Divide the path into observable states
A missing vehicle marker might mean power loss, device crash, antenna fault, coverage loss, authentication rejection, ingestion lag, processing error, or display filtering. Give each boundary a health signal and last-success timestamp.
Avoid one generic online flag. A device can be connected while its position, clock, or sensor data is invalid.
- Device heartbeat
- Last valid observation
- Upload queue depth
- Ingestion rejection reason
Choose safe degradation
Define what operators and riders see when freshness thresholds are crossed. Suppress unsafe automation, retain the last known value only with its age, and preserve a manual communication route.
Recovery includes reconciling buffered data and clearing false alerts. The first new message does not prove the backlog is consistent.
Inject a failure at each boundary and confirm monitoring identifies the correct layer without relying on the end-user report.