Comms architecture
A sovereign mesh that keeps working when the network does not
Every AiR forecourt unit and home wall unit is a compute node and a radio node. Multi-IMSI IoT eSIM carries routine traffic. Sub-GHz LoRa and Reticulum carry the safety-critical path across a 170-node national grid that runs independently of any single telecommunications operator, with encryption terminating only at the endpoints.
Node counts, hop metrics and throughput figures on this page are planning figures from a deterministic model. Radio and regulatory limits quoted are real constraints and are stated as such.
Grid state
The mesh at national scale
Modelled state of the target backbone: node health, routing depth and the inference capacity the fleet carries between it.
Mesh nodes
0
Forecourt, home, relay and depot nodes
Healthy nodes
0
7 degraded and self-routing around
Average hops to backhaul
0.0
4 average neighbours per node
Corridor coverage
0.0%
12 regions on the spine
Aggregate inference
0 TOPS
Sum of on-unit NPU capacity across the fleet
Idle capacity available
0 TOPS
Schedulable outside forecourt peak hours
Packets relayed / 24h
0
Beacons, alerts and queued records
Nodes without cellular
0
Reachable only through mesh or store and forward
Nodes by region
Regional routing depth and compute
Coverage
Where the mesh reaches, and how fast
Region by region: node density, modelled mesh latency for a prioritised safety payload and 30-day reachability across all backhaul paths.
Sovereign coverage map
Modelled state of the national backbone by region. Select a metric, then tap a region.
North West
Nodes
19
Healthy
17/19
Mesh latency
1036 ms
Reachability
98.89%
Average hops
2.7
Inference
280 TOPS
8 nodes in this region have no cellular path and are reached only over LoRa mesh or store and forward, which is what sets the latency figure above.
Radio layer
A sub-GHz collinear antenna on every crown: licence-exempt EU868, duty-cycle enforced in firmware.
Connectivity stack
Four paths, in strict order
A check must never depend on one radio, one operator or one cable. AiR degrades down the ladder without a driver noticing.
Multi-IMSI IoT eSIM
Roams across all UK mobile networks on a private APN with no public inbound IP. Primary path for session and model traffic.
Site ethernet or Wi-Fi
Used where the forecourt or home already has fixed line capacity. Never trusted: same encryption applies.
Mesh backhaul
LoRa plus Reticulum routing through neighbouring AiR nodes to reach a node with upstream capacity.
Store and forward
Node keeps signed records locally and replays them when any path returns. No check is ever lost.
Topology
Node density and hop planning
Coverage is a function of terrain and antenna height, not marketing. Use the link budget to see what a hop actually supports.
Typical hop distances
Open rural / hilltop relay
8 - 15 kmLine of sight, SF10 - SF12
Rural mixed
5 - 9 kmPartial obstruction, SF9 - SF11
Suburban
3 - 5 kmRoof-line antennas, SF8 - SF10
Dense urban
1.5 - 3 kmHigher node density compensates
Motorway corridor
6 - 12 kmService-area spine nodes
Hop link budget
868 MHz free-space path loss with a terrain and clutter margin, against SF12 receiver sensitivity. Used to place relay nodes during survey.
Path loss
109.3 dB
Received level
-101.3 dBm
Sensitivity
-137 dBm
Margin
35.7 dB
Link viable at this spreading factor
Payload discipline
The safety-critical path is hundreds of bytes, prioritised over everything else on the link.
Payloads
What actually travels the mesh
The safety-critical path is measured in hundreds of bytes. That is why a low-bandwidth sovereign mesh is sufficient where it matters, and why bulk traffic stays on cellular.
| Payload class | Size | Priority | Cadence | Path |
|---|---|---|---|---|
| Safety alert | 180 - 420 B | P0 | On event | Mesh first, eSIM parallel |
| Session summary | 0.9 - 2.4 kB | P1 | Per check | eSIM, mesh fallback |
| Model gradient delta | 40 - 260 kB | P3 | Nightly | eSIM or site WAN only |
| OTA image chunk | 512 kB chunks | P4 | Release window | eSIM or site WAN only |
| Mesh health beacon | 24 - 64 B | P2 | Every 90 s | Mesh |
| Fleet command | 64 - 512 B | P0 | On demand | Mesh or eSIM, signed |
National spine
170 anchors placed along corridors, then filled by ordinary forecourt and home nodes.
Backbone assumptions
How 170 anchors become a national mesh
Anchors provide regional persistence and Reticulum transport. Ordinary forecourt and home nodes are full network instances, and only a selected subset forward traffic, because universal forwarding degrades a Reticulum network.
Planning arithmetic
The 21.4 km figure is an average planning-cell equivalent derived by dividing UK land area by 170, not a coverage claim. Urban clutter can reduce useful LoRa reach substantially and elevated line-of-sight paths can extend it well beyond it.
- Motorway and trunk-road service areas
- Large dealer groups and mobility campuses
- Roadside-assistance operational sites
- Fuel retail estates and logistics hubs
- Selected rooftops, towers and elevated commercial properties
Primary data plane
Resilience plane, stated precisely
On-unit compute
An NPU-class module, a secure element and a signed record store inside every enclosure.
Edge intelligence
Inference at the tyre, not in a data centre
Each unit carries an NPU-class compute module. Decisions that affect a driver happen on the unit in milliseconds; only de-identified aggregates and model gradients ever leave.
Leak-signature classification
On unitPressure decay curve across the fill cycle is classified on-unit to separate a slow puncture from thermal drift.
Load estimation cross-check
On unitDeclared occupancy and load are checked against measured inflation behaviour to flag implausible profiles.
Plate and vehicle recognition
On unitRegistration is read locally; the image never leaves the unit and is discarded after the session.
Anomaly and tamper detection
On unitHose, valve and compressor telemetry is modelled locally to raise maintenance before failure.
Federated model improvement
FleetOnly gradient deltas leave the unit. Raw driver data stays local, so accuracy improves without central collection.
Corridor risk modelling
AggregateAggregated, de-identified deviation patterns are combined across nodes to model corridor-level risk.
Distributed capacity
Idle units outside peak hours form a scheduled compute pool for model training and corridor modelling, using capacity already paid for.
Federated by default
Gradients travel, data does not. Model accuracy improves across the fleet without centralising driver records.
Graceful isolation
A node cut off from every upstream path still measures, corrects and reports locally, then replays when a path returns.
Sovereign by design
Relays forward ciphertext they cannot read. Identities are keys, not registry entries.
Security and sovereignty
Encrypted end to end, sovereign by design
Relays carry ciphertext they cannot read, identities are keys rather than registry entries, and no third-party cloud sits in the safety-critical path.
Per-node identity keys
Every node holds its own Reticulum identity in a secure element. Destination addresses are derived from public keys, so there is no central address registry to compromise.
End-to-end encryption
Payloads are encrypted for the destination identity with ephemeral key exchange and forward secrecy. Relaying nodes carry ciphertext they cannot read.
No plaintext at rest on relays
Relay nodes store only routing metadata and queue ciphertext. A stolen unit yields no driver data.
Signed firmware only
OTA images are signed offline. A node refuses any image without a valid signature and rolls back on failed attestation.
Revocation and quarantine
A suspected node is revoked at the identity layer and its neighbours stop routing for it within one beacon interval.
Sovereign data path
No third-party cloud sits in the safety-critical path. Aggregation runs on infrastructure under UK control and follows the four-tier data rule.
Honest constraint: EU868 is licence-exempt and duty-cycle limited, so the mesh is engineered for small, prioritised payloads rather than bulk transfer. It is a resilience and sovereignty layer, not a broadband replacement. Firmware enforces the 1% per-channel duty cycle, and bulk traffic is held for cellular or fixed-line paths.
Resilience
What happens when something breaks
National mobile outage
Safety path intactNodes fall to tier 3 mesh routing. Safety alerts continue to move; session records queue and replay.
Single node loss
No coverage gapNeighbours re-route within one beacon interval. Average hop count rises by roughly one.
Regional power blackout
Degraded, not darkBattery-backed relay nodes hold the spine; forecourt units resume and replay on power return.
Upstream cloud unavailable
No customer effectAll inference and correction logic is on-unit, so checks continue exactly as normal.
Rollout
Building the 170-node backbone
Coverage is built as a spine first, then filled. Each phase proves the radio assumptions of the next.
Phase 1 - Pilot cluster
Nodes 1 - 1212 nodes across one region proving hop distance, duty cycle behaviour and mesh failover against real terrain.
Phase 2 - Corridor spine
Nodes 13 - 7058 nodes along motorway and trunk corridors, including battery-backed hilltop relays, to create the national backbone.
Phase 3 - National fill
Nodes 71 - 170100 nodes across forecourts, retailer sites and home wall units to bring every corridor within two hops of the spine.
Costs are indicative build estimates and exclude installation and site works.
Corridor intelligence
What the mesh reports at regional and corridor level.
Machine specifications
Full TP-4 data sheet including comms hardware.