CHERITech '2612–13 November · MunichJoshua Cooper speaking · meet us on the CHERITech stand

Interactive · Glow CHERI meter with edge AI

The grid’s new front door

By the front door of an ordinary home is a device that measures the electricity and decides what the battery, charger and heat pump do. Pick an attack and a defence, then run one day at that address. The day stops at each event, so you can see exactly where it goes wrong, or where it is held.

1Attack
2Device by the door
3How to watch
14 Orchard Close · a January weekday06:00
Indoors
20 °C
Heat pump on schedule
Today’s bill
£3.40
Battery buys cheap, covers the peak
Car tomorrow
80%
Charges overnight at 4p
Who knows you’re out
Nobody
Data stays in the home

Ready

Choose an attack and the device by the door, then run the day.

What happened

  1. A normal January morning.Heat pump warming the house; battery charged overnight at 4p; car at 80%.

Now multiply it

Fleets share firmware, so a bad day is never one house. Drag the slider to see when a household problem becomes a national one.

Homes hit at once
900,000
at 5 kW each
Sudden swing
4.5 GW
on the continental European grid
Frequency
49.0 Hz
Automatic load shedding begins

Illustrative: frequency falls linearly with the swing, anchored on the published reference of about 4.5 GW to reach 49 Hz. The real grid has reserves, inertia and protection schemes; the point is the scale, not the decimal.

Each layer stops a different attack

Memory safety stops the exploit. Local intelligence stops the instruction. A well-formed malicious command contains no memory bug, which is why the device by the door needs both.

AttackConventional controllerGlow CHERI meterCHERI + edge AI
Firmware takeoverCold house, £5 lost, car at 22%Normal day: exploit trappedNormal day, attempt logged
Rogue dispatchBattery dumped, car lateSame: no memory bug involvedRefused; home keeps its plan
Privacy harvestAttacker knows when you’re outRead blockedBlocked; less data leaves anyway

See the world’s first CHERI-secured smart meter

Glow single-phase, 3-phase and 3-phase CT meters on SCI Semiconductor ICENI silicon, with edge AI for local decisions and control.

How this works

  • The day is an illustrative scenario, not a measurement. Each step is a capability demonstrated in published research: cloud-based takeover, settings tampering, exposure of consumption data and cyber-physical ransomware (Forescout SUN:DOWN, 2025). Prices use a typical GB time-of-use tariff: about 4p overnight, 35p at the evening peak.
  • “Conventional controller” assumes the device shares one exploitable bug with the rest of its fleet, the realistic worst case for devices running the same firmware.
  • With edge AI, the rogue dispatch is refused because it fails a local plausibility check. A small share of homes (about 1 in 20) where the command happened to fit local conditions would still act; that share is a placeholder.
  • The multiply section moves frequency linearly with the swing and is anchored on the SUN:DOWN reference of about 4.5 GW to 49 Hz. Reserves, inertia and protection schemes are not modelled.

Sources