Home › Applications › Remote IO over 4G

Remote IO over 4GA contact closes at one site. A lamp lights at another.

Mirror digital inputs at one site onto relay outputs at another over 4G, using any open MQTT broker. The mapping is in the firmware at both ends — no bridging software to install, no server to maintain, no vendor cloud in the data path.

This is indication and signalling only — it is not an interlock, not an emergency stop and not a safety function, and nothing that protects people or plant may depend on it.

Talk to our engineers WT460M gateway

How it works

including what happens when it breaks

Both ends online, nothing changingThe master publishes its status to a topic. The slave subscribes to that same topic as its command topic. The broker in the middle only relays — there is no software of ours on it.

What sits at each end

WT460MMaster — where the contacts areFour digital inputs take the field contacts. These are 0–24 V inputs, not self-wetting dry-contact inputs: a volt-free contact is looped through the panel's own supply so a closed contact presents a voltage. The wetting supply and common return are decided at design time and recorded on the as-built.

WT460M + WT32iSlave — where the lamps areThe gateway polls the WT32i over RS-485. The card carries eight relay outputs — seven mapped signals plus one permanently assigned to DATA VALID — and, critically, a watchdog you configure over Modbus.

Any MQTT brokerIn between — a broker, nothing moreThe master publishes its status; the slave subscribes to that topic as its command topic, decodes it and drives its outputs. The mapping lives in firmware at both ends, so the broker only relays. Use one you already run, one you stand up in an afternoon, or a hosted one — there is no software of ours on it and nothing to license.

Seven mapped signals, not eight. One relay is permanently DATA VALID, because a lamp that is off because the contact is open looks identical to a lamp that is off because the link died. Wire the panel so DATA VALID holds in a COMMS FAIL lamp, and feed that lamp from a supply that survives the card. A dark panel is not a healthy panel.

When the link drops

three failures, three detection times

The WT32i’s watchdog is configured over Modbus. If the card stops being written to, it releases its outputs by itself — without consulting the network, the broker or us. All three times below are arithmetic from your settings, and all three are measured and recorded at commissioning.

The master goes silentthe slave's freshness windowSooner if the broker's last-will fires first. The slave stops refreshing its outputs and drops DATA VALID.

The broker goes downthe watchdog timeoutThe slave stops receiving, so it stops writing the card. There is no server-side process that could have acted on your behalf — and none that could have failed silently either.

The slave's link or its RS-485 pair diesthe watchdog timeoutNothing anywhere else can reach the panel to tell it. This is exactly why the failsafe lives inside the card and not in software.

Nothing of ours runs on the broker. The master publishes status, the slave treats that topic as its command topic and executes it. That removes an entire class of failure — there is no bridge process to crash, hang or be left un-patched — and it means the link works with whatever broker the site already has.

Store & forward is off on this channel. Buffering is right for telemetry and wrong here — replaying a queued output command after a ten-minute outage would light a lamp with a state from ten minutes ago. Latest value wins; anything stale is discarded on its sequence number.

Where it earns its keep

Sewage pumping station → STP control roomUnmanned stations strung out over 6–10 km. Wet-well high level, pump 1 run, pump 2 run and common trip appear as a row of lamps per station. If a station goes silent its row shows COMMS FAIL — rather than a comfortable dark panel that reads as “all normal”. No remote starting of pumps is offered.

Pump house and overhead tankThe tank's float contacts are 3–8 km from the pumpset. High, overflow and low level light an annunciator at the pump house and drive a hooter. The pumpset's dry-run and level protection stay at the pump house on the pump's own relay — the low-level lamp is an indication, not a trip.

Raw-water jackwell across the highwayThe pilot cable has been cut twice by road widening and once for its copper. Jackwell pump run, trip, sump low and delivery pressure appear in the mill control room. The mill's “water wanted” push-button lights a lamp at the jackwell — a request, not a remote start. A SIM needs no right-of-way approval.

Quarry crusher → plant control roomA 433 MHz radio pair that worked until a new stacker and a monsoon's growth took out line of sight. Crusher running, feeder running, mine power and dewatering pump status become an annunciator column. It is explicitly not the belt interlock — pull-cord, zero-speed and sequence interlocks stay hardwired and local.

Unmanned DG room, godown or cold storeMains healthy, DG running, low fuel and common trip, with a hooter at the manned office. This supplements the site's own local alarms rather than replacing them, offers no remote starting, and only works if someone is rostered to answer the hooter.

Canal head regulator and borewell fieldsScattered wells are separate sites, each needing its own gateway and SIM — six wells is twelve lamps plus the comms lamp, so two cards. Gate position is indicated; gate operation is not offered. A row of lamps on a wall, not an app on a phone that is out of charge.

Who can drive the outputs

Because any broker works, the broker you choose is the whole of your security boundary. Use TLS on both the 4G and LAN paths; give the master and the slave separate credentials; set topic permissions so the master can only publish its own status and the slave can only subscribe to it; disable anonymous access and the plaintext listener.

Anyone who can publish on the master’s topic can drive the slave’s outputs. That is the one sentence to take away — credentials are per-device, rotated at handover, and owned by your IT rather than by us. A convenient public test broker is fine on the bench and wrong in a control room.

What this is not

This is indication and signalling only — it is not an interlock, not an emergency stop and not a safety function, and nothing that protects people or plant may depend on it.

Your pull-cords, zero-speed switches, trip relays, dry-run protection, ESD and fire systems stay hardwired and local, exactly as they are today. This runs alongside them and tells a person at the other site what is happening. It is a process status annunciator — not a fire alarm annunciator, not listed for life-safety use, and not connected to any fire system.

Public cellular round trip is commonly around 200 ms and can be seconds when a cell is congested or a modem is re-registering. It is never guaranteed, and we do not offer a latency figure we cannot hold. What you get at handover is the measured distribution for your installation, recorded across a working day.

WT460M — 4G + Ethernet gateway WT32i — Modbus IO card Getting a SIM to attach Scope a link with us