|
INSTRUMENT NODES open roster, each standalone |
CONTRACT ENDPOINTS every node speaks them |
BUS & PROTOCOL STANDARDS spoken natively, not wrapped |
TIMESTAMP DOMAIN every source, one timeline |
SILENT FAILURES a dropped record raises |
Every node is a complete instrument. The control plane must never become a dependency.
Take any node to a bench with nothing but a laptop — radio, vehicle bus, identity reader, industrial line, camera, direction-finding array, mixed-signal rig — and it still captures, timestamps and hashes its own evidence. Add the control plane and those independent instruments become one correlated system. Remove it and nothing stops working.
That single rule is why the roster is open-ended rather than fixed. Eight nodes exist today and the list is not closed — adding the next one never forces a redesign of the ones already built. It is also what makes the whole ecosystem agent-addressable — an expert layer can discover capabilities, request captures and correlate across domains it was never specifically taught, because every node answers the same five endpoints.
| Node | Domain | What it speaks |
|---|---|---|
| A | Radio & wireless | Wi-Fi, BLE, 802.15.4, Thread, sub-GHz, LoRaWAN, wideband SDR |
| B | Identity & secure element | NFC, LF/HF RFID, ISO 14443, ISO 7816, POS, debug interfaces |
| C | Vehicle networks · flagship | isolated CAN-FD ×8–16, LIN, K-Line, Automotive Ethernet, FlexRay, UDS |
| D | Control & evidence plane | registry, time authority, authorisation, segmentation, health — the optional one |
| E | Vision & physical | IP, PoE, ONVIF, RTSP, MIPI CSI-2, GMSL, edge inference |
| F | Industrial & OT | RS-485, Modbus RTU/TCP, OPC-UA, PROFINET, MQTT, Sparkplug B |
| G | Coherent RF & direction finding | multi-channel coherent SDR, array sensing, bearing estimation |
| H | Hardware & mixed-signal | 24-bit simultaneous ADC, FPGA timing, side-channel, power characterisation |
Energy and charging, automation pipelines and the mobile layer are not separate islands either — they attach to the same contract and land on the same timeline. Each gets its own section below. None of them is the platform; all of them are nodes on it.
The board above lights each node in turn on a 24-second cycle, and repaints itself for your system light or dark theme. If your OS asks for reduced motion it renders static and fully lit instead. Each node then gets its own instrument face and full write-up below, A through H.
Wi-Fi, BLE, 802.15.4, Thread, sub-GHz and LoRaWAN, plus wideband SDR capture — measured against the environment the product actually ships into, not the bench it was designed on.
|
A link budget that closes on a desk meets forty competing radios, a metal rack, a closing door and a human body that moves. Every wireless failure I have chased in the field came from that gap, not from the protocol. |
Signal strength alone says nothing about whether packets arrive. Retry rate, packet error rate and link quality get recorded together, because a strong signal with 30% retries is a broken link that looks healthy. |
Duty cycle and radiated power are bounded against the regional limit before a schematic exists. A certified module does not make the product certified — the enclosure and antenna are part of the system under test. |
What a spectrum capture is actually for
Not for a screenshot. The capture exists to answer one of three questions:
| is the band usable | occupancy and noise floor over time, not a single sweep on a quiet Sunday |
| who else is here | separating Wi-Fi from non-Wi-Fi emitters — the microwave, the lighting ballast, the neighbouring plant |
| is it us | adjacent-channel leakage and spurious emissions from our own hardware, which is the answer more often than anyone expects |
Max-hold over minutes beats peak-detect over milliseconds, because interference is usually intermittent and the intermittent case is the one that ships and then fails.
NFC, LF/HF RFID, ISO 14443, ISO 7816 contact cards, POS and debug interfaces — captured as protocol shape and timing, never as content.
|
Credential material does not enter a repository, a log, or a capture. The fields that would carry a secret are not collected at all — enforced at the capture layer, because discipline alone loses to a debug build that was never meant to ship. |
Frame waiting time, response latency and WTX requests tell you what is wrong with an interface without ever needing the payload. A card that answers late under load is a different fault from one that answers wrongly. |
Secure boot, signed OTA with an exercised rollback path, a locked debug port and keys in a secure element are established on the production line. Adding them after the first field incident means re-touching every unit already shipped. |
The rollback path nobody exercises
Almost every connected product has A/B slots. Far fewer have actually pulled power midway through a write, deliberately corrupted the image, and confirmed the unit still boots the old slot and reports why.
Until that test has been run on real hardware, A/B is a diagram rather than a recovery mechanism — and the first time it matters is the worst possible time to discover the difference.
CAN and CAN-FD, LIN, K-Line, Automotive Ethernet, UDS and OBD-II — captured with hardware timestamps, decoded, and correlated against the analog reality on the wire.
|
Slow precision analog and high-speed physical-layer capture are different subsystems. A 24-bit simultaneous ADC is right for supply rails and CANH/CANL behaviour — and useless for nanosecond edge ringing. Conflating them is how a spec sheet becomes fiction. |
An FPGA in the block diagram is not evidence of nanosecond accuracy. Latency and jitter get characterised on the bench against a disciplined reference before either number appears in a document. |
Capture → Source → EvidenceLink, hash-tracked on one timebase. An RF observation, a bus frame, a camera event and an analog measurement land on the same timeline — which is what makes cross-domain reasoning defensible instead of suggestive. |
How the transmit-permission chain actually works
Anything that can reach a live bus defaults to receive-only. Transmit requires every condition to agree, and the chain is per channel — never one shared gate, because a shared gate turns a single fault into a multi-bus event.
service permission ──┐
│
supervisor healthy ──┼──> AND ──> TX ENABLED (this channel only)
│
FPGA permission ────┤
│
MCU request ──────┘
any input false ────────> fail silent, receive-only
Failure modes this is built against: a supervisor brown-out mid-transaction, firmware asserting a request the hardware never authorised, and one channel's fault propagating into the other fifteen. The last one is why the gate is replicated rather than shared — it costs more silicon and it is not negotiable.
What a capture carries before it is allowed on the timeline
| timestamp | from the disciplined domain, not the host OS clock |
| source | which physical interface, on which node, in which mode |
| node identity | so a federated timeline can be pulled apart again |
| content hash | SHA-256 over the raw bytes, before any normalisation |
| uncertainty | the honest error bar — absent uncertainty is a red flag, not a clean result |
Raw is preserved and never overwritten by a derived view. If a later analysis disagrees with an earlier one, both remain re-derivable from the same stored bytes — which is the difference between an evidence trail and a log file.
Registry, time authority, authorisation, segmentation and health. The only optional node on the board, and the design decision the rest of the platform is built around.
|
Capture continues. Timestamping continues, from the local disciplined source. Hashing continues. Evidence stays valid. The single thing lost is cross-domain correlation — which is exactly what this node is for and all it is for. |
A node that left the rack is not a system fault. It is a node in SILO mode whose evidence will merge on return. Collapsing those two things into one alarm is how a platform teaches its operators to ignore alarms. |
One clock, one schema, one storage path, thinner nodes, cheaper per unit — and a plane that becomes the single point of failure, with every new node forced to negotiate against a central design. |
The deciding case is the ordinary one
One engineer, one box, one customer site.
If that requires the whole rack, the platform has failed at the exact moment it matters most. Everything else about the architecture — the uniform contract, the per-node evidence chain, the local time source — exists so that sentence stays true.
It also makes the roster open-ended. A ninth node negotiates with a five-endpoint contract, not with a central schema and its owners.
MIPI CSI-2, GMSL, IP, PoE, ONVIF and RTSP with edge inference — and a hardware-synced trigger, which is what separates evidence from footage.
|
A dropped frame nobody logged as dropped is worse than a hole in the record: it makes the timeline look complete when it is not. Drops and late frames are first-class entries, not silent omissions. |
Not inherited from whatever the pipeline happens to do under load. Under pressure a system must degrade the way you chose, not the way the buffer chose. |
A camera event 0.4 ms from a bus frame and an RF burst, on one timebase, is a correlated observation. The same three on three host clocks are three recordings that happened the same afternoon. |
Why this node exists at all
A camera on its own is a well-solved problem and I would not build one. This node exists because a visual event is frequently the only human-legible anchor in an otherwise abstract timeline.
When a bus error, an RF burst and a physical movement land within a millisecond of each other, the video is what lets a person confirm the machine was right — and what lets them catch it when the machine was wrong.
Modbus RTU/TCP, OPC-UA, PROFINET, MQTT and Sparkplug B over isolated RS-485, 4–20 mA and 24 V I/O — with the physical layer of a factory taken seriously.
|
Half the real work is recovering what a tag represents on the floor, and that knowledge usually lives in a person rather than the PLC project file. An unmapped register is recorded as unmapped, never guessed into a unit. |
Store-and-forward with hours of local buffer, a watchdog and a safe restart. The line does not stop because the network did, and an edge gateway that wedges silently is worse than one that crashes loudly. |
Scaling factors get revised when someone finally finds the right document. If only the scaled value was stored, every historical number is now wrong and unrecoverable. |
How a dashboard ends up confidently wrong
The failure is almost never a broken connection — those are loud and get fixed. It is a register read correctly, scaled with an assumed factor, labelled with a plausible name, and plotted on a chart that nobody questions for eleven months.
| guessed scaling | a raw 7412 becomes 74.12°C or 7412 rpm depending on an assumption nobody wrote down |
| counter wrap | a 16-bit production counter wraps at 65535 and the daily total silently goes negative once a week |
| state enums | vendor-specific and undocumented; "3" means RUN on this drive and FAULT on the identical one next to it |
All three are prevented the same way: record the raw value, record the transformation separately, and mark anything unconfirmed as unconfirmed.
Multi-channel coherent SDR, array sensing and bearing estimation — with a shared clock, a calibrated phase reference, and an export-control classification asked before the schematic.
|
Channels either share a clock and a calibrated phase reference or they do not. If they do not, the bearing the algorithm produces is decoration, and the error bar beside it is decoration too. |
Cramér–Rao says ±2.1°; the array achieves ±3.2°. Publishing both is the point. A bearing without an error bar is not a measurement, and a gap that is hidden becomes a surprise in the field. |
Phase residual drifts with enclosure temperature. That is tracked and recalibration is scheduled rather than discovered — a DF system that was accurate at commissioning tells you nothing about today. |
Export control comes before the bill of materials
Dual-use RF, spectrum monitoring and direction-finding capability fall under EU Regulation 2021/821, administered in Germany by BAFA.
The classification decides whether a unit can legally cross a border, be demonstrated abroad, or be contributed to a multi-country consortium. It turns on what the hardware is capable of — channel count, bandwidth, coherence — not on how it is marketed or what it is intended for.
That means it constrains the BOM. Discovering it after Rev B costs a respin and a lead time, which is why it is the first question on this node rather than the last.
Synchronised precision acquisition: a 24-bit simultaneous-sampling converter and a high-speed capture path, sharing one FPGA timebase and one trigger — two subsystems, deliberately not one.
|
A 24-bit sigma-delta is right for supply rails, load steps and power characterisation, and useless for nanosecond edge ringing. Quoting one instrument number for the other job is the most common way a datasheet stops being true. |
Achieved noise floor −118 dBFS against a −124 dBFS claim. Six decibels, stated rather than rounded away. A specification without a measured counterpart is a marketing number. |
Both paths fire together. That is what allows a rail transient and a bus error to be placed on the same timeline and reasoned about as one event instead of two coincidences. |
An FPGA in a block diagram is not evidence
It is common to see nanosecond accuracy claimed on the strength of an FPGA appearing somewhere in the architecture. The FPGA makes the accuracy possible; it does not demonstrate it.
What demonstrates it: latency and jitter characterised on the bench against a disciplined reference, across temperature, with the numbers recorded before they appear in any document. Until that has been done, the correct value to publish is "not characterised" — which is a far better answer than a number that turns out to be wrong in front of a customer.
ERP and MES, machine telemetry over Modbus and OPC-UA, documents, mailboxes, third-party APIs — pulled into one pipeline that produces validated, typed, traceable records. The retry path, the dead-letter route, the human-review queue and resume-after-crash are part of the design, not patches added after the first bad run.
Why the happy path is the least interesting part of an automation
|
Failure modes that actually occur
|
What that forces into the design
|
The measurable outcome is deliberately boring: same input, same output, byte-equal, on a rerun six months later — and every number in the final report traceable back to the exact bytes it came from.
Extraction order: rules first, model second
| 1 · layout match | known sender, known template — deterministic, free, and correct |
| 2 · grammar & regex | structured fields with a defined shape: dates, references, totals, units |
| 3 · model pass | only for what survives the first two — the genuinely unstructured residue |
| 4 · confidence | scored per field, not per document, with the source span retained |
Running the model first is faster to build and worse in every other way: it costs more per document, it is non-deterministic on reruns, and it removes the ability to say why a value is what it is. A field that a rule can decide should never be decided by a guess.
OCPP 1.6J and 2.0.1, OCPI roaming, ISO 15118 Plug & Charge, IEC 61851 pilot signalling, MID metering, and smart-charging profiles under a real site limit. Charge-point firmware on one side, the backend and settlement data on the other.
The three things that quietly break charging deployments
|
Energy that isn't measured A session billed from a value the controller calculated rather than a register the meter reported is a dispute waiting to happen. Where regulation requires a signed value, an inferred one is not a shortcut — it is a defect. |
Load management as a target The main fuse is a hard constraint, not a setpoint to aim at. Allocation has to be recomputed on every meter sample, and a connector that cannot get headroom must queue visibly rather than silently under-deliver. |
Interop assumed, not tested Two implementations both "2.0.1 compliant" still disagree on transaction identity, offline behaviour and reconnection. That gets discovered on a live site unless it is exercised against a real counterparty first. |
Offline behaviour deserves its own line: the backend link will drop. What the charge point does during that window — keep charging, queue transaction events, and reconcile afterwards without duplicating or losing a session — is the difference between a product and a demo.
Multi-omics ingestion, pathway and flux modelling, target ranking, and dose–response characterisation — built on the same discipline as everything above: versioned raw data, a pinned environment, pre-specified analysis, and negative results kept beside positive ones.
Where quantitative biology goes wrong, and what stops it
|
The recurring failures
|
What the pipeline enforces
|
Attrition is the honest headline: the great majority of programmes that clear target identification never reach a candidate molecule. So the value of the work sits in killing the wrong hypothesis cheaply and early — not in defending it late.
Flutter and React Native where cross-platform is right; Kotlin and Swift when background BLE has to survive the OS, or when MTU and throughput tuning decide whether the product works at all. The instrument is half a product — the other half is what someone holds, and that half is usually where connected hardware actually fails.
The four app-side failures that break connected hardware in the field
|
Provisioning Works perfectly on the developer's desk with one device and clean RF. Fails in a room with forty devices, a bad advertising interval, and a user who backgrounds the app halfway through pairing. |
OTA rollback Almost every product has A/B slots. Far fewer have exercised the rollback path — pulled power mid-write, corrupted the image deliberately, confirmed the unit still boots the old slot. |
Pairing recovery Interruption is the normal case, not the exception. Lift, walk out of range, take a call. State that can't resume from a partial handshake produces a device that must be factory-reset. |
Fleet truth A device offline for a week is not "healthy" and not "failed" — it is unknown. Dashboards that collapse those three states into two are the reason nobody trusts the dashboard. |
Isolation and power-tree get reviewed before anything is energised. ERC and DRC are enforced, diffs stay deterministic, and manufacturing output requires a human decision — a bench instrument that can reach a vehicle network is not a place for silent automation.
Every gate has an exit criterion. A mistake caught at schematic costs an afternoon; the same mistake caught at pilot costs a tooling run and a lead time.
Two things that get planned late and hurt
|
Export control Dual-use RF, spectrum monitoring and direction-finding hardware fall under EU Regulation 2021/821, administered in Germany by BAFA. This decides whether a unit can legally cross a border, be demonstrated abroad, or be contributed to a multi-country consortium. It is a classification question first — what the hardware is capable of, not what it is marketed as — and the answer shapes the BOM. Discovering it after Rev B is expensive. |
Bench instrument ≠ fielded unit A receive-only bench box and a unit deployed in a contested or industrial environment are different products. The step between them is ruggedisation, EMC qualification, environmental and vibration testing, sealing, thermal derating and a supply chain that survives a multi-year build. The gap is routinely underestimated because the schematic barely changes. The cost and calendar do. |
This is a different cut from the node roster above. The roster lists instruments; this lists the engineering domains I deliver in, which is why energy, automation and the mobile layer appear here and the control plane does not.
What "filled / amber / outline" honestly means here
| filled | I design it, debug it at the signal or wire level, and ship it. If it breaks at 2 a.m., I can find out why without help. |
| amber | I work in it productively and have delivered in it, but I would pull in a specialist for the extreme end — a certification-grade RF layout, a safety-rated PLC program. |
| outline | Adjacent. I read it, review it, and integrate against it — I do not claim to originate it. |
An honest matrix has outline cells in it. A profile where every cell is filled is a profile that has not been checked against reality.
|
Reproduce before fixing A failure I can't trigger on demand isn't diagnosed — it's a guess with a stack trace attached. Most "flaky" hardware is perfectly deterministic once the right variable is under control. |
Fail silent by default Receive-only unless every condition in the transmit chain agrees. Per channel. Never a shared gate. |
|
Smallest change that solves it No rewrite sold as a fix. The change should be small enough that a reviewer can hold the whole thing in their head. |
Evidence over claims Timestamps, traces, exact firmware revisions, measured before and after. If a conclusion can't be re-derived from stored artefacts by someone else, it isn't finished. |