Function

The controller permanently monitors

• frequency
• 3 Line Voltages
• a DC voltage like backup batteries
  
• more inputs can be added, if necessary, for example an overcurrent input, or a temperature sensor for bearings.
  To measure current, the output of a clamp adaptor like this (200A, ≈ 45KW) can be rectified with an opamp and connected to the dc input.
  400A, 90KW
  DIY cheap solution, virtually unlimited current

3 Modes

1. ELC

The dump loads are never disconnected, even in case of fault detection like over frequency or over voltage.

• the 13 PNP outputs control 13 sets of SSRs. One output might typically switch 3 SSRs for 3 phases. So a typical setup might include 39 SSRs.
  Each PNP output can scource 150mA. So if your typical SSR soaks 20mA, you can connect 7 SSRs to each output, for example if you only have smaller SSRs available.
  
  ATTENTION:
  Don't use mechanical relays, because the switching frequency of the PNP outputs is up to 50Hz. Mechanical relays might survive for only a few days.
• the 2 relays control the water valves, if valves are installed
• there is an optional PNP output for switching off the main relay/contactor in case values are out of range

Overspeed protection

You can connect a second ELC as backup/brake, if the first ELC fails. Set the second ELC to a slightly higher frequency.
You can connect the PNP outputs in parallel with the first ELC (cheaper), but you can also use a separate set of SSRs and dump loads (potentially safer).

The brake won't protect the generator from overspeed if the generator doesn't output any power. So the only failsafe way to protect from overspeed is to shut the water down. What's so dangerous about overspeed

2. Low priority User load

In principle, you could connect a low priority resistive user load like a boiler directly to the ELC as a dump load.
But what if the water boiler is too far away or if you want to connect an inductive load like a water pump?
Use the controller to switch this load automatically if the frequency or voltage falls below a threshhold.

Another scenario:
A hydro power supplies electricity to a village and a hospital/health center. Before the hydro power shuts down completely due to overload, it makes sense to disconnect the village first.

Third scenario:
You want to warn the  users that the hydro power is about to shut down if they don't switch off some loads. Connect a signal lamp or a horn to the controller.

Setting:

Set the target frequency to something below 50/60Hz, e.g 49.5 Hz,* and set a minimum voltage. Below these threshholds, the user load wil get disconnected, and will automatically be switched on again, if the values have reached the "back on" threshholds, or after a certain time.

• Operate the user load directly from the on board relay, if the power is not more than 1KW, or the current is not more than 5A.
• Use the on board relay to operate the main contactor for the village
• Use one of the PNP outputs to directly drive a SSR (take care to consider the reduced switching capacity of a SSR if connecting an inductive load)

*Note:
This setup will only switch the user load off, once the Hydro power has actually reached the end of its capacity, and the frequency starts dropping. Make sure the Protection Relay Value is set to something lower, e.g 49.0 Hz, than the user load relay, or else the protection relay will shut the user grid down before this user load can be shut off.
Ideally, the user load would be shut off before the hydro power has reached the end of its capacity, but that would mean some type of remote communication between the ELC and the user load switch. This would involve either long wiring or wireless/mobile communication, and is probably not worth the effort. As it is, the frequency is the means of communication.
If there is no high voltage transformator for the transmission line between the generator and the users, it might be possible to utilize powerline based commercial home automation systems like Universal Powerline Bus (UPB), PLCbus or X10.
comparison of different home automation systems
UPB clone
UPB discussion

3. Protection Relay

If the frequency or voltage values are out of range (too high or too low), the system will be shut down permanently, that is, the user loads will be disconnected, and the water valves will close to prevent damage of the generator through overspeed.
Even if the values get into the legal range again, the Protection relay won't switch the system on again.

• The 2 SPDT (single pole dual throw) relays will switch to idle.
• The PNP outputs have no function

The shutdown reason will be stored in the internal memory even in case of power loss, and can be checked at a later point for error diagnosis.
For reading the display however, the ELC will need power. So it might be a good idea to have a 5V battery pack ready at the site ( 3 x 1.5V batteries = 4.5V, or 4 x 1.2V rechargeable batteries = 4.8V should do the job), if there is no petrol generator at the site.
If there is 12V battery power at the site, a 12V DC-5V DC power supply will also work.