Proprietary NPU design executing decision trees on-silicon, independent of external networks.
Off-grid vector mapping & waypoint calculation
When GPS is denied or spoofed, the pendant switches to an on-device vector-map that fuses accelerometer, gyro, and barometer data to calculate dead-reckoned waypoints. A Kalman filter continuously refines position error, allowing hikers, first-responders, or disaster teams to navigate canyon, forest, or urban canyon environments for up to 72 h without satellite lock. If a mesh neighbour has a valid fix, the filter ingests that telemetry (encrypted, zero-knowledge) to reset drift—no central server required.
Continuous vitals monitoring with trauma alerts
A multi-spectral PPG sensor samples heart-rate variability 64 × per second; a negative-temperature-coefficient thermistor logs skin temperature; a 3-axis accelerometer detects fall signatures. Edge-trained TinyML models compare live streams against owner-specific baselines stored in the secure enclave. When three-sigma deviation persists for > 30 s, the firmware raises a tier-1 alert (local LED + haptic). If the user does not cancel within 60 s, tier-2 triggers an encrypted SOS broadcast across the ARIN mesh, including last-known position, heart-rate trend, and device ID—again, no cloud handshake.
Mesh relay for group coordination in blackout zones
Each pendant acts as a store-and-forward node for 128-byte packets. A token-ring schedule assigns 5 ms TX windows, eliminating packet collision without a master clock. Messages hop up to 8 devices, extending range to ~ 5 km in open terrain. Priority flags (medical, geo-fence breach, low-battery) pre-empt routine traffic. If a gateway node (satellite bridge or vehicle modem) appears, the protocol auto-uploads the highest-priority packets, then returns to radio silence—user configurable.
Absolute offline autonomy. Sovereign connectivity on demand
Hardware-Level Encryption
A dedicated RISC-V NPU running at 160 MHz executes 512 MAC/cycle inside a CC EAL-6+ secure enclave. Firmware is signed at the foundry; boot-loader verifies the signature before every wake-up. Runtime decryption keys are stored in e-Fuses blown after provisioning—no JTAG, no debug interface, no firmware update port. Raw biometric vectors are hashed with a 256-bit device-unique key; only the hash leaves the enclave (for pendant-to-pendant authentication), making reconstruction of the original signal cryptographically infeasible.
User-initiated, returns to radio silence
The user triggers “cloud sync” by a deliberate gesture (triple-tap + fingerprint). A one-time TLS 1.3 session negotiates a 256-bit ephemeral key; the handshake includes a hardware-rooted attestation certificate proving the firmware has not been modified. Once the encrypted payload is acknowledged, the radio stack powers down, the session key is zeroised, and the device reverts to air-gap—total window < 3 s, no background telemetry possible.
Peer-to-peer distress signal (FCC Part 15) independent of cellular grids
In a grid-down scenario the pendant automatically boosts TX power from 0 dBm to +10 dBm and shifts to the 868 MHz ISM band (LoRa, 250 kHz BW, SF = 9) for maximum range. A forward-error-correcting codec (Reed-Solomon 255,223) gives 8 dB coding gain, allowing a 50-byte distress packet to be decoded at -137 dBm—roughly 12 km line-of-sight. The message format is compatible with amateur 869.4 MHz simplex and with commercial SAR receivers that support open-standard LoRaWAN—no proprietary hardware required.
