Monitoring, Automation, and Intelligent Control

Introduction

IoT-enabled electrical systems combine sensing, communication, computation, control, and human supervision. A smart building, substation, manufacturing line, or microgrid does not become intelligent merely by connecting equipment to a network. It must measure relevant variables, interpret them in context, make decisions within required time limits, and act safely when measurements, networks, or software fail.

This chapter examines the integration of IoT with feedback control, programmable logic controllers (PLCs), supervisory control and data acquisition (SCADA), distributed control systems (DCSs), event-driven automation, alarm management, and human-machine interfaces (HMIs). Particular attention is given to stability, latency, deterministic operation, fail-safe behavior, remote supervision, cybersecurity, and closed-loop performance.

Learning Objectives

After studying this chapter, the reader should be able to:

1. Explain the structure and purpose of feedback control in IoT-based electrical systems.
2. Distinguish PLC, SCADA, DCS, edge, and cloud functions.
3. Analyze the effects of sampling, communication delay, jitter, and packet loss on control.
4. Design event-driven sequences, alarms, and HMI displays using sound engineering practice.
5. Select fail-safe and fault-tolerant strategies for remote and distributed operation.
6. Evaluate closed-loop performance using transient and steady-state measures.
7. Apply these principles to an industrial electrical-energy management scenario.

1. From Monitoring to Intelligent Control

Monitoring observes system variables such as voltage, current, power, temperature, frequency, vibration, breaker position, and energy consumption. Automation uses measurements to execute predefined actions. Intelligent control adds context, prediction, optimization, or adaptation while remaining subject to engineering constraints.

A useful hierarchy is:

The hierarchy is not a rigid rule. Modern systems distribute computation between field devices, edge computers, and cloud platforms. However, protection and fast control should not depend on an Internet connection. A practical design assigns each function to the lowest layer capable of performing it safely and reliably.

2. Feedback Control Fundamentals

A feedback loop compares a desired reference with a measured output. Let r(t) be the reference, y(t) the measured output, and e(t) the error. The error is

A controller uses e(t) to calculate a command u(t) for an actuator. The plant is the physical process being controlled, and a sensor measures its output. Disturbances, represented by d(t), affect the plant independently of the controller.

For a linear time-invariant single-input, single-output system, the closed-loop transfer function under negative unity feedback is

where G(s) is the plant transfer function, C(s) is the controller transfer function, s is the Laplace variable, R(s) is the reference transform, and Y(s) is the output transform. This expression assumes linear models, zero initial conditions, unity sensor gain, and negative feedback.

The characteristic equation is

Its roots, called closed-loop poles, determine stability and much of the transient response. A continuous-time system is asymptotically stable when all closed-loop poles lie strictly in the left half of the complex s-plane. Real systems may be nonlinear, time-varying, saturated, or subject to delays, so this criterion is a model-based approximation rather than a guarantee under every operating condition.

PID control

A widely used controller is proportional-integral-derivative (PID) control:

Here Kₚ is the proportional gain, Kᵢ is the integral gain, Kᵈ is the derivative gain, and u(t) is the controller output. Kₚ, Kᵢ, and Kᵈ must be selected with units consistent with the controlled variable and actuator. The proportional term responds to present error, the integral term removes persistent error for suitable plants, and the derivative term anticipates changing error.

Digital controllers use sampled data. With sampling interval Tₛ and sample index k, a basic discrete approximation is

This form assumes a sufficiently fast and approximately uniform sampling interval, a linear incremental approximation, and no special anti-windup or filtering. In practice, derivative action is commonly filtered because measurement noise is amplified by differentiation. Integral windup must be prevented when the actuator saturates; otherwise the stored integral term can cause excessive overshoot and delayed recovery.

Performance measures

For a step reference, common measures include rise time, peak time, settling time, maximum overshoot, and steady-state error. If y∞ is the final value and ymax is the maximum value, percentage overshoot is

This definition assumes y∞ is nonzero and a positive step response is being assessed. Settling time is the time after which the output remains within a specified band, commonly ±2% or ±5% of the final value. The band must always be stated because different specifications produce different settling times.

3. IoT Control Architecture

An IoT control architecture normally contains sensors, signal conditioning, a controller, actuators, a communication network, data services, and an HMI. Sensors may be analog, digital, wireless, or embedded in intelligent meters. Signal conditioning provides isolation, filtering, scaling, and conversion. The controller executes control logic, while the actuator changes the physical process.

Figure: A layered IoT feedback architecture. Fast control remains local while supervisory services provide broader visibility and optimization.

The control loop should be closed locally whenever delay or communication loss could compromise safety or performance. Cloud systems are valuable for historical analysis, fleet comparison, maintenance prediction, and noncritical optimization, but they are generally unsuitable as the sole mechanism for fast protection or motion control.

4. PLC, SCADA, and Distributed Control

A PLC repeatedly executes a scan: input acquisition, program execution, output update, and diagnostic tasks. The scan time must be known or bounded for time-critical applications. PLC programming commonly uses ladder diagrams, function-block diagrams, structured text, and sequential function charts. Interlocks, permissives, timers, counters, and state machines are central to reliable automation.

SCADA systems collect data from PLCs, remote terminal units (RTUs), meters, and protection devices. They present process graphics, trends, alarms, commands, and reports. SCADA is supervisory: it normally does not replace local control or protection. A historian stores time-stamped values for performance assessment and event reconstruction.

A DCS distributes control among interconnected controllers, often for continuous processes with extensive regulatory control. PLCs are traditionally associated with discrete and machine control, although modern PLCs also perform advanced process control. The distinction is therefore functional rather than absolute.

Distributed control introduces several engineering concerns:

• time synchronization and trustworthy timestamps;
• ownership of commands when multiple operators or services act simultaneously;
• configuration consistency across devices;
• network redundancy and recovery behavior;
• coordination between local automatic modes and remote supervisory commands.

5. Sampling, Latency, and Determinism

A digital control loop contains sensing, computation, communication, actuation, and physical response delays. Let total delay be

where each term is a nonnegative time interval. The equation is a timing budget, not a dynamic model. In a real system, each term may vary; variation is called jitter.

Latency reduces phase margin and can destabilize a loop, particularly when the plant is fast or lightly damped. A network may have excellent average latency but unacceptable maximum latency. Control requirements should therefore specify worst-case or high-percentile delay, jitter, packet-loss behavior, and recovery time—not only average values.

Deterministic operation means that an action occurs within a bounded and predictable time. Industrial Ethernet with suitable scheduling, time-sensitive networking, local fieldbuses, and real-time operating systems can improve determinism. However, protocol capability alone does not prove that a complete application is deterministic. Device queues, switch loading, operating-system scheduling, wireless interference, and software execution time must also be assessed.

Sampling must be fast enough to represent the relevant dynamics. The Nyquist condition for a band-limited signal requires a sampling frequency greater than twice its highest frequency component. In practical control, sampling substantially faster than this theoretical minimum is normally selected to allow filtering, computation, and phase-margin preservation. Anti-alias filtering is required before analog-to-digital conversion when higher-frequency components could fold into the measured band.

6. Event-Driven Automation and State-Based Design

A cyclic controller evaluates logic periodically. An event-driven controller responds to transitions such as overcurrent, loss of communication, door opening, utility failure, or restoration of a permissive. Events are useful when immediate response and clear causal records are important, but poorly designed event systems can produce race conditions, duplicate commands, or alarm floods.

A state machine provides a disciplined model. Typical states are Off, Starting, Running, Stopping, Fault, and Manual. Transitions require explicit conditions, and each state defines permitted outputs. For example, a motor may transition from Starting to Running only after a run command is present, all permissives are healthy, and feedback confirms rotation. A fault transition should have defined reset conditions; simply clearing an alarm should not automatically restart hazardous equipment.

Good event design includes a unique event identifier, timestamp, source, severity, state before and after the event, operator action if applicable, and acknowledgement status. Sequence-of-events recording is especially valuable in protection and power-system disturbances, where milliseconds may distinguish cause from consequence.

7. Alarm Management and HMI Design

An alarm indicates an abnormal condition requiring operator awareness or action. It is not merely a piece of data. A high-temperature value may be a measurement, while “transformer temperature high—reduce load” is an alarm with an expected response.

Alarm systems should define priority, consequence, limit, delay, deadband, responsible role, and operator response. Chattering alarms can be reduced with hysteresis or a time delay, but these should not hide a rapidly dangerous condition. Alarm shelving must be controlled, recorded, and time limited.

A high-quality HMI presents the process hierarchy from overview to detail. It uses consistent symbols, units, colours, navigation, status indication, trends, and command confirmation. Colour should not be the sole carrier of meaning because of colour-vision limitations and poor visibility. Critical commands should show equipment identity, current state, requested action, permissives, and consequences.

Remote supervision must distinguish monitoring from control authority. A user may be permitted to view values but not issue commands. Role-based access, command logging, two-person authorization for high-risk actions, and local/remote selectors help prevent unsafe operation.

8. Fail-Safe, Fault Tolerance, and Cybersecurity

Fail-safe design moves equipment to a state that minimizes hazard when a fault occurs. For example, loss of an energizing signal may cause a valve to close or a contactor to drop out. The correct state depends on the process: a cooling system may need to remain on during a communication failure. Thus, fail-safe is a risk-based engineering decision, not a universal “turn everything off” rule.

Fault tolerance maintains service despite selected faults through redundancy, bypasses, watchdogs, and graceful degradation. Redundancy can be parallel, standby, or voting. It adds cost and complexity and can create common-cause failures if redundant channels share power, software, network paths, or environmental exposure.

Essential safeguards include independent emergency stops, hardwired or safety-rated interlocks where required, watchdog timers, bounded command validity, local fallback control, authenticated communication, network segmentation, least privilege, secure configuration backups, patch management, and tested recovery procedures. Safety functions should not be implemented solely in a general-purpose cloud application.

Cybersecurity and functional safety are related but distinct. Cybersecurity protects confidentiality, integrity, and availability against intentional or accidental actions. Functional safety reduces risk from dangerous failures. A secure system can still be unsafe if its control logic is wrong; a safe design can become unsafe if an attacker changes set points or disables alarms.

9. Closed-Loop Evaluation

Closed-loop performance should be evaluated using both normal-operation data and fault scenarios. Relevant metrics include:

• tracking error and steady-state error;
• overshoot, settling time, and oscillation;
• energy consumption and actuator activity;
• delay, jitter, packet loss, and controller scan time;
• alarm rate, nuisance-alarm rate, and response time;
• availability, mean time between failures, and recovery time;
• number and severity of unsafe or unauthorized commands.

For a sampled reference r[k] and output y[k], a useful root-mean-square tracking error over N samples is

This metric has the same units as the controlled variable. It is meaningful only when samples are comparable, the time interval is specified, and abnormal or missing data are treated explicitly. A low RMS error does not guarantee safety: a short but dangerous excursion can be hidden by long periods of good performance.

Worked example: energy-storage power control

An inverter is commanded to track a 50 kW reference. During five equally spaced samples, measured powers are 48, 52, 51, 49, and 50 kW. The errors are 2, −2, −1, 1, and 0 kW. Therefore,

The result indicates average tracking quality over this interval; it does not establish stability or compliance with a power-quality standard. Longer tests, disturbances, saturation, communication faults, and startup behavior must also be examined.

10. Illustrative Case: Smart Facility Microgrid

Background

Consider a university facility containing photovoltaic generation, a battery energy-storage system, HVAC loads, critical laboratory loads, and a utility connection. The facility has meters, protective relays, PLC-controlled breakers, a SCADA server, and an energy-management application.

Problem

The facility experiences peak-demand charges and occasional utility interruptions. An initial cloud-based controller reduces demand during normal operation but causes unacceptable delays during islanding. Operators also receive repeated alarms for transient communication failures and are uncertain whether a breaker command was accepted.

Analysis

Islanding and protection require local, deterministic action. Cloud round-trip delay is variable and cannot be included in the primary protection loop. The alarm problem is partly caused by treating every communication retry as a high-priority process alarm. The command problem results from missing command ownership, confirmation, and feedback states.

Approach and solution

The redesigned architecture uses local PLC and relay logic for under-frequency, overcurrent, breaker interlocking, battery limits, and islanding transitions. The energy-management application sends slower supervisory targets such as a demand limit or battery state-of-charge schedule. If supervisory communication fails, the PLC maintains a conservative local mode.

The HMI distinguishes Command Requested, Command Accepted, Command Executed, and Command Failed. Every command has an operator identity, timestamp, target, validity interval, and feedback requirement. Communication retries are recorded diagnostically, while a persistent loss that affects control is escalated as an actionable alarm.

A state machine defines Grid-Connected, Transitioning, Islanded, Resynchronizing, and Fault states. Resynchronization requires voltage magnitude, frequency, phase-angle, and protection permissives to be within approved limits. Automatic reconnection is inhibited if feedback is invalid.

Outcome

The arrangement preserves local protection during network failure, reduces nuisance alarms, and provides a traceable command history. Demand optimization remains possible without making cloud availability a safety dependency. Performance testing measures transition time, frequency deviation, battery current limits, recovery after PLC restart, and behavior during loss of each communication path.

Learning points

1. The fastest and most safety-critical functions belong at the edge or in dedicated protection equipment.
2. Supervisory optimization should degrade gracefully when data services fail.
3. State-based logic makes transitions, permissives, and recovery explicit.
4. Alarm quality depends on operator actionability, not alarm quantity.
5. A command is incomplete until its execution and feedback status are known.

11. Design and Commissioning Workflow

A professional project begins with a functional description and hazard analysis. Engineers identify controlled variables, manipulated variables, disturbances, safe states, performance requirements, and authority boundaries. They then prepare an I/O list, network and timing budget, control narrative, state diagrams, alarm philosophy, cybersecurity plan, and test specification.

Simulation or hardware-in-the-loop testing can expose unstable tuning, incorrect scaling, race conditions, and recovery errors before field deployment. Factory acceptance tests verify logic and interfaces; site acceptance tests verify wiring, sensors, actuators, protection coordination, network behavior, and operator procedures. Tests must include abnormal cases: sensor failure, stuck actuator, power loss, time synchronization failure, packet loss, invalid data, controller restart, and unauthorized command attempt.

During operation, change management is essential. Set-point changes, firmware updates, logic modifications, and alarm-limit adjustments should be approved, recorded, tested, and reversible. Historians should preserve configuration versions alongside process data so that engineers can distinguish a process change from a control change.

12. Contemporary Developments and Ethical Considerations

Edge artificial intelligence can detect anomalous motor current, estimate equipment health, or forecast load. Such models should assist—not silently override—validated protection and control logic. Model drift, biased training data, false positives, explainability, and update approval require attention. An AI recommendation should expose its confidence, evidence, and permitted operating range.

Remote operation creates accountability questions. Operators must know whether data are current, whether a device is in local or remote mode, and whether a command is being executed by a person or an automated service. Privacy may arise from detailed occupancy or production data. Regulatory duties may include electrical safety rules, critical-infrastructure requirements, records retention, data protection, and standards for industrial cybersecurity and functional safety. The applicable jurisdiction and industry standards must be consulted rather than assumed.

Chapter Summary

IoT-based electrical systems integrate measurement, communication, computation, actuation, and supervision. Effective designs separate fast local control and protection from slower supervisory analytics. Feedback control uses error to regulate a plant, while stability depends on controller dynamics, plant behavior, sampling, delay, and saturation. PLCs execute deterministic local logic; SCADA provides supervisory visualization, alarms, commands, and history; DCSs distribute process control across coordinated controllers.

Latency, jitter, packet loss, and sampling determine whether a networked loop can meet its performance requirements. Event-driven automation and state machines clarify transitions and fault recovery. Alarms must be actionable, prioritized, and resistant to nuisance behaviour. HMIs should communicate state, authority, permissives, and consequences clearly. Fail-safe design, fault tolerance, cybersecurity, and functional safety must be engineered together but should not be confused. Finally, commissioning and lifecycle management require testing of normal, abnormal, and recovery conditions.

Key Terms

Feedback control: Control in which measured output is compared with a reference to determine corrective action.

Set point: Desired value of a controlled variable.

Plant: Physical process or equipment being controlled.

Controller: Device or algorithm that computes an actuator command.

PID controller: Controller using proportional, integral, and derivative actions.

PLC: Programmable logic controller used for industrial automation.

SCADA: Supervisory control and data acquisition system.

DCS: Distributed control system for coordinated process control.

RTU: Remote terminal unit that gathers data and executes remote control functions.

HMI: Human-machine interface for operator visualization and interaction.

Latency: Time taken for information or an action to travel through a system.

Jitter: Variation in latency or execution timing.

Determinism: Predictability and boundedness of system timing and behaviour.

Interlock: Logic that prevents an unsafe or impermissible operation.

Permissive: Condition that must be satisfied before an action is allowed.

Fail-safe: Design that moves toward a risk-minimizing state after a fault.

Alarm: Actionable notification of an abnormal condition.

Historian: Time-series data store used for operational records and analysis.

State machine: Formal model consisting of states and permitted transitions.

Closed-loop performance: Behaviour of a controlled system when feedback is active.

Review Questions

Short Answer Questions

1. What is the purpose of feedback in an electrical control system?
2. Distinguish monitoring, automation, and intelligent control.
3. Why should fast protection generally remain local rather than cloud-dependent?
4. Define latency and jitter in a networked control loop.
5. What information should accompany a high-priority alarm?

Long Answer Questions

1. Explain the roles and differences of PLC, SCADA, and DCS architectures.
2. Describe PID control and discuss integral windup, derivative noise, and actuator saturation.
3. Explain how a state machine improves event-driven automation and fault recovery.
4. Discuss fail-safe design, fault tolerance, cybersecurity, and functional safety.
5. Develop a commissioning plan for an IoT-enabled industrial motor-control system.

Analytical / Application Questions

1. A remote controller has variable communication delay and controls a fast inverter. Decide which functions should be local and which may remain supervisory. Justify the decision using stability, safety, and determinism.
2. Design the states, transitions, permissives, and alarms for a standby generator that starts after utility failure and returns to standby after restoration.
3. A facility has a low average tracking error but frequent short overshoots and nuisance alarms. Propose measurements and design changes that would distinguish control instability, sensor problems, alarm configuration errors, and communication faults.

Multiple Choice Questions with Answers

Question 1

Which function should normally remain local in an IoT-enabled electrical system?

A. Long-term energy reporting

B. Cloud-based fleet benchmarking

C. Fast protective tripping

D. Monthly maintenance analytics

Correct Answer: C. Fast protective tripping

Question 2

For a negative unity-feedback system, the closed-loop transfer function is:

A. C(s)G(s)

B. C(s)G(s) / [1 + C(s)G(s)]

C. 1 + C(s)G(s)

D. 1 / C(s)G(s)

Correct Answer: B. C(s)G(s) / [1 + C(s)G(s)]

Question 3

What is the principal purpose of integral action in a PID controller?

A. To remove suitable persistent steady-state error

B. To measure network packet loss

C. To limit sensor bandwidth to zero

D. To guarantee stability for every plant

Correct Answer: A. To remove suitable persistent steady-state error

Question 4

Jitter refers to:

A. The final value of a control variable

B. Variation in timing or latency

C. The gain of a pressure sensor

D. The number of PLC inputs

Correct Answer: B. Variation in timing or latency

Question 5

Which statement best describes SCADA?

A. It is exclusively a mechanical actuator

B. It provides supervisory monitoring, visualization, alarms, and data acquisition

C. It always replaces protective relays

D. It is a mathematical stability theorem

Correct Answer: B. It provides supervisory monitoring, visualization, alarms, and data acquisition

Question 6

A permissive in an automated system is:

A. A condition that must be satisfied before an action is allowed

B. A historical data record

C. A cloud billing account

D. A derivative filter

Correct Answer: A. A condition that must be satisfied before an action is allowed

Question 7

Using the chapter’s RMS definition, errors of 2 kW and −2 kW over two samples give an RMS error of:

A. 0 kW

B. 1 kW

C. 2 kW

D. 4 kW

Correct Answer: C. 2 kW

Question 8

Which HMI practice most improves command accountability?

A. Hide command feedback from the operator

B. Use colour as the only status indicator

C. Distinguish requested, accepted, executed, and failed states

D. Allow every user unrestricted control

Correct Answer: C. Distinguish requested, accepted, executed, and failed states

Question 9

A fail-safe design should:

A. Always keep every actuator energized

B. Move toward a risk-minimizing state appropriate to the process

C. Depend exclusively on a cloud server

D. Ignore sensor failures

Correct Answer: B. Move toward a risk-minimizing state appropriate to the process

Question 10

Why is a state machine useful in event-driven automation?

A. It removes the need for sensors

B. It makes permitted states, transitions, and recovery conditions explicit

C. It guarantees zero communication delay

D. It replaces all safety analysis

Correct Answer: B. It makes permitted states, transitions, and recovery conditions explicit