Why this environment matters
A substation gateway may connect protection equipment to supervision, engineering tools and a remote control centre. Those paths operate on different timescales and should not inherit the same authority. This proposal places the candidate NØNOS boundary around supervisory and engineering access while preserving independently assessed protection functions.
The security challenge
A relay-status reader might need event and measurement access without any ability to change a setting group. A maintenance tool may require a temporary write permission for one relay. A proposed broker would express those differences explicitly and would bind a change request to the target device and the approved maintenance activity.
How the capsule model could help
Protocol parsing could occur inside restricted capsules, with a dedicated adapter handling accepted operations. The gateway would not be placed into a time-critical trip path merely to gain uniform software architecture. Any such placement would need its own timing and safety assessment, including behavior under overload and failure. After a disturbance, engineers need to reconstruct which observations and actions preceded the trip. Gateway recovery should preserve event ordering and identify uncertain timestamps rather than smoothing them into a convenient narrative. A temporary runtime can forward evidence to durable storage, but that storage and its clock dependencies need separate design. The pilot would compare a recorded event stream with relay-side records while introducing communication faults and rejected engineering commands. Success would mean that authorised access remains narrow and diagnosis remains possible; it would not establish protection-system correctness.
Deployment requirements
Substation protocols, time synchronisation, protection coordination and vendor support must be established for the actual equipment. The proposed operating-system boundary would not replace certified protection devices or an approved engineering-change process. Evaluation requirements: Use a status-only identity to request a setting-group change and verify rejection before relay access. Interrupt a maintenance session and confirm that its write authority cannot be reused after expiry. Reconcile gateway and relay event records across a restart with deliberately uncertain clock synchronisation.
Current public-beta limitations, hardware support and application availability must be assessed before any pilot. Neither this use case nor an industry source establishes NONOS certification or a current customer deployment.
Keep the engineering session distinct from protection traffic
A relay-status reader might need event and measurement access without any ability to change a setting group. A maintenance tool may require a temporary write permission for one relay. A proposed broker would express those differences explicitly and would bind a change request to the target device and the approved maintenance activity.
Protocol parsing could occur inside restricted capsules, with a dedicated adapter handling accepted operations. The gateway would not be placed into a time-critical trip path merely to gain uniform software architecture. Any such placement would need its own timing and safety assessment, including behavior under overload and failure.
A trustworthy event order matters during recovery
After a disturbance, engineers need to reconstruct which observations and actions preceded the trip. Gateway recovery should preserve event ordering and identify uncertain timestamps rather than smoothing them into a convenient narrative. A temporary runtime can forward evidence to durable storage, but that storage and its clock dependencies need separate design.
The pilot would compare a recorded event stream with relay-side records while introducing communication faults and rejected engineering commands. Success would mean that authorised access remains narrow and diagnosis remains possible; it would not establish protection-system correctness.
Who could buy or integrate it?
- Transmission utilities procuring substation communication and engineering gateways
- Protection equipment OEMs integrating gateway platforms
- Substation engineering contractors delivering utility-approved station designs
Industry examples: Schweitzer Engineering Laboratories, Siemens. Organisations shown illustrate the industry. No NONOS customer, partner or endorsement relationship is implied.