System Architecture

TAPP is built around a simple idea: the equipment that must never be touched and the equipment that talks to the internet are kept on separate networks, and the only connection between them carries data in one direction. That one-way path is established in the Gateway’s hardware, not configured in software. This page explains that two-path architecture in plain language.

Two Physical Devices on Site

A TAPP installation places two distinct devices in the mechanical room, each with a different role:

TAPP Gateway — a one-way data transfer gateway. It collects data from equipment control systems on its protected side and passes that data, one direction only, to its transport side. There is no forwarding path from the transport side back to the protected side.
Network Router — handles internet egress and the wireless sensor radio. It is the only device that talks to your network and to the cloud.

Two-path architecture: control systems connect one-way through the TAPP Gateway to the protected side (Path A); wireless sensors report over 900 MHz radio to the Network Router (Path B); both converge and publish to AWS IoT Core over MQTT with TLS.

Path A — Controls / Critical (on the protected side)

Path A is for any critical equipment that has a control system — a boiler, a chiller, a water chemistry controller, or similar. Multiple pieces of equipment can share the protected side of the TAPP Gateway; all of them are isolated from the customer network in the same way.

Equipment controllers connect only to the protected side of the TAPP Gateway. They have no connection to the customer network and no connection to the public internet.
TAPP reads controller data over Modbus TCP using read function codes only (FC3/FC4). Write function codes (FC6/FC16) are never issued.
Where the boundary sits. Modbus TCP is a polled request/response protocol, so TAPP’s collection point does exchange traffic with the controller — read requests out, data back — across the protected network. That collection point sits entirely within the protected side. The one-way boundary is the gateway between the protected side and the transport side, and nothing arriving from your network or the internet crosses it.
Data crosses the TAPP Gateway one direction only — outbound from the protected side to the transport side. There is no reverse forwarding path.
The protected side is accessible only by physical presence at the equipment. No remote path to it exists.

Path B — Wireless Sensors (transport side only)

Where a control system isn’t present — or where you want additional coverage on tanks, motors, pumps, and other rotating or process equipment — TAPP adds wireless sensors. These live entirely on the transport side.

Sensors measure vibration, temperature, and a range of analog and digital signals, and communicate over a 900 MHz radio network.
The 900 MHz ISM band is chosen deliberately for industrial sites: longer range and far better penetration through walls, metal, and dense equipment than 2.4 GHz, so sensors reach the receiver from across a plant room without added infrastructure.
Sensors report to a receiving radio on the Network Router, which collects their readings alongside the controller data. The sensors are self-contained measurement nodes; they carry telemetry only.
Sensors are read-only. They observe equipment; they have no control capability and no connection to any control system.
Wireless is deliberately confined to the transport side. RF is treated as an untrusted medium and is kept off the protected side by design.
Worst-case impact of a compromised or jammed wireless link: a false or missing sensor reading. There is no path to the protected side, and no safety event is possible.

Convergence and Egress

Both paths converge at the TAPP transport side, which publishes data to AWS IoT Core via MQTT over TLS.
One AWS IoT identity and certificate per deployment.
Traffic is NAT’d through the Network Router — one MAC address is visible on the customer network.
Primary uplink is the customer’s wired network drop; cellular is automatic failover only.

Defense in depth: three independent layers protect your control systems.

Protocol. TAPP software issues Modbus read function codes only. Write function codes are never issued.
Topology. The TAPP Gateway provides no reverse forwarding path. Traffic originating on the transport side has nowhere to go.
Built in, not configured. The one-way path is established in the Gateway’s hardware. It is not a setting, it is not adjustable in the field, and it cannot be changed remotely.

The practical consequence: an attacker who compromises TAPP’s internet-facing side gains a monitoring endpoint, not a route to your controls.

These protections address remote and network-borne threats. They are not a substitute for physical security. Anyone with physical access to the mechanical room can interact with your equipment directly — by connecting to a controller, or by altering the equipment itself — and the TAPP Gateway is no more a barrier to that than any other device in the room. Physical access to the site remains the customer’s control, and TAPP is designed on the assumption that it is enforced.