AI-driven lights-out power plants: what unattended generation really takes in energy and utilities

A lights-out power plant is a generating site whose normal operating cycle runs with nobody present, under a written unattended-operations basis. The basis states the conditions under which unattended operation applies, what the plant does automatically in each named event, how long it can hold that state, and who arrives when it cannot. The phrase describes an attendance model, not a technology: sites qualify by having their manual tasks instrumented, actuated, designed out or scheduled into attended windows, and by having a defensible written case behind the arrangement.

Yes, and they are unremarkable. Utility-scale solar, wind, battery storage and much small hydro run without permanent site crews, controlled from remote operations centres, with technicians dispatched for maintenance and faults. Duke Energy publicly describes operating around 5,500 MW of hydro, solar and batteries from a single regulated renewable operations centre, and Enel Green Power reports managing 59 plants from one control room in Greece. What is new is not the practice but its extension towards higher-hazard plant, which is where the constraints bind.

In every credible arrangement, AI advises and deterministic control logic acts. Models perform detection, diagnosis, triage and evidence assembly; the actions that move plant are DCS logic and protection functions that are interlocked, tested and explainable. That boundary is not conservatism for its own sake — the unattended-operations basis, the insurance position and any subsequent investigation all depend on being able to state exactly why the plant did what it did. Blurring the boundary makes the safety case substantially harder to write and to defend.

Usually because of the balance of plant rather than the turbine. A CCGT carries a large on-site hazard inventory — gas, high-pressure steam, hydrogen cooling, chemical storage — and a long list of tasks that need hands: chemistry sampling, local valve operations, filter and lubrication work, local resets and first-response fire duties. Fire and life-safety arrangements assume a response, and insurers price that assumption. Several of those constraints can be reduced with instrumentation and design change; some cannot, which is why reduced night crewing is a more realistic target than an empty site.

Time-to-human is the measured time from an escalation to a competent person being on site. Set it by measuring, not estimating: drive it at night, in the worst season you have data for, with the usual route closed. It then becomes a hard design constraint, because every automatic response must hold the plant in a safe state for at least that long. Sites whose worst-case time-to-human exceeds what the plant can safely hold are not unattended candidates in the current configuration, however good the monitoring is.

No. Remote monitoring is read-only by construction, so every remote diagnosis ends with someone driving to site. It genuinely improves reliability — developing faults are caught days or weeks earlier — but it does not change a roster, and programmes that report telemetry coverage as progress towards autonomy are measuring the wrong axis. The step that changes attendance is remote actuation and isolation: the ability to put the unit in a defined safe state and hold it there without anybody present.

No, but they shape the architecture and belong in the design from the start. The ISA/IEC 62443 series provides the segmentation model — zones, conduits, controlled access — and for North American bulk-electric assets, NERC CIP turns much of that into compliance obligation. The specific requirement unattended operation adds is a designed loss-of-communications behaviour: what the plant does when the remote centre goes dark must be an explicit, tested decision recorded in the unattended basis, alongside a second independent telemetry path where the consequence justifies it.

You schedule it into attended windows. Physical isolation and its verification are hands-on requirements in every jurisdiction — control of hazardous energy is a hands-on discipline and no permit regime accepts a remote substitute. Unattended sites therefore plan planned work into periods when people are present, batch it to reduce visits, and design the maintenance strategy around visit frequency rather than trying to automate isolation. This is a scheduling problem with a well-understood answer, not a barrier to unattended operation.

It can go either way, and the only honest answer comes from measurement. Unattended sites lose the informal recovery an on-site operator provides — the local reset, the nudge that avoids a trip — and gain earlier detection, faster diagnosis and consistent pre-approved responses. Report equivalent forced outage rate against an attended baseline in the same season, alongside unattended hours, and treat any deterioration as a signal that the response catalogue is incomplete rather than as proof the model was wrong.

Not the operating fleet, and not on any timescale worth planning around. Licensed nuclear plants are staffed under licence conditions with minimum crewing requirements, and changing those requires a regulator to accept a reduced-staffing case supported by operating evidence — a multi-year process tied to a specific design. Some advanced reactor concepts propose smaller operating crews, but that is a licensing question rather than an AI question. AI in nuclear today is advisory: condition monitoring, procedure support and outage planning, all with a human accountable.

Start where the hazard is low and attendance is habitual — typically older small hydro, legacy solar and standby sites staffed by inheritance rather than by risk assessment. Those sites produce an attributable attendance result inside two quarters, and the mechanism they prove is the same one that higher-hazard plant will need. Spend that credibility on the harder cases afterwards. Sequencing the other way round, starting with the thermal site that has the biggest roster, is the most reliable way to stall the programme in a safety-case argument.

Six things: the conditions under which unattended operation applies, the events that end it, the pre-approved automatic responses with their hold durations, the measured time-to-human, the escalation path and evidence requirements, and the external agreements covering fire, security and insurance. It also names an owner with authority to suspend unattended operation, and states its review triggers. Treat it as a control document under management of change rather than as a report — a basis that is not re-tested after plant modifications expires silently.