The power plant controller (PPC) decides how much active and reactive power the whole plant delivers and receives setpoints from the grid operator; the SCADA concentrates commands, alarms and historians and is the bridge to the control center. That makes them the most sensitive assets of a solar plant. They are protected with their own control zone separated by a firewall, personal role-based accounts, security event logging, backup of the approved configuration and a link to the control center over a dedicated conduit, with TLS and IEC 62351 where the equipment supports it.
Why they are the most sensitive assets
In a solar plant, each inverter decides its own power. The power plant controller (PPC) decides that of the whole plant: it measures at the point of interconnection, receives setpoints from the grid operator and the control center, and sends active and reactive power commands to the inverters to meet the grid code. The SCADA concentrates commands, alarms and historians for the plant and its substation, and through its gateway the plant sends the control center the signals it supervises.
That position makes them critical from the cybersecurity point of view. Whoever changes a setpoint or a control setting in the PPC changes the behavior of the entire plant at the point of interconnection. Whoever gets into the SCADA can see and, depending on permissions, operate. And since both communicate outward, they are the natural boundary between the plant network and the rest of the world. How the PPC works is explained in the solar plant controller, and supervision by the system operator in SCADA and PMU supervision of renewable plants.
Zones and conduits
The IEC 62443 series proposes separating devices into zones according to their security need and controlling all traffic between them through conduits. For the PPC and SCADA, a reasonable split is:
| Zone | Devices | Communicates with |
|---|---|---|
| Plant control | PPC, inverter controllers, point-of-interconnection meter | Inverters (field) and SCADA |
| Substation | Relays, bay controllers, gateway | SCADA and control center |
| Station | SCADA servers, HMI, historian, clock | Control and substation zones; DMZ |
| DMZ | Jump server, historian replica, cloud exit | Outside and station, never directly to control |
| Corporate and surveillance | Office, cameras | Only with the DMZ |
The link to the control center goes through a dedicated conduit, which does not share a path with the office or the internet exit. The firewalls between zones only let documented flows through: for example, from the SCADA to the PPC the planned variables and commands, and nothing from the camera network. The equipment that makes this possible is described in industrial router and firewall.
Controls on the PPC and SCADA
IEC 62443-3-3 groups the security requirements of a system into seven foundational requirements. Applied to the PPC and SCADA, they translate as follows:
- Identification and authentication. Personal accounts, without factory credentials; strong authentication for remote access.
- Use control. Roles that separate viewing, operating, changing local setpoints and changing control settings; integrator and manufacturer accounts enabled only for each intervention.
- System integrity. Firmware and applications of verified origin; change control over the logic and the control settings.
- Data confidentiality. Encryption where the protocol and the equipment support it, especially outside the plant.
- Restricted data flow. The zones and conduits of the table above.
- Timely response to events. Logging of accesses, setpoint changes, setting changes and commands, with synchronized time, sent to a place where someone reviews it.
- Resource availability. Backup of the approved configuration, redundancy where the design calls for it, and a defined behavior of the PPC and the inverters if communication is lost.
That last point is both a security and an operations matter: manufacturers define what the inverter does when it stops receiving setpoints, and that behavior must be set and tested.
The link to the control center
Supervision and control from the control center usually travel over IEC 60870-5-104. There are two levels of protection:
- With the protocol’s security standards. IEC 62351-3 applies TLS to protocols over TCP/IP. IEC 62351-5, in its 2023 edition, defines security for IEC 60870-5 with secure data exchange and authenticated encryption. Its application to 101 and 104 is in IEC TS 60870-5-7. IANA has registered a dedicated port for the secure version of 104. The detail is in IEC 62351 and in secure IEC 104 and DNP3.
- With the network. While the gateway or the control center do not support the secure version, the link goes through a dedicated conduit and the firewall accepts only the addresses of authorized masters. A VPN is used if the path is a public network, and connections are logged.
Backup and change control
The approved PPC configuration (setpoints, control modes, droop, ramps) is the one that was tested with the grid operator. It must be backed up and compared after every intervention. The same goes for the SCADA database and the gateway configuration: a signal wrongly mapped to the control center is an operations problem, and an unlogged change is also a security problem. The method is described in IED and SCD configuration management.
What the regulations require
Grid cybersecurity frameworks (NERC CIP in North America, NIS2 and the network code on cybersecurity in Europe, and national guides elsewhere) generally treat larger generating units and the generators’ control centers as critical assets. Within those plants, the PPC, the SCADA and the gateway are typical critical cyber assets: they use routable protocols and are essential to operate the plant. The rules typically ask for logical security perimeters, only the necessary ports and services, access monitoring, change and configuration control, verified backups, and remote access through an intermediate system with two-factor authentication. An incident affecting them is reported following the procedure of the grid operator or regulator. The design and settings are adapted to the local code and the requirements the utility gives you.
Frequent mistakes
- The PPC on the same network as the cameras or the office.
- A single administrator account shared by operations, integrator and manufacturer.
- The 104 gateway accepting connections from any address.
- No backup of the control settings that were tested with the grid operator.
- Logs that nobody reviews or that are lost when the device restarts.
We can help with your plant
At Tiza Group we configure the PPC, SCADA and gateways of solar plants, their zones and firewalls, their accounts and logging, and the link to the control center, as part of our substation and plant cybersecurity service. We also configure the relays and controllers of the connection substation remotely through remote relay configuration, in sessions that you authorize and that are logged. Write to us with your plant’s control architecture.
Related guides
- Solar plant controller (PPC): what it is and what it controls
- SCADA and PMU supervision of renewable plants for the system operator
- IEC 60870-5-104: what it is, how it works and how it is tested
- IEC 62351: cybersecurity for IEC 61850, 104 and DNP3
- Solar plant communications
- Secure IEC 104 and DNP3: TLS and IEC 62351-3 and -5
- Solar plant cybersecurity: risks and controls
- BESS cybersecurity: BMS, PCS and EMS
References
- IEC 62443-3-3:2013, System security requirements and security levels.
- IEC 62351-3:2023, profiles including TCP/IP; IEC 62351-5:2023, security for IEC 60870-5 and derivatives.
- IEC TS 60870-5-7, security extensions for IEC 60870-5-101 and -104.
Frequently asked questions
Why is the PPC more critical than an inverter?
Because an inverter controls its own power and the PPC controls that of the whole plant. An improper change to its setpoints or to its voltage and frequency control settings affects the entire plant at the point of interconnection, which is exactly what the grid operator supervises and what the grid code requires.
Can the IEC 104 link to the control center be encrypted?
The standards exist: IEC 62351-3 applies TLS to protocols over TCP/IP and IEC 62351-5 defines security for IEC 60870-5, with its application to 104 in IEC TS 60870-5-7. Whether it can be used depends on the plant gateway and the control center supporting it. Meanwhile, the link is protected through a dedicated conduit, with a firewall that filters by address and a VPN if it travels over a public network.
Who should have accounts on the PPC?
Only the people who operate or maintain it, each with their own account and a role that limits what they can do: view, operate, change local setpoints or change control settings. Integrator and manufacturer accounts are enabled for each intervention and reviewed periodically.