Why this environment matters
A treatment-plant operator needs to know whether the display represents the live process and whether an adjustment will reach the intended control point. The workstation is therefore both a viewing surface and a privileged route into treatment operations. This concept examines how those roles could be separated without displacing independent plant safeguards.
The security challenge
A proposed workstation would receive telemetry through a read-focused capsule and issue adjustments through a different command broker. An operator action would identify the process point, requested value and authorised operating context. Importing a report, opening a trend or acknowledging a notification would not by itself create permission to alter chemical dosing.
How the capsule model could help
The prototype would also distinguish measured values from calculated or stale values on the display. A compromised visual component might otherwise mislead an authorised operator into approving a harmful action. The command confirmation should show the relevant source and state through a separately assessed path, rather than trusting an arbitrary field in the requesting application. If the workstation fails, the control system and local safety arrangements need a defined response. Reloading a clean interface should first reacquire and reconcile live state, not replay a queue of old adjustments as if they were new requests. Recovery records should make an unconfirmed command distinguishable from one the controller accepted. For an initial evaluation, the proposed broker could observe a recorded control feed and compare its decisions with a simulator. Engineers should establish plant-specific bounds, staffing procedures and fallback visibility before permitting any connection that can write to operating equipment.
Deployment requirements
This is a workstation boundary proposal, not a water-treatment control design. Treatment chemistry, independent protection, hydraulic behavior and local operating procedures require plant engineering evidence. No cited guidance establishes that NØNOS is ready for this duty. Evaluation requirements: Present delayed telemetry and verify that stale data is visible before an operator is asked to confirm an adjustment. Crash the viewer during a pending command and distinguish accepted, rejected and unconfirmed results after recovery. Try a write operation from the report-generation capsule and verify denial at the device interface.
Current public-beta limitations, hardware support and application availability must be assessed before any pilot. Neither this use case nor an industry source establishes NONOS certification or a current customer deployment.
An alarm display should not inherit set-point authority
A proposed workstation would receive telemetry through a read-focused capsule and issue adjustments through a different command broker. An operator action would identify the process point, requested value and authorised operating context. Importing a report, opening a trend or acknowledging a notification would not by itself create permission to alter chemical dosing.
The prototype would also distinguish measured values from calculated or stale values on the display. A compromised visual component might otherwise mislead an authorised operator into approving a harmful action. The command confirmation should show the relevant source and state through a separately assessed path, rather than trusting an arbitrary field in the requesting application.
Recovery must preserve the plant’s actual state
If the workstation fails, the control system and local safety arrangements need a defined response. Reloading a clean interface should first reacquire and reconcile live state, not replay a queue of old adjustments as if they were new requests. Recovery records should make an unconfirmed command distinguishable from one the controller accepted.
For an initial evaluation, the proposed broker could observe a recorded control feed and compare its decisions with a simulator. Engineers should establish plant-specific bounds, staffing procedures and fallback visibility before permitting any connection that can write to operating equipment.
Who could buy or integrate it?
- Drinking-water utilities fund operator workstation renewal and approve plant integration.
- Control-system suppliers package workstation software into treatment automation contracts.
- Water engineering integrators implement upgrades; shift operators use the resulting displays.
Industry examples: Siemens, Schneider Electric. Organisations shown illustrate the industry. No NONOS customer, partner or endorsement relationship is implied.