What's true today
- Runs on the ward LAN, no cloud, no internet. The Edge Node is the brain: it raises calls from supervised inputs, drives over-door lights and displays, and messages staff phones — with nothing beyond the local network. Pull the internet and the ward is unaffected. Live
- The display is the device. The Edge Node serves its own full-screen call board straight from the hardware — point a TV, monitor or tablet at it and it shows live calls with no head end, no broker and no app. If the gateway, the cloud or the internet is down, the display keeps working. See the Edge Node → Live
- No cloud dependency, no dead-man's switch. No licence keys that stop the system when a vendor's server goes away; documented MQTT and BACnet feeds; firmware you hold and can update yourself.
- Secure by default. HTTPS on the LAN only, password login, signed firmware, OTA update with automatic rollback — independently security-reviewed (October 2026). Live
Out-of-band backup links In development
An IP network can be attacked or simply fail. For a display to survive that, it needs a path that isn't IP — so the Edge Node is gaining out-of-band links that carry calls to the display when Ethernet is down or compromised.
- RS-485 backup. A two-wire bus from the node to the display: no network stack to attack, no switch, DNS or DHCP in the path, galvanically isolated, runs to ~1.2 km, and power can ride the same cable. The display prefers Ethernet and falls back to RS-485 automatically.
- Point-to-point LoRa, where a wire can't go. A direct radio link between node and display — deliberately not LoRaWAN, so there's no gateway or network server to be taken out or compromised. Calls are tiny; range and independence are the point.
Supervised, and fail to a known state
A backup link is only safe if the system knows when it's needed. Both paths exchange heartbeats: losing the primary fails over to the backup and raises a fault; losing the backup is itself a fault, never silent; and if every path is lost, the display shows a visible LINK LOST screen rather than a frozen last frame.
Where cyber-resilience ends — honestly
Out-of-band links protect against network failure and IP-layer attacks — ransomware on the LAN, a compromised switch, a flooded or severed network. They do not protect against the device itself being compromised; that is the job of signed firmware, local-only interfaces and no cloud dependency. And comms resilience needs power resilience: UPS-backed PoE or a local battery, or none of it matters. We say which layer each measure covers rather than selling "cyber-proof".
Standards
Southerly Nurse Call is designed to AS 3811:2026 — supervised links, fail-to-known-state behaviour and fault escalation to maintenance are built in, not bolted on.