Physics, not guesswork
Everything the monitor claims, it measures — or derives from something it measures and tells you how confident it is. Absent data is reported as absent, never as zero. Here is the whole chain, from the water to your phone.
Inside the buoy
Eight parts do all the work. Numbered on the cutaway, described beneath it.
-
1
Air temperature and light
The second half of lid detection. When the top cap cools to ambient, the lid is off.
-
2
Status ring
Green on the first sweep after setup. You should never need to look at it again.
-
3
Potted core
nRF9151: LTE-M, NB-NTN satellite and GNSS on one die. Nothing to connect to Wi-Fi.
-
4
Flotation collar
Weighted so the buoy rides level in a moving tub and cannot be flipped by a jet.
-
5
19 Ah lithium cell
Thionyl chloride, with a capacitor to carry the transmit peaks. Never charged, never swapped.
-
6
Isolated chemistry island
pH, ORP and conductivity behind a galvanic barrier, so they never fight each other.
-
7
Probe guard
Protects the probe tips and keeps the measurement chamber flushed with tub water.
-
8
Pressure pod, at the floor
Water level, leak rate and pump ripple, all recovered from one fixed-depth reading.
What it actually measures
Five measurement channels. Between them they cover every fault in the requirements, plus the chemistry.
The buoy floats. The sensor does not.
A free-floating buoy cannot measure water level — it rides the surface, so its depth below the waterline never changes. The pressure transducer therefore hangs on a short weighted tail that rests on the tub floor, giving a fixed reference depth. Water column height comes straight off it, and so does the leak rate.
The same signal finds the pump
A running pump puts a ripple into that pressure signal. Thirty seconds of it, analysed for amplitude and dominant frequency, says whether the pump is running, whether it is labouring, and — over weeks at a constant schedule — whether the filter is loading up.
Two temperature zones, one lid
One sensor in the water, one in the top cap. The device continuously learns what the gap between them looks like with the lid closed. When the cap converges on true ambient, the lid is off; an ambient light sensor corroborates it in daylight.
Chemistry behind a barrier
pH, ORP and conductivity all terminate at a potentiostat on an electrically isolated island. That isolation is what stops the classic failure — two wet probes sharing a ground through conductive water, and both readings dancing.
Ten things it will wake you up for
Every detector runs on the device. It has to: the tub still needs protecting when the backhaul is down, so alerts queue locally and escalate the moment any link comes back.
Freeze
critical Satellite eligibleWarning at 10 °C and falling, critical at 5 °C. The alert carries the predicted hours to freezing so you know your response window.
Rapid water loss
critical Satellite eligibleA shell or plumbing failure emptying the tub. Distinguished from bathing and from the slow-leak advisory.
Power loss suspected
critical Satellite eligibleNo circulation across the longest filtration gap, with water cooling along the unheated curve learned for your tub.
Overtemperature
warning Satellite eligibleWarning at 41 °C, critical at 43 °C — a stuck contactor or a failed controller, before anyone gets in.
Lid open
warningAir-zone temperature converges on ambient. Alerts after 30 minutes with the heat-loss rate in °C per hour.
Pump labouring
warningPressure-ripple amplitude and frequency drifted off the baseline learned during your first week.
Filter clogged
advisoryA slow decline in ripple amplitude at a constant pump schedule. Shipped with a confidence score.
Slow leak
advisoryWater column falling by millimetres per day, after bathing and evaporation are filtered out.
Chemistry out of range
advisorypH, sanitizer or buffering outside band, with the dose that fixes it. Sentinel and Summit.
Water change due
advisoryDissolved solids projected to reach the drain threshold. Carries the date, and repeats a week out. Sentinel and Summit.
Service due
advisoryBattery approaching end of life, probe drift beyond calibration, or a sensor reporting a fault.
Thresholds are defaults. All of them are configurable from the cloud, all with hysteresis, so a tub sitting right on a boundary does not flap between states.
Why there is no Wi-Fi in this product
The original concept called for Wi-Fi, cellular and satellite. We dropped Wi-Fi on purpose, and the product is better for it.
It does not fit
The application core has 256 KB of RAM. A full Wi-Fi station stack consumes essentially all of it and requires disabling the cellular modem library. The two stacks do not coexist on this silicon, and the cellular one is the one that matters.
It fails when you need it
Wi-Fi depends on the router having power. A power cut is exactly the moment a freeze alert has to leave the property. A monitor that goes silent during an outage is a monitor that is silent during the emergency.
It was only ever about cost
Wi-Fi existed in the design to avoid cellular data charges. Since connectivity is prepaid for the life of the device and the telemetry budget is about 80 KB a month, there was nothing left to save.
The everyday path
Telemetry batches go out over LTE-M roughly every two hours, and a heartbeat at least daily. Payloads are CBOR over CoAP with DTLS, small integer keys throughout, kept under 256 bytes on the wire. Between windows the modem is in power-saving mode and the device is genuinely asleep.
The emergency path
When a critical alert cannot get out over cellular, the same modem falls back to NB-NTN — narrowband non-terrestrial, 3GPP Release 17, on the Skylo network. It is the same chip and the same antenna, so there is no second radio to fail and no separate module in the bill of materials.
Where the energy goes
A 19 Ah lithium thionyl chloride cell, with a hybrid layer capacitor to carry the transmit peaks the cell itself cannot deliver.
| Subsystem | Duty | mAh / year |
|---|---|---|
| Sleep floor | Continuous, about 10 µA | 88 |
| Environmental sampling | Temperature, light and pressure every 5 minutes | 130 |
| Chemistry cycles | 12 a day, 30 seconds each | 550 |
| LTE-M uplinks | 12 batches a day plus a daily long session | 180 |
| Satellite events | Budgeted at two a month, worst case | 13 |
| Total | Sentinel, typical installation | ≈ 960 |
Against 19 Ah derated 20 % for self-discharge, cold and end-of-life knee, that is roughly 15 Ah usable — more than a decade on paper. The device is rated at three to five years because that is the margin we are prepared to warrant, not because the arithmetic runs out. A Guardian, with no chemistry cycles, draws well under half of the figure above.
Locked down, and kept current
It is a connected device in your garden. It is built like one.
Per-device certificates
Each unit carries its own credential, provisioned at manufacture and stored in the modem's secure element. There is no shared key to leak.
Encrypted in transit
Every uplink and downlink rides DTLS. The device authenticates the server as strictly as the server authenticates the device.
Signed firmware, over the air
Updates are signed, verified before they are applied, and resumable — a satellite-only site is not a site we can brick with a half-delivered image.
Bluetooth is not a backhaul
The local link handles claiming, live readings and probe calibration. Telemetry never depends on it, and it is authenticated by the QR plate on the collar.
Want the engineering detail?
We will share the device design document, the fault-detection logic and the power measurements with partners, dealers and investors under NDA.
Ask for the technical pack →