0–10 V and 4–20 mA
The two standard industrial probe interfaces. The 4–20 mA loop runs over long distances and signals a broken wire by itself, because zero milliamps is not a valid reading.
Intelligent building automation
The technology, tier by tier
Three tiers, our own hardware and our own radio protocol: the modules are designed to switch circuits from inside the junction boxes that already exist, the gateway in the building to decide, and the platform to coordinate. Below: how each tier is designed, and what has already been measured.
Product in development. The complete Mentivira solution will be available in 2028.
01Architecture↑ topics
Designed so that decisions are taken in the building.
The architecture is designed in three tiers. The hardware modules will sit inside existing junction boxes and switch real circuits: lighting, sockets, pumps, valves, blinds. The gateway in the building will aggregate telemetry, run the automations and keep the history. The platform will coordinate the fleet, issue cryptographic identities, distribute updates and provide remote access.
The split of decisions is explicit. The module will decide the safety loops, on its own inputs, in firmware. The gateway will decide everything that concerns how the building runs — schedules, zoning, occupancy, heat-source selection, the rules drawn in Mentivira Flows. The platform will decide nothing about how the building runs.
The reason authority moves down is simple. A system that needs an internet link in order to decide whether to start a pump has a single point of failure located outside the building and outside the owner's control. With a gateway-first architecture the control loop will close locally, and telemetry and history will stay on the gateway.
Only the messages needed for coordination, administration and updates will travel to the platform, over a single encrypted channel opened outbound from inside the building. The gateway is designed with no port open from the internet.
Three tiers, and what each one decides.
Authority over data and over decisions is designed to sit in the building. The platform will coordinate the fleet but will not receive your building's telemetry.
02Modules↑ topics
One common core, different function boards.
Every module is designed on the same core board — the compute unit, the 12 V supply, the 868 MHz radio and the wired bus — onto which a function carrier board will plug. The certification-sensitive part, the radio-frequency path and the protocol stack, is designed once and reused across the whole range. The modules are designed to fit inside standard 60–100 mm junction boxes, not on DIN rail, and will come in 4, 8 or 12-channel variants, so you do not pay for channels you do not use. The switching modules are designed for per-channel current and energy measurement, through very low-value shunts and dedicated measurement circuits — without per-circuit metering any saving stays an estimate; as of today that measurement is designed, not yet built on the prototype.
| Module type | What it switches or reads | Variants | Typical use |
|---|---|---|---|
| Electromechanical switching (relays) | 16 A at 250 V AC contacts, with snubbers for inductive loads and pulse-mode coil hold | 4 / 8 / 12 channels | Lighting circuits, socket groups, pumps, valves, blinds |
| Electronic switching (triacs) | Phase-cut control with opto-triacs and zero-cross detection, anti-flicker timing, inrush limiting | 4 / 8 / 12 channels | LED lighting dimming, small AC motors |
| High-side switching (DC) | Breaking the positive rail towards DC loads | 4 / 8 / 12 channels | Irrigation solenoid valves and loads that require the positive switched |
| Low-side switching (DC) | Breaking the return path, with hardware pulse-width dimming | 4 / 8 / 12 channels | LED strips, solenoid valves, DC fans |
| Analog inputs | 0–10 V, 4–20 mA, NTC thermistors, PT100 / PT1000 probes, OneWire | 4 / 8 / 12 channels | Flow and return temperature, CO₂, humidity, particulates |
| Dry inputs | Potential-free contacts, read locally, plus pulse counting | 4 / 8 / 12 channels | Conventional switches, mechanical thermostats, status contacts, pulse-output meters |
03Radio↑ topics
In a finished building, new cabling costs more than the equipment.
Wired automation systems require new cable runs. In a finished, occupied building the cost of the intervention — breaking walls, patching, repainting, activity stopped — exceeds the cost of the equipment. That is why the link between modules and gateway is designed as radio, and the modules are designed to fit inside the boxes that already exist.
We chose sub-1 GHz, not 2.4 GHz. At 868 MHz the signal passes through walls and reinforced-concrete floor slabs where Wi-Fi and Zigbee do not reach, the band is far less congested in dense apartment blocks, and the low power draw is what makes a battery-powered thermostat possible. It is the European short-range device band, under EN 300 220.
Radio is not the only option. Inside the electrical panel, where the modules sit next to each other anyway, a galvanically isolated RS485 wired bus will do the job — same functions, same application layer, the choice made per building and per project. The wired bus is designed to run in the clear, as a physically controlled closed bus; on radio every frame is authenticated-encrypted with AES-256-CCM, with a cryptographic identity unique to each device and fresh session keys at every power-up.
The radio path figures, measured on the prototype.
The figures below come from our own instrumented test bench and from prototypes on real silicon. They are in-house measurements, not independently reproduced — external cryptographic evaluation remains outstanding.
−95 dBm
Signal through 3 reinforced-concrete slabs
Measured on the prototype, on real silicon. The remaining margin is enough for a stable link.
868 MHz
Our own sub-1 GHz band, with our own protocol
Two physical layers: a faster modulation preferred by default, and a long-range one used when the link budget demands it.
17,698 frames
Over 72 h of continuous operation, zero CRC errors
Measured on the instrumented test bench, as an endurance run of the protocol core · measured on the prototype
1 gateway
A single unit for the reference building
Verified on a 250 m² test building, ground floor plus upper floor and attic with a technical basement, covered with no dead zones. Not one hub per floor and not a repeater in every corner.
Our own radio, through reinforced concrete.
In a finished building, a new cable run costs more than the equipment. That is why the link between modules is designed as radio, and the wired bus will stay inside the panel only.
04Updates↑ topics
Designed so that a failed update does not leave you without a system.
The gateway is not a managed Linux box, it is an appliance. An update is designed to pass through four gates, precisely so that there is no scenario in which the device is left in an intermediate state and the building is left without its control logic.
An immutable, signed image
The system will run from a read-only partition, cryptographically verified at every boot, with no package manager on the device. That removes configuration drift between two gateways and any path to modify it in the field.
Two partitions, A and B
The new version will be written to the inactive partition while the building keeps running on the active one. The switchover will happen at a single reboot, not during a live installation.
A health gate and automatic rollback
After reboot the gateway will have to prove it works: services up, radio present, links re-established. If it fails the gate it will return to the previous version by itself — with nobody intervening and no site visit.
Fleet rings, with automatic halt
A version will not reach the whole fleet at once: lab, then canary, then 1%, 10%, 50% and only at the end the rest, with a soak period between rings. If the regression rate rises, the rollout will halt automatically and the buildings that have not received it will stay on the version that works.
A fast lane for vulnerabilities
Security fixes will follow the same path but on an expedited lane, targeting at most 7 days from publication of the vulnerability. Security updates will be part of the service for its whole life — that is a manufacturer obligation, not just a commercial promise.
05Safety↑ topics
Critical loops, designed not to wait for the network.
Some loops must not depend on anything. That is why the switching modules are designed with their own dry inputs and local logic in firmware: a combination of inputs, a threshold, an output. The loop will run in the microcontroller on the board, next to the relays — below the gateway, below the local network, below any server.
The reference case is the wood-burning fireplace boiler. If the water temperature goes over the configured threshold, the module will start the circulation pump and drive the three-way valve on its own initiative. It is designed to work with the gateway switched off, with the local network down and with the internet cut, because no network component sits inside the loop.
Interlocks go further than firmware. On blinds, mutual exclusion between directions is designed into the board topology — a direction relay plus a run relay — so commanding both directions at once becomes electrically impossible, whatever logic fault occurs. And one actuator will have exactly one controller: two rules will never fight over the same relay.
06Measurement↑ topics
What is not measured cannot be regulated.
The inputs module is designed to read field quantities directly, with no intermediate converters, and send them over the same telemetry path as the rest of the system. That means any probe you connect will automatically appear in the history, in the charts and in the rules, with no extra code.
Thermistors, PT100 / PT1000 and OneWire
Temperature will be read where it matters: flow, return, buffer tank, hot water, pipe, ground. OneWire allows several sensors on one wire, which matters at a heating manifold with many circuits.
Pulse-output meters
Energy, water, gas and heat meters with a pulse output will be counted locally. Consumption will become a continuously tracked quantity, not a monthly reading.
0–10 V analog outputs
For modulating valves, fan coils and variable-flow ventilation, where on/off is too blunt. Designed in, with the components still going through qualification.
Indoor air quality
CO₂, humidity and particulate probes connect to the same 0–10 V and 4–20 mA inputs. Upon transposition of the directive, overdue since 29 May 2026, indoor environmental quality monitoring is a requirement for non-residential buildings that fall under the building automation and control system (BACS) obligation — so the analog input is not an optional extra, it is a compliance component. The qualified probes and the associated reporting are on our roadmap, not yet delivered.
07Integration↑ topics
We complement wired systems, we do not replace them.
A building that already has KNX on lighting or Modbus on the heat plant has no reason to throw away what works. Our integration direction — KNX, Modbus and BACnet — treats the product as a complement: the wired system keeps the zones it covers, and the radio modules add the zones cable never reached.
This matters to two groups. To the building manager, because extending automation no longer goes through approval of a rewiring project. To the electrical contractor, because they can propose a new stage on a building they have already delivered. On our test installations we already integrate third-party equipment over Modbus RTU and over application programming interfaces — meters, smart breakers, cameras.
The reason is not only commercial. Legislation explicitly requires interoperability between different proprietary technologies for building automation and control systems, which makes this direction a compliance requirement rather than an optional extra. Honest status: it is a development direction planned for the first two years of operation, not a function delivered today.
What stays mandatory, even with the system installed.
The mechanical thermal-discharge valve remains mandatory and is not replaced by us. The local firmware loop will start the circulation pump, but the final protection of a wood-burning fireplace boiler is mechanical, specified in the plumbing design, and is not a Mentivira matter. We do not place ourselves between the customer and a safety requirement.
Component status, item by item. The firmware intended for local execution of the safety loops is in development, not finished. Per-channel current measurement is designed in and not yet built on the prototype. The analog outputs and the indoor air quality module are development directions, on input hardware that already exists in the specification. The repeater transport rungs are specified but not yet built.
The certifications — CE marking, including RED Art. 3.3 with the EN 18031 standards for cybersecurity — are a compliance objective we are working towards, not a status we hold. The architecture is built to satisfy them, with a written security dossier: threat model, protection mechanisms, an item-by-item conformity matrix. When we obtain them, we will show them.
The estimated 15–25% energy saving depends on the individual building and is to be confirmed in the pilot programme. Figures marked as measured come from the hardware test bench and from our own test installation, a house where prototype modules have been running for more than five years under open-source orchestration. The complete Mentivira solution will be available in 2028.
Tell me when Mentivira is available
The complete Mentivira solution will be available in 2028. Leave an address and you get a single e-mail, at launch.
No marketing, no sold lists. One e-mail, at launch.
The address is used only to notify you at launch, by ZYONARA SRL. You can withdraw it at any time by writing to [email protected]. Details in the privacy policy.