Remote Operation of Unattended Hydro Plants

Small hydro plants are expensive to staff and cheap to run. The economics push towards nobody on site, and the engineering has to catch up with that: every decision an absent operator would have made has to be either an algorithm, a designed failure response, or an accepted risk that somebody has written down.

We have built one such plant and operated it remotely, and we have taken the next step — a whole generating group from one room — to concept and specification.

What an unattended plant has to decide for itself

  • What it does when the link to the control room is lost entirely, and for how long it is allowed to keep running without one.
  • What it does when the controller restarts and finds the machine in a state it did not leave it in.
  • How it starts from cold when nobody is there to warm the oil system by hand.
  • Which remote commands are permitted at all, and what happens to the rest.
  • How the headwater is managed when inflow changes and no one is watching the basin.

These are questions answered in design, not discovered in service. The cold-start algorithm and the control modes behind the last one are described under Hydro Turbine Control and Protection.

Telecontrol is part of the plant

The unit is operated from a control room at another plant in the group. There is no operator in the machine hall. That single decision drives most of the architecture.

The link is four redundant encrypted channels — two terrestrial internet providers, a satellite link and GSM — carrying IEC 60870-5-104, with a communication controller at each end handling load distribution and failover. Start and stop, load setpoint, the daily load schedule and the choice of control algorithm are permitted from the remote station. Every other command is refused and filtered in the communication controller. A remote operator cannot reach into the unit and move something that was not on the list, which is a cheaper and more durable protection than any amount of network segmentation, because it survives a compromise of everything above it.

Links of this kind fail in ways that are not obvious. On this plant the GSM channel dropped periodically while the modem still reported a healthy signal from the base station, and stayed down for 30 to 120 minutes until it was power-cycled. That is not a fault redundancy testing finds; it is one a trend over ten days finds. We raised it with the network operator rather than papering over it with an automatic modem reset.

We test the telecontrol subsystem as a plant item: channels disconnected one at a time, then two at a time in different orders, then three, checking each time that the unit stays stable and that remote monitoring survives. Transfer between primary and backup channels has to be bumpless, and the only way to know it is is to break the primary while the machine is running.

The harder question is what the plant does when it loses the link to the head node entirely and runs blind until a process setpoint stops it. That behaviour should be a designed decision, not a discovered one.

Watching the civil works, not just the machine

On a hydro plant the dam, the intake and the penstock fail more slowly than the unit does, and more expensively. The instrumentation that watches them belongs in the same system:

  • Piezometer boreholes in the dam, read continuously rather than walked monthly with a dip meter.
  • Radar level in the settling basin, brought back to the unit cabinet over fibre, driving a control loop that holds headwater level by moving the unit's load. The machine follows the water, rather than the water being managed around the machine.
  • Headwater and tailwater level, from which net head is computed continuously — the measurement the governor needs to stay tuned across a seasonal head range.
  • Differential pressure across the trash racks. A rising differential is debris, and it costs head directly; without the measurement it shows up only as an unexplained loss of output.
  • Frazil ice at the intake on cold-climate plants, which no other instrument will warn you about.
  • Water level at the intake, with automatic control of the bypass and spill valves.
  • An autonomous drone with its own charging station and weather station, flying a fixed route on a schedule with no operator present and uploading to the archive server automatically.
  • Process video, with motion detection raising an alert at the remote control room.

All of it feeds a plant performance and condition subsystem that computes running hours, assesses equipment condition and produces maintenance recommendations, with an interface into the owner's maintenance management system.

One control room for a whole group

We were asked to work out what it would take to operate four hydro plants and a photovoltaic station from a single control room, and produced the concept and the specification for it. The study was taken to concept and specification and was not built.

What it covered:

At the control room. Archive and calculation servers, operator and engineering stations, communication equipment, the MES layer and its interface to the owner's maintenance management system, video walls and surveillance.

At each plant, graded by what was already there. Two of the sites needed new unit and electrical control, local control panels, instrumentation, cable routes, changes to existing valve and drive assemblies, changes to the 6 kV switchgear cells, modification of the electro-hydraulic turbine control, and vibration and overspeed protection. The other two already had modern unit control and needed only communication equipment, digital and hard-wired links for start, stop and setpoints, and extensions to the auxiliary and drainage drive assemblies.

At the photovoltaic station. Changes to the existing system to export data and accept setpoints, communications equipment, and configuration at the dispatching end — with a frank note in the study that the installed SCADA was old enough that an upgrade or replacement would probably be needed to retain local control and local archiving.

What was deliberately excluded. Civil works, control room furnishing and display walls, new electrical equipment and new drive assemblies. A concept study that quietly includes everything is not a concept study; it is a wish.

The same architecture — several sites dispatched as one — is what we built and ran for seven years on a CHP plant, a photovoltaic station and a wind farm, described under Virtual Power Plant. The security side of operating a plant over somebody else's network is under Control System Cyber Security.