How it works

A site is one head end and one to ten field panels on an isolated local network.

The head end serves the operator dashboard. The field panels carry the wiring. Every field panel has 14 channels: 4 relays and 10 zones.

The head end holds no physical I/O at all, by design. It is a controller, not a wiring point.

It serves the operator dashboard over the local network and holds the pre-shared key used to talk to field panels.

A field panel is where the copper lands. Each one carries 4 relays and 10 zones, terminated on external breakout boards rather than on the board itself.

Either hardware profile can be a field panel. Transport is a property of the board, not of the job it does.

A zone is not open-or-closed. It reports one of five values: normal, active, open, short or unknown.

open and short are the point. A two-state input cannot tell you the difference between nothing happening and someone cutting the wire.

Supervised zones use end-of-line resistors and an analogue-capable pin. There are a limited number of those pins per board, so supervision is planned at the same time as the wiring.

Relays are outputs. Outputs never hold last state.

Each relay has a configured safe state, and it goes there whenever the panel cannot hear the head end.

The subnet is chosen by the installer at flash time. Nothing is hardcoded; 192.168.10.0/24 is only the default the tool offers.

Addressing is static. There is no DHCP, and the head end does not hand out addresses — a panel needs a working address before it can talk to anything.

The gateway may be left blank. An air-gapped network with no router is valid and likely.

Boards are reached by name over mDNS, such as gtx-head.local, with the IP address as the fallback rather than the headline.

Field panels send a heartbeat. If a panel has not heard from the head end within 15 seconds, or the physical link drops, every output on that panel goes to its safe state. Instantly on link-down, on the timeout otherwise.

There is a second, subtler protection. When a board powers up, its pins float before the firmware takes control — long enough for a relay to click, which on a gate motor means the gate opens by itself.

A shared pre-shared key signs every message between the head end and a field panel.

The key is written at commissioning and never leaves the head end towards a browser — not in a payload, not in a log, not in a configuration dump.

Server-side validation is the guarantee. Browser-side validation is a convenience.

No cloud relay, nothing phoning home, no telemetry.

The dashboard is served by the head end itself, over the local network, embedded in the firmware. The page and the protocol ship as one artefact and cannot drift apart.

No internet, no CDN, no external font, no analytics — a single self-contained page, because the network it runs on may have no route out.

It is deliberately plain. Zone state must be unmistakable at 2am. State before decoration.