Halden product page · 3 directions

Design exploration · Aastroem

Three directions for the Halden product page.

One product, two tiers — Halden Observe (read-only monitoring, shipping today) and Halden Control (the command path, a separate engagement). Each direction below is a committed visual treatment aimed at a technical buyer: plant operators and engineers evaluating remote monitoring for vanadium redox flow battery sites.

Copy is drawn from the real product docs and kept confidentiality-safe — no customer names. The palettes lean on something the subject actually gives us: vanadium's four oxidation states are four distinct colors, the literal chemistry of the battery being watched.

Audience: technical buyers Read-only data diode 8-gate security model System fonts (CSP-safe)
01

Telemetry

Control-room · instrument

The operator's own world: a dark instrument panel, live signal, monospace readouts. Observe is a running trace; Control is a hatched, locked-off surface you can see but not touch. This reads as “software an operator already trusts,” not a brochure.

Palette

Cool near-black with blue bias. Teal = live/observe, amber = gated/control — semantic, not decorative.

Type

Display / bodySystem grotesque
Data / labelsSF Mono · tabular-nums

Monospace is the control-room vernacular — used for every number and slug.

Layout

Full-bleed status bar, live oscilloscope hero with a 4-cell readout, then the two tiers as instrument panels. Vanadium states appear as a data-series legend.

halden.aastroem.io / observe
STREAM LIVE SITE ap-southeast-2 PROBE uptime 41d 06h mTLS TLS1.3 · cert pinned lag 180 ms

Halden Observe · read-only monitoring

Watch every cell. Touch nothing.

Read-only remote monitoring for vanadium redox flow battery sites. An on-site probe reads battery and PLC telemetry and streams it out to the cloud — operators watch it in Grafana.

The only thing a site gives up is an outbound WAN connection. No inbound ports, no standing write path.

STACK VOLTAGE · SoC · FLOW RATE60 s window · 1 Hz
Stack V
48.2 V
State of charge
63 %
Flow rate
21.4 L/min
Retention
365 d
probeEMQX mTLS bridgecloud broker TelegrafVictoriaMetricsGrafana
halden-observe

Observe

● Available now

Read-only telemetry, edge to dashboard. A data diode enforced at the probe — the bridge is egress-only with a raw/# filter and no command channel.

  • Read-only OPC UA client — browse + read_value, zero writes
  • Store-and-forward buffering rides out WAN outages
  • Per-probe mTLS certs, pinned at the broker
  • VictoriaMetrics · 365-day retention · Grafana alerts
halden-control

Control

◇ Separate engagement

The command path — setpoints, mode changes, dispatch — applied to the BMS/PCS. It ships as a disabled stub by design.

  • Distinct ADR + threat-model review before any activation
  • On grid-scale assets, a regulator / cyber-security gate
  • Activation is a commercial decision, not a code change
▲ command channel disabled · cmd/# denied
V²⁺ V³⁺ V⁴⁺ V⁵⁺ — electrolyte states, used as telemetry series colors
02

Electrolyte

Schematic · engineering drawing

A blueprint of the thing itself. The hero is a real flow-battery schematic where the data-diode is drawn as a one-way path off the stack — you can literally see that data only flows out. Light, precise, drafting-table calm. The vanadium four-state palette becomes an honest legend, not an accent grab.

Palette

Blueprint grid on cool paper; ink-blue linework. Amber (V⁵⁺) reserved to mark the Control / write path.

Type

Display / bodyHumanist sans
AnnotationsMono callouts · dims

Mono used the way a draughtsperson uses stencilled callouts — measured, technical.

Layout

Drawing-sheet stamp, an SVG stack-and-tanks schematic as hero, tiers as spec cards with a left rule, and a four-swatch vanadium state legend.

halden.aastroem.io / product
◆ Aastroem · Halden · Sheet 01 — Observe

The monitoring layer, drawn to spec.

Read-only remote monitoring for grid-scale vanadium redox flow battery sites. Telemetry leaves the stack on a one-way path — there is no drawing on this sheet for a way back in.

FIG 1 · SITE → CLOUD DATA PATHread-only · egress only

V²⁺/V³⁺ V⁴⁺/V⁵⁺ CELL STACK PROBE read-only mTLS ▸ egress CLOUD Grafana ✕ no write path (Halden Control)
halden-observe

Halden Observe

▲ Shipping

probe → local EMQX → mTLS bridge → cloud broker → Telegraf → VictoriaMetrics → Grafana. Dashboards and alerts, including probe-staleness detection.

  • Outbound WAN is the site's only requirement
  • Store-and-forward through connectivity loss
  • Multi-tenant cloud; per-site accounts stay thin
  • Region-locked ap-southeast-2
halden-control

Halden Control

◷ On the roadmap

The separately-contracted write path — remote setpoints and dispatch to the BMS/PCS. Not a sheet on this drawing; a distinct product with its own commitments.

  • Its own architecture decision record + threat model
  • Regulator-gated on grid-scale assets
  • Enabled by contract, never by config flag
✕ write path out of scope for Observe
V²⁺violet · charged −
V³⁺green · discharged −
V⁴⁺blue · discharged +
V⁵⁺yellow · charged +
03

Gates

Trust · editorial slate

For the buyer whose real question is “can I trust this on critical infrastructure.” Calm, confident, typographic. The structural device is the actual 8-gate security model — a numbered ladder, because here the sequence genuinely carries meaning. Serif display for gravity; a single gold accent reserved for the gates themselves.

Palette

Warm near-black (red bias) to separate it from Direction 01's cool black. Gold spent only on gates.

Type

DisplayEditorial serif
BodyNeutral sans
StateMono tags

Serif signals institutional confidence — the only direction that isn't mono-led.

Layout

Editorial hero with an italic gold emphasis, the gate ladder as the page's spine, then the two tiers as calm cards. Generous whitespace throughout.

halden.aastroem.io

Halden · monitoring for critical energy assets

Read-only by architecture. Trusted by design.

Halden watches vanadium redox flow battery sites without ever holding a way in. The read-only guarantee isn't a setting — it's the shape of the system, backed by an eight-gate security model built for grid-scale assets.

The security model — baseline & opt-in hardening

05GATE
Measured bootTPM 2.0 attestation of the probe before it joins
Active
06GATE
Signed imagescosign-verified, reproducible builds; fail-closed admission
Active
07GATE
Encrypted OT linkOPC UA Sign+Encrypt with mutual certificate auth
Active
08GATE
Audit forkIsolated account · S3 Object Lock · 7-year retention
Active
+1.5
SOCI-ready hardening tiereBPF egress, hardware-key operator auth, SIEM & automated reporting — opt-in, additive
Opt-in
halden-observe

Observe

Available

Read-only remote monitoring. The probe reads and streams; nothing standing lets the cloud write back. Its single site requirement is an outbound WAN connection.

  • Data-diode architecture, enforced at the edge
  • mTLS end to end · TLS 1.3 · CRL revocation
  • 365-day metrics retention with alerting
🛡 Baseline gates 05–08 active on every deployment
halden-control

Control

By engagement

The command path — setpoints, mode changes, dispatch — is a sibling product with its own contract, its own threat model, and its own regulatory gate. It is never a toggle on Observe.

  • Distinct architecture decision record before build
  • Regulator / cyber-security review on grid-scale sites
  • Commercial decision, not a code change
🔒 Ships disabled · cmd/# denied in the broker ACL