An open protocol for observation

01What an open observation protocol does

An observation protocol is a shared contract for instruments and computers. It says how a device joins a network, proves what it is, keeps time, publishes what it measures and leaves when its work is done.

The Observatory Protocol is an open protocol of this kind. Its released specification states the aim plainly: a device that has never met a grid should be able to join it without depending on any single vendor, cloud or central service.

The problem it addresses is familiar to anyone who has run a network. Systems are built one vendor, one cloud and one programme at a time, so a sensor from one maker cannot join another operator's network.

Data also loses its calibration and provenance on the way, and a correction made upstream rarely reaches the report that used the old value.

The protocol answers with contracts rather than products. It publishes machine-readable schemas, a set of functions covering a device's whole life, conformance profiles for each kind of participant, and a test suite that anyone can run.

It also separates the roles in a network: nodes that carry instruments, a local authority for each site, clusters and grids that manage fleets and federation, providers, consumers and independent verifiers.

The planes are separate too. Control, data, evidence and exchange each have their own path, and the exchange plane never opens a way to manage a site from outside.

02From joining to retiring: the life of an instrument

The specification follows a device from first contact to retirement. Each stage is a function with its own objects, states and evidence, so no state is reached by wording alone.

Joining comes first. A node presents attestation evidence in the remote attestation model, rooted in hardware where its device class has a root of trust, and receives a short-lived identity, a policy and a signed plan¹.

Providers of devices, software, models and data are admitted separately, by manifest and by rights, security and technical review, for a stated scope. Presence on a network or a commercial relationship never implies admission.

Describing and timing follow. Every instrument carries a passport with its make, firmware, mounting, units and calibration history, and every observation reports the quality of the time it carries.

Observing, qualifying, correcting and exchanging carry values to their users with their context intact. Federating and orchestrating let sites form larger grids and receive changes by signed plan.

Proving lets peers answer unpredictable challenges with signed receipts that an independent verifier can check. Exit closes the loop: every provider declares an open export and replacement path, tested before it is admitted.

03Trust that is earned, not assumed

The protocol's first principle is zero implicit trust. A participant starts untrusted, earns trust by attestation, admission and evidence, and loses it on expiry or revocation.

This follows the zero trust idea that no implicit trust is granted to an asset because of its network location or its ownership².

Attestation follows the IETF architecture, in which an attester produces evidence about itself, a verifier appraises it, and a relying party decides whether to trust the attester¹.

In the protocol, a verifier must bind its result to a nonce and an expiry. An old result therefore cannot be replayed to admit a device that has since changed.

Identity is short-lived and renewable, and long-lived shared secrets are not allowed. Control traffic between a site and its nodes runs over TLS 1.3 with mutual authentication³.

Network time must be authenticated, for example with Network Time Security, and satellite time alone is never treated as trusted time⁴.

A node whose time integrity is compromised stops signing receipts that depend on time. Trust in the record depends on trust in the clock.

04Local first, without losing the rules

Field sites lose their links. Storms take down masts, satellite paths drop out and fibre gets cut, so a protocol for observation must assume the upstream path will sometimes be gone.

Under the specification, approved local operation continues through the loss of upstream links for the autonomy window set in the site's plan.

Observations are written to a durable local outbox first and published at least once with a unique key, so the receiver can absorb any duplicates when the link returns.

Field devices publish telemetry over MQTT, a lightweight, open publish and subscribe protocol designed for constrained devices and for links where bandwidth is at a premium⁵.

Offline is not policy-free. Expired authority, revoked identity, compromised time or missing mandatory evidence force quarantine, even when nobody upstream can see it happen.

A gap is recorded, never filled silently. A user later sees exactly when the site was cut off and which values arrived late.

05Values that keep their context

A value without context is a rumour. The protocol requires every value to carry its provenance, time, uncertainty, quality and correction state, and it treats a missing value as a typed state, never as zero.

Quality flags come from a controlled vocabulary, each with the test that set it, and provenance must be expressible in the W3C provenance ontology of entity, activity and agent⁶.

Instrument metadata maps to open sensor vocabularies, and weather and climate instruments should also map to the metadata of the global meteorological observing system⁷.

Geographic metadata in general has its own international family, ISO 19115, with parts for an XML implementation and for data acquisition and processing⁸.

Corrections travel too. A correction notice names the record and version it corrects, the reason, the issuer and every dependant it invalidates, and subscribers to a product must receive it.

Nothing is erased. Superseded versions stay in the record, so an analysis made last year can still be explained today.

Products reach users through open interfaces: OGC APIs, SensorThings for observations and STAC for archives, with publication to the WMO Information System as an option^9101112.

Events map one to one to CloudEvents, a common way of describing event data across services and platforms¹³.

06Why openness matters

Openness is what lets many owners rely on one contract. When the schemas, tests and documentation are public, anyone can build a device, a site or an application that works with the rest without asking permission.

The protocol makes every provider replaceable behind typed contracts with a tested exit path. Hardware, software, cloud, radio, model, data and service providers can change without rebuilding the network.

It also requires that a conforming deployment be operable by its owner without any service, data or approval from another organisation, unless the owner chooses to federate.

An overlay for operators applies whenever the operator is not the publisher of the software. The operator generates every root key, keeps its own update mirror and sends telemetry only to collectors it has configured.

Conformance is a statement of tested scope. Levels rise from a signed self-declaration through self-testing and laboratory testing to qualification with field evidence, and each level names the evidence it needs.

The specification, contracts and documentation are published under an open content licence, and the tools and test code under an open source licence. It is still a draft, and its open gaps are listed in public.

Nexus Observatory Inc. implements the open Observatory Protocol in the equipment and software it designs. The protocol itself stays open for any maker, operator or community to implement.

That is the point of an open protocol. The contract belongs to no single implementer, so the networks built on it can outlive any one of them.