Architecture & Security
How this prototype is built, what we found reviewing the specification, and what week one would deliver
Three principles everything else follows from
The panel is the certified system. FireCare is not.
Every connection is a read-only, volt-free or isolated tap. No remote reset, disable, isolate, release or configuration change in the MVP. If FireCare, the router, the cellular network and the cloud all fail at once, the panel detects, alarms, evacuates and releases exactly as commissioned.
Fail loud, never fail quiet.
Fault and supervisory interfaces are wired normally-closed, so a cut cable between panel and gateway produces the same signal as a real fault. Missing heartbeats raise COMMUNICATION LOST. A platform that goes quiet when it breaks trains people to trust silence.
Nothing is suppressed, only explained.
Chattering inputs are flagged as wiring defects and still raise their event. Repeat events increment a counter rather than generating a second notification, and the raw trail is kept intact underneath.
The signal path
Panel and plant → gateway → cloud → app, with the fire panel independent of all of it
Building systems
- Fire panel — relays + RS-232
- Sprinkler flow & valve — DI
- Fire pump — DI / Modbus
- Smoke extraction — Modbus
- PA/VA — relay / network
- Gas suppression — relays
- Generator — Modbus
FireCare Gateway Panel
- RUT956 · 4G · dual SIM
- RS-485 remote I/O expansion
- Opto-isolated interposing relays
- Own 24 V supply + battery
- Edge rules + store-and-forward
- Per-gateway X.509 identity
Ingestion
- MQTT over TLS 1.3
- Topic ACL per gateway
- Monotonic sequence numbers
- Raw payload written first
- HTTPS fallback
Event engine
- Driver adapters → one schema
- Debounce & retard windows
- Command vs feedback timers
- Absence-of-signal rules
- Incident roll-up
- Role-based routing
Data & audit
- PostgreSQL, RLS forced
- Membership-derived access
- Append-only hash-chained audit
- Encrypted backups, tested restore
- CI access-matrix tests
Applications
- Operations dashboard
- Field mobile app + QR
- Push with storm suppression
- Inspections, defects, jobs
- Reports & compliance evidence
Nothing flows back down this path. There is no command channel from cloud to panel in the MVP. Every connection at the building is a read-only, isolated tap. Cut every arrow above and the fire panel still detects, alarms, evacuates and releases exactly as it was commissioned to.
Layer by layer
What we build, and what each layer is actually protecting against
| Layer | What we build | Why it is there |
|---|---|---|
| Site — FireCare Gateway Panel | One DIN-rail enclosure per building: Teltonika RUT956 (4G/dual-SIM, RS-232, RS-485, digital I/O) plus Modbus RTU remote-I/O modules on an RS-485 trunk, a dedicated 24 V supply with its own standby battery, and opto-isolated interposing relays on every panel connection. | Expands one gateway to the eight systems in your email without a router per system. Isolation and a separate supply mean the interface cannot load or degrade the fire panel, and cannot draw on the panel's certified standby battery calculation. |
| Edge agent — buffer and first-pass rules | Debounce, retard and command/feedback timers execute on the gateway. Events are queued to local storage and replayed with their original on-site timestamps when the link returns. Per-gateway X.509 identity, MQTT over TLS 1.3, monotonic sequence numbers. | A 4G outage must not silence a site. Rules that decide whether something is an alarm belong where the signal is, not three network hops away. Sequence numbers make a dropped or replayed message detectable rather than invisible. |
| Ingestion — broker and normaliser | MQTT/TLS broker with per-device certificates and topic ACLs pinned to each gateway's own prefix, plus an authenticated HTTPS fallback. Every payload is written raw before any rule sees it. | A shared fleet credential would let one stolen gateway publish as any site. Writing raw first means the evidence trail survives even if a rule is later found to be wrong. |
| Event engine — normalisation and correlation | One canonical event type. Driver adapters (digital input, Modbus, RS-232 panel parser, Ethernet/API) translate into it and nothing else in the platform may create an event. State rules, qualification windows, command-versus-feedback correlation, absence-of-signal rules and incident roll-up. | This is what makes the panel-driver strategy in section 13 work: adding Edwards EST3 means writing one parser, not rebuilding the platform. It is also what turns a contact closing into a defect with a cause. |
| Data — PostgreSQL with enforced tenancy | Row-level security on every table, with FORCE ROW LEVEL SECURITY so even the table owner is filtered. Access derives from one membership table. A CI job fails the build if any table is added without a policy, and an access-matrix test attempts real cross-tenant reads through the REST API on every commit. | Your section 18 test asks whether Tenant A can reach Tenant B by UI or direct API. The only honest answer is a test that runs on every deployment, not a statement in a document. |
| Applications and notification | Responsive operations dashboard, field-friendly mobile app, QR asset access, FCM push with role-based routing, acknowledgement, on-call rosters and storm suppression. | The same incident reaches different people differently. A building manager who is sent every plant fault learns to ignore the one that matters. |
| Audit and observability | Append-only audit table with UPDATE and DELETE revoked at the role level and periodic hash-chaining. Independent dead-man's-switch that alerts RF if the ingestion pipeline itself stops processing. | An event log that an administrator can quietly edit is worth nothing in an insurance dispute. And a monitoring platform that fails silently is worse than none at all. |
Event engine tunables
Every one is a commissioning parameter, not a magic number
Alarm debounce
400 ms
Kills wiring flicker without a perceptible delay on a real alarm.
Fault debounce
2 s
Faults are qualified harder than alarms because they are less urgent.
Sprinkler flow retard
30 s
Mirrors the flow switch's own retard rather than second-guessing it.
Command → feedback
20 s
How long commanded plant has to prove it is running. Per-asset in production.
Chatter threshold
6 in 2 min
Flags an unstable input as a wiring defect. Never suppresses its event.
Incident window
10 min
Forty devices in a real fire become one incident with forty children.
Repeat suppression
60 s
Increments a counter instead of sending a second notification. Raw trail kept.
Heartbeat
60 s × 3 grace
COMMUNICATION LOST after 180 s of silence from a gateway.