Recovering without help.
WHAT ERRORS OCCUR
Sensor read failures Communication failures Storage errors Unexpected values Software faults
WHAT THE PRINCIPLE IS
Continue if possible, restart if not, and never stop.
WHY
A halted device is indistinguishable from a broken one and requires a visit.
WHAT ESCALATING RECOVERY LOOKS LIKE
Retry the operation Reinitialise the subsystem Restart the device Enter a minimal safe mode
WHAT MINIMAL SAFE MODE SHOULD DO
Maintain the safe physical state, and attempt to report.
WHY REPORTING MATTERS MOST
A device that fails silently cannot be helped.
WHAT TO COUNT
Errors, by type, reported with telemetry.
WHAT RISING COUNTS INDICATE
Degradation before outright failure.
WHAT TO AVOID
Infinite retry loops consuming power Restarting in a loop, which drains batteries rapidly Errors that are logged and never reported
WHAT TO IMPLEMENT FOR REPEATED RESTARTS
Increasing delays, and eventually a reduced-function mode.
WHY
A device restarting continuously exhausts its battery within hours.
WHAT TO NEVER DO
Depend on a person noticing.
WHAT TO TEST
Every failure path, by inducing the failure.
