Control hierarchy diagram of a solar and storage plant showing the battery management system, power plant controller, energy management system and SCADA

EMS vs BMS vs PPC vs SCADA: Who Controls What in a Solar and Storage Plant

Four controllers appear on every solar and storage project, and they are not alternatives to each other. The BMS owns cell safety. The PPC owns what the plant presents to the grid. The EMS owns the economic decision about when to charge and discharge. SCADA owns visibility and the record. Each layer can refuse the layer above it, and the refusal always travels downward in authority: the BMS can override the EMS, never the other way round.

Confusion between these four is the most reliable source of delay on a storage project, because every supplier assumes a different division of work. One quotes an EMS that is really a scheduler. Another calls a SCADA package an EMS because it has a setpoint box on screen. A third assumes the PPC function sits inside the converter. The remedy is to write the boundaries into the specification yourself, before the first purchase order.

The four layers, defined in one line each

A BMS, battery management system, measures every cell's voltage and temperature, calculates state of charge and state of health, balances cells, and disconnects the battery when a limit is breached.

A PCS, power conversion system, is the converter that executes power commands between the battery DC bus and the AC bus. It is not a control layer in its own right, but every command passes through it.

A PPC, power plant controller, regulates what the plant as a whole presents at the point of connection — real power, reactive power, voltage, power factor and export limits — to meet the grid code and the connection agreement.

An EMS, energy management system, decides when the battery should charge and discharge, and by how much, to meet an economic or operational objective.

SCADA, supervisory control and data acquisition, collects, displays, logs and alarms. It gives operators a view and gives engineers a record.

Who owns what: the table to put in your specification

Layer Owns Decides Timescale Must never
BMS Cell safety, balancing, SoC and SoH Whether the battery may operate at all Milliseconds to seconds Be overridden by any layer above it
PCS Conversion and its own device protection How to execute a power command Milliseconds Choose what the battery should do
PPC Grid compliance at the point of connection Plant-level P, Q, V and export limit 100 ms to a few seconds Be bypassed by an economic schedule
EMS Economic dispatch When and how much to charge or discharge Seconds to minutes Issue or clear a safety trip
SCADA Visibility, logging, alarms Nothing automatic Seconds Sit in a closed-loop control path

Our recommendation is to paste that table into the technical schedule and ask every bidder to confirm it line by line. The conversation it produces is more useful than any amount of architecture discussion, because it forces each supplier to say which rows they are taking.

What the BMS owns, and why it wins every argument

The BMS lives closest to the hazard, so it has the final word.

It measures cell voltages and temperatures continuously, calculates state of charge and state of health, balances cells so the weakest does not define the pack, and opens the DC contactors when voltage, temperature, current or insulation leaves the permitted window. For lithium iron phosphate cells that window is typically around 2.5 V to 3.65 V per cell, with temperature limits tighter on charge than on discharge.

What follows from this is a principle worth stating plainly: no other layer may raise a BMS limit. An EMS that wants more energy out of the pack cannot be given permission to push below the BMS cut-off, and any architecture where such a command is even expressible is wrong. The limits exist because the cells have a chemistry, not because the supplier was cautious.

The second BMS point that gets missed is derating. A BMS does not usually jump from full capability to zero; it narrows the allowed charge and discharge current as temperature, state of charge or cell spread move. The EMS has to read and respect those live limits, or it will keep commanding a power the system cannot deliver and the plant will log a stream of unexplained shortfalls. What the underlying cell and rack parameters mean is covered in LFP battery rack selection.

What the PPC owns

The PPC is the layer that faces the utility. Its job is to make the whole plant — solar inverters, PCS, sometimes the DG — behave as one generator at the point of connection.

It typically regulates real power against a limit or ramp rate, reactive power or power factor against a target, voltage against a band, and export against a limit that may be zero. It distributes setpoints to the inverters and the converter and measures the result at the connection point, closing the loop every few hundred milliseconds.

PPC functions are usually a condition of connection rather than a commercial preference. Export limits, ramp rates and reactive capability are set by the applicable CEA regulations and the distribution licensee's technical standard, enforced through the connection agreement rather than the plant's own judgment. Read the standard in force for your connection; do not assume a neighbouring plant's scheme will be accepted.

Our position on export limitation is that it needs a hard-wired backstop in addition to the PPC loop. The PPC should hold export at zero through control; a contact-based trip should exist for the case where it does not. The reasons are the same ones that make us wire source-selection interlocks in copper on any BESS with an existing DG synchronisation panel.

What the EMS owns

The EMS is the only layer that asks "should we?" rather than "can we?".

It decides when the battery charges and discharges, using inputs the lower layers ignore: the load profile, the demand recorded so far in the billing period, time of day, the solar forecast, the state of the diesel set, the operator's priorities. The mechanism behind the biggest of those decisions — demand charge reduction — is worth understanding before setting any threshold, and we have set it out in maximum demand charge calculation.

What an EMS must not do is also clear. It does not trip anything for safety. It does not raise a BMS limit. It does not override a PPC export constraint. It issues setpoints that the layers below are free to refuse, and a good EMS is written to expect refusal rather than to treat it as a fault.

The common mistake in procurement is buying a scheduler and calling it an EMS. A scheduler executes a timetable: charge from 23:00, discharge from 18:00. A real EMS reacts to measurement — it watches demand integrating in the current block and acts before the block closes. The difference shows up in the bill, not the demonstration.

What SCADA owns, and what it must never be allowed to do

SCADA collects data, draws it on a screen, raises alarms and keeps history. It is the layer the plant actually lives in day to day, and it is the one most often asked to do something it should not.

SCADA should not sit inside a closed control loop. A tag written by an operator through a SCADA screen is a command, and commands are fine; a SCADA script that reads a measurement and writes a setpoint every few seconds is a control loop running on a supervisory system that was never designed for determinism. When the server reboots for an update, the loop stops, and the plant finds out at the worst moment.

The honest test is to ask what happens to each function if the SCADA server is off for an hour. Anything that breaks safety or grid compliance was in the wrong layer.

The boundaries that must never be crossed

Decision Correct owner Why it must not move
Open the DC contactors on a cell limit BMS The only layer measuring cells; must act without permission
Stop charging on a fire or gas detection Hard-wired detection to BMS and PCS Must act with every controller dead
Limit charge or discharge current on temperature BMS Derating is a chemistry limit, not a preference
Hold export at the connection limit PPC, with a hard-wired backstop A condition of connection, not an economic setting
Ramp rate and reactive target at the connection point PPC Grid code compliance is plant-level
Decide the charge and discharge schedule EMS The only layer that sees price, demand and forecast
Change a peak-shaving threshold EMS, operator approved Economic; changing it must not need a protection engineer
Trip a breaker for a plant fault Protection relay, hard-wired Protection never depends on a network
Record and report everything SCADA Record, not control

The row that gets argued about is the second. Suppliers sometimes offer fire detection reported into the EMS, which then commands a stop. That works until the EMS is rebooting, the switch has failed or the integration was never tested. Detection must reach the stop and isolation path through a contact, with the EMS informed in parallel for the record.

Why a safety trip is never an EMS decision

Three reasons, and all three are sufficient on their own.

A safety trip has to work when the controller is dead. An EMS runs on a server or industrial PC, over a network, with software that gets patched, and a trip depending on any of those has a failure mode no amount of redundancy removes.

A safety trip has to work in a defined time. Communication links are statistically fast, not deterministically fast; a Modbus register may be read in twenty milliseconds, or after the poll cycle has worked through two hundred other registers.

A safety trip must not be clearable by the layer that caused the condition. If the EMS can clear a trip, the same logic that drove the system to a limit can return it there, and the record will show an operator reset that nobody performed.

In our FAT practice for control and interface panels, we test these paths by powering down the controller and proving the trip still works. It is the one test that makes integrators uncomfortable, and the one we insist on, because a scheme that only functions with every device healthy has not actually been tested. What belongs in that document is set out in our electrical panel FAT and routine test checklist.

Timescales: who answers in milliseconds and who in minutes

Function Typical response Carried by
Cell overvoltage or overtemperature trip Milliseconds to a few hundred milliseconds BMS to DC contactors, hard-wired
Converter internal fault Milliseconds PCS own protection
Protection trip on a plant fault Tens of milliseconds Relay to breaker, hard-wired
Export limit backstop Fraction of a second Hard-wired contact
PPC regulation loop Approximately 100 ms to a few seconds Communication link
EMS dispatch decision Seconds to minutes Communication link
SCADA logging and alarm display About one second Communication link

Read that table from the top down and the architecture writes itself. Everything in the first four rows belongs in copper or inside a single device. Everything below can live on a network, because a second of delay changes a number rather than a consequence.

Where the signals actually run

In a typical industrial plant the BMS talks to the PCS over a dedicated link, usually with a parallel hard-wired permissive and trip pair. The PCS, the inverters and the meters talk to the PPC and the EMS over Modbus TCP, with IEC 61850 or IEC 60870-5-104 appearing where a utility interface demands it. SCADA subscribes to all of it.

Three practical points from building the panels that carry these signals at our works in Vadodara. Segregate control wiring from power wiring and keep communication cables away from converter output cables, because a switching converter is an aggressive electromagnetic neighbour. Give the control system a supply that does not disappear with the main breaker, since diagnostics are most needed when the power has gone. And label every hard-wired interlock on the schematic with its function, not only its terminal number, because the engineer deciding whether a signal is safety or convenience will be reading that drawing at two in the morning.

The integration failures we see most often

  1. Two layers controlling the same variable. The EMS and the PPC both write a power setpoint, and the plant hunts. One owner per variable, always.
  2. Safety routed through communication. Fire detection or a BMS trip reaching the breaker only through a register.
  3. A scheduler sold as an EMS. It runs a timetable and never reacts to measured demand.
  4. No one responsible for the clock. Logs from four systems with three different times cannot be reconciled after an event.
  5. Live BMS limits ignored. The EMS commands rated power while the BMS is derating, and the shortfall is blamed on the battery.
  6. Untested failure modes. Nobody pulls a cable during commissioning to see what each layer does when it loses the others.

The sixth is where we spend most effort. Our practice is to list the failure cases — network down, EMS down, PPC down, BMS communication lost, auxiliary supply lost — and define the required behaviour for each before anything is wired. On the industrial projects we have delivered, that exercise has always been cheaper on a drawing than on site.

What to write in your specification

Keep it short and make it unambiguous.

  • A boundary table, naming the owner of each decision, confirmed line by line by every bidder.
  • One owner per controlled variable, stated explicitly.
  • A list of hard-wired signals: BMS trip, fire detection stop, emergency stop, export backstop, source-selection permissives.
  • Required behaviour on each communication or controller failure.
  • A single time source for every system.
  • Access to live BMS limits by the EMS, and a stated requirement that the EMS respects them.
  • A test schedule that includes powering down each controller in turn.

That list fits on one page, and it decides more about how the plant behaves than the choice of any individual product.

The governing principle

Authority runs downward and information runs upward. The layer closest to the hazard has the final word, and every layer above it issues requests that may be refused.

Write that into the specification, name one owner for every controlled variable, and keep every safety path in copper. The rest of the integration is ordinary engineering.

  • Wisdom Techno Solutions
  • Reviewed by Ankit Patel

Frequently Asked Questions

What is the difference between an EMS and a BMS?

A BMS, battery management system, monitors and protects the cells — voltages, temperatures, balancing, state of charge — and disconnects the battery when a limit is breached. An EMS, energy management system, decides when the battery should charge or discharge to meet an economic or operational objective. The BMS answers whether the battery may operate; the EMS answers whether it should.

What does a PPC do that an EMS does not?

A power plant controller regulates what the plant presents at the point of connection — real power, reactive power, voltage, ramp rate and export limit — so the site complies with its connection agreement and the applicable grid requirements. An EMS decides the economic dispatch behind those numbers. PPC functions are usually a condition of connection; EMS functions are a commercial choice.

Is SCADA the same as an EMS?

No. SCADA collects, displays, logs and alarms, giving operators visibility and engineers a record, while an EMS makes dispatch decisions. Many packages are marketed as both, so the practical test is whether the product reacts to measured conditions and issues setpoints on its own, or only presents data and passes operator commands through.

Can the EMS override the BMS?

No, and any architecture in which that command can even be expressed is wrong. The BMS limits exist because of cell chemistry, and it is the only layer measuring individual cells. The correct relationship is that the EMS reads the BMS's live charge and discharge limits and keeps its own setpoints inside them.

Why must a safety trip be hard-wired rather than sent over a network?

Because it has to work when the controller is powered down, has to act in a defined time rather than a statistically likely one, and must not be clearable by the layer that caused the condition. Communication links are fast on average and unbounded at the tail, and software gets patched and rebooted. A trip path in copper has none of those dependencies.

Who decides when the battery charges?

The EMS, within limits set by the BMS and the PPC. It uses the load profile, the demand recorded so far in the billing period, time of day, the solar forecast and the state of the diesel set to decide when to charge and discharge. The lower layers can refuse those setpoints, and a well-written EMS expects refusal rather than treating it as a fault.

What happens if the EMS fails?

A correctly designed plant continues safely with reduced capability: the BMS still protects the cells, the PPC still holds the plant inside its connection limits, the protection still trips on faults, and the converter idles or holds its last valid setpoint according to a defined failure behaviour. What should stop is the economic optimisation, and that behaviour has to be specified and tested rather than assumed.

Does a small storage system need all four layers?

The functions are always present, but they may be combined in fewer boxes. A compact system may carry PPC functions inside the converter and present a basic EMS and data interface in one package. The requirement is not four products; it is that each decision has one named owner and that the safety paths remain independent of the supervisory ones.

Can SCADA be used to control the battery?

SCADA can pass operator commands and display status, which is appropriate. What it should not do is sit inside a closed control loop, reading a measurement and writing a setpoint on a cycle, because a supervisory system is not built for deterministic timing and will stop during a reboot or an update. The test is simple: if the SCADA server were off for an hour, nothing involving safety or grid compliance should change.

Which protocols are used between these layers?

Modbus TCP is the most common for converters, meters and controllers in industrial plants, with IEC 61850 or IEC 60870-5-104 where a utility interface requires them. Protocol choice matters less than the discipline around it: one owner per variable, a defined failure behaviour per link, and a single time source. Safety signals stay out of the discussion entirely, because they belong in copper.

What is the commonest integration failure on a storage project?

Two layers controlling the same variable — typically the EMS and the PPC both writing a power setpoint — which makes the plant hunt and produces an unstable output nobody can diagnose from a single log. The second commonest is safety routed through a communication link. Both are prevented by a boundary table agreed before any purchase order.

How do you test that the control boundaries actually work?

By breaking each link deliberately and observing the result: power down the EMS, power down the PPC, pull the BMS communication cable, drop the auxiliary supply, and confirm each layer does what the specification says. Safety trips should be proven with the controllers powered off entirely. A scheme tested only with every device healthy has not been tested.

Related Guides

Talk to Us About Your Plant

Wisdom Techno Solutions manufactures the electrical system that sits at the centre of a solar and storage installation — the LT panel, the switchgear, the metering, the protection and the control — at our works in Vadodara, Gujarat. We build PLC control panel, and the same engineers who design an assembly test it before it ships and commission it on site.

Wisdom Techno Solutions is a licensed partner for three design-verified switchgear platforms: Rittal Ri4Power (Rittal Solutions Partner since 2021 — the Ri4Power system carries Intertek ASTA design verification to IEC 61439-1 and -2 Edition 3, with copper and aluminium busbar systems up to 6300 A), C&S CX (Licensed Partner since 2023, up to Form 4B Type II) and Siemens SIEPAN Elite/8PU (IEC 61439 Solutions Partner since 2024). We build to each system's verified configuration and routine-verify every assembly in-house at our Vadodara, Gujarat facility, for industrial, EPC and infrastructure projects across India. For a solar or storage plant that covers the LT switchboard, the BESS PCC and the AC and DC distribution.

If you want to know whether your plant is a candidate, send us twelve months of electricity bills and one day's load profile. That is enough to size a system, show where the savings would come from, and tell you honestly if the answer is no.

The quickest route is our free feasibility study: send the bills and we come back with the sizing and the numbers behind it. To work out your own numbers first, use the free free solar, storage and electrical calculators.

Send your single line diagram, your load list or your last twelve bills, and we will come back with the electrical scheme and the numbers behind it.

Control, metering and communication panels for solar and storage are built at our LT panel manufacturer in Vadodara.