Early warning for
sudden-onset glacial hazards.
Sovereign by construction.
We build the whole stack — the sensor board, the firmware on it, and the platform the alert lands in. Near-field seismic detection at the face, valley-scale geolocation, and signed transboundary routing that no single country controls. Detect-and-route, not prediction.
Proven on two real collapses.
Both events were re-analysed from open FDSN archives, near-field, in the 2–8 Hz band at 100 Hz sampling. Detection and geolocation are reproducible end to end from the pipeline. These are the numbers the node spec is derived from — not the other way round.
- station range
- 24–42 km
- SNR (2–8 Hz)
- 40–130
- best station
- 95 @ 32 km (CH.VDL)
- location error
- 6.5 km
- source
- ETH open network · ak135 1-D model
- station range
- 11–14 km
- SNR (2–8 Hz)
- 3.3–3.6
- best station
- 3.3 @ 11 km (CH.SNTZ)
- location error
- 10.0 km
- source
- SED open FDSN
Detection is a band-limited SNR test against a rolling noise reference. Geolocation cross-correlates the Hilbert envelopes of the 2–8 Hz signal between station pairs; the inter-station lags triangulate the source. For Bondo, replacing the constant-velocity assumption with an ak135 1-D velocity model tightened the solution from 8.4 km to 6.5 km.
A board we drew, not a kit we bought.
Four-layer PCB, schematic and layout in KiCad, with a complete fabrication package — Gerbers, drill file, BOM and pick-and-place. Six actives; the rest is passives, power and antenna matching.
| ref | part | role |
|---|---|---|
| U1 | STM32WL55JC | Cortex-M4 @ 48 MHz + sub-GHz LoRa radio on one die |
| U2 | BGT60TR13C | 60 GHz mmWave radar — surface motion, debris depth |
| U3 | NEO-M8N | GNSS — position baseline, displacement threshold |
| U4 | ADXL355 | MEMS accelerometer — seismic channel, wake-on-interrupt |
| U5 | ATECC608A | Secure element — per-node key custody, signed events |
| U6 | TP4056 | Li-ion charge controller — solar / battery |
Derived from the data
- ▸ 2–8 Hz passband — most range-robust band measured
- ▸ 100 Hz sampling on the seismic channel
- ▸ ~30 km effective radius per node
- ▸ 5 nodes + 1 gateway covers a valley system
60 GHz surface watch
- ▸ BGT60TR13C over SPI2 at 10 MHz, DMA-fed
- ▸ Range FFT on-chip via CMSIS-DSP (Cortex-M4)
- ▸ Range profile → debris depth estimate
- ▸ Correlated with the seismic channel before alerting
Keys that never leave
- ▸ ATECC608A secure element, I²C
- ▸ Private key generated on-die, never exported
- ▸ Every event signed at the node
- ▸ A forged node cannot enter the trust mesh
Bare metal, written here.
~2,300 lines of C across 15 modules, targeting the STM32WL55JC with an ARM GCC cross-toolchain and a CMake build. No vendor RTOS pulled in wholesale — HAL, drivers, mesh and application logic are ours, so we can account for what runs on a node sitting above a village.
- ▸ Drivers, HAL, power management and telemetry assembly are written.
- ▸ The tree has not yet been compiled on hardware. Battery life and classification latency are design targets, not measurements.
- ▸ LoRa mesh and MQTT/TLS are API-complete with stubbed transports.
- ▸ On-node event classification is a stub — today the classifier runs in the backcast pipeline, not on the node.
Aether — where the alert lands.
Nodes do not talk to a bespoke server. They speak MQTT over mutual TLS into aether-io.com, our carrier-grade device platform — the same one that runs fleets of routers and CPE. Device identity, certificate enrolment, telemetry retention and alert routing are platform features, not things we rebuilt for this product.
surface_sensorradar_bgt60tr13c · closest_target_m · target_countgpslat · lon · alt · displacement_from_baseline_mseismicpeak_acceleration_mg · event_classbattery_pctstate of chargetemperature_cenclosure temperatureRadar, GNSS displacement and seismic arrive together in one nested frame, so correlation happens on aligned data rather than on three streams stitched together after the fact.
PKI, not passwords
- ▸ Per-device certificates issued over EST
- ▸ Mutual TLS on the broker — no shared secret
- ▸ Revocation cuts a node off at the broker
- ▸ Node keys held in the ATECC608A, not in flash
Pheme event fan-out
- ▸ Event type and severity select the topic
- ▸ Webhook, SMS and email targets per agency
- ▸ Each nation owns its own recipient list
- ▸ Audit trail: who was notified, when, what followed
- ▸ Per-node baselines, anomaly rules, fleet health
A fix, or an honest guess
- ▸ Nodes never send a location — they send arrival times
- ▸ ≥3 stations: triangulated, arrival times shown
- ▸ <3 stations: labelled node_baseline, never dressed as a fix
- ▸ Enforced by acceptance test, not by convention
No country can trigger another's siren.
The transboundary trust model is not a policy document — it is code, and it runs as a drill. A synthetic collapse on the Chinese side fires Nepali and Indian alerts while the waveform stays where it was recorded.
The limits, first.
- ⚠Geolocation is valley-scale, not face-scale. 6.5–10 km is enough to route an alert to the correct downstream community. It is not enough to say which face failed. Denser geometry (5–10 nodes per valley) is the path to <2 km, and that is a target.
- ⚠We do not predict collapses. A correctly-run 30-day near-field scan — absolute reference, teleseism-masked, day-binned — found no precursor build-up at 23 km from Bondo. We publish that negative rather than bury it. Precursor detection is a research question, not a product.
- ⚠Both validated events are European. Himalayan near-field waveforms are not on open FDSN — Chamoli sits with IMD/WIHG, Rasuwa with NEMRC/DMG. Access is the gating item for a regional detection claim, and we would rather say so than extrapolate.
- ⚠The node firmware is not yet field-proven. The tree is written but uncompiled on hardware, and on-node classification is still a stub. Detection today runs in the backcast pipeline against archived data.
An earlier version of this site reported a minutes-ahead seismic precursor at Chamoli. Our own validation audit traced that signal to an M6.0 earthquake at 2021-02-07T04:22:56Z in Magsaysay, Mindanao, Philippines — 28 minutes before the collapse — and withdrew the result. Ramp amplitude across the stations orders by distance from the Philippines, not from Chamoli. We would rather you read that here than find it yourself.
Deploy a valley.
Five nodes and one satellite gateway cover a valley system. We bring the hardware, the firmware and the platform; you keep your data and your sirens.