06 · Development · Dock probe
When the probe is offline, temperature cannot reuse the last truck’s number
The IoT engineer turns probe readings into events that can be checked. If collection fails, it must fail explicitly. It cannot fill in a value that looks normal. Whether receiving may proceed is still judged by the business service.
- 06:00 Sync time. Probe time is four minutes off the server. Correct the event, then store it.
- 06:20 Offline. Dock probe has no heartbeat. The receiving page shows cannot measure temperature, not yesterday afternoon’s temperature.
- 07:10 Recover. Backfill carries collection time and does not overwrite a truck already rejected.
The IoT engineer connects devices to documents. It is not only storing numbers
Probes, scan gates, scales, and access control all send numbers into the system. The IoT engineer’s mark is stating when those numbers are valid. Heartbeat present, time trusted, device belongs to this dock: missing any one, the reading cannot take part in the receiving judgment. He makes offline a business state and hands it to the receiving flow: cannot measure temperature means manual temperature with evidence, not the system auto-filling a default. A default temperature makes an unqualified truck look qualified.
Split with backend: device connect, protocol, reconnect, and backfill are his. Whether receiving is allowed is still judged by the business service. He does not change stock in the gateway. The gateway only produces events: “this dock at this time was this temperature” or “at this time there was no reading.” No reading is also an event. It cannot be omitted.
Backfill is the easiest way to rewrite history wrong
After the network returns, the device will resend hours of data. If stored by server-arrival time, a morning reject will be rewritten by an afternoon temperature. The IoT engineer requires event time to use device collection time, and once a business document is closed it no longer accepts new temperature to change the conclusion. Backfill only appends audit. It does not reverse the case. A device whose clock drift exceeds the threshold alerts first and does not take part in judgment until time sync is done.
Device records must have an owner: which dock this probe belongs to, calibration due date, which probe is the substitute. A report from a device with no record goes only to isolation, not into production rules. Otherwise a test device from the next worksite will punch numbers into the live warehouse.
The incident of reusing the last truck’s temperature
At a cold-chain warehouse the probe went offline. The page still showed 2°C. That was cache from the last truck. The new truck was actually warmer, but the goods were unloaded. The IoT engineer cancelled cache display. Offline, the API returns no reading. The receiving service refuses automatic sign-off. After recovery, backfill writes into the truck log. The unloaded truck goes through variance. It does not use the new temperature to pretend it was qualified then. After that, if heartbeat has no update for more than two minutes, the dock screen shows offline, not a frozen number.
At implementation he does a pull-the-cable drill with the warehouse clerk. If the drill fails, the device is not considered connected. When the same dock swaps probes, he requires a handoff record of old and new IDs. Historical temperatures stay on the device of that time. Writing the new probe’s numbers onto the old curve without a handoff makes an incident review think temperature was always normal. The curve can continue. The ID cannot be swapped in secret. During maintenance there must be a clear out-of-service state. Readings while out of service do not enter the rules. Before re-enable after maintenance, check clock, heartbeat, and location ownership. All three must be in place before temperature again takes part in receiving.
He alerts two weeks before a probe’s calibration is due. On the due day it leaves automatic judgment and switches to manual temperature. Using an expired probe with no alert still produces a stable reading. A stable wrong number is harder to find than offline. Offline at least leaves the page empty. Expired still gives a temperature that looks proper.
Temperature-zone rules are written into the plan by the industry consultant. This role does not change that industry word. The gateway only produces “this dock at this time was this temperature” or “at this time there was no reading.” No reading is also an event. The device record states owner, calibration due date, and substitute probe. A report with no record goes only to isolation. A test device from the next worksite cannot punch numbers into the live warehouse. If the pull-the-cable drill fails, the device is not considered connected. The industry consultant proves temperature zones cannot be copied. The IoT engineer proves offline cannot pretend qualified.