Safety and evidence in Diyar
Cogitave Diyar drives real industrial heat-treatment equipment without depending on a network connection, and this module explains the three mechanisms that let it do so safely and provably. First, a layered, hardware-first fail-safe design where every failure path — a wedged CPU, a blind sensor, a power cut, a lost serial cable — falls back to the heater being off, never the reverse. Second, a request model where the cloud and any remote client can only ask the edge to start a run; the edge alone verifies and can refuse, and there is no primitive anywhere in the system that lets a remote party force actuation. Third, an evidence pipeline that journals every reading locally before it is ever published, chains it so tampering becomes detectable, layers a Merkle history tree on top so completeness can be proven without shipping an entire run's history, and lets the cloud independently reconcile what it received rather than trusting the edge's word. Throughout, the module states plainly which parts of this are built and verified today versus named, not-yet-shipped follow-ups.
By the end of this module, you will be able to:
- Explain the de-energize-to-trip rule and identify which of Diyar's four safety layers are hardware-mandatory versus software defense-in-depth.
- Describe why a comms-loss watchdog is required before any heat output can be driven over a field bus such as Modbus.
- Explain why a remote start from the cloud is a signed, vetoable request rather than a command, and what "config-class only" means for a device shadow's desired state.
- Trace how a reading becomes tamper-evident evidence: journal-before-publish, the SHA-256 hash chain, the per-session Merkle history tree, and cloud-side reconciliation.
- State, in each case, what Diyar has actually built and verified today versus what is a named, not-yet-shipped follow-up.
Prerequisites
- Comfort reading systems terminology (typestates, watchdogs, hash chains) at a conceptual level — no Rust code is required.
- Basic familiarity with industrial control concepts: relays, field buses such as Modbus, sensor and actuator channels.
- Completion of this path's introductory module on Cogitave Diyar's operating model is recommended but not required.
Units
- 01De-energize-to-trip: the safety model7 min
- 02Why the cloud can request but never actuate5 min
- 03Tamper-evident evidence and store-and-forward6 min
- 04Knowledge check5 min
- 05Summary3 min
Related
- How a device becomes a Diyar solution Diyar turns a physical device into a certified solution through layered signed documents and firmware-compiled registries, not through custom code written per customer. A signed device profile configures the edge's hardware at boot; a certified verdict engine - a frozen product engine or one of the generic function blocks - decides pass or fail; and a three-document app package computes, offline, exactly what a device is authorized to observe, operate, or actuate. The module walks each of these three layers as they exist in the Diyar edge platform today, closes with one worked solution (ISPM-15) built entirely on that machinery, and states plainly where a capability is proven only against internal example fixtures rather than a field deployment - because that distinction is part of what you need to evaluate the product honestly.
- Understand Cogitave Diyar Cogitave Diyar is the platform layer of the Cogitave cloud: multi-tenant management for distributed field devices that have to keep working, and keep proving what they did, even when the network is unavailable. This module introduces the problem Diyar solves (a regulated, unattended field process — starting with ISPM-15 wood-packaging heat treatment — that must run and produce trustworthy evidence with no network), the edge-autonomous model that solves it (the device is the sole authority over safety and evidence and runs fully offline), the platform/solution split that lets a new regulated process plug in as a certified verdict engine plus a signed device profile rather than a fork, and a tour of the architecture from the edge binary through the cloud/on-prem control plane to the client surfaces — including an honest account of what is still early (the kiosk and portal UIs) and what is still gated pending hardware validation.
- Glossary The terms used across Cogitave documentation and training, defined once - agent kernel, capability grant, provider driver, sandbox, sovereign unikernel, MCP, evidence, and the words that are easy to assume.