Smart Souq Al-Mubarakiya

This is my dream for Al-Mubarakiya, and I wanted to share it with everyone: that the souq stays as we know and love it, with its soul and its history, and becomes safer through smart technology that works in silence.

Souq Al-Mubarakiya is more than two centuries old. People walk it on foot, its alleys get crowded, and everyone loves it. So the smart souq begins by protecting what is already there: the safety of people first and the heritage of the place second, and only then the analytics.

The idea: small sensors spread through the souq without anyone noticing them, and send their readings to a local unit inside the souq, a small computer in a municipal room, which keeps the fire alarm and the public address working even if the internet is cut. From there the readings flow into a living digital copy of the souq built on the very map that numbers sixty locations, what we call the digital twin, so the system knows every spot by its name and its sensors. On top of all that sit the analytics that help the people who run the souq run it safely and help the merchants understand the flow of their customers, and around all of it a fence of protection that suits a place this sensitive.

The whole thing is here to read: the blueprint, the diagrams, the sensor catalog, the registry, the brief, and the deck, shared so that any conversation about the souq can start from something concrete.

Everything on this page is meant to be touched. Say who you are in the strip below and it lays out a path for you; these are the main stops.

• The map at the top: every number on it is a marker; switch on the zones layer and tap a zone name for a printable zone profile. Tap one and the location's card appears with its sensors and a simulated reading. Search by name, switch on layers to see gateway coverage, crowd density, and zones, and switch to the street map to see the same places on a real map.
• The scenarios under the map, five ready to play: a fire, a gas leak, a crowd surge on a Ramadan night, a dust storm, and a cyber attack stopped at the OT conduit. Choose one and press play; you will hear the alarm and the announcement and watch the map react. Or build your own: pick any place and any sensor it carries, and the console writes a seven step drill around it.
• For a training room, host a room and share its code with the people present; every phone that joins follows your steps live with its own sounds, in its own language. During any drill its bar stays on the screen with a stop button, every step shows a notification, and once a drill has ended you can download its log.
• The roadmap: five phases; tap any of them to see what it ends with and the gate it has to pass.
• What it takes ends with a calculator: choose zones and the registry counts the places, sensors, gateways, and installation weeks.
• The sensors: fourteen classes you can filter by domain, each with a typical day drawn on its card, and under the thresholds an explorer that shows what moving an alert level does to the alerts a day, with the table that says when each sensor raises an alert and where its numbers come from, and a button on each card that starts a drill with that sensor.
• Dotted words are glossary terms: tap or hover one anywhere for its meaning.
• The registry: the souq in numbers first, places per zone, sensors per class, names verified, then all sixty seven places, searchable by name or number; tap any row to jump to its spot on the map, and the details button opens its full profile, every sensor with its threshold, its day's curve, and its recent events.
• Quick jump: press Ctrl K, or Cmd K on a Mac, and type a section or a place; press ? for the keyboard shortcuts.
• From any place to the nearest exit: every location card says how far the nearest exit is, and show the way draws it on the map.
• The roadmap with dates: choose a start month above the phases and each phase gets its months.
• Accessibility: the round button at the bottom corner opens text size, high contrast, a light theme, reduced motion, and underlined links, remembered on your device, and an arrow takes you back to the top.
• The operations view: this is what the screen of whoever runs the souq would look like; scrub the day with the slider to watch every zone through the hours, and if you switch its source to a real broker it shows real messages over MQTT.
• Two phones in the architecture section: switch the merchant portal's shop and period and tap a bar; on the visitor app, tap your location to move, ask where a place is, read a story, and start a drill above to see what both screens would show.
• The diagrams: on a phone you can swipe them sideways, and each has an interactive version on its own page.

Every decision in this design answers to five facts about this particular souq.

• Heritage: we drill nothing into an old facade. Sensors go on lamp posts, awnings, and municipal fixtures, and not a single screw goes in before the National Council for Culture, Arts and Letters agrees.
• Climate: our summers pass 50 C and our dust shows no mercy, so every device here is rated to 60 C or better, sealed against dust and water, and runs on solar where wiring is not allowed.
• Life safety first: narrow alleys, wooden roofs, restaurants wall to wall, and crowds on Ramadan nights and National Day. Fire and crowds are the first thing we care about; everything else comes after.
• Many owners: the Municipality, the Ministry of Interior, Kuwait Fire Force, NCCAL, CITRA, Electricity and Water, Commerce, and then the merchants themselves. Each has a say, which is why the agreement between them is half the project.
• Privacy: we count people and never identify them. No cameras that recognize faces, no reading of number plates, counting happens inside the device with no image kept, and signs in the souq tell people what we measure and why.
• A gift you already have: the sixty numbered locations on the map are the asset list, ready made. They became the IDs of the digital twin.

Network and the local unit

swipe sideways to read the whole diagramopen the interactive version →

Five outdoor LoRaWAN gateways with overlapping coverage, four on the municipal fiber ring and one on NB-IoT where fiber does not reach, all landing on a redundant local firewall pair in a municipal room beside the souq. The local unit pair runs the LoRaWAN network server, the MQTT bridge, and the local rules engine, so join, decode, and life safety alerting never depend on the platform. The OT conduit firewall is the only path to lighting, fire panel, PA, and HVAC, and it accepts signed commands from an allow list, nothing else.

The stack, open source core with an Azure path

The design does not change between the two columns. The local unit is identical in both, which is what keeps the souq safe if the platform contract ever changes hands.

Sizing, why this is small

The data here is small, under a message a second across the souq, and the effort in this design goes into reliability, security, and governance.

Alert severities and who is told

Thresholds that raise an alert

Starting values for the pilot, tuned per zone during Phase 1 and reviewed with Kuwait Fire Force for the life safety rows.

Where the numbers come from

• Air: the Kuwait Environment Public Authority set the daily limits at PM10 350 and PM2.5 75 micrograms per cubic meter in 2017, and its Kuwait Air Quality Index counts PM10 up to 350 as acceptable. The advisory fires where Kuwait's own scale turns moderate.
• Heat and smoke: a fixed temperature of 58 C and a rise of 8 C per minute follow the standard heat detector classes of EN 54-5.
• Gas: alarms at ten percent of the lower explosive limit are the common industrial practice for combustible gas detection, and 35 parts per million is the NIOSH recommended exposure limit for carbon monoxide.
• Heat stress: a heat stress index (WBGT) above 32 C follows the ISO 7243 approach to heat stress in the workplace, applied here to visitors.
• Crowds: three people per square meter is the density at which crowd safety guidance describes movement as restricted and the risk of a surge rising.
• Cold chain: chilled display above 5 C follows common food safety practice for chilled food.
• Water, noise, waste, tamper, parking, lighting: operational settings for the pilot, to be tuned per zone in phase one.

The local unit has four modes and moves between them on its own. Life safety never waits for the cloud.

swipe sideways to read the whole diagramopen the interactive version →

When the connection drops, the local unit moves between four modes by itself. Connected streams to the platform moment by moment. Degraded, when the platform slows down, lets the local rules take the lead and decide. Offline, when the platform is gone entirely, stores three full days of readings while the fire alarm keeps working as if nothing had happened. Recovering, when the connection returns, sends what was delayed and reconciles the digital twin before going back to connected. And every three months we pull the fiber on purpose to make sure it works, not only on paper.

Trust zones

Control mapping

Privacy by design

• Footfall is counted in the local unit by LiDAR or thermal sensors, and no image ever leaves a device or is stored.
• No facial recognition, no plate reading, no device fingerprinting of visitors' phones.
• Merchant accounts are the only personal data, and they live behind the WAF with strong authentication.
• Public and merchant views only ever see aggregates by zone and hour.
• Signage in the souq says what is measured and why, and the privacy notice is published.

Device lifecycle

1. Provision: unique certificate from the device CA, no shared keys, no default credentials.
2. Join: the broker accepts publish only from known certificates, and unknown devices are logged as a security event.
3. Update: signed firmware only, staged rollout, rollback ready.
4. Monitor: heartbeat, battery, signal, and behavior baselines into the SOC.
5. Retire: certificate revoked, device wiped, registry updated, the same day it leaves the wall.

Operational security

• OT changes go through change control with a manual override and fail safe defaults, and automation never dispatches emergency services on its own.
• Quarterly offline drills prove the local unit protects life safety without the platform.
• Annual penetration test, annual tabletop with Kuwait Fire Force, and an independent assessment before any new OT control.

The control matrix generated by hisn matrix is in architecture/control-matrix.txt.

Threat model, what we assume will be tried

Conduit matrix, who may talk to whom

Everything not listed is denied, and the conduit firewalls log every denial as a security event.

Five safeguards run through this design. They are the questions any reviewer would ask about a system that can touch a fire panel or a lamp, and each one has a concrete answer here.

Two principles shaped the choices here. Consequence first: every safeguard is ranked by what a failure would do to people in the alleys, which is why fire and crowd safety outrank analytics. Compliance that reduces consequence: IEC 62443, CITRA, and the framework mapping exist to make the souq safer, not to produce paperwork, so the review gates ask whether a safeguard is real, not whether it is documented.

A note on training. For anyone who wants to learn IoT and OT security properly, the SANS Institute runs well regarded courses on industrial control systems security; that is a suggestion for further learning and nothing more. Nothing on this site is taken from SANS material, which is copyrighted by SANS, and SANS has no connection to this work.

A system like this is only as safe as the team behind it.

The pilot, at its smallest, needs five people: an industrial security engineer who owns the zones and conduits and knows why we drew them this way, an analyst in the security operations center who reads operational readings and not only computer logs, an incident responder who has rehearsed with Kuwait Fire Force, an operations engineer who knows the fire panel, the public address, and the lighting as physical machines rather than icons on a screen, and a leader who holds the decision during an event.

For anyone who wants to learn this field properly, the SANS Institute's courses on industrial control systems security are a good place to start; that is a suggestion for further learning, nothing here comes from their material, and the learning is better started before the first sensor is mounted, not after.

Every command that changes something physical follows one path, and a human stays in it.

swipe sideways to read the whole diagramopen the interactive version →

Any command that changes something in the real world, dimming the lights or playing an announcement, walks one path and no other: it starts as a request on the dashboard, a second person approves it if it goes beyond the usual schedules, the platform signs it, the conduit firewall checks it against a short allow list, then the local unit executes it, reads back the effect, and records it as an event in the security operations center. And the system never calls the fire force by itself; it raises the alert, and a human confirms.

An honest picture of a first pilot, not a price list.

The pilot zone

The restaurants street, Safat Square, and Gold Parking. It is where the fire risk is highest, the crowds are thickest, and a win would be most visible.

Sensing, about sixty devices

• 24 heat and smoke sensors under the awnings of the restaurant stalls
• 12 LPG and carbon monoxide sensors in the kitchens
• 8 anonymous footfall counters at the alley entrances and the square
• 4 noise sensors, 3 air and heat index sensors, 2 heat stress sensors
• 1 water quality probe at a drainage point, 4 waste fill sensors
• 60 parking bay sensors in Gold Parking, 1 traffic counter on the boundary street
• 6 lighting control nodes on the lamp posts of the square

Connectivity and the local unit

• 3 outdoor LoRaWAN gateways with battery backup and fiber or NB-IoT backhaul
• A redundant pair of fanless local units in a municipal room, with an local firewall and an OT conduit firewall
• Neutral, non invasive brackets and enclosures, nothing touching historic fabric

Platform and people

• The open source platform, on premises or cloud, sized for the whole souq from day one
• A device identity authority, dashboards and alerting, and the fire panel and PA integration accepted with Kuwait Fire Force
• A penetration test and a tabletop exercise before anyone says the work is done
• Ten percent spares, because the heat will take its share whatever we do
• Runbooks and training for the people who will actually run it

What it costs

Most of the money will not go to sensors but to digging, cabling, and connecting to the systems already there. A pilot is the cheapest way to find out what the whole souq really needs, and to earn the merchants' trust before scaling.

Risk register

KPIs by phase

The words this vision leans on, in plain language.

• The local unit, what engineers call the edge: a small, rugged computer inside the souq, in a municipal room, that receives the sensors, runs the safety rules, and keeps the fire panel and the public address working even when the connection to the platform drops.
• Digital twin: a living digital copy of the souq. Here it is the registry of the sixty numbered map locations, each with its sensors and their latest readings.
• Trust zone: a group of systems that share the same level of trust and the same protections. This design has seven, from the public internet down to life safety.
• Conduit: the only controlled path between two trust zones, with a firewall that allows exactly what is listed and logs everything else.
• OT, operational technology: the systems that move something physical, here the lighting, the fire panel, the public address, and the ventilation.
• IoT, the internet of things: the sensors and small devices that measure the world and report over a network.
• LoRaWAN: a long range, low power radio network for small sensors. A handful of gateways cover the whole souq, and batteries last years.
• Gateway: the radio receiver that hears the sensors and forwards their packets to the local unit over fiber or a cellular backup.
• NB-IoT: a cellular network for small devices, used here as the backup path where fiber does not reach.
• MQTT and the broker: the messaging protocol the sensors publish on, and the server that receives and routes those messages. The broker only accepts devices it knows.
• Certificate per device: each device carries its own cryptographic identity, so a stolen or cloned device cannot pretend to be another.
• Signed command: an instruction that carries a cryptographic signature the conduit can verify before anything physical moves.
• Allow list: the short list of commands a conduit will pass. Everything not on it is refused.
• Store and forward: the local unit keeps readings when the platform is unreachable and sends them once the link returns.
• SOC, security operations center: the team and tools that watch the security events, from a rejected device to a blocked command.
• IEC 62443: the international standard for securing industrial and operational systems. Its zones and conduits shape this design.
• SBOM, software bill of materials: the list of every software component inside a device model, so a known vulnerability can be found and patched.
• Footfall: how many people pass a point per hour, counted anonymously, with no images kept.
• The heat stress index, WBGT: the wet bulb globe temperature, a heat stress index that combines temperature, humidity, sun, and wind.
• LEL, lower explosive limit: the lowest concentration of a gas that can ignite. The gas sensors alert at ten percent of it.
• PM10 and PM2.5: dust particles up to ten and two and a half microns across, the numbers that rise in a dust storm.
• NTU: the unit of turbidity, how cloudy water is.
• Tabletop exercise: a rehearsal around a table of how an incident would be handled, with the people who would actually handle it.
• Penetration test: an authorized attempt to break into the system, so the gaps are found before anyone else finds them.

The dream is that the souq stays as we know and love it, and becomes safer.

This vision, which I share here to read, is the start of a conversation about how, not a plan and not a project. And if one sensor under one awning ever raises one alarm one minute before what would have happened, the whole vision has already paid for itself.