A late decision is
a physical event.
RooTrust runs its control loops in a verified bare-metal kernel. Interlocks are hardware-verified. And when the network goes away, a substation, a pipeline manifold or a water utility stays in a safe state without anyone watching.
What RooTrust has to get right
Microsecond Actuation
Protection logic and breaker trip commands are evaluated in a bare-metal #![no_std] Rust microkernel. Jitter stays under 10 microseconds. Everything on this path is bounded before the system ships, because a control loop that allocates, defers or retries has already given up the deadline it was supposed to hold.
Zero-Trust Interlocks
An actuation needs dual cryptographic attestation from the onboard Hardware Security Module (HSM). There is no manual override that skips it.
Air-Gapped Edge Failover
Sever the satellite backhaul or the fiber and the local RTUs keep running their safe-state routines for up to 30 days, with no central oversight.
It speaks what's on the wire
Native drivers for IEC 61850 MMS/GOOSE, Modbus TCP, DNP3 SAv5 and OPC UA, evaluated directly. Nothing is translated by a proxy in the middle.
Limits the firmware enforces
Actuator travel speeds are governed so a pipeline never sees a hydraulic shockwave, and a chemical pump is physically barred from exceeding its statutory dosage cap.
What happens between sensor and actuator
Collect from everything on the wire
Analog I/O, pressure sensors and RTU telemetry are polled continuously across multi-vendor field equipment. No translation delay.
Evaluate the interlocks
Safety parameters and ladder interlocks are evaluated in sub-milliseconds inside the formally verified Rust engine.
Dispatch a signed command
Cryptographically verified commands go to breaker coils, pump motors and pipeline valves, with microsecond accuracy.
Trip before the damage
On anomalous feedback or a voltage surge, the system trips into an air-gapped mechanical safe state — before the equipment is damaged.
"In IT, an error triggers a reboot. In OT, an error causes a pipeline rupture, an exploded generator, or an unpowered city. RooTrust assumes the perimeter is breached and guarantees physical safety."
Bring us your SCADA architecture.
Our systems engineers are in Central Europe and the Americas. One of them will read it.
Talk to a systems architect