PLCs, RTUs, PPCs and EMSs — a buyer's guide for people who don't programme them

TL;DR

A Programmable Logic Controller (PLC) is a deterministic industrial computer that runs a control programme on a real-time operating system; a Remote Terminal Unit (RTU) is its substation-flavoured cousin, optimised for telemetry over long, lossy links and for substation protocols. If you are buying renewable-energy plant equipment in Europe in 2026, what you actually need to know is: which device sits where in the Purdue model , what operating system runs inside it, whether it is certified to IEC 62443-4-2 , whether the vendor will keep up with the EU Cyber Resilience Act (CRA) , and how the supply chain looks. Above the PLC/RTU layer you will also encounter two industry-standard, named devices that procurement people often confuse with generic "PLCs" — the Power Plant Controller (PPC) for plant-level grid-code compliance in PV, wind and hybrid plants, and the Energy Management System (EMS) for site-level dispatch in battery storage — and they sit in separate tender categories with their own vendor ecosystems. This guide is a non-programmer's tour of the buying decision.

What a PLC actually is

A PLC is a rugged, fan-less industrial computer whose entire reason for existing is to execute a small control programme every few milliseconds, forever, without missing a cycle. The programme is typically written in one of the five IEC 61131-3 languages — Ladder Diagram, Function Block Diagram, Structured Text, Instruction List or Sequential Function Chart — and is loaded onto the device by an engineer using the vendor's engineering workbench (Siemens TIA Portal, Rockwell Studio 5000, Schneider EcoStruxure Control Expert, ABB Automation Builder, Beckhoff TwinCAT).

Inside the box you will find a CPU, memory, a backplane for input/output modules, and increasingly an Ethernet stack with one or more industrial protocols layered on top — PROFINET, EtherNet/IP, Modbus TCP, OPC UA, and on the substation side IEC 61850 and IEC 60870-5-104 . The point is that the PLC reads inputs, executes the programme, writes outputs, repeats. Determinism is the product. Everything else — the web server, the diagnostic tools, the cloud connector — is a feature that exists in tension with determinism, which is why competent buyers spend more time on the scan-cycle behaviour than on the brochure.

Brand-wise, the European installed base is dominated by Siemens (S7-1200, S7-1500), Schneider Electric (Modicon M340, M580, M580 Safety), ABB (AC500), Beckhoff (CX, C6), Phoenix Contact (AXC F), B&R, WAGO, and at the smaller end of the market Mitsubishi, Omron and Rockwell. In renewable-energy plants you will also see Bachmann M1 controllers — the wind industry's de-facto standard turbine controller.

What operating system actually runs inside

The operating system inside a PLC varies by vendor, and the difference matters at procurement time. The classical PLC runs a proprietary real-time kernel — Siemens's S7-1500 uses an in-house RTOS, ABB's AC500 has its own, Rockwell's ControlLogix uses a Wind River VxWorks variant. These kernels are small, hardened, and the attack surface is mostly the protocol stacks. At the other end of the spectrum, "soft PLCs" and edge controllers (Beckhoff TwinCAT, CODESYS-based devices, Siemens's newer Industrial Edge offering) run Linux with a real-time patch (PREEMPT_RT or Xenomai ) and execute the control logic in a user-space or kernel-space task. Some hybrid devices run a hypervisor — one virtual machine for the deterministic control task, another for a general-purpose Linux that handles HMI, OPC UA server, and the inevitable Docker container someone wanted to deploy.

The reason this matters to a buyer who is not the programmer is procurement-level: a device running Linux has a different vulnerability surface, a different patching cadence, and a different CRA-compliance story than one running a proprietary RTOS. Ask the vendor what is inside. If they cannot tell you, that is information too.

Where the PLC or RTU sits in an OT network

The Purdue Enterprise Reference Architecture is the lingua franca for OT network layering. Level 0 is the physical process — sensors, actuators, motors, valves. Level 1 is the basic control — PLCs, RTUs, intelligent electronic devices (IEDs) in substations. Level 2 is the supervisory layer — SCADA, HMI, plant historian. Level 3 is site operations — MES, asset management, the operations data lake. Levels 4 and 5 are corporate IT. The interesting work, security-wise, is at the boundaries.

In a utility-scale solar PV plant the picture is roughly: at Level 0/1 you have string-level optimisers and central or string inverters (which are themselves microprocessors with embedded firmware, not really PLCs in the classical sense), trackers with their own small controllers, the meteorological station, and the medium-voltage switchgear with its protection relays. Above them sits the Power Plant Controller (PPC) — the plant-level master that manages active power setpoints, reactive power, voltage regulation, frequency response and curtailment commands at the point of common coupling, and it is what the grid operator and the grid-code compliance engineers actually negotiate with. On hybrid sites the PPC also orchestrates dispatch across PV, battery storage, and sometimes wind, in a single envelope. SCADA, historian and the gateway to the TSO sit at Level 2/3 above it. The PPC subsection below covers implementation forms and vendor options.

In a battery energy storage system (BESS), the layering is similar but the vocabulary is different. At the lowest level each battery rack has its own Battery Management System (BMS) — the cell-level safety and balancing controller, usually embedded firmware from the cell or pack vendor. Above the BMS sits the Power Conversion System (PCS) controller — the inverter brain that handles the AC/DC conversion and grid-forming or grid-following behaviour. Above both of those sits what the procurement world calls the "site controller" but which is industry-standard called the Energy Management System (EMS). The EMS handles state-of-charge management, ramp-rate control, market-facing dispatch (frequency response, arbitrage, peak shaving, ancillary services), and the coordination logic across multiple battery strings or containers.

A word of caution: "EMS" is overloaded vocabulary — at the TSO level it also means the grid control centre's Energy Management System (GE EMP-EMS, Hitachi Energy Network Manager, Siemens Spectrum Power), which is an entirely different beast operating at the transmission-system scale. In a BESS-site tender, "EMS" means the battery-storage site controller. Make sure both sides of the table are using the term in the same sense. The EMS subsection below covers implementation forms and vendor options.

In a wind farm, you have a turbine controller in each nacelle (typically Bachmann M1 or a vendor-specific equivalent — Vestas's controller is integrated with the turbine), a tower-base controller, the park substation with its protection relays and RTU, and a park-level controller that aggregates the turbines and presents a single dispatchable resource to the grid. This park-level controller is sometimes called a Park Controller, or — Vestas-specific — a Park Pilot, and it serves the same role as the PPC on a solar plant: grid-code-relevant active and reactive power control at the point of common coupling, frequency response, voltage regulation, curtailment. The terminology differs by sector and vendor; the function does not.

Plant Controllers (PPC) and Energy Management Systems (EMS) — the named devices you'll see in tenders

Once you move from generic OT thinking to renewable-energy procurement, two specific named devices stop being abstractions and start appearing on Bills of Materials, scope documents, grid-connection agreements and tender response sheets. Treating them as "just a PLC at Level 2" is a procurement category error — they have their own vendor ecosystems, their own certification regimes and, often, their own line in the budget.

The diagram below shows where the PPC and the EMS actually sit relative to the inverter, PCS, turbine and BMS controllers below them, and relative to the SCADA, RTU and TSO control centre above them, mapped onto Purdue levels. Note in particular the two boxes labelled "EMS" — one at site level inside the plant boundary, one at the TSO control centre — drawn separately to make the overloaded-vocabulary point visually obvious.

flowchart TB
    classDef tso fill:#f5f3ff,stroke:#7c3aed,color:#4c1d95
    classDef l45 fill:#e8f0fe,stroke:#1a73e8,color:#0b3d91
    classDef l3 fill:#fff4e5,stroke:#d97706,color:#7c2d12
    classDef l23 fill:#ecfdf5,stroke:#059669,color:#064e3b
    classDef l1 fill:#fef3f2,stroke:#dc2626,color:#7f1d1d
    classDef l0 fill:#f3f4f6,stroke:#6b7280,color:#1f2937

    TSO["TSO / DSO control centre
grid-level EMS
(Spectrum Power, Network Manager, EMP-EMS)"]:::tso

    subgraph L45["Level 4-5 — Corporate IT"]
        ERP["ERP · Asset mgmt · Market interface"]:::l45
    end

    subgraph L3["Level 3 — Site operations"]
        SCADA["Plant SCADA + Historian"]:::l3
        RTU["Substation RTU
IEC 60870-5-104 northbound"]:::l3
    end

    subgraph L23["Level 2/3 — Plant-level control"]
        PPC["PPC — Power Plant Controller
P / Q / V / f, curtailment,
grid-code compliance"]:::l23
        SEMS["EMS — site Energy Mgmt System
SoC, dispatch, ramp rates,
market bids (BESS only)"]:::l23
    end

    subgraph L1["Level 1 — Basic control"]
        INV["PV inverters
string / central"]:::l1
        PCS["BESS PCS controller
AC/DC conversion"]:::l1
        TRK["Tracker PLCs"]:::l1
        WTG["Wind turbine controller
Bachmann M1 / OEM"]:::l1
    end

    subgraph L0["Level 0 — Physical process"]
        PV["PV modules"]:::l0
        BAT["Battery racks + BMS"]:::l0
        TURB["Wind turbines"]:::l0
        MET["Met station + sensors"]:::l0
    end

    TSO -.->|IEC 60870-5-104| RTU
    RTU --> SCADA
    SCADA --> PPC
    SCADA --> SEMS
    PPC -->|Modbus TCP / IEC 61850| INV
    PPC --> PCS
    PPC --> TRK
    PPC --> WTG
    SEMS --> PCS
    INV --- PV
    PCS --- BAT
    WTG --- TURB
    TRK --- MET

    L45 ~~~ L3 ~~~ L23 ~~~ L1 ~~~ L0

Figure: layered view of a hybrid renewable plant (PV + BESS + wind), mapped onto Purdue Enterprise Reference Architecture levels. The physical process (Level 0) — PV modules, battery racks, wind turbines, the met station — is read and driven by Level 1 basic controllers: PV inverters, the BESS Power Conversion System (PCS) controller, tracker PLCs, and the wind turbine controllers (Bachmann M1 or OEM-specific). Above them at Level 2/3 sit the two named application-role devices procurement teams meet in tenders: the Power Plant Controller (PPC) handling grid-code-relevant active and reactive power, voltage, frequency and curtailment across the whole plant; and the site-level Energy Management System (EMS) handling battery state-of-charge management, ramp-rate control and market-facing dispatch (BESS-specific). SCADA, historian and the substation RTU sit at Level 3 — the RTU is the northbound gateway to the TSO over IEC 60870-5-104. Crucially, the TSO / DSO control centre at the top of the diagram runs its own "EMS" — a grid-level Energy Management System such as Siemens Spectrum Power, Hitachi Energy Network Manager or GE EMP-EMS — which is the same three letters used for a completely different scale of system. The two EMS boxes are drawn separately for that reason: in a BESS-site tender, "EMS" means the site controller; in a TSO conversation, "EMS" means the control-centre application suite. Both uses are correct in their own contexts.

The Power Plant Controller (PPC)

The PPC is the plant-level master controller for a PV, wind or hybrid renewable plant. Its job is to take the setpoints negotiated in the grid-connection agreement — active power schedule, reactive power or power-factor target, voltage support, frequency response, ramp-rate limits, curtailment in response to a TSO command — and translate them into coordinated commands across every inverter, tracker, and (on hybrid sites) BESS PCS at the site. It is the device the grid-code compliance test is performed against, and it is typically the device whose certification is required for the grid-connection commissioning. On wind farms the same role is performed by what is sometimes called the Park Controller or, on Vestas turbines specifically, the Park Pilot.

The PPC shows up in four common implementation forms. The table below lays them out with vendor examples and the procurement scenario where each tends to fit.

Communications-wise, the PPC almost always talks IEC 60870-5-104 northbound to the TSO or DSO control centre, and a mixture of Modbus TCP, IEC 61850 (GOOSE and MMS) and vendor-proprietary protocols southbound to the inverter fleet and the substation IEDs. If your tender does not nail down the protocol matrix, you will inherit a problem.

The site-level Energy Management System (EMS)

The EMS in BESS context is the site-level controller that sits above the PCS controller and the BMS, and handles state-of-charge management, ramp-rate control, market-facing dispatch — frequency response, arbitrage, peak shaving, ancillary services — and the coordination logic across multiple battery strings or containers. It is the device that decides, second by second, whether the site is charging, discharging, or holding. It does not mean the same thing as a TSO-level Energy Management System, which is the grid control centre's master application suite (GE EMP-EMS, Hitachi Energy Network Manager, Siemens Spectrum Power) and operates at a completely different scale and scope. Both uses of "EMS" are correct in their own contexts. In a BESS-site tender, write down which one you mean.

EMS implementation forms mirror the PPC pattern:

Why they sit above the PLC layer (and sometimes are PLCs)

Architecturally the PPC and the EMS sit at Level 2/3 — above the PLCs, RTUs and inverter controllers at Level 1, below the SCADA, historian and corporate systems at Level 3/4. They are application roles, not hardware categories. A PPC can be a PLC running a PPC application; an EMS can be a PLC running an EMS application. But they appear as separate tender lines, with separate vendor ecosystems, separate certification expectations and — crucially for the procurement-record discipline — separate accountability for grid-code compliance.

The same IEC 62443-4-2 and EU CRA considerations apply to both PPCs and EMS as to any other OT device. On the PPC specifically, grid-code compliance certification — the TSO's test for active and reactive power response, fault ride-through and frequency response — is typically a more demanding and country-specific gate than the basic component-level cybersecurity certification. Both gates have to be passed; one is not a substitute for the other.

What "buying" one actually means

Buying a PLC or RTU — or a PPC or EMS — is not buying a box. You are buying a long-running commitment to a vendor ecosystem: the engineering tool, the programming licence, the runtime, the cybersecurity patch cadence, the spare-parts pipeline, and the training of the people who will keep the device running for 15–20 years. The hardware cost is usually the smallest line in the lifecycle.

The questions you actually need answered before you sign are not technical-deep, they are procurement-shaped. They are about the vendor's commitments to you over time. The IEC 62443 evidence pack post lays out the artefacts a competent supplier should produce on demand; treat the bullet list below as the procurement-stage version of the same conversation.

The questions to ask before you sign

• Which IEC 62443 certifications does the device hold, at which security level, and from which accredited lab?
• What is the vendor's CRA-compliance roadmap, and what does their CRA self-declaration cover?
• What is the firmware update cadence, and what is the disclosed-vulnerability response time?
• What protocols does the device speak natively, and which require a paid licence module?
• Where is the engineering tool maintained, and what is its own patch policy?
• What is the spare-parts and support commitment in years, in writing?
• Is the supply chain auditable end-to-end, including the silicon?
• For PPC and EMS specifically: what is the grid-code compliance certification status in the country of installation?

PLC vs RTU — what's actually different

A PLC and an RTU share family resemblance but were optimised for different jobs. The PLC was born in the discrete-manufacturing world — automotive plants, packaging lines, food and beverage — where the control task is fast, deterministic, and the device sits comfortably on a local network with reliable power. The RTU was born in the utility world — substations, pipelines, water networks — where the device sits at the end of a long communication link (originally serial, then radio, now usually cellular or fibre), needs to buffer events locally during a link outage, and speaks utility protocols (DNP3 in the Americas, IEC 60870-5-101/104 in Europe, IEC 61850 in modern substations).

Modern devices blur the line. ABB's RTU500 and Siemens's SICAM A8000 are functionally PLC-class machines that happen to ship with utility protocol stacks. Conversely, a Siemens S7-1500 with the right communications processor can be made to behave as an RTU. The distinction that still matters at procurement time is what the device was designed for, what its event-buffering and time-synchronisation behaviour is under link loss, and which protocol family is native versus bolted on.

Vendor origin and supply-chain caveats

The EU CRA, NIS2 and the wider geopolitical re-evaluation of OT supply chains mean vendor origin is now an explicit procurement criterion in a way it was not five years ago. None of this is a blanket prohibition — it is a disclosure-and-justification requirement. Capture the choice, and the reasoning, in the procurement record, because in three years' time someone will ask.

I just want to know what to choose

If you are buying for a European utility-scale PV, wind or hybrid plant in 2026 and you want the safe defaults, the table below is what to put in the first column of your scoring sheet. Every entry is mature, IEC 62443-4-2 certified at meaningful levels, with credible CRA-compliance trajectories and European spare-parts networks. Read it as a starting point, not as a final answer — the right choice for your site depends on the existing fleet, the integrator's track record, and the TSO's certification expectations.

For the PPC, EPC-supplied software-on-IPC implementations are also common and entirely respectable provided the EPC has a track record. PLC-based PPC implementations — application code on a Siemens, Schneider or ABB controller — are credible where the integrator has done it before and can show a working reference plant in the same country with the same TSO. For third-party BESS EMS, expect careful integration testing and a clear contractual division of responsibility for state-of-charge management, warranty preservation and market-facing dispatch. The same supply-chain caveat applies to both PPC and EMS — capture the choice and the rationale in the procurement record.

FAQ

Is a PLC the same as a microcontroller? No. A microcontroller is a chip; a PLC is a complete industrial computer with a control runtime, I/O modules, a programming environment and a vendor commitment behind it. The chip inside the PLC may be a microcontroller (or an ARM SoC, or an x86), but that is an implementation detail.

Can I run my own software on a PLC? On classical PLCs, no — the vendor's runtime is the only thing that runs, and your "software" is the control programme you load into it. On modern edge controllers (Beckhoff TwinCAT, Siemens Industrial Edge, CODESYS-based devices) you can, increasingly, run containerised user code alongside the deterministic control task. This is a feature and a risk in equal measure.

Does the EU CRA apply to PLCs? Yes. PLCs are "products with digital elements" under the Cyber Resilience Act, Regulation (EU) 2024/2847 , and fall within scope. The CRA's substantive obligations apply to products placed on the EU market from 11 December 2027, with the reporting obligations starting 11 September 2026. Buy from vendors who can already show you a credible CRA-compliance roadmap — see the CRA applicability post for the wider scope ruling.

Is IEC 62443-4-2 the only certification that matters? It is the most important one for component-level cybersecurity, but it is not the only signal. ISASecure CSA , SOC 2 (for cloud-connected components) and the vendor's own SDLC maturity (IEC 62443-4-1 ) all contribute. For PPC and EMS, the grid-code compliance certification (country-specific, performed by the TSO or an accredited test body) is a separate and often more demanding gate.

What's the difference between a PPC, an EMS, and a PLC? A PLC is a generic, programmable industrial controller — a piece of hardware with a runtime. A Power Plant Controller (PPC) is the plant-level controller in a PV, wind or hybrid plant whose role is grid-code compliance — active and reactive power, voltage support, frequency response, curtailment at the point of common coupling. An Energy Management System (EMS), in BESS context, is the site-level battery controller managing state of charge, ramp rates and market-facing dispatch (and is a different thing from the TSO control-centre EMS, which uses the same three letters for a much larger system). Both PPC and EMS can be implemented on a PLC, but neither is the same thing as a PLC — they are application-specific roles that may use a PLC as their hardware substrate, or may use a purpose-built appliance, or may run as software on an industrial PC. At procurement time, PPC and EMS appear as separate tender lines from the PLC line, and have their own vendor ecosystems and their own certification expectations.

Should I worry about the operating system inside? Yes — at the procurement level, not the engineering level. A Linux-based device has a different patching model and a different vulnerability surface than a proprietary RTOS. Ask the vendor what is inside the box. Their answer, or lack of one, is procurement information.

If this guide helps you sit through one fewer painful tender, the post has paid for itself. To flag a vendor I have missed or a certification status I have got wrong, LinkedIn is the way to reach me.