L2 Channels / the passive data diode
A channel decides what is allowed to pass. Records leave on one path, commands enter on another, never mixed. The passive data diode makes the outgoing path one way with physics: a magnet and an optical isolator, nothing to set and nothing to switch off.
The explainer
The arrow reads itself. Each bar becomes its sentence, and the amber shaft lights last. In English or Spanish.
Line by line
The head is what the diode does not have. The shaft is the physics. The direction is the point.
The one-way part has no electronics. A splitter, a fusion splice and an optical isolator.
Nothing inside stores energy. Nothing to charge, swap or let run flat.
A permanent magnet does the work. The isolator needs no power at all.
There is no code in the path. Nothing to update, nothing to backdoor through an update.
A magnetic field rotates polarised light in glass. The Faraday effect.
The rotation keeps its sense when light comes back. Between two polarisers, that is a one-way door.
BM Global builds it into a passive data diode for power plants and industrial sites.
No login, no management port, no account. There is nothing to sign in to.
The isolator does not care about bit rate. The transceivers on each side set the speed.
Light travels forward, from the plant switch to the receiving switch.
Light sent backwards is blocked by the isolator. Check it yourself with a power meter.
The optical path
A 90/10 splitter, a fusion splice and an optical isolator. Ten percent of the plant light returns to the plant switch, so its link stays up although nothing comes back from IT.
Swipe sideways to see the whole path.
How the isolator works
On 13 September 1845 Michael Faraday placed “a piece of heavy glass” between the poles of an electromagnet and saw the plane of polarised light turn.1 In 1885 Lord Rayleigh pointed out what follows: the turn keeps its sense when the light comes back, so between two polarisers the path opens one way only.2
A fibre isolator does the same with a garnet crystal, a permanent magnet and birefringent wedges. Forward, the two beams meet again at the output fibre. Backward, the rotation adds instead of cancelling, and the light is steered into the housing wall.3
A magnetic field rotates polarised light in glass.
Rotation that does not reverse, between two polarisers.
Glass and fibre carry light both ways. The isolator is what stops it.
Measure it yourself
The same test works on any channel product. If a vendor cannot let you run it, ask why.
If the magnet weakens
The garnet runs in magnetic saturation, so a small loss of field changes nothing.4 Sintered NdFeB magnets kept below their critical temperature are estimated to lose under 1 % in 30 years.5
A large loss would make the isolator worse in both directions at once: forward light drops together with the blocking. The receive power on the IT switch shows it. It does not turn silently into a two-way link.
Where it fits
In Beyond Purdue every device is sorted by what it is allowed to do. L2 Channels decide what is allowed to pass. The data plane lives on shouts: every message goes one way to a group, is repeated, and is never acknowledged. That is exactly what a diode carries.
NIST defines a one-way transfer device and names the example: “A common example is a fiber optic isolator.”6
Protection stays hardwired at L0. The diode does not replace it; it keeps the network from reaching it.
Stories from plants
Each story names a real system, real data and a real receiver, and says what the diode does not solve. Plant names are examples.
Coal and gas plant
After every trip the engineers walk to the control room with a USB stick to collect the logs. They want them on their desk instead.
DCS engineering PC to an office listener PC
Folder to folder. Works today on Linux
Honest limit. Nothing can be re-requested: files sent while the receiver is off are lost unless the sender repeats them. A passive diode protects the network path, not the plant from an insider at the console.
Coal and gas plant
The turbine OEM asks for a VPN to the vibration monitor. The plant refuses and loses warranty arguments.
Vibration monitor to the OEM diagnostics portal
Folder to folder. Works today on Linux
Honest limit. Nothing can be re-requested: files sent while the receiver is off are lost unless the sender repeats them. A passive diode protects the network path, not the plant from an insider at the console.
Coal and gas plant
Procurement orders coal on yesterday’s stock figure because the plant data never reaches ERP.
Fuel handling system to ERP and procurement
Folder to folder. Works today on Linux
Honest limit. Nothing can be re-requested: files sent while the receiver is off are lost unless the sender repeats them. A passive diode protects the network path, not the plant from an insider at the console.
Coal and gas plant
The security team sees the IT network but has no view of the DCS. The logs must reach the SIEM without a path back.
DCS servers and switches to the SOC
Native UDP. Works today, no transfer software
Honest limit. Plain UDP has no delivery confirmation; the receiver must be listening when data is sent. A passive diode protects the network path, not the plant from an insider at the console.
Coal and gas plant
The emissions report is retyped from the CEMS screen every month, and auditors ask how they can trust it.
CEMS analyser PC to environmental reporting
Folder to folder. Works today on Linux
Honest limit. Nothing can be re-requested: files sent while the receiver is off are lost unless the sender repeats them. A passive diode protects the network path, not the plant from an insider at the console.
Coal and gas plant
If ransomware hits the office, the backup of the ES680 engineering station must sit where the attack cannot reach or encrypt it.
ES680 engineering station to an offsite vault
Folder to folder. Works today on Linux
Honest limit. Nothing can be re-requested: files sent while the receiver is off are lost unless the sender repeats them. A passive diode protects the network path, not the plant from an insider at the console.
Coal and gas plant
The safety office needs the fire and gas event log for the audit, without a link to the safety system.
Fire and gas system to the safety office
Folder to folder. Works today on Linux
Honest limit. Nothing can be re-requested: files sent while the receiver is off are lost unless the sender repeats them. A passive diode protects the network path, not the plant from an insider at the console.
Transmission substation
After a fault, the protection engineers want the records from every relay without logging in remotely.
Protection relays to the protection department
Folder to folder. Works today on Linux
Honest limit. Nothing can be re-requested: files sent while the receiver is off are lost unless the sender repeats them. Teleprotection and SCADA control still need their own two-way links. The diode carries data that only needs to leave.
Dam and reservoir
Residents downstream want to see the level during a storm. The valves and gates are controlled from a small local panel.
Level sensor to a public flood website
Folder to folder. Works today on Linux
Honest limit. Nothing can be re-requested: files sent while the receiver is off are lost unless the sender repeats them. The diode stops remote control through the network. It does not replace strong local passwords or physical security.
Real incidents
Public reports only. A diode is one tool. Each angle states its limit.
Wind, February 2022
The Viasat KA-SAT attack cut Enercon’s remote monitoring and control of 5,800 turbines. They kept generating. The Stack
Separate monitoring from control. A diode does not stop an attack on a satellite modem.
Dam, April 2025
A valve at a Norwegian dam was opened remotely for about four hours through a web panel. AP News
Data goes out without a web panel exposed. Local passwords still matter.
Retail, 2013
The Target breach began with credentials stolen from its refrigeration and HVAC contractor. NPR
The vendor gets data, not a login.
Building, 2017
Casino data was taken out through an internet-connected fish tank. The Washington Post
Building sensors report out one way and cannot become a way in.
Solar, May 2025
Undocumented communication devices were found in some Chinese inverters and batteries. Reuters
The diode protects the plant network path. It cannot stop a radio inside the device.
The Nights
Scheherazade stayed alive by telling a story every night and stopping before the end. The data plane works the same way.
Sources
Faraday discovered the effect. Rayleigh made the one-way arrangement.