocol runs on each hop — Modbus TCP at device level, DNP3 (IEEE 1815) or IEC 61850 inside the plant, DNP3 or ICCP/TASE.2 out to the utility — and the question that settles most disputes, which loop actually closes on the revenue meter.

Several of the upper layers' settings stop being tuning parameters the moment a study is submitted.

In North America the droop, deadband, ramp limits and voltage-control gains entered into the interconnection models become binding, and NERC MOD-026 and MOD-027 verification expects field settings to match them; NERC CIP shapes how the upper layers are networked for market-registered bulk-system plants, with IEC 62443 the common baseline for control-system hardening, and IEEE 2800 setting performance for transmission-connected inverter-based resources while IEEE 1547 covers distribution interconnection.

In the European Union the connection requirements descend from Commission Regulation (EU) 2016/631 into national grid codes and each TSO's own technical rules, so the binding document is the connection agreement written under those. Whichever jurisdiction, the consequence is the same: changing a setting in the upper layers may be a restudy rather than a site adjustment.

Every interface in the hierarchy needs a defined behaviour for when the link drops, and the answer differs by level. Loss of the utility link is not loss of the PPC, and loss of the PPC is not loss of the PCS.

Specify each one on its own — hold last setpoint, ramp to zero, revert to local voltage control, or open — with a timeout attached, and exercise them during commissioning rather than reading them in a manual. The restart sequence deserves the same treatment, because bringing auxiliaries, converters, telemetry and dispatch back in the wrong order is the kind of fault that only surfaces end to end.

How a hierarchy fails

Two failure shapes recur, and they are opposites. Inversion is a protective limit parked on a layer that cannot enforce it — an export limit implemented only as an EMS calculation, a temperature interlock that exists as a SCADA alarm, a cell-level bound expected of a controller that polls every few seconds. It passes every test run at normal speed and fails at the one speed that mattered.

The gap is a limit nobody owns, which is what a split between EMS, PPC and SCADA suppliers manufactures: each vendor assumes another handles POI voltage regulation, or curtailment enforcement, or the response to a lost market link, and the discovery arrives during witness testing with the schedule already committed.

Then there are the label problems. Hierarchy is an overloaded word on a battery site — the three-tier BMS stack inside the battery and the plant control stack from cells to system operator are both called one, and a specification that says the hierarchy without saying which one has said nothing.

Vendors relabel layers freely, from battery control system for the top BMS tier to site controller for something that is a PPC in all but name, so resolve every acronym against the drawing showing what it is wired to. Apply the same suspicion to the operator screen: a single pane of glass is a view, not a control path, and a plant whose only route to a setpoint runs through a SCADA server has put a supervisory layer where the dispatch chain was meant to be.

The last one is drift. Firmware moves at a different pace on each layer — a converter update from the PCS vendor, a BMS update from the battery supplier, an EMS release from the controls house — and each is tested against its own product rather than against the stack it sits in.

A limit that used to taper toward zero now steps; a fault word that was one bit is now two; a default reasserted by an update quietly replaces a commissioned setting. None of it shows in normal operation. That is why change control over a control hierarchy should name the interfaces rather than the products, and why the firmware version of every layer belongs in the same record as the settings it was commissioned with.