System design for physical AI: OT security monitoring and NERC CIP evidence from one system of context

An open reference architecture published under CC BY 4.0 describes a unified OT security monitoring and NERC CIP evidence system for a US electric utility operating control networks across more than 80 substations, joining ten source systems through two adapter families onto an ordered, replayable event backbone that writes fourteen typed objects. The design keeps detection on procured OT monitoring sensors reading SPAN or TAP traffic copies, with no component in the RTU-to-DNP3 control path, and uses a GNSS-disciplined time card with holdover to keep sensor, capture and log clocks correlated. The paper reports that owning the reasoning node — a single server of eight 141 GB GPUs running GLM 5.2 at FP8 — costs roughly $510,000 over three years versus about $630,000 for the deepest equivalent AWS commitment, and that a closed model by the token matches the owned node at about 25 users while sending bulk electric system telemetry outside the operator's boundary.

This is the engineering summary of an open reference architecture. The paper, its object model as JSON and the model register are free to reuse under CC BY 4.0: https://codeatoms.ai/ot-security-cip-evidence-us/ https://codeatoms.ai/ot-security-cip-evidence-us/ . The operator is described by class, never by name. An electric utility in the United States runs control networks behind more than 80 substations. It needs one answer: what is connected, is anything behaving abnormally, and can it prove both when the regional reliability auditor arrives. Asset discovery, network monitoring, log retention, threat intelligence and compliance reporting each hold one slice, and the slices do not join. Here is how that turns into one system. Detection belongs to the procured OT monitoring sensors, which read a copy of the traffic at SPAN or TAP ports. Nothing in the design sits in the RTU-to-DNP3 control path, and nothing writes into an electronic security perimeter. Data leaves each zone one way: a constrained DMZ conduit by default, hardware data diodes at the highest-impact perimeters. Ten source systems, including the SIEM, an OT detection tool, an IT monitoring platform, the energy management system and the substation data platform, enter through two adapter families onto an ordered, replayable event backbone. The adapters write fourteen typed objects: substation, OT asset, network sensor, anomaly alert, investigation case, vulnerability finding, detection rule, threat intelligence item, pcap evidence record, CIP evidence artefact, OT security analyst and the three systems of record. From one alert, a single traversal reaches the rule that fired, the asset it implicates, that asset's substation and impact rating, the analyst who owns the triage, and every evidence artefact the asset's CIP categorization obliges the operator to retain. GLM 5.2 MIT 753B parameters, 753 GB at FP8 planning factor 1.2 904 GB node 8 x 141 GB HBM-class GPUs = 1,128 GB embedding Qwen3-Embedding-0.6B Apache-2.0 , ~1.2 GB at BF16 A smaller GPU class cannot hold the FP8 weights, so the node is one server of eight 141 GB cards at the operator's own data center. Triage drafts run in seconds, which is fine: the consumer is an analyst at a workbench, not a protection relay. A GNSS-disciplined time card with holdover keeps sensor, capture and log clocks in agreement, because pcap evidence that cannot be correlated across an outage is not evidence. Owning the reasoning node costs about 510,000 dollars over three years, about four fifths of the deepest three-year AWS commitment for the same eight cards 0.63 million dollars , with every price cited in the paper's Appendix A. A closed model by the token matches the owned node at about 25 users, and it would send bulk electric system telemetry outside the operator's boundary. Full design, figures and the object model: the paper https://codeatoms.ai/ot-security-cip-evidence-us/ . Designed on CodeNinja Praxis https://codeatoms.ai/praxis/ , the platform for designing physical AI systems. The object model imports into Hyper Ontology https://codeatoms.ai/hyper-ontology/ , which turns it into a living system. Load it yourself with the open hyper-ontology loader https://github.com/muhammadumar89/codeninja-research/tree/main/hyper-ontology-py .