Industry Pain Points:

The specific role of a secure IoT network appliance (data diode) in a monitoring platform: 35kV substations are the power core of coal mines, supplying electricity to critical equipment such as personnel hoisting systems, coal conveyance, and mine ventilation. It is crucial for the monitoring center to have real-time visibility into the substation's operational status to ensure safe mining operations. If external entities could remotely control the substation via the monitoring network, it would lead to severe consequences. The network appliance resolves this dilemma by enabling the central control room to monitor substation operations in real time while physically blocking any external control signals—ensuring one-way data flow and thus guaranteeing security.

In the Baoyushan Mine Integrated Automation Monitoring Platform project, operational data from the 35kV substation needed to be collected and displayed centrally in the control room. However, the substation’s relay protection system uses the XJ 104 protocol, which is not supported by the existing monitoring software, making data collection impossible. Additionally, since the monitoring system ring network is connected to the internet, absolute information security requires a physically unidirectional data flow—data can only be extracted from the substation, with no possibility of sending any data back to it.

A secure IoT network appliance based on the Phytium processor and Kylin operating system supports multiple industrial protocols and power communication standards. It can collect operational data from the 35kV substation using the XJ 104 protocol and forward it to the monitoring software via the widely supported Modbus TCP protocol, enabling real-time visualization of substation status. The appliance ensures physical unidirectionality—data can only be transmitted from the substation outward, with no reverse communication possible—thereby eliminating the risk of remote control of the substation from external networks.

Solution Details:

On the internal side, the secure IoT network appliance connects via Ethernet to the XJ Electric relay protection system of the 35kV substation, using the XJ 104 protocol—a customized version of the standard IEC 60870-5-104 protocol, which is not supported by most gateways or network appliances. The appliance collects over 2,000 telemetry, telecontrol, and pulse signals at a 1-second cycle. Once data is acquired on the internal side, it is transferred through an internal unidirectional channel to the external side of the appliance. The external side connects to the enterprise ring network via Ethernet, using the Modbus TCP protocol for data transmission.

The communication protocol used by the XJ Electric relay protection system is not the standard IEC60870-5-104, but a proprietary variant. As a result, most SCADA software and many network appliances do not support it. However, the China Systems network appliance supports this customized version of IEC60870-5-104 among its wide range of power protocols. By simply configuring on-site parameters, the gateway can extract data from the relay protection system and forward it to SCADA software via user-friendly interfaces such as Modbus TCP or OPC UA.

The network appliance in this project uses a domestically designed and manufactured Phytium CPU and the Kylin operating system, ensuring trustworthiness at the system's foundational level and minimizing the risk of attacks exploiting CPU or OS-level vulnerabilities. Given that coal mines and substations have lifespans of decades or longer, long-term availability of spare parts is essential. By using a fully domestic CPU, the solution ensures reliable long-term supply of core components. The Phytium CPU is a trusted, independently developed processor widely used in government and industries with high information security requirements, forming the cornerstone of the appliance’s security.

Key hardware specifications and network topology are as follows:

Hardware Specifications

CPU

Phytium FT1500, 4-core, 1.5GHz

RAM

8GB DDR3 RAM

Storage

128GB NAND Flash

Ethernet Interfaces (Electrical)

6 ports

Ethernet Interfaces (Fiber)

2 ports

Wireless Interface

Wi-Fi and 4G support, optional

Serial Ports

2 x RS485/RS232, optional

Implementation Results:

Since deployment in July 2020, the secure IoT network appliance has been operating stably 24/7. It fully meets the customer's requirements for data acquisition and unidirectional isolation protection. Meanwhile, the secure IoT network appliance from Shenzhen Sinmax leverages China's independently innovated Phytium CPU, Kylin OS, and a proprietary appliance engine to ensure long-term, reliable supply.

Successful Case:

Integrated Automation Monitoring Platform Project at Baoyushan Mine, Henan Energy Group