Empowering AIoT with
Zero‑Trust Cybersecurity
Build, secure, and scale IoT & Edge AI workloads, from device identity and TLS 1.3 to streaming analytics and data pipelines. Designed for regulated industries and mission-critical systems.
AIoT Foundation Platform
From secure onboarding to a live Digital Twin
Provision devices, stream telemetry, and bring products to life with AI Agents and real-time Digital Twin. All on the TESAIoT Foundation.
Who Benefits from TES⩓IoT Platform?
Accelerating Thailand's IoT ecosystem to meet global markets and cybersecurity standards
IoT Product Designers
- Skip 3-6 months of security implementation
- Pre-integrated PKI, mTLS, and device management
- Focus on product innovation, not infrastructure
Platform Providers
- White-label ready for industry verticals
- Proven architecture handling millions of devices
- Healthcare, Smart City, Industry 4.0 templates
Investors & VCs
- De-risked IoT investments with proven tech
- 70% faster time-to-market for portfolio companies
- Built-in compliance for global expansion
Cybersecurity Policy Makers
- ETSI EN 303 645 & ISO 27402 compliant
- National IoT security framework ready
- Zero-Trust architecture as standard
Engineering Students
- Learn production-grade IoT architecture
- Free tier for academic projects
- TESA certification pathway included
Startups & Enterprises
- From MVP to scale without re-architecting
- Enterprise SLAs and 24/7 support
- Multi-tenant ready with cost optimization
Key Capabilities & Architectural Strengths
Security‑first foundation, analytics by default. Built for production AIoT.
Security‑First Design
Compliance‑Ready
MQTT QUIC
BDH AI
Authentication Modes
Username and password authentication. Ideal for simpler deployments.
Digital certificates for both device and server. Enhanced security with mutual authentication.
Hardware-based onboarding with Infineon factory certificate, protected update for TESAIoT credential rotation.
Product Model Store
Edge AI Dashboard
Knowledge Graph
API Keys
Certificate Management
Vault PKI
Device Mgmt
RBAC & PDPA
Provisioning
API Gateway
TimescaleDB
Architecture of TES⩓IoT
Zero Trust Security Flow
End-to-end security with mTLS, PKI, and encrypted data pipelines
Zero Trust Security
mTLS authentication, encrypted channels, and certificate-based identity
Edge AI Ready
Digital twin support, real-time analytics, and ML pipeline integration
High Performance
Low-latency MQTT, optimized data pipelines, and scalable architecture
The TESAIoT Dev Kit ships with its whole firmware
A three-core Edge AI development kit — Cortex-M55 400 MHz + Ethos-U55 NPU, two Cortex-M33, Wi-Fi 6 + BLE — and the firmware that actually runs on it: ~237,000 lines of open C, 60+ public APIs, MicroPython prebuilt, DEEPCRAFT Edge AI working out of the box, and 838 pages of Thai + English documentation. Not a demo written for the docs. The image we flash on the board.
Every layer of the stack, in one open hub
A single playground that crosses the entire product stack: firmware on the MCU, middleware on the edge, web applications in the browser. Firmware, software, and platform developers learn the shape of each layer, remix any example, and ship whatever comes next. No silo between teams, no re-inventing the interface between them.
Firmware · on the silicon
RTOS tasks, sensor drivers, IPC between cores, secure-boot chain. For Firmware Developers who live in the MCU and want production-ready scaffolding from day one.
Middleware · on the edge
Connectivity, device identity, BLE gateway, sensor fusion, telemetry pipelines. For Software Developers wiring the device to the cloud without re-implementing the plumbing.
Web · in the browser
Live dashboards, realtime plots, digital-twin views, admin portals. For Platform Developers who ship the surface users actually touch.
What you get when the kit lands on your desk
A three-core PSoC Edge E84 board with an NPU, and the complete firmware that runs on it — released as an open SDK. It boots to a touch menu, reads every sensor, runs MicroPython, talks TLS to the cloud, and runs an Edge AI model on the NPU. All of it readable, all of it yours to change.
3 cores + NPU
Edge AI silicon, not a hobby MCU.
- Cortex-M55 400 MHz + Helium + Ethos-U55 NPU
- 2× Cortex-M33 200 MHz · TrustZone · NNLite
- Wi-Fi 6 + BLE (CYW55513) · 4.3" DSI touch
- 512 Mb QSPI · 128 Mb HYPERRAM · 52 MB LittleFS
~237,000 lines of C
Every screen, every driver, the whole BSP.
- Apache-2.0 for all TESA-authored source
- Only 6 libraries closed — each one named and explained
- Signed archives: cd lib && ./verify.sh
- 31 C examples in-tree (
CY_IGNOREd until you opt in)
MTB or MTB + MicroPython
Same libraries, same board, same docs.
- MTB only · µs-level timing, smallest RAM, step debug
- MTB + MicroPython · edit-and-run over REPL, mix C and Python
- MicroPython ships prebuilt — no 189 MB port to build
./setup.sh --checktells you exactly what is missing
838 pages · Thai + English
Written for engineers, in the language they work in.
- Technical terms stay in English, as the industry uses them
- Examples that actually compile
- Prebuilt
app_combined.hexper release - SHA-256 published — the same file we flash to test
Edge AI on day one
A DEEPCRAFT™ model runs from the moment you unbox, and there are four documented ways to bring your own — without touching the closed libraries and without waiting for a new release from us.
Thai as a first-class language
Noto Sans Thai renders on the display out of the box, and the documentation is bilingual throughout. Thai industry gets a stack that speaks its language natively.
A path to a real product
HSM-backed device identity, Protected Update for field upgrades, and mTLS whose private key never leaves the silicon. The same structure carries you from a classroom exercise to a production line.
Three commands, then it is your firmware
setup.sh detects which variant you hold, tells you what is missing, and prints every command it runs so you can type them yourself when there is no script.
- Clone the SDK
git clone https://github.com/tesaiot/tesaiot-pse84-devkit-sdk.git - Pick your template
cd bento-firmware-template-mtb-mpyfor C + MicroPython, or-mtb-onlyfor pure C. - Build
./setup.sh --build— it checks the toolchain first and stops with a readable reason if anything is missing. - Flash, then power-cycle
make program, then unplug USB fully, count to ten, plug back in. The display backlight needs a cold 0→1 edge; a debugger reset is not enough.
Watch the whole platform being built
Five tracks, recorded against the real hardware: the platform overview, getting firmware onto the board, the Digital Twin, the fifteen-episode BitStream Studio course, and the Thai-language software-engineering series. Pick an episode; nothing loads until you do.
What the platform is, in half an hour
Three videos that frame everything else: the secure platform end to end, the hub the developers work in, and the security model the whole stack rests on.
From download to a running Dev Kit
Two routes onto the hardware: the full ModusToolbox build, or remote flashing straight from the browser when you have no toolchain installed.
The board, mirrored in 3D
The twin concept, the studio that authors it, and how the 3D model itself is made. Episode BS-06 in the course below builds the Dev Kit twin end to end.
The full BitStream Studio course
Install to animation, in order. Episodes 01–05 get the tool running, 06–11 cover the twin, the flow editor and live MQTT data, and 12–15 finish with real-time web output, graphics and animation.
กระบวนการพัฒนาซอฟต์แวร์ 4 ตอน
ชุดบรรยายภาษาไทยว่าด้วยกระบวนการพัฒนาซอฟต์แวร์ ตั้งแต่ภาพรวม ความต้องการของผู้ใช้ ไปจนถึงข้อกำหนดของระบบและซอฟต์แวร์ — พื้นฐานที่ทำให้โปรเจกต์เอมเบดเดดไปถึงสินค้าจริงได้
Four ways in: pick your read
Memfault-style persona routing. Every claim below is verifiable in source.
Firmware Developer
60+ APIs across connectivity, IPC, sensors, UI. Flash in 60 seconds, tune at compile time.
See the API surfaceTechnical SI
True dual-core split (CM33-S + CM33-NS + CM55), 46-opcode IPC, 41 middleware integrations.
See the architectureBusiness Owner
Time-to-prototype in days, not quarters. Proven demos: medical gateway, smartwatch, industrial dashboard.
See the killer demosPolicy Maker
Thai-built · open source · Optiga Trust M secure boot · PSoC Edge enablement for Thai industry.
See the security postureThree cores. One symmetric IPC bus. Zero context-switch tax
Real-time sensing on CM55, graphics on CM55, secure boot + fusion + cloud on CM33, all wired by a 128-byte, 46-opcode pipe.
What this buys you
- Decoupled jitter. Graphics on CM55 never stalls sensor acquisition, and vice versa. Stock single-core examples can't do this.
- Symmetric IPC.
cm33_ipc_send_gyro_data(),cm33_ipc_send_fusion_result(),cm55_trigger_scan_all(): send raw, receive typed. - Compile-time tuning. A central configuration header centralises FreeRTOS priorities and stack sizes per task. Override with
-DTESAIOT_*defines; no library rebuild. - Prebuilt archives shipped to you.
libtesaiot_cm55.a,libcm55_lvgl.a,libalgobsx.a(Bosch BSXLITE 9-DOF fusion), built for GCC_ARM, LLVM_ARM, and IAR. - Two BSPs, one stack. Switch between EVAL_EPC2 and KIT_PSE84_AI with a Makefile target; no source edits.
60+ public APIs across 7 categories, all C, all grep-able
Organised by responsibility, not by file layout. Every entry below is a real function prototype in the library headers.
WiFi manager
- wifi_manager_request_scan()
- wifi_manager_request_connect()
- wifi_manager_request_disconnect()
- wifi_manager_request_status()
- cm55_trigger_scan_all()
- cm55_get_wifi_list()
IPC pipe · CM33 to CM55
- cm33_ipc_pipe_start()
- cm33_ipc_send_gyro_data()
- cm33_ipc_send_fusion_result()
- cm33_ipc_send_imu_daq_config()
- cm33_ipc_send_mag_daq_config()
- cm33_ipc_pipe_send_raw()
- cm33_ipc_get_recv_pending()
- cm33_ipc_get_send_queue_used()
System init
- cm33_system_init()
- cm33_system_enable_cm55()
- system_register_tick_hook()
- cm55_system_init()
- cm55_system_register_tick_callback()
- + compile-time priority tuning via defines
Event bus
- event_bus_create()
- event_bus_subscribe()
- event_bus_unsubscribe()
- event_bus_publish()
- event_bus_destroy()
- event_bus_stats()
Sensor fusion · BSXLITE
- imu_fusion_init()
- imu_fusion_get_status()
- fusion_push_imu_sample_from_ipc()
- fusion_set_output_mode()
- fusion_set_stream_rate_hz()
- Returns quaternion · Euler · orientation · calibration state
Sensor DAQ
- create_imu_daq_task() BMI270
- imu_daq_set_rate_hz() 1-100 Hz
- imu_daq_set_enabled()
- create_mag_daq_task() BMM350
- mag_daq_set_rate_hz()
- + remote rate & enable via IPC
UI · LVGL 9.5 layout
- ui_container_clear_style()
- ui_fill_parent()
- ui_center_in_parent()
- ui_pad_xy()
- ui_margin_all()
- ui_gap()
Display pipeline · CM55
- display_init() GFXSS + DC + GPU
- cm55_gfx_task()
- VGLite GPU · NemaGFX · LVGL 9.5
- 3 displays · 3 touch controllers wired
BLE pack · IoT gateway
- ipc_ble_pack_cmd_empty()
- ipc_ble_pack_read_index()
- ipc_ble_pack_scan_result()
- Generic BLE scan · pair · read · publish
- Pluggable GATT-profile handler
Diagnostics
- setup_run_time_stats_timer()
- calculate_idle_percentage()
- cm33_ipc_get_recv_pending()
- cm33_ipc_get_send_queue_used()
- + FreeRTOS task introspection table
Security · Optiga Trust M
- cy_rslt_t return codes throughout
- Secure boot chain · CM33-S to CM33-NS to CM55
- TLS 1.3 · mbedTLS · HW-accelerated
- On-device CSR · signed OTA · dual-slot
- Crypto APIs match mbedTLS signatures
Cloud / IoT · via middleware
- MQTT / MQTTs AWS IoT SDK
- HTTPs
- secure-sockets
- core-mqtt · aws-iot-device-sdk-port
- wifi-connection-manager
▶ All entries above are exported symbols from the shipped static archives. Link them the same way you'd link any Arm C library.
Your entire firmware workflow, inside VS Code
The TESAIoT extension collapses seven firmware tools into one editor panel. Configure the silicon, build the libraries, flash the board, provision the connection, inspect the RTOS, and watch the sensor stream, all without leaving the file you're editing.
Hardware & Firmware Configurator
Pin mux, clock tree, peripherals, and IRQs. Visual config with live Makefile sync. One panel covers every bring-up decision.
Library Builder
Select modules, pick the toolchain (GCC_ARM · LLVM_ARM · IAR), and produce the three prebuilt static archives per target.
Firmware Builder
Compile CM33-Secure + CM33-Non-Secure + CM55 in one click. Errors navigate straight to the source line in the editor.
Firmware Programmer
One-click flash via KitProg3 / OpenOCD. Secure-boot signature-chain state is visible alongside the flash progress.
Connection Manager
WiFi credentials, MQTT brokers, cloud endpoints, and device identity: set at provisioning time, never hardcoded.
System Inspector
FreeRTOS task table, heap usage, CPU idle %, IPC queue depth. Live, sortable, updated at 1 Hz.
Realtime Visualizer
IMU, magnetometer, environmental and 60 GHz radar streams plotted live. Export CSV for offline analysis.
Six sensors, three displays, three touch controllers, all wired and ready
Every chip below has a working reader, a matching LVGL presenter, and a tutorial episode that proves the pipeline.
SENSORS
6-axis IMU
Accelerometer + gyroscope. Feeds BSXLITE 9-DOF fusion. 1-100 Hz on CM55.
3-axis magnetometer
I3C. Hard-iron calibration tracked in imu_fusion_status_t.
Pressure · temperature
Barometric + ambient. 8× oversampling. Background-all mode.
Humidity · temperature
I²C. Sensirion driver. Comfort-zone presenter bundled.
60 GHz radar
Range-Doppler & spectrogram processing stack (see Edge-AI dashboard).
VGA camera
DVP capture stream via CM55 camera_stream task.
Stereo digital mic
Level meter + peak hold + balance. Episode INT-EP06.
9-DOF fusion
Bosch prebuilt algorithm. Quaternion + Euler + orientation + calibration.
DISPLAYS & TOUCH
Waveshare DSI 4.3"
Default for KIT_PSE84_AI. FT5406 touch.
Waveshare DSI 7"
Default for KIT_PSE84_EVAL_EPC2. GT911 touch.
EK79007AD3
Parallel TFT option for compact form factors.
Capacitive touch
Third touch controller. Wired, not hardcoded.
What the stack speaks, out of the box
Every chip below is pulled via make getlibs. No side-download, no side-license.
Ten things no stock ModusToolbox example ships with
Every claim below ships as part of the platform: a callable API, a live service, or a first-class tool.
True dual-core IPC protocol
46 opcodes, 128-byte payload, dual endpoints (EP1, EP2). Symmetric send/receive, backpressure-aware, sequence-numbered for ordering.
BSXLITE 9-DOF fusion, calibration-tracked
Bosch prebuilt algorithm. Exposes quaternion, Euler, orientation class, and acc/gyr calibration state, not just "here's raw data".
IoT gateway BLE hooks
A generic BLE-gateway surface: scan, pair, read, and publish any BLE peripheral to your cloud broker. Device-type classification is built into the IPC opcode set, and new GATT profiles register through a single handler callback.
Semantic UI layout library
ui_pad_xy(), ui_gap(), ui_center_in_parent(), ui_fill_parent(). Eliminates 80% of LVGL boilerplate.
Thai-language first-class support
Noto Sans Thai rendering + a shipped working example. No patching required. Thai industry gets a stack that speaks their language natively.
Production WiFi manager
5-state machine (IDLE to CONNECTING to CONNECTED to RECONNECT_WAIT to ERROR). Exponential retry 1s, 5s, 15s, 60s. NVM + CRC32 + ping watchdog.
Cross-domain demos on one stack
Medical gateway · industrial dashboard · smartwatch · motion radar · Pong · Flappy · sensor fusion. All from the same 60+ APIs.
OPTIGA Trust M middleware · CSR to Protected Update
End-to-end trust management. On-device CSR via Optiga, CA signing, cert provisioning, then signed-OTA delivery with dual-slot rollback. One middleware covers the full trust lifecycle.
TESAIoT Configurator & Diagnostics · live in VS Code
Configurator (pin mux, peripherals, clock tree) and live diagnostics (RTOS task table, IPC queue depth, sensor streams) both drive the board in real time from the VS Code editor. No separate tool, no external log viewer.
TESAIoT Digital Twin · hardware-synchronized in real time
A 3D model of the board mirrors the physical device in real time: orientation, sensor readouts, peripheral state. Drive the model from the board for visualization, or drive the board from the model for HIL testing.
Learn by building: every episode is a working firmware image
Two 7-episode arcs plus 24 practise examples. All runnable tutorials on KIT_PSE84_AI.
Final WiFi Manager
Scan, profile save, auto-connect, exponential retry, then ping watchdog. Enterprise WiFi provisioning as a reference design.
SensorHub Final
Five sensors + stereo mic on one 60 fps dashboard. I²C + I3C + PDM + SDIO scheduled under FreeRTOS. The most complex reference.
BMI270 Radar View
6-axis IMU projected to a polar radar scope with 64-point trace. Raw accel/gyro becomes a visual you can feel.
9-DOF Sensor Fusion
Complementary-filter AHRS: accel + gyro + mag give roll / pitch / heading. Production orientation in under 500 lines.
Industrial Dashboard
Four live sensor cards + rolling chart + FreeRTOS stats. A drop-in reference for gateway / plant-floor HMI.
Space Shooter
Entity pool, AABB collision, D-pad + fire touch input, 50 fps on the MCU. Proof that the graphics pipe has headroom.
HMI Menu & Setting · 7 tutorials
Interactive Sensors · 7 tutorials
Reference designs · 24 runnable examples
Healthcare BLE device support
BLE medical device bridge. Discovered via scan filter, paired, and routed to MQTTs with device-type classification.
Industrial device bridges · Modbus + CAN
Same discover, classify, then route pattern for the plant floor and vehicle fleets. Plug in existing OT hardware without writing new middleware.
MQTT over QUIC · mobile + distributed fleets
For devices that change network. 0-RTT reconnection, connection migration across IP, mTLS provisioned per device via Vault PKI.
No toolchain. Flash from your browser in sixty seconds
Pair the TESAIoT Desktop Programmer once, plug in your PSoC Edge E84, and push any released firmware image with no ModusToolbox install, no clone, and no command line.
- Install the Desktop ProgrammerOne small cross-platform helper for macOS, Windows or Linux. Install it once; it pairs with this page.
- Plug in your boardConnect a PSoC Edge E84 dev kit over USB and switch the programmer to Remote mode.
- Pair this pageHit Flash to get a pairing code. The programmer claims it and your board details appear automatically.
- Pick a firmware and flashChoose a released image and push it over USB. Watch live progress, and the board reboots itself when it's done.
Grab the TESAIoT Desktop Programmer, plug in your PSoC Edge E84, and flash your first image in under a minute, right here, no command line.
Hardware root of trust. Signed updates. Zero-trust ready
Security is not a module. It's the first thing CM33-Secure does.
Optiga Trust M
Hardware secure element. Root of trust. Device identity. CSR provisioning.
Secure boot chain
CM33-Secure verifies CM33-Non-Secure, then CM55. PSA-aligned. Rejects unsigned images at reset.
TLS 1.3 / mbedTLS
Hardware-accelerated crypto. MQTTs · HTTPs · secure-sockets all routed through the accelerated stack.
Signed OTA
Protected Update flow with version + signature gates. Dual-image slot.
On-device CSR
Device-local CSR generation via Optiga that never exposes the private key.
IPC-log audit trail
Structured logging over IPC; CM55 renders, CM33 audits. No plaintext-to-USB leaks.
The kit is real hardware. The firmware is open. Both are ready
Enterprise Cloud & Community Edition
Choose how you run it. Let TESA manage it end to end on a trusted cloud, or self-host the open-source edition. Either way you get the same core.
Let TESA run it for you.
The same stack as Community Edition, fully managed, scaled, and backed up by TESA on a trusted cloud audited to the standards banks and governments rely on. No racks, no on-call, no compromise.
You don't worry about it, TESA handles it
Absorbs onboarding waves and bursty telemetry, scaling from 10 to 10 million devices on demand.
Multi-zone redundancy with automatic failover, about 99.99% uptime, no single point of failure.
Redundant, managed MongoDB and TimescaleDB, so you never tune a replica set.
Point-in-time recovery plus cross-zone replication, so your telemetry and certificates are never lost.
Full observability run for you, including patches, upgrades and security fixes.
Certificate lifecycle and automated key rotation, operated by TESA.
Enterprise services: beyond the open-source core
Special capabilities available on the fully-managed platform.
Device keys are generated inside the secure element and never exported; TESA's Vault CA signs the CSRs, giving you a turnkey hardware root of trust.
Signed, encrypted datasets rotate keys, certificates and data objects inside the OPTIGA™ Trust M over MQTT.
Signed firmware (ECDSA / RSA / Ed25519), short-lived presigned downloads, canary / rolling rollout with automatic rollback.
Native-speed anomaly detection, correlation and time-series forecasting, plus managed edge-AI inference.
No-code drag-and-drop dashboards (about 30 widget types) bound to live device fields over WebSocket / SSE.
One authenticated, rate-limited gateway with scoped keys; live data over REST / WebSocket / SSE / GraphQL.
Upload a 3D export to get a web-ready, device-bound model with a Digital-Twin data API.
Org-level isolation and RBAC with per-tenant quotas and keys, so you run many organizations on one platform.
Standards & compliance
Targets 100% · Levels 1-4Fully managed by TESA, Enterprise Cloud is engineered to meet ETSI EN 303 645 and the NCSA Consumer IoT Cyber Security Guidelines across all four levels, end to end. TESA owns the operational layer, including signed and timely updates, monitoring, resilience, periodic accredited penetration testing and a published support lifecycle, and pairs the platform with a TESA reference secure device (hardware secure element / HSM and secure boot), so the device-side requirements are covered too.
Want the platform without the ops?
Tell us about your fleet and we'll tailor a managed plan: enterprise security and compliance, delivered as a service you simply turn on.
Talk to our teamUse Cases
Healthcare, Smart City, Industry 4.0, Energy. All powered by Edge AI and secure connectivity.
- Fall detection for seniors (Edge AI)
- Continuous vital signs monitoring
- Baby cry & siren recognition
- HIPAA/PDPA privacy compliance
- Gesture control for smart homes
- Object & human detection
- Low-latency event alerts
- Secure telemetry & analytics
- Factory alarm detection (audio AI)
- Predictive maintenance
- Visual inspection of parts
- OT network segmentation
- Energy-efficient edge computing
- Smart grid integration
- EV charging optimization
- Solar & battery forecasting
Security & Compliance with Advanced PKI
Certificate-based identity, encrypted data paths, RBAC, and auditable operations. Supports ISO 27001, ETSI EN 303 645, GDPR/PDPA.
TESAIoT PKI Architecture
PKI Architecture
Security Features
Operational Workflows
Key Innovation: 4-Tier PKI Strategy
Certificates sized by tier balance cryptographic strength, packet overhead, and device power budgets.
Join the Future of Secure AIoT
Provision identities, stream data securely, and unlock AI at the edge with TESAIoT.