How one node works

Any switch can always open. Closing has to earn it.

Each node is a switch with two small computers. The safety chip can always open it, on its own. Closing needs every check to pass, the handle up and no padlock. Computers can ask a node to close, but never force it, and never switch a home off.

Run it

One home's switch through a whole outage, in six short chapters. Press Play; the parts doing the work light up.

On grid

Grid power Shared with neighbors Home's own battery No power Open wire or fault Close wire

All readings: volts, amps, battery, handle

Inside the node

The switch has two coils: one opens it, one closes it. Who can fire each one is the whole safety design.

The handle and padlock are physical gaps in the close wire, so no bug or hacked command can bridge them. The trip coil runs on a supercapacitor, so opening works even with no power anywhere.

Try it: line up the waves before closing

Before closing, the node compares the street's voltage wave with the home's. If they are out of step when the contacts meet, a surge rips through both sides. Set how far apart the two sides are, then ask the node to close. It waits until the waves line up within 20°. The 60 Hz wiggle is frozen so you can see the shapes; the drift between them runs at real speed.

Frequency difference 0.12 Hz Voltage difference 3 %

Open. Waiting for a close request.

Limits are from the IEEE 1547 standard for systems this size: under 0.3 Hz, under 10% voltage and under 20° apart.

All 17 parts and their costs

Part	What it is	What it does	Example class	Cost
`CT_GRID` `CT_HOME`	Two current sensors	Measure current on each side of the switch, including which way it flows. The safety chip reads them through its own comparator, separate from the metering chip, so one failure can't blind both.	Split-core current transformers	$8.00
`VSENSE_x2`	Voltage taps	Measure voltage on each side. Comparing the two tells the node whether the street is live and whether the waves line up.	Resistor dividers	in board
`METERING_IC`	Energy-metering chip	Samples voltage and current about 8,000 times a second and works out volts, amps, frequency and the phase angle between the two sides.	ADE7953 / ATM90E26 class	$3.00
`SAFETY_MCU`	Safety microcontroller	Can only open the switch. Watches for grid loss, faults and overloads, holds the close-enable line, and checks the main chip's heartbeat. Its program is fixed at the factory and can't be changed over the air.	Arm Cortex-M0+ class	$0.80
`MAIN_MCU`	Main microcontroller	Runs the rules: the eight-check close permit, the night caps, status reports, and requests from the computers. Accepts only signed firmware updates.	ESP32-S3 class	$3.00
`SECURE_CHIP`	Secure element	Keeps the node's private key locked in hardware. Signs every report and checks every incoming command's signature, age and serial number.	ATECC608 class	$1.00
`RADIO_900`	Mesh radio	Talks to the regional computer over 900 MHz, hopping through other nodes, the way smart meters already do.	Wi-SUN class module	$7.00
`PLC_MODEM`	Powerline modem	Sends data over the 240 V wires to the transformer node. It connects on the street side, so it keeps working when the switch is open or the wires are dead.	G3-PLC class	$6.00
`CLOCK_RTC`	Real-time clock	Keeps time through outages for the night caps. Drifts about a minute a year and is checked against the transformer node's GPS time.	DS3231 class	$1.50
`SUPERCAP`	Supercapacitor	Stores enough energy to fire the trip coil several times with no power anywhere, and keeps the clock running for weeks.	5 F supercapacitor	$4.00
`PSU_DUAL`	Power supply	Powers the node from whichever side has voltage: the street or the home's battery.	On the board	in board
`CONTACTOR_200A`	Latching contactor	The switch itself. Latching means it stays where it is without power. Rated to break 200 A of normal load; for a big grid short it waits for the utility fuse to clear first, so it never welds itself shut.	Meter-disconnect latching relay	$40.00
`HANDLE` `HASP`	Manual handle and padlock hasp	Down pulls the contacts apart through a mechanical linkage. Up asks the node to close. A padlock through the hasp blocks the handle.	Molded lever	$14.00
`INTERLOCK_SW`	Interlock switch	Sits in the close-coil wire and opens whenever the handle is down or padlocked, so the coil can't get current.	Snap-action switch	with handle
`WINDOW`	Viewing window	Lets a lineworker see the contacts apart with their own eyes.	Clear cover	with handle
`STATUS_LIGHT`	Status light and display	Green: closed. Amber: waiting, with the reason in words. Red: locked out.	LED and small display	in board
`LOAD_RELAYS`	Load-control outputs	Switch the AC, water heater and EV charger circuits in the panel to enforce caps. The essentials circuit (fridge, fan, a light, medical) is never switched.	Drivers for panel relays	$30–60 in panel

Node hardware comes to about $132 with the housing, board and assembly. The home's own main breaker still protects the wiring inside the house; the node only manages the connection to the street.

Who decides what

Fast decisions at the bottom, big-picture ones at the top. If any link fails, the layers below keep working.

Central computerOne per utility. Night plans, the base link, reconnecting, and when island batteries buy and sell.

Fiber or cellularIf it fails, regions keep their last plan.

Regional computerMerges street islands and shares energy between them.

900 MHz mesh radioIf it fails, each street runs its own island.

Transformer nodeAbout 15 homes. Runs the island battery and keeps its 10 kWh floor locked while the grid is up.

Powerline signalIf it fails, homes with batteries run alone.

Home nodeIn the meter socket. Has the final say over its own switch.

The wires themselvesFrequency drops as storage drains. Every node reads it, no message needed.

Manual override

Every node has the same handle, from the home switch to the power-line recloser. Off is purely mechanical. On is only ever a request.

Handle down: open

A lever pulls the contacts apart. No chip or battery involved, so it always works. Anyone can do it.

Down with a padlock: locked

The hasp holds the handle down and the close wire is cut. Only the padlock's owner can release it.

Handle up: asks to close

Up doesn't touch the contacts. It asks the node to close, and the node runs the same 8 checks. Amber means waiting, with the reason shown.

Who can do what

Who	Can	Can't
Homeowner	Pull the handle down any time. Push it up to ask for a close. Register medical devices so they are never capped. Set the EV's driving reserve and the home battery's backup reserve.	Force a close past a failed check. Remove a crew's padlock.
Line crew	Padlock any node: home, transformer or section. Ground the lines. Reset a fault lockout with a utility key after a test pulse comes back clean.	Close a switch past a failed check. Even after their own reset, the line must pass a test pulse first.
Utility operator	Set the night plan. Ask switches to close. Put an area on storm hold, which blocks every automatic close there.	Open a home remotely. Close anything past a padlock or a failed check.
Base commander	Open or padlock the base boundary. Approve lending the base's spare power.	Be forced to lend. The base always powers its own mission first.
Firefighter	Pull any home handle down to kill power to a burning house's street connection. Padlock it if needed.	Nothing extra. Off is always available to anyone.

Rules no computer can change

The key rules live in hardware or the safety chip's factory-fixed program, not in software anyone can update.

Opening never needs permission. Two separate paths, neither waits for a message.
A padlock blocks closing. It physically cuts the close wire.
No computer can switch a home off. Only its own readings, the handle or a padlock can.
Never join two sides out of step. Both chips must agree the waves line up.
Never power a dead line blind. A test pulse must come back clean first.
Emergency energy can't be sold. The island battery's floor only discharges while cut off from the grid.

All 13 rules and where each lives

Rule	Where it lives	Why it can't be bypassed
Opening never needs permission	Safety chip and the mechanical handle	Two independent paths, and neither waits for a message. The trip coil runs on the supercapacitor.
A padlock blocks closing	Interlock switch in the close-coil wire	It is a physical gap in the wire. No software can put current across it.
No remote command can switch a home off	Home node firmware: there is no OPEN action	Homes open only on their own readings (grid lost, fault, frequency below the shed limit), the handle, or a padlock. A stolen key can't cut anyone's power.
Never close two sides that are out of step	Main chip permit and safety chip close-enable	Both chips measure independently and both must agree: under 0.3 Hz, 10% voltage and 20° apart.
Never power a dead line without a clean test pulse	Main chip permit, transformer and section nodes	A short or a grounded line shows up in the pulse, and the switch locks out until a crew resets it.
Never break more current than the contactor is rated for	Safety chip	Above its rating it waits for the utility fuse or breaker to clear, so the contacts can't weld shut.
Never feed power back into a dead substation	Section and base boundary nodes	They read voltage on the substation side and refuse any close that would energize it from an island.
Never cap a home below 0.2 kW, and never cap registered medical devices	Main chip firmware and the panel wiring	The essentials circuit has no relay on it at all, so there is nothing to switch off. If an island must drop whole homes to survive, homes with registered medical devices go last.
Never sell the island battery's emergency floor	Island battery controller, wired to the transformer switch	Below 10 kWh it can discharge only while the transformer switch is open. An open switch means no path to the grid, so that energy can only power the island.
Never drain an EV below its owner's reserve	The EV's two-way charger	The owner sets the reserve (40% here). The charger stops sharing there, so the car can always be driven away.
One move per 15 seconds per switch, except opening for safety	Main chip	Stops islands from flapping. Safety opens skip the wait.
At most 5 requests a minute per node	Secure chip and main chip	A flood of valid commands still can't rattle switches.
The safety chip's program can't be changed over the air	Factory-fixed memory	Firmware updates reach only the main chip, and only when signed with the utility's key.

If a part fails, the switch holds or opens

What fails	What the node does	Result
Main chip crashes	A watchdog restarts it within a second. The safety chip keeps protecting. No closes happen until the main chip is back.	Home stays as it was
Safety chip fails	The main chip notices the missing heartbeat, blocks every close, holds the switch where it is, and reports "service needed". The battery inverter's own built-in anti-islanding still protects the street.	No new islanding at this home until it is fixed
Metering chip fails	Readings stop or look impossible, so the main chip blocks closes. The safety chip still reads the sensors through its own comparator.	Safe, open or closed as it was
A current sensor fails	The two sides disagree in a way physics doesn't allow. The node blocks closes and reports it.	Safe
Contacts weld shut	After a trip, current is still flowing. The node reports "welded", and the transformer node opens upstream.	The next node up isolates the street
Node loses all power	The latching contactor stays where it is. If the grid is lost at the same time, the supercapacitor fires the trip.	Open is always reachable
Radio fails	Messages go over the powerline signal to the transformer node instead.	Full function within the 15-home group
Radio and powerline both fail	The node works alone. Homes with batteries island themselves; no merges happen.	Safe, with less shared power
Clock is wrong	It is checked against the transformer node's GPS time. If it is off by more than 5 minutes, the node uses the strictest normal cap, 0.5 kW, until it is fixed.	Storage is still protected by the frequency floor
Lead battery fails	The next-strongest grid-forming battery takes over voltage and frequency in about 20 ms.	Island stays up
A firmware bug	The rules that matter for safety live in the safety chip and the interlock wiring.	A bug can't close past a padlock or into a fault

← Back to the main page and the simulator