Every reading checked on arrival. Every figure provable later.
meldra verifies smart meter telemetry at the ingestion boundary and writes the proof into your lakehouse. Ask for a settlement figure and it arrives with the snapshot it came from and the status of every reading behind it.
| MPAN | Period | Status |
|---|---|---|
| 1200 0412 …83 | 1–48 | VERIFIED |
| 1200 0577 …14 | 31 | CHAIN_GAP |
| 1200 0611 …02 | 1–48 | VERIFIED |
The gap is between the meter and the record.
A utility can prove a reading was authentic at the meter, and separately that a warehouse row hasn't changed. Nothing joins the two.
At the meter: solved
IEC 62351 and DLMS handle encryption and device authentication well.
In between: lost
Readings are transformed and loaded. The link to the source is dropped, and a deleted reading leaves no trace.
In the lake: argued
Substantiating a challenged figure takes days of analyst time, and produces an argument rather than a proof.
Nothing is written until it has been checked.
Each block carries a hardware monotonic nonce and an ECDSA P‑256 signature. The gateway performs an atomic nonce compare-and-swap, recomputes the hash and verifies the signature before the reading is written.
- Verification is a column, not a log line, so you can query it.
- Failures are recorded, never loaded quietly.
- Replays are refused by the nonce check.
A missing reading is evidence, not noise.
Readings for each meter-day are linked in sequence. When a link breaks, the gap is flagged CHAIN_GAP where it occurs, instead of being silently dropped or averaged away.
- Mid-day and end-of-day gaps both show up.
- Queryable by meter, feeder or period.
- Change one byte in a stored reading and the verifier names the block.
Every answer carries its own receipt.
Ask in SQL or plain English. The result returns with the exact data snapshot it was computed from and the verification status of every contributing reading. Your counterparty re-runs it and gets the same number.
- Snapshot-pinned. Results reference an immutable table snapshot.
- Reproducible. Same query, same snapshot, same figure.
- Plain English or SQL, with the SQL shown.
GET /v1/query/submit · example response
Settled consumption, feeder F‑4471, 1–31 August 2026
Valid traffic is verified. Invalid traffic learns nothing.
Rotating ingress routes
Routes derive from a shared secret and a 60-second epoch, with three windows valid at once for clock drift. There is no fixed endpoint to scan.
Divert, don't block
Blocking tells an attacker they've been seen. An invalid or stale route is sent to an isolated decoy that returns plausible synthetic telemetry, and the source is flagged.
Access below the engine
Masking is applied to the Arrow data before it's registered with DuckDB, so aliases, subqueries, CTEs and SELECT * can't recover a masked value.
Your storage, your data, your exit.
Tables are Apache Iceberg on your own object storage. If meldra disappeared tomorrow, your data would be untouched and readable by the engines you already run.
The catalogue maps to the IEC Common Information Model (61970‑301, and 61968 including part 9 for meter reading), with a CIM RDF export.
- Connects to your head-end and sits beside your MDM, not instead of it.
- Energy-native schemas your settlement team will recognise.
Every number has its conditions next to it.
Re-measured on 6 October 2026: single thread, 1,000 signed blocks from a meter simulator, on a standard laptop, median of five runs. Not yet run on real meters.
What we can't claim yet.
These are unmeasured or unfinished. We publish them because you'd find them anyway.
Not yet run on real meters
All measurements come from a meter simulator producing signed blocks. No production AMI estate has been through it.
Single-thread figures only
Horizontal scaling is designed but multi-thread and multi-gateway throughput aren't benchmarked.
Detection rates unmeasured
No detection accuracy, false-positive rate or containment duration until we've run it.
Pushdown needs explicit filters
SQL WHERE predicates aren't yet translated into Iceberg expressions for file pruning.
Fast path is conditional
The zero-materialisation Arrow path only engages when no access policy applies to the query.
Defects found and fixed
Including a nonce-ordering bug that could lock out a meter. Exploit-tested, fixed and pinned with regression tests.
Questions utilities ask us.
Does this replace our MDM or head-end system?
No. The platform connects to your head-end system and writes verified tables to your own object storage. Your MDM keeps doing its job; meldra adds evidence that survives into the lake.
Where does our data live?
On object storage you control, as Apache Iceberg tables. Any engine that supports Apache Iceberg can read it without meldra.
What happens to a reading that fails verification?
It's rejected and the failure is recorded. It is never loaded quietly. Missing periods in a meter-day sequence are flagged as CHAIN_GAP.
Is it running in production?
Not yet. We're working with a small number of design partners. Every benchmark so far comes from a meter simulator, and our list of known gaps is public.
How does a design-partner pilot work?
A short call about where your figures get challenged, a scoped pilot on a sample of your own telemetry, and a written read-out of what was verified, what was missing and what we'd change.
Bring one disputed figure. We'll trace it with you.
Two terminals, no slides: signed readings, a rotating route, a decoy, and a changed byte the verifier names.