Engineering for plants beyond easy reach

Our containers sit close to villages, schools and fuel stores, often on islands without a full-time fire service. I treat the conditions under which a battery may run as an engineering decision that the commercial team can question but cannot overrule. Our battery safety lead may derate equipment on her own authority and must tell me within a day. Container designs are accepted only after a factory test in which the cooling fails deliberately and we watch how fast cell temperatures rise and when alarms fire. I also ask suppliers for propagation test evidence before purchase, and we space containers and route access so that local firefighters can stay well back. The cost appears as lost availability and slower deployment. I report both openly, because a safety margin that disappears whenever a quarter looks weak is not a margin.

Our Cebu control room watches fifty-two plants, most connected by satellite or patchy mobile networks. I design monitoring on the assumption that links fail, so each site stores its own data for at least fourteen days and sends it on when the link returns. A plant that stops reporting is treated as an alarm, not as an absence of alarms. Site controllers carry a fixed fallback schedule agreed with each cooperative, so the battery still supports the evening peak if Cebu cannot reach it. We separate alarms that need a decision within minutes from those that can wait for the next boat, because a control room flooded with low-value warnings stops reading them. Field technicians help write these rules, since they know which faults can be cleared remotely and which ones always require someone standing at the cabinet.

Inverters and plant controllers are computers that can change how a grid behaves, and on a small island our plant may supply most of the evening load. I keep an inventory of every connection into that equipment, including supplier links bought as part of warranty packages. All remote access now passes through a gateway that we operate, with named approval from the control room, recorded sessions and automatic expiry. Firmware is installed on a test bench in Cebu before any site receives it, and releases go out in stages. Our corporate network cannot reach plant controls directly. I measure the effect on repair times as well as on exposure, because a security rule that technicians quietly bypass after a long night achieves nothing. The board sees both figures each quarter, alongside the incidents and near misses.

Each island grid has its own interconnection requirements, drawn from the applicable grid and distribution codes and from the cooperative's or utility's own operating limits. In general they describe how a plant must respond when frequency moves, how fast its output may ramp and whether it stays connected through a brief voltage dip. I want every setting that governs that behaviour to be recorded, tested before energisation and protected from casual change. Commissioning evidence is written for the cooperative's engineer as well as for us. When firmware or controller changes might alter that behaviour, we retest before release rather than rely on the supplier's description. Where I am unsure how a requirement applies, I ask the grid operator directly and keep their answer on file. A plant that behaves exactly as described is worth more to a small grid than one with impressive average output.

A company our size cannot write everything, and should not try. My rule is that we buy where independent testing, certification or a wide user base matters more than flexibility, and build where the software holds knowledge that is specific to our customers. Site-level control now runs on a commercial controller with type-test documentation, because cooperatives need evidence we could not produce cheaply. Fleet forecasting, battery scheduling against each supply agreement and our reporting to cooperatives stay in-house, because that logic is the company's understanding of its contracts. I compare total cost over five years, including licences, migration and the people needed to keep each option safe. I also ask who would maintain the software if its principal author left, since a dependency on one engineer is a risk the board should see named.