Control systemThere are couple major players in this industry, each are specifically tailored to the power industry, the specifics are intentionally left out.
The control system has a unique layout:
- Organized into what's called drops. Each drop has two completely separate, but redundant controllers/processors, each individual controller has redundant networking, with redundant power supplies. The redundant controllers have redundant networking between the pair (one of which is separate from the above), this is how they stay in sync, you can turn controllers off back and forth without losing control.
- All networking switches are redundant, you can unplug entire switches without losing control.
- Each drops redundant power supplies are fed from separate 30kva UPSs, with a bank of batteries bigger than most garages. In the event the UPS faults, the load is automagically switched to AC, fast enough nothing is dropped. The UPS batteries are separate from the station DC bus, which is the last line of defense when all else fails. (which I've seen)
- Each drop has cages of I/O cards. Each cage can hold just about any type of I/O and can be mixed. Common I/O types are digital in/out, 4-20ma in/out, serial, Ethernet, proprietary communication etc. Critical plant I/O is triple redundant, going to different drops in-case an entire drop is lost.
- I/O is polled at specific intervals and varies depending on purpose. Normal non critical stuff usually once per second with turbine I/O at 100ms or faster.
- Most I/O can be hot swapped, depending on what it's controlling.
- Each drop is a standalone entity and will continue the best it can, when neighboring drops fail, even if portions of it's logic depend on I/O points from other drops. Some are programmed with heartbeats to detect certain conditions so the entire plant can be automatically taken down in the event of uncontrollable loss.
- Controllers/Processors run a tailored version of VxWorks on Intel x86 hardware. These are programmed via Solaris Sparc workstations in a logical (think AND/OR gate) type symbols on "logic sheets". Imagine functional drawings of 74 series logic and you'll have a pretty good idea.
- Logic can be modified on-the-fly, but is generally only done online in not critical areas to reduce the risk. Just in-case one of those once in a million, stars are aligned type of events happen.
- The entire control system network is physically separated from the outside world, there is no hacking in taking control by some unknown person 5000 miles away. You'd have to drive to the plant, physically plug into a free network port, which would do you no good since free ports are disabled. To even get to this point you'd have to cut one of my fingers off (not telling which one) to open the biometic lock on the door.
Obviously a brief overview of an incredibly complex beast. The control system drives 30,000+ physical I/O points, from small solenoids in 1/4" tubing, to 10,000HP electric motors, to 500kv switch yard breakers, including some 150,000+ internal data points. Note modern day coal/combine cycle plants will have 5x the physical I/O.
Even with all of this redundancy and complexity there are hard wired sensors with direct control (outside of the control system) of specific breakers to instantly stop all fuel to the boiler, or stop the turbine in the event of a complete loss of the control system. The boiler can melt within just a few seconds of cooling water loss and the generator is filled with hydrogen gas, something we'd all prefer say together! I don't recall which plant it was, but this has happened here in the US many years ago, it blew the entire plant to pieces on a hydrogen generator explosion.
Questions, please ask.
