The Overview · V1.1 · 6 November 2026 · Petr Roupec, BM Global

Beyond Purdue

Purdue sorts devices by where they sit. Beyond Purdue sorts them by what they are allowed to do.

One model for machines, people and AI. The simpler and more predictable a level, the more authority it holds: authority is earned by predictability, not by intelligence. People work inside the plant, so their safety is part of every step.

Use the arrow keys, Page Down or the buttons above to move through the slides.

0 How to read it

Every explanation follows one order

The laws come first. Everything else is a result of them, and of the data living in independent nodes.

The Laws of Authority

The main principle. Who is allowed to do what.

Independent nodes

Data lives in independent nodes, with meaning. All that follows is a result of it.

Names and aliases

Naming and asset management, DNS style, because people already know it.

Everything else

Copies, shouts, the diode, commands, maintenance, implementation.

1 The Laws of Authority

The laws

A lower-numbered law always overrides a higher one, as in Asimov (Asimov's laws).

Meta-law.No level acts outside these laws.

Law Zero. Protection.No harm to people or the environment, by action or inaction. Nothing is allowed to weaken protection. A lock outranks every level.

First Law. Independence.If every level above fails, protection still acts.

Second Law. Obedience.The controller obeys the operator, unless that breaks Law Zero or the First Law.

Third Law. Self-preservation.The machine protects itself, but people come first.

Fourth Law. The gate.Out channels carry data out, in channels carry commands in. They never mix and never originate an action.

Fifth Law. The record.Data nodes process, store and present data on demand. They record every command, permit, lock and bypass. They grant no access and take no action.

Sixth Law. The human decides.The operator can always ignore, override or stop any advice.

Seventh Law. See everything, touch nothing.AI analyzes, interprets and supports. It reaches an actuator only through a human decision.

Eighth Law. Authority flows down only.Information rises, authority descends. Failure never grants authority.

1 The Laws of Authority

Who is allowed to do what

Level	Authority	Allowed to	Never allowed to
L0 Protection and isolation	Absolute	Trip. Veto over every level. Hold the lock.	Be overridden, or depend on any other level.
L1 Controller	Acts	Actuators, within its logic and protection limits. Shouts every command it executes.	Act outside protection limits.
L2 Channels	Gatekeeper	What crosses, and in which direction. Every level speaks only through L2. Data diodes, passive by preference.	Originate a command. Mix data and commands.
L3 Data nodes	Holds and serves	Nothing. It processes, stores and presents data on demand, and holds every command given and executed.	Grant access. Act on the plant. Pass a command.
L4 Operator	Decides	Commands to controllers, each one shouted to L3 as given. Override and stop of any advice.	Disable protection.
L5 AI	Voice, no vote	Nothing. It analyzes, interprets and supports the operator.	Touch an actuator.

Only L0 and L1 touch the process. L4 is the operator. L5 is the AI. Protection stays hardwired.

1 The Laws of Authority

The levels, drawn

Drawing C: combined levels of authority — Drawing C. The combined levels of authority.

Drawing B: diagonal process versus context — Drawing B. Process and context on the diagonal.

2 Independent nodes

Data lives in independent nodes

The second idea. Everything that follows is a result of it.

Data does not live in one big database. Each signal, asset or record is a small, independent node with its own name, its own data and its own meaning.

The nodes are the L3 Data nodes of the data plane. They hold and serve; they command nothing. The technology works with the humans: DNS, IPv6, multicast and OPC UA, all of it familiar.

Drawing D: data plane as a name space — Drawing D. The data plane as a name space.

3 Names and aliases

Naming is always the big issue

Every node has a DNS-style name, because people already read names like these. A name is updated in three ways: automatically when a node is born, by a person, or by a shout.

DNS also has aliases, so every name a plant already uses finds the same node (RFC 1034). Every data diode is named the same way.

hp-steam.u1.plant.example          the node
10LBA10CT001.kks.plant.example     alias: KKS code
te114.vendor.plant.example         alias: vendor tag
hp-steam-temp.hmi.plant.example    alias: HMI name
asset-20417.cmms.plant.example     alias: asset number

dd01.u1.plant.example              a data diode
asset-4711.cmms.plant.example      alias of dd01

4 What follows

At least two copies

Every node lives in at least two copies, on different hardware, power and rooms, to be really redundant.

Both copies listen to the same shouts, so they hold the same data without ever syncing. Losing one copy loses nothing.

copies of every node. They listen; they never sync.

5 What follows

Shouts

Every message goes one way to a group, is repeated, and is never acknowledged. A question is a shout, and so is the answer.

Subscribing is joining a multicast group, an ordinary IPv6 function (RFC 3810). With source-specific multicast, each node is allowed to hear only the sources it names (RFC 4607).

one way

Sent to a group, never to a person or a machine.

repeated

A node that missed a shout hears it again.

never acknowledged

Nothing has to come back, so nothing can come back.

6 What follows

The data diode, the enabler

The isolator lets light pass one way only, so data and commands cannot mix. The levels hold because the diode holds.

A passive diode has no power, no firmware and nothing to configure, so it is as predictable as a relay or a padlock. Each diode is named like any other asset (NIST glossary, IEC 62443-3-3).

Drawing M: the enablers, every data diode is a named asset — Drawing M. The enablers: every data diode is a named asset.

7 What follows

Every command leaves two marks

Given and executed. The operator's command is shouted as given; the controller shouts it as executed. Commands keep their own lane and never pass through the data nodes.

Drawing J: commands are recorded — Drawing J. Commands are recorded.

8 What follows

People work inside the plant

Maintenance is part of operation. When equipment is released for work, the lock holds it still, and a lock outranks every level. Isolation exists because of maintenance. The emergency stop stops a machine; only the lock keeps it stopped.

In serviceReleased for workUnder testReturning to service

Drawing K: four plant states across the levels — Drawing K. The four plant states, read across every level.

Drawing L: the maintenance cycle — Drawing L. The maintenance cycle in the data plane.

9 What follows

Enforced by construction, not by programming

copper

for protection

light and direction

for channels

signatures

for names

A law that lives only in software is a wish.

10 Implementation Suggestions, for decision

How it is built

Existing technology for everything. The only new parts are small: listen, send, the role list and the image.

The example: five computers in the plant zone (OTZ), five in the office zone (ITZ), and passive fibre-optic data diodes between them. Nothing on the following slides changes a law.

10 Implementation Suggestion

Two zones, five hosts each

Every host keeps every record, so the nearest copy is always local. A failed host or diode loses nothing. dd04 and dd05 are the two out paths to the readers, as in Drawing M.

10 Implementation Suggestion

What runs on one machine

Software node	How many	What it does	Existing technology
record nodes	hundreds to 30,000	One per variable: name, address, value, history, alarms, meaning, state	SQLite, one file per plant area
listen	1	Joins the area groups and hands each shout to its record node	MLDv2 joins (RFC 3810)
send	1	The only process that transmits: answers, repeats, birth and health shouts	Small service
name	1	Local DNS for the zone, updated on the host (RFC 2136)	BIND or PowerDNS
time	1	Keeps the time tags correct, from the zone's own source	chrony
health	1	Disk, CPU and network counters, shouted as records	Node Exporter (Prometheus)
diode-out or diode-in	forwarders only	Sends or receives through the diode card, with repair of losses	FLUTE (RFC 6726)

Least action: stopping send silences a host but it keeps recording; stopping listen freezes its copy. Neither touches anything outside the host.

10 Implementation Suggestion

Deploying a machine: an image and a name

Every machine in a zone gets the same image. The only thing that differs is its name, and the name decides its role.

Updates come as signed bundles on a stick inside the zone, written to the spare half of the disk, with fallback if the new version does not boot (RAUC). One machine at a time; the other four hold every record.

Rack and cable. Released for work, like any other equipment.
Write the zone image. Nothing is downloaded; the zone has no internet.
Give it its name, nothing else. For example ot4.l3.u1.plant.example (cloud-init).
First boot. The role comes from the name. It shouts its birth and fills itself from repeats and asks.
Returning to service. Its health appears in monitoring.

10 Implementation Suggestion

Data nodes at 30,000 tags per computer

Each data node keeps its own name, aliases, address and records. Only transport and storage are grouped:

Shouts by plant area, about 50 to 200 groups. Switches keep small group tables: 1,024 entries on a Cisco IE3500 (Cisco), 1,800 to 8,000 on FortiSwitch (Fortinet). Each shout carries the node's IPv6 address; DNS maps it to the name.

One SQLite file per area, with each node keeping its own rows.

Estimate, 40 bytes per change	Changes/s	Network
10% of tags change each second	3,000	about 1 Mbit/s
Every tag, every second	30,000	about 10 Mbit/s
Full repeat every 60 s	+500	small

History at 10% change: about 10 GB per day per copy before compression. Retention is a decision for each zone.

Capacity = hosts × tags per host ÷ copies. Five hosts at 30,000 tags with two copies hold 75,000 tags.

10 Implementation Suggestion

The diode forwarders

Sending side

Multicast only, so no reply is ever needed (RFC 2464).

Traffic pinned to the diode card, and the card silent except for shouts.

Every shout numbered. Transmit counters and "sent, sequence N" recorded on the node of the diode.

Receiving side

Accept, check, store, then re-shout on the office LAN as a new source.

Office nodes subscribe to the forwarder like to any other node.

It acts on nothing. Two diodes, two forwarders; duplicates are dropped by name and sequence.

Proof of arrival exists only on the far side, by design. ITZ never asks OTZ; OTZ shouts snapshots and the signed zone across as files.

Basis

Maintenance in the standards

Each standard covers its own level or its own equipment. None of those reviewed sets maintenance out across levels of authority.

Standard	What it says about maintenance	Level
IEC 61508-1, 7.15	Operation, maintenance and repair are a life-cycle phase.	L0
IEC 61511 ed.2, 16.2	Bypasses need authorization and indication, and are recorded.	L0, L3
ISO 14118	Prevention of unexpected start-up: isolation and energy dissipation.	L0
ISO 13850	The emergency stop overrides all functions, but is not a measure against unexpected start-up.	L0
EN 50110-1:2023	The five safety rules, permission to start work, re-energizing after work.	L4, L0
OPC UA Part 9, Annex E	Alarm state machine with RemoveFromService.	L3

Maintenance is linked to 10 to 15% of fatal accidents at work (EU-OSHA).

Watch

The Works, narrated

Five minutes 46 seconds, in the same order: laws, nodes, names, then the rest.

Read

The documents

The Laws of Authority, One PagerV1.0 · PDF The Laws of Authority, StatementV1.0 · PDF ArticleV1.0 · PDF LinkedIn ArticleV1.0 · PDF Levels of Authority DrawingsV1.1 · PDF Data Plane ConceptV1.0 · PDF Implementation and Deployment PlanV1.1 · PDF Eight Questions by Level of AuthorityV1.0 · PDF The Works, OverviewV1.0 · PDF The Works, NarrationV1.0 · PDF Data Diodes as the EnablerSuggestions V0.1 · PDF Maintenance is OperationSuggestions V0.1 · PDF Universal Control System, One PagerV4 · PDF

Purdue sorts devices by where they sit. Beyond Purdue sorts them by what they are allowed to do.