An IoT gateway for energy assets that replaces the control cabinet

The task

Anyone who connects generators, storage and consumers to a control centre needs a device at every site that collects readings, passes on setpoints and secures the connection to the outside. At the client, this used to be done by an entire control cabinet with a router and a controller. It was too expensive to install by the thousand.

The task was to put the function of that control cabinet into a DIN-rail device: Modbus over RS485 and Ethernet, analogue and digital inputs and outputs, LTE with two SIM cards, Wi-Fi, and a temperature range of -20 to +85 °C. Plus one condition from the rules for connecting energy assets: the plant network and the connection to the control centre must not share a network path.

The solution

The gateway has two processors. The Ethernet port to the plant ends at a microcontroller that does nothing but take the Modbus payload out of the packets and pass it over a serial line to the Linux main processor. There is therefore no path between the plant network and the cloud connection that an IP packet could take, and the evidence for that is in the schematic, not in a firewall rule.

The main processor runs its own embedded Linux. The connection to the control centre is a VPN whose certificates are generated during manufacturing. A new certificate replaces the old one only once a connection has been established with it; a firmware update goes into a second slot and only becomes permanent if the device then reaches the control centre. Otherwise, the previous version boots. The configuration web server can only be reached after a button press and only for a short time, and the control centre can request a hash of the program memory at any time.

We delivered the concept, the main, operator panel and expansion boards, the Linux system, the firmware of the second processor on semf, the services for device management, monitoring and tunnelling, and the verification, from integration tests in the pipeline to EMC qualification. For series production, a test station based on qdTest contacts, measures and registers every device and provisions it with certificates. The client builds its plant logic on top and places the device on the market.