Remote Pump and Generator Control Without GSM: Designing a Fail-Safe Long-Range Relay Link

Maharashtra's distribution company publishes the agricultural feeder timetable every month. The August 2026 circular gives non-solarised farm feeders eight hours of three-phase supply a day, on a day-or-night rotation, and in some divisions the window opens at 02:25 or 21:20. If the borewell is three kilometres from the house, someone either walks to the pump in the dark or switches it remotely. Telecom towers, pipeline valves and generators at unmanned posts have the same problem without the timetable.

The usual answer in India is a SIM-based 'mobile starter'. This post covers the alternative, a private sub-GHz radio link that closes a contact at the far end, and the part that decides whether either approach is safe: how that contact is wired into the starter or generator controller, and what happens when the link goes quiet. The radio is the easy part.

Why SIM-based starters fail where they are needed most

GSM starters are mature: Nano Ganesh, one of the earliest, dates to 2003-04 and passed 60,000 installations according to an FAO e-Agriculture case note. They work well with reliable coverage at the pump. Their failure modes are specific:

• Coverage has to exist at both ends, and the end that matters is the well or the tower, not the farmhouse. Pump houses tend to be low, in a dip, and inside a steel enclosure.
• Many low-cost starter boards still use 2G-only GSM modules. Jio runs no 2G network, so those boards cannot use a Jio SIM at all, and Jio has argued publicly for a 2G phase-out since at least 2020. A 2G-only device is a bet on someone else's network roadmap.
• SMS delivery is best-effort; a command that arrives forty minutes late can be worse than none.
• Prepaid validity lapses, and nobody notices until the night it is needed.
• Many units authenticate a command by caller ID or an SMS keyword. Caller ID is a convenience, not authentication.
• When the network is congested or down, the control channel goes with it.

None of this makes cellular wrong. With solid 4G at both ends, a cellular controller is simpler than anything described here. A private radio link earns its place when coverage at the equipment is poor, the two ends are within tens of kilometres, or control must not depend on a telecom operator. Our LoRa vs LTE for rural IoT analysis compares the two families more broadly.

What the radio actually switches: a dry contact

A remote relay module such as MeshVani Relay presents a volt-free changeover contact: COM, NO (normally open) and NC (normally closed). De-energised, COM connects to NC; energised, COM moves to NO. That is the whole interface. It does not start a motor; it switches a circuit you design, and that circuit is where safety lives.

Never put the radio's contact in the motor power path. A squirrel-cage pump motor draws roughly five to seven times its full-load current on starting, which is why contactors are rated separately for AC-3 duty under IEC 60947-4-1. The radio's contact belongs in the starter's control circuit, where the push-buttons sit. If the module's datasheet does not explicitly rate its contact for your control voltage (often 230 V or 415 V AC on Indian DOL and star-delta starters) and for an inductive coil load, fit a DIN-rail interposing relay with a coil voltage the module can drive, and let that relay's contact go into the starter.

Two-wire versus three-wire control

Indian pump starters are almost always three-wire: a normally-open START button in parallel with the contactor's auxiliary hold-in contact, and a normally-closed STOP in series. Generator controllers usually work the other way: a remote-start input that must stay closed for as long as the set should run. On a DSE7310, for example, closing the remote-start input requests a run; when it opens, the controller runs a configurable cooling period (0 to 600 seconds) and then stops.

• Supply interruption mid-run. Pulse: the contactor drops out and stays off when power returns. Maintained: the motor restarts by itself when three-phase returns.
• Radio link lost mid-run. Pulse: the equipment keeps running, because the starter latched it. Maintained: it depends on what the module does with its relay on link loss, which you must confirm.
• Radio module loses its own power. Pulse: nothing changes until the next command. Maintained: the relay de-energises and COM falls back to NC, so equipment wired to NO stops.
• Best for. Pulse: pumps on rotational supply where an unsupervised restart is unwanted. Maintained: generator remote-start inputs, and loads that must stop when the control system dies.

The supply-return row matters on farm feeders. Auto-restart is what many farmers want, because supply comes and goes within the window. It is also how motors burn: three-phase returns with a missing phase and the motor restarts into it. If you choose maintained wiring for a pump, a single-phasing preventer and a restart delay are not optional. If you choose pulse wiring, accept that someone has to send a new START after every interruption.

Decide the safe state before you pick NO or NC

Write down, for each load, what it should do if the remote end loses power, loses the link, or receives garbage. Then wire so that the de-energised relay produces that state. Typical answers:

• Borewell or transfer pump: safe state is off.
• Generator at an unmanned site: usually off, so a module failure cannot crank the engine three times and leave it running until the fuel is gone. A site whose sensors must stay powered may decide the opposite; record that decision rather than leaving it to whoever wired the panel.
• Fire-water or drainage valve: often fail-open. Use the contact sense that opens the valve when the relay is de-energised.
• Sirens and floodlights at a perimeter: off, with a periodic test.

Every installation also needs a local Hand-Off-Auto selector between the radio and the starter. A technician working on the pump or the generator must be able to turn the remote path off physically, and lock it there. A remote start that arrives while someone has a hand on a coupling is the failure that matters most, and no amount of encryption prevents it.

What happens when the link goes quiet

Radio links fade: monsoon foliage adds loss, a repeater battery runs flat, a tractor-trolley parks in front of the antenna. There are three workable patterns for what the equipment does meanwhile, and they combine.

1. Hold last state

The remote relay keeps whatever state it was last commanded. Cheap on airtime, and acceptable with pulse wiring on a pump that has its own dry-run and overload protection. Dangerous with maintained wiring on anything that should not run unattended indefinitely.

2. A hardware run timer in the panel

Put an off-delay timer relay downstream of the radio contact so that each START allows at most, say, 45 or 90 minutes of running. A new command re-arms it. This caps the damage from a lost STOP, needs no radio traffic, and works with any relay module. For pumps on rotational supply it is the pattern we recommend first.

3. A heartbeat watchdog

The controller sends a periodic keep-alive, and the remote end drops to its safe state if it misses several in a row. This is the strongest pattern and the most expensive in airtime, which in India is a legal budget, not a preference. Under Table I of G.S.R. 853(E), the licence exemption covering telecommand and telemetry in 865-868 MHz, each transmitter may occupy the air for 1 percent of any hour: 36 seconds. Some deployments qualify for the more generous Table II, as our LoRa frequency bands guide explains; the arithmetic below takes the conservative Table I case.

Approximate airtime for a 16-byte frame on a 125 kHz channel (coding rate 4/5, 8-symbol preamble, explicit header, CRC):

• SF7: about 51 ms. A heartbeat every 30 seconds uses about 6 seconds an hour.
• SF9: about 165 ms. A heartbeat every 60 seconds uses about 10 seconds an hour.
• SF12: about 1.32 s. A heartbeat every 5 minutes uses about 16 seconds an hour, 44 percent of the budget. Every 2 minutes exceeds it.

So the watchdog interval you want decides the spreading factor you can afford, and the spreading factor decides the range. A 30-second watchdog is comfortable at SF7 and impossible at SF12. Retries make it worse: three retries per missed acknowledgement quadruple the airtime of a bad hour, which is exactly when the link is weak. If you need both a tight watchdog and long range, the answer is usually antenna height or a repeater that lets you run a faster spreading factor, not a slower one. How a hopping link spends the same airtime budget is covered in our FHSS explainer.

An acknowledgement is not proof that water is flowing

A good relay module confirms that its contact changed state. MeshVani Relay sends an encrypted acknowledgement back to the base station for exactly that purpose. But between the contact and the water there is an interposing relay, a contactor coil, an overload relay, a single-phasing preventer, a dry-run cut-out, the motor and the pump. Any of them can stop the job after the relay has truthfully reported success. On rotational supply, the usual reason is that three-phase has not arrived yet.

If the operator needs to know the pump is running, plan a second signal: a current switch on one motor phase, a flow switch on the delivery line, or a pressure switch, read back by a device that has an input channel. Ask any vendor, including us, specifically for running feedback rather than assuming the acknowledgement covers it.

Range: the worked example

MeshVani Relay is specified at 20 km line-of-sight, with repeaters extending coverage past 50 km and 40 km demonstrated with elevated antennas. The words that matter are 'line-of-sight' and 'elevated'. Here is what they mean for a 20 km link at 866 MHz, using the Table I ceiling of 14 dBm e.r.p. (16.15 dBm EIRP), a 2.15 dBi receive antenna, 3 dB of total cable and connector loss, and receiver sensitivities typical of sub-GHz LoRa transceivers: about -137 dBm at SF12 and about -123 dBm at SF7.

• Maximum tolerable path loss: about 152 dB at SF12, about 138 dB at SF7.
• Free-space loss over 20 km: 117 dB. On paper that is 35 dB of margin at SF12.
• Plane-earth loss with both antennas at 3 m, a pole on a pump house at each end: about 153 dB. The link does not close even at SF12, before any crop or tree loss.
• Plane-earth loss with a 30 m tower at one end and a 10 m mast at the other: about 122 dB. Roughly 30 dB of margin at SF12 and 16 dB at SF7.
• First Fresnel zone radius at the midpoint of a 20 km path: about 42 m. Earth bulge at the midpoint (k = 4/3): about 8 m. Radio horizon for two 3 m antennas: about 14 km. For 10 m and 30 m: about 36 km.

The 3 m case is how many pump installations are actually done, and it explains most 'nowhere near the brochure' complaints. With 10 dB of crop clutter and a 10 dB fade margin, the plane-earth model puts the limit near 6 km at SF12; survey before you promise more. Raising one end onto a water tank, tower or hilltop is worth more than transmit power, which in India is capped anyway. Where no single high point sees both ends, a repeater on a ridge, tank or building is the standard fix; each hop adds airtime, so recheck the duty-cycle budget.

Field details that decide whether it survives a monsoon

• Antenna outside the panel. A steel enclosure is a shield. Use a mast and a short run of low-loss coax; feeder loss comes straight off the link budget.
• Lightning and surge. Bond the mast to earth, fit a coaxial surge arrester at the panel entry, and follow IS/IEC 62305 for anything on a tower.
• Power the remote module independently. On an eight-hour feeder the panel is dead for sixteen hours, and a module powered from it cannot receive a command or report anything until supply returns. A small solar-charged battery keeps it awake; MeshVani Relay runs on 5 to 12 V DC with microamp standby draw.
• Panel temperature. The module's rating (-30 to +70 degrees C for MeshVani Relay, in an IP65 enclosure) is an ambient figure. A closed steel panel in May sun runs well above ambient; measure it.
• Labelling. Mark the panel with the remote path and safe state; the next electrician will not otherwise know a radio can start this motor.

Security: what replaces caller ID

Two properties matter. Commands must be authenticated, not merely encrypted, so a forged frame is rejected. And an old valid command must not be replayable: a recorded 'START' from 02:30 should be useless next week. MeshVani Relay uses AES-256-GCM authenticated encryption with keys derived through PBKDF2-SHA256, and rejects replays with a monotonic nonce and timestamp validation. Frequency hopping makes the link harder to find and jam, but no sub-GHz link is unjammable by a nearby transmitter; the failure logic above is what protects you then.

Change the default shared password at commissioning and again when staff leave. A strong cipher with the password written on the panel door protects nothing.

When this is the wrong tool

• You need telemetry from many sensors: levels, flow totals, energy. That is a LoRaWAN or SCADA network or a cellular RTU, not a point-to-point relay link.
• You want to control equipment from another city through an app. Use cellular where coverage exists.
• The load is safety-critical in the functional-safety sense, such as a burner or a process trip. A licence-exempt radio link with non-interference, non-protection status should not be part of a safety instrumented function.

For an unattended pump or generator without reliable coverage, a few to a few dozen kilometres away, a private encrypted relay link is a sound choice. Autoabode builds MeshVani Relay for that job in India; the wider family is on our radio and secure communications page. If you have a site in mind, send us the coordinates of both ends, the antenna heights you can get, and what the load is, and we will tell you whether the link closes. Contact the team.

Commissioning checklist

• Safe state written down for each load; NO or NC chosen to match it.
• Radio contact in the control circuit only, through an interposing relay unless its rating covers your control voltage and an inductive coil.
• Pulse or maintained wiring chosen deliberately; single-phasing preventer and restart delay if the motor can restart on supply return.
• Lockable Hand-Off-Auto selector fitted and tested in Off with a live remote command.
• Link-loss behaviour tested by switching the base station off mid-run; run timer or watchdog fitted where needed, and its airtime checked.
• Band, e.r.p. and default password checked; RSSI and SNR recorded in the dry season and again after the monsoon.