MinePulse

Architecture

Where the hardware sits, how it reaches the cloud, who reads it

The three facts everything else follows from

200 m

How far LoRa reaches underground

In a drift, not the kilometres it manages on surface. Rock, not transmit power, sets the range, which is why the answer underground is more small gateways at 300 to 400 m rather than fewer large ones. This single number sizes the whole deployment.

Links per gateway, in opposite directions

Down to the sensors by LoRa radio, up to the server by fibre, Ethernet or LTE. Same shape as a phone tower: radio to the handset, cable to the network. Underground the upward link cannot be LTE, because no cellular signal reaches there.

Not a feature. Permission.

Near a fuel bay, an explosives magazine or a gassy heading, an explosion proof gateway is the only class permitted, at any price. Everywhere else in a non-gassy metal mine a standard unit is correct and far cheaper. If the mine is gassy, everything underground becomes Ex and the hardware budget roughly triples.

Consumption

Control room, mobility and reporting

Control roomSupervisor mobileReporting stationIntegration

Brain

Network server, rules engine and the agent

LoRaWAN network serverRules engineAgentSupabase Postgres

Radio

KONA gateways and the backhaul to the cloud

KONA MicroKONA EnterpriseKONA MacroKONA Macro ExKONA MegaKONA Mega ExKONA MobileKONA PhotonKONA Strand Macro

01b

Every gateway, both ways

The two links a gateway carries, and why they are different

Down: LoRa AU915 to the sensorsUp: fibre, Ethernet or LTE to the server

Field

Sensors and trackers on people, plant and material

PeopleAssetsEnvironmentPowerProcess

Security

Written for the person who can stop the project. In mining that is rarely operations; it is the OT security lead, and their default answer is no.

The gateway cannot read what it carries

This is the part most people get wrong about LoRaWAN, and it is the strongest thing we can say. Every payload is encrypted on the sensor with AES-128 using an application key that only that device and the server hold. The gateway is a relay. It forwards ciphertext it has no way to open. Steal a gateway off a mast and you learn nothing: not a location, not a name, not a reading.

On the device

Each endpoint carries its own unique keys, provisioned at join. Two of them: one for the network session, one for the application payload. Compromising one device gives you that one device, never the fleet. A frame counter increments on every message, so a captured packet replayed later is rejected rather than believed.

Over the air

The payload is already encrypted before it leaves the sensor and stays encrypted the whole way to the server. Nothing in between decrypts it, including our own gateways. Anyone listening on 915 MHz hears traffic exists and learns nothing else.

On the mine network

The IoT segment is its own VLAN and never touches the process control network. Traffic is outbound only: gateways dial the server, nothing dials the gateways, and no inbound port is opened on the mine's perimeter. Where the network server runs on site, telemetry never leaves the concession at all.

In the application

The database enforces access by row, so a bug in a screen cannot return another tenant's data. The application login can read and write exactly one column; it cannot change the schema or delete anything, and that is verified rather than assumed. Every alarm acknowledgement is attributed and kept.

Threats, named rather than avoided

How real it isGenuinely possible. LoRa is a radio band and a determined attacker with a transmitter can deny it locally.

What answers itIt cannot be done quietly. Gateways report continuously, so the gateway-offline rule fires within three minutes and names the area that went dark. Jamming turns into an alarm rather than into silence, which is the difference that matters underground.

Standards a mining reviewer will ask about

IEC 62443The OT security standard mining actually asks about. The design follows its zones and conduits model: the IoT segment is its own zone, the link to the control network is a defined conduit, and traffic across it is one directional. We are not certified to it and do not claim to be; the architecture is built so an assessment is possible rather than doomed.

Purdue model separationThis system sits at level 3 and above. It never writes to a PLC, never touches level 1 or 2, and cannot move a machine. It reads and it reports. That single sentence resolves most of the objection an ICS engineer arrives with.

Ley 29733, PeruContinuous location of named workers is personal data under Peruvian law, not merely operational telemetry. It needs a lawful basis, a retention period, and a subject access route. The safety justification is strong, but it has to be written down and the retention has to be finite, which is a decision for the mine and not for us.

What we do not claim

No IEC 62443 certification. The architecture is compatible with an assessment; it has not had one.
No penetration test yet. It should happen before a pilot carries real people, and it belongs in the budget as a line rather than as an assumption.
The demo runs read-all access with no login, which is correct for something you hand a prospect and wrong the moment a real mine's data goes in. Auth and per-tenant isolation are the first job of a pilot, about two days of work.
LoRaWAN 1.0.4 keys are symmetric and provisioned at manufacture. The supply chain is part of the trust boundary, and we can show the chain from TEKTELIC in Canada through the distributor to us.

This list exists on purpose. A security reviewer who catches one overclaim stops believing the rest of the page, so the limits are stated here rather than discovered later.