Control system architecture — what is actually behind "the DCS"

Every topic in this section has said “the DCS” as though it were one thing. This page opens the box.

From transmitter to screen

Follow a pressure signal all the way:

1. Field device — the transmitter sends 4–20 mA, as covered in what a transmitter is.
2. Field junction box — several instruments’ cables join a multicore heading back to the building.
3. Marshalling cabinet — the multicore terminates, and cross-wiring connects each signal to a chosen I/O channel.
4. I/O card — converts the analogue signal to a digital value.
5. Controller — executes the control logic and decides the output.
6. Operator station — displays the value on a graphic, and holds the alarm.
7. Historian — records it for trending and analysis.

The I/O count drives more than you expect

Type	Direction	Carries	Example
AI — analogue input	Field to system	A continuous value, normally 4–20 mA	Pressure, level, flow and temperature transmitters
AO — analogue output	System to field	A continuous demand, normally 4–20 mA	Control valve positioner, variable speed drive setpoint
DI — digital input	Field to system	On or off	Valve limit switches, motor running status, level switches
DO — digital output	System to field	On or off	Motor start command, solenoid valve, beacon
RTD and thermocouple input	Field to system	Resistance or millivolts, not 4–20 mA	Direct-wired temperature elements without a transmitter
Pulse input	Field to system	A frequency or a count	Turbine meters, flow totalisers
Fieldbus segment	Both	Digital data for several devices on one pair	FOUNDATION Fieldbus or PROFIBUS PA instrument segments

Every field device is one of these four, and the I/O count drives a surprising amount of a project — cabinet sizes, marshalling, cable quantities and system cost all scale with it. Spare I/O is the cheapest thing to buy at design stage and the most expensive to add later.

Every field device is one of these, and the I/O count sizes cabinets, marshalling, cable quantities and a good part of the system cost.

Spare I/O is the cheapest thing to buy at design stage and among the most expensive to add later — the same argument as spare cores in control cables, and it gets resisted in exactly the same way.

DCS, PLC, SCADA

The distinction has blurred, but the emphasis still differs:

DCS — distributed control system. Built around large numbers of continuous analogue loops, with operator graphics, alarms, historian and engineering tools integrated as one product. Its natural home is a continuous process plant.

PLC — programmable logic controller. Built for fast, deterministic discrete logic and sequencing. What equipment vendors supply with packaged units, and what runs machine sequences. The HMI is a separate product.

SCADA — supervisory control and data acquisition. For geographically distributed assets — pipelines, wellheads, water networks — where the emphasis is telemetry over long distances rather than tight loop control.

Safety logic solver. A separate controller running only the safety instrumented functions, certified for the job and deliberately independent of the control system.

Redundancy

Anything whose failure would stop the plant is normally duplicated: controllers in hot-standby pairs, dual power supplies from separate sources, dual network paths, redundant I/O on critical signals.

The point is worth stating precisely: redundancy protects against random hardware failure. It does nothing at all about a configuration error, a bad change, or a common-mode problem — because the standby unit is running exactly the same faulty logic as the primary.

Networks and the levels

Level	What lives there	Example
0 · Process	The field devices themselves — sensors and final elements	Transmitters, control valves, motors
1 · Basic control	Controllers executing the logic, and the I/O they read and write	DCS controllers, PLCs, safety logic solvers
2 · Supervisory	Operator interface, alarms and the control room	Operator stations, engineering stations, alarm displays
3 · Site operations	Plant-wide systems — historian, laboratory, production scheduling	Process historian, batch records, maintenance systems
3.5 · Demilitarised zone	The controlled boundary between plant and business networks	Data diodes, replicated historians, jump servers
4 and 5 · Business	Corporate IT — email, ERP, the internet	Company network and everything on it

The levels matter for two reasons. They describe how data flows up and commands flow down — and they are the basis of control system cyber security, where the rule is that connections between levels are deliberate, controlled and few.

Levels 0 to 2 are the control system proper. Level 3 is where plant-wide systems live. Above that is corporate IT.

The levels matter for cyber security, and the standard is IEC 62443. The principle is segmentation: connections between levels are deliberate, controlled and few, with a demilitarised zone between the plant and the business network so that data can flow out without a path flowing back in.

Alarms

An alarm exists to tell an operator to do something. That is the whole test, and it is failed constantly.

Change control

Control system changes are software changes to something that moves large pieces of equipment. They go through management of change: proposed, reviewed, tested where possible, implemented under control, and documented.

That applies just as much to a tuning constant or an alarm limit as to new logic. “It’s only a setpoint” is how a great many upsets begin — and on anything touching a safety function it is not a judgement call at all.

What to take away

• The path is field, junction box, marshalling, I/O, controller, operator station, historian.
• Marshalling exists so I/O can be reassigned without touching field cable.
• I/O count drives cabinets, cable and cost. Buy spares early.
• DCS for continuous loops, PLC for fast discrete logic, SCADA for distributed assets, and a separate certified solver for safety.
• Redundancy covers random hardware failure. It does nothing about a bad configuration.
• Security comes from segmentation and controlled boundaries. Treat “it’s air gapped” as a prompt to look harder.
• An alarm that nobody can act on is not an alarm. Rationalise them.