Design defense for review panels
Why it is built this way.
Every decision in SAAYA, the alternatives we rejected, what our own physics model says about them, what it costs, and how we would find out we are wrong.
Status. This is a software, firmware and CAD package with a transparent screening model. Nothing here has been built or measured yet. Every number below is either a cited source, a costed allowance, or a model prediction written so that a measurement can refute it.
The problem
Rest in the heat, with nowhere to go indoors.
India's outdoor workforce — construction, agriculture, delivery, street vending — cannot step into an air-conditioned room between shifts. The ILO projects that heat stress will cost India about 5.8 % of working hours by 2030, roughly 34 million full-time jobs (ILO 2019, as reported by Down To Earth). The 2025 Lancet Countdown estimates 247 billion potential labour hours lost in India in 2024 (Lancet Countdown 2025).
Vellore is a hard case. May's mean daily maximum is about 39 °C and the record is 45 °C, with afternoon humidity around 43–51 % in the hot months (IMD normals relayed by Wikipedia). That sits right at the edge of where a fan stops helping.
Policy is moving the same way. India's NDMA draft Guidelines for Cooling Centers (May 2025) call for temporary shaded structures for outdoor workers at work sites, with high-reflectance roofs, no bare GI sheet roofing, shaded or green unpaved ground and cross-ventilation (NDMA 2025). SAAYA is a testable, low-cost version of exactly that structure, plus a way to prove whether it works.
Versus normal cooling
Not a cooler. A shade with a conscience.
A normal cooling product is judged by how cold it gets a closed room. An outdoor rest spot has no walls to hold cold air, so that yardstick does not apply. SAAYA attacks the larger part of outdoor heat load — radiation from the sun, sky, roof and hot ground — and uses a small fan only where it helps. Its genuinely new part is not the shelter; it is a control and evidence layer that knows when a fan is not spinning, when a sensor is lying, and when a comparison is not valid.
| Room AC (1.5 t) | Evaporative cooler / mister | Pedestal fan in the open | SAAYA shelter | |
|---|---|---|---|---|
| Works in an open-sided space | No — needs walls | Partly; effect blows away | Yes | Yes, designed for it |
| What it attacks | Air temperature and humidity | Air temperature, by adding moisture | Sweat evaporation (air movement) | Radiant load first (sun, roof, ground), then air movement |
| Electrical input | ≈1.4–1.6 kW | Fan plus pump | ≈35 W (BLDC) to 55–125 W (AC motor) | Bench fan 0.32 W typical; full-size fan to be selected |
| Water | None (condensate) | Continuous; hygiene and cleaning | None | None for cooling |
| Weak in Vellore when | Grid outage | Humid monsoon months | Above ≈39–40 °C a fan can add heat | Low sun angles; needs ground and overhang design |
| If it fails | Silently warm | Silently wet or dry | Silently stops | Detects a stalled fan, a dead sensor or stale data and says so; help request survives reboot |
| Knows whether it worked | No | No | No | Only claims an effect after a predeclared, paired, replicated comparison |
Power figures: Blue Star 5-star 1.5 t inverter rated input 1395 W and Voltas 3-star 1615 W (spec, spec); Atomberg Efficio 400 mm BLDC 35 W (Atomberg); Usha 400 mm 55 W and Crompton Torpedo 125 W (retailer specs); Noctua NF-A4x10 PWM 0.32 W typical (Noctua). An open shelter is not equivalent to AC and is not marketed as such.
What the physics says
Shade does the heavy lifting.
We wrote a small steady-state model (api/thermal.py, 17 test cases) instead of quoting a temperature drop. It balances sun, sky, wind and grey-body radiation on each roof skin, then computes the mean radiant temperature (MRT) at a seated worker's head from the exact solid angle of the roof, sky and ground. MRT is what the body feels from surrounding surfaces; it is the quantity a shelter actually changes.
Loading model…
What this changed in the design
The roof is only a small part of what a seated person sees; sky and sunlit ground fill most of the rest. So once the sun is blocked, roof finish moves the seated radiant load by a couple of degrees, while overhang depth and what the ground around the shelter is made of move it by several. That reordered our priorities: deep overhang and ground treatment first, a cool roof lining second, and the second roof skin as an optional, removable experiment rather than a core cost.
One more surprise: we had specified a bare, low-emissivity metal lining. Once the model counted the hot sunlit ground the lining reflects, a painted (high-emissivity) lining came out marginally better. What matters is that the lining stays cool, not its finish — so the cheaper, more corrosion-resistant painted lining is acceptable.
Each design is reported at its less favourable seat: in mid-May the noon sun is north of the zenith at Vellore's latitude, so the shadow shifts south and the rear bench is the harder case.
Is the second roof skin worth its cost?
The upper skin keeps the lining within a few degrees of air temperature even as the white top coat soils, cutting the underside by about 8–22 K. But the seated radiant benefit is under 1 K in this geometry. It earns its place where people sit close to the roof, under a larger roof, or touch it — not on a 2.4 m bench shelter.
Deep verandah, in numbers
The ground around the shelter
Light paving lowers ground temperature but reflects sunlight back up at the person, so in the model it raises seated MRT by about 5 K. Irrigated ground cover lowers it by about 4 K. This is a known urban-climate result, and it is why the site plan, not just the roof, is part of the design.
How sensitive are these conclusions?
How the model can be proven wrong
Each prediction carries a declared tolerance band: the range it spans when uncertain inputs (irradiance, wind, diffuse fraction, ground temperature, lining emissivity) take their plausible extremes. The roof-underside bands for SAAYA and a weathered shed do not overlap, so a ₹49 probe can tell the two designs apart. The globe bands overlap: the globe tests the model's absolute level, not the design difference.
Model assumptions: thin metal skins in steady state; convection-only wind coefficient h = 2.8 + 3.0v (Watmuff 1977), with radiation explicit; Swinbank clear sky (optimistic — a hazy sky is warmer); ventilated-gap air at ambient (optimistic); isotropic diffuse sky; noon sun from latitude and date; roof underside sees shaded and sunlit ground by view factor; person absorptance 0.7 (VDI 3787 convention), black globe 0.95; ASHRAE/ISO 7726 forced-convection globe relation, which is biased below about 1 m/s air speed. Operative temperature is indicative only at these radiant levels. The model was reviewed adversarially before release; the corrections are listed under “Flaws fixed”.
When a fan helps
A fan can make things worse.
A fan cools by evaporating sweat. When the air is hotter than skin and very dry, it can also blow heat onto the body faster than evaporation removes it. The evidence:
- In 8 young men at 42 °C, a fan still helped, but only up to a critical humidity — heart rate started rising at 47 % RH with a fan versus 38 % without (Ravanelli et al., JAMA 2015).
- In 9 adults aged about 68 at 42 °C, the fan gave no benefit; heart rate and core temperature were slightly higher with it (Gagnon et al., JAMA 2016).
- In a very hot, dry condition the fan made every measured outcome worse; in a hot, humid one it helped (Morris et al., Annals of Internal Medicine 2019).
- A biophysical model proposes fan-use ceilings of 39 °C for young healthy adults, 38 °C over 65, and 37 °C for older adults on anticholinergic medicines, and advises against routine fan-only advice in northern India (Morris et al., Lancet Planetary Health 2021).
- WHO's current fact sheet says to use fans only below 40 °C (WHO).
What SAAYA does with that
The firmware now screens fan benefit by air temperature: below 37 °C the fan is expected to help; from 37 °C the display says the benefit is limited for older or medicated people; from 39 °C automatic mode stops and the display reads “Hot: fan may add heat”, restarting only below 38.5 °C. Manual mode is never blocked — the worker decides, the shelter informs. The rule is identical in C++, Python and the browser, and tested in all three. It is a conservative screen built on the strictest published ceilings, not a clinical rule; humidity-dependent limits need the full Morris 2021 tables, which we have not yet extracted.
This is the clearest difference from a normal fan controller, which is a thermostat: it switches on harder as it gets hotter, which is exactly backwards above about 39 °C.
Architecture decisions
What we chose, and what we did not.
Each decision lists the alternatives considered, why they lost, and the evidence that would make us change our mind. Open any row.
Cooling strategyPassive first: deep shade and a reflective, low-emissivity roof; a small fan only as an add-on
- Alternatives considered
- Room AC; desert (evaporative) cooler; misting fan; a plain pedestal fan with no shade
- Why this won
- Outdoors there is no enclosure to hold conditioned air, so AC power is mostly wasted and needs mains and refrigerant service. Evaporative and misting systems add humidity, need water and cleaning, and lose effect in Vellore's humid monsoon months. Our model shows shade alone removes about 16 K of seated radiant load before any machine runs.
- What would change our mind
- If paired measurements show the fan in comparable shade gives the same globe temperature and air speed at the seat, the shelter structure is not justified and a shade retrofit wins.
RoofWhite reflective top, ventilated gap, cool painted lining underneath; second skin removable
- Alternatives considered
- Single painted sheet; insulated sandwich panel; green roof; concrete slab
- Why this won
- A cool lining is what a seated person feels; once the lining runs near air temperature its finish barely matters, so a painted lining (better against corrosion) is acceptable. Sandwich panels cost more and trap heat at night; concrete stores heat and needs foundations; green roofs need water and structure. The model says the second skin buys under 1 K at the seat in FS-01 geometry (while cutting the lining 8–22 K), so it is kept as a removable experiment, not a core cost.
- What would change our mind
- Underside probe more than the declared margin away from the predicted value on three clear days; or a cheaper single sheet matches the double roof's globe temperature.
ControllerESP32 (classic WROOM) running local control
- Alternatives considered
- Arduino Uno/Nano; Raspberry Pi; STM32; a commercial PLC
- Why this won
- About ₹425, enough RAM for JSON telemetry, hardware PWM (LEDC), interrupt-capable tach input, non-volatile storage for the help latch and a hardware watchdog. A Uno lacks memory and connectivity; a Pi boots an OS from an SD card that corrupts on power loss and draws far more power; a PLC is over-specified for a rest shelter. Control stays on the microcontroller so a network or laptop failure never stops the fan or clears a help request.
- What would change our mind
- If outdoor qualification needs industrial temperature range or isolated I/O, move to an industrial module with the same control logic (the logic is a pure header file with native tests).
Air sensorsTwo SHT31 (inside / reference), I²C, fixed addresses 0x44 and 0x45
- Alternatives considered
- DHT22; BME280; analog thermistors
- Why this won
- SHT31 is digital, fast and specified at typically ±0.2 °C and ±2 % RH; DHT22 has slower timing-critical single-wire reads and weaker humidity stability; BME280 self-heats more and is tuned for pressure. Two identical sensors make the paired comparison fair: swap them between rigs to measure their bias.
- What would change our mind
- Co-location test shows offsets drifting beyond the margin; then add a reference instrument or replace.
Roof and fan feedbackDS18B20 contact probe on the roof underside; fan tachometer read by interrupt
- Alternatives considered
- IR thermometer; no fan feedback (open loop); current-sense only
- Why this won
- A tach confirms the fan is actually turning, which is the difference between commanding cooling and delivering it. Current alone cannot tell a stalled rotor from a slow one. DS18B20 is waterproof, cheap and works on long cables. An IR sensor needs emissivity correction on a low-e surface — exactly the surface we chose.
- What would change our mind
- If tach readings disagree with an optical tachometer, the pulses-per-revolution assumption is wrong and is corrected in firmware.
Energy accountingINA219 on the fan branch, integrated only over valid, gap-free intervals
- Alternatives considered
- Estimate from datasheet watts; smart plug
- Why this won
- A datasheet maximum (0.48 W for the bench fan) is not consumption. Gaps are reported, never interpolated, so a missing meter cannot look like zero energy.
- What would change our mind
- Reference meter disagrees with INA219 by more than its stated accuracy.
Fan drive4-wire 12 V PWM fan, PWM via an NPN open-collector stage; fails to full speed
- Alternatives considered
- Switching a 2-wire fan with a MOSFET; mains pedestal fan with a relay
- Why this won
- The fan has its own motor driver, so the ESP32 only sends a signal. Under the Intel 4-wire fan convention a fan with a floating PWM line runs at full speed, and the stage's base pull-down floats the line if the ESP32 dies — the failure mode is more airflow, not less. A relay-switched mains fan brings shock risk into a wet outdoor space.
- What would change our mind
- Measured behaviour of the chosen fan at 0 % and floating PWM differs; then add an explicit isolation path.
Help buttonLatching request stored in flash; cleared only by a separate acknowledge button
- Alternatives considered
- Momentary button; app or phone alert only
- Why this won
- Workers may not carry phones; a request must survive reboots, sensor faults and network loss. It is independent of every threshold — no algorithm can cancel it.
- What would change our mind
- Field usability testing shows the controls are misunderstood; then redesign wording and pictograms.
Data pathUSB serial → local bridge → loopback FastAPI → SQLite (WAL)
- Alternatives considered
- MQTT broker; cloud IoT platform; InfluxDB/Grafana
- Why this won
- Zero recurring cost, no internet dependency, no credentials on the public site, and no worker data leaving the laptop. SQLite is a single ACID file that runs anywhere; WAL lets the bridge write while the dashboard reads. Pydantic rejects NaN, infinity and out-of-range values at the door. A cloud path is a later stage, not a prerequisite.
- What would change our mind
- More than one shelter or remote monitoring is required; then add MQTT behind the same schema.
AnalysisDeterministic evaluator; optional local AI that can only explain finished records
- Alternatives considered
- Cloud LLM in the control loop; ML anomaly detection
- Why this won
- Rules that invalidate a comparison must be auditable and identical every time. An LLM may help a reader understand a record, but it has no actuator, cannot change evidence and runs locally so records never leave the machine.
- What would change our mind
- Never for control. For explanation, if users find it misleading in testing, remove it.
Interface and hostingBuildless ES modules and three.js; static hosting on Vercel and GitHub Pages
- Alternatives considered
- React/Next.js app; a server-rendered dashboard
- Why this won
- Fewer dependencies, works offline, free to host and impossible to attack through a server because there is none. The public site replays tested synthetic records and can neither ingest data nor control a device.
- What would change our mind
- If many shelters share live dashboards, add an authenticated backend.
CADCode-CAD (CadQuery and Manifold), checked in CI for invalid solids and interference
- Alternatives considered
- SolidWorks/Fusion files only
- Why this won
- Every dimension is in version control, reviewable as a diff, rebuilt by CI, and exported to STEP, STL, DXF and drawings. Reviewers can change a parameter and regenerate.
- What would change our mind
- A fabricator needs native files; export STEP (already produced).
The evidence engine
No claim without a valid comparison.
A cooling product usually reports a number. SAAYA reports a number only when it can defend it, and says why when it cannot. The rules are fixed before any data arrive:
- Predeclaration. The endpoint, which direction counts as better, and the smallest meaningful difference are locked into the record before the first sample. Changing them afterwards is impossible through the API. This is the same idea as preregistering a clinical trial: it stops us choosing the analysis after seeing the result.
- A simultaneous reference. Every intervention reading is paired with a matched reference reading taken at the same second. Weather changes affect both.
- Invalidation, not silence. Mixed sources, stale data, a fan that was commanded but did not spin, a mismatched reference or a gap in the record each produce an explicit “invalid” with the reason.
- One run is never a result. A single run reports only whether its point estimate lies beyond the margin, in either direction, or within it. The margin is declared in advance and set above what the instruments could produce on their own: two probes rated ±0.5 °C could disagree by up to about 1 °C before the co-location swap removes their fixed offset, so we declared 1.0 °C.
- No false precision. Sixty readings one second apart are not sixty experiments. The record reports the lag-1 autocorrelation and the effective sample size to show why no within-run confidence interval is given.
- Replication across days. Uncertainty comes only from independent runs, and runs on the same afternoon share weather, so the system requires at least three runs on three distinct days. It computes a two-sided 95 % Student-t interval of the run means (stricter than the 90 % interval of a standard equivalence test) and claims a direction only if the whole interval clears the margin, or “no meaningful difference” only if the whole interval sits inside it. Invalid runs are reported, never dropped.
Loading…
Try it in the evidence lab: pick “Fan feedback failure” and watch the comparison get withheld.
Cost and how to cut it
Spend where the physics pays.
Bench prototype: from ₹10,409 to about ₹4,661
Two premium parts make up most of the current bench cost: two Adafruit SHT31 carriers (₹3,066) and an imported Noctua fan (₹3,130). A costed budget profile in research/costs.json replaces them with GY-SHT30 modules (₹179 each) and a generic 4-wire PWM fan with a tachometer, and uses a ₹49 DS18B20 probe (Probots). That brings the bench to about ₹4,661 — close to the original ₹2,150–4,200 dossier estimate — without giving up anything the evidence chain needs.
What we refuse to cut: the tachometer (cheap Indian 40 mm fans are 2-wire with no feedback, which would blind the fault detection), the second matched sensor for the paired reference, and calibration time. Removing those would make the system cheaper and unable to tell the truth.
Full-size shelter: spend where the model says it pays
- Make the upper roof skin optional. The model gives it 0.3–0.8 K at the seat. It is roughly half of the ₹9,000–16,000 roof-materials allowance.
- Treat the ground before buying more roof. Irrigated ground cover lowers seated MRT by about 4 K versus dry ground at no structural cost; 0.3 m more overhang on every side buys about 1.4 K but grows the roof by about half. Light paving makes it about 5 K worse.
- Paint the lining. A painted lining performs as well as bare low-emissivity metal at the seat and resists corrosion better.
- Retrofit existing shade first. Foundations and structural steel are the largest lines. Where a sound structure already exists, re-roofing its underside and adding the controller is the cheapest option and is the comparison we plan to run.
- Bolt repeated sections. The frame uses repeated tube sizes and flat plates so cutting, drilling and jig costs fall with quantity.
Running cost
A 1.5-ton AC at about 1.4–1.6 kW uses roughly 11–13 kWh in an 8-hour shift. A 35 W BLDC fan uses about 0.3 kWh. The bench fan uses a few watt-hours. The shelter's real running costs are cleaning, repainting the reflective top and replacing fans and sensors; the annual maintenance allowance is ₹1,500–3,500.
Flaws fixed in this review
We audited our own system first.
- Database connections leaked on every request. Python's SQLite context manager commits but never closes; the old API produced 27 unclosed-connection warnings in one test file. Connections now always close, the database runs in WAL mode so the bridge can write while the dashboard reads, and indexes cover the hot queries. A regression test fails on the old code.
- The evaluator could only say “observed” or “invalid”. The specification required a predeclared beneficial direction and a “no clear difference” outcome. Both now exist, with the margin locked into the record at declaration.
- Uncertainty could never be established. There was no method to combine runs. Cross-run aggregation with a t-interval and an equivalence-style decision now exists in the API and the offline physical evaluator.
- A device could inject simulated rows. The authenticated device endpoint accepted
SIMULATEDrecords, letting a token holder write into the simulation namespace. It now accepts measured records only. - Several measured fields were unbounded. Roof, outdoor and reference temperatures, air speed, power and RPM now carry the physical ranges of the sensors that produce them, so a corrupted serial frame cannot store 9 000 °C.
- The automatic fan threshold had no hysteresis. A single 32 °C threshold makes a fan chatter on and off around the set point. Firmware, the Python mirror and the browser projection now share an on-at-32 / off-below-31 °C band, with tests in C++, Python and JavaScript.
- Two cost figures contradicted each other. The research review still quoted a superseded ₹30,500–52,500 full-size range while the costed model gives ₹94,134–170,771. The text is corrected and the old figure is marked superseded.
- Automatic mode ignored when a fan stops helping. It would run a fan at any temperature above 32 °C, including above the 39–40 °C ceilings where published studies show a fan can add heat. Automatic mode now stops there and the display warns; manual control is never blocked.
- Design priorities were asserted, not derived. The ventilated double roof was presented as core. The new screening model shows shade and overhang dominate the seated radiant load in this geometry, which changed the cost priorities above.
- Our own first model had eight errors, found by an adversarial review. The globe prediction used a person's absorptance instead of a black globe's (biased 2.5–6.6 K low); the roof lining was assumed to see only shaded ground (which flattered the low-emissivity lining); the wind coefficient double-counted radiation; the May sun was placed south instead of north of the zenith; the headline double-counted shade and roof; falsification had no tolerance; a single run was labelled a “difference”; and same-afternoon runs could pass as independent days. All eight are fixed and each has a test. Every figure on this page comes from the corrected model.
Panel questions
Questions we expect, answered straight.
Isn't this just a fan under a roof?
The structure, yes, and we say so: shade, reflective roofs and fans are prior art. Two things are different. First, the design is driven by a radiant-heat model that changed our priorities (overhang and ground before a second roof skin). Second, the controller knows when its own claims are unsupported: a commanded fan that is not spinning, an invalid sensor, a mismatched reference or a gap in the data each block a cooling claim. Normal shelters cannot tell you whether they worked.
Why not air-conditioning or an evaporative cooler?
An open-sided rest space cannot hold conditioned air, so AC power is mostly wasted, and it depends on mains power and refrigerant servicing. Evaporative cooling adds humidity, consumes water, needs cleaning and weakens in Vellore's humid monsoon months. If a site needs genuinely cooled air, the right answer is a separate enclosed cooling room; the NDMA draft guidance treats those as different facilities.
Your own model says the double roof barely helps. Why keep it?
Because we report what the model says. In FS-01 geometry the second skin cuts the lining temperature by about 8–22 K but changes the seated radiant load by less than 1 K, so it is now an optional, removable experiment. It matters more when people sit closer to the roof, under larger roofs, or as the white top soils. If paired measurements agree, it stays optional; if not, we update the model.
How do you know the model is right?
We don't yet; it is a screening model. It is built from standard relations (Swinbank sky, Watmuff convection, view factors, ASHRAE/ISO globe relation), its energy balance closes to below 0.001 W/m², 17 test cases check geometry and physical limits, and it survived an adversarial review that found and fixed eight errors. It makes predictions with declared tolerance bands — roof lining temperature and 150 mm globe temperature at the seat — that a ₹49 probe and a globe thermometer can test over three clear days.
Sixty samples is not statistics.
Agreed, and the system says so. Consecutive one-second samples are autocorrelated; the record reports the effective sample size to show why no within-run interval is claimed. Uncertainty comes only from independent runs on different days, combined with a t-interval, and a direction is claimed only if the whole interval clears the predeclared margin.
Is it safe to run a fan at 40 °C in Vellore?
Not always, which is why the controller screens it. Above 39 °C automatic mode stops and the display warns that a fan may add heat; at 37 °C it warns that benefit is limited for older or medicated people. Manual control stays with the worker. SAAYA never labels anyone safe and never delays a help request.
Why an ESP32 and not a Raspberry Pi?
Control has to keep working through power cuts and network loss. An ESP32 boots in milliseconds, has a hardware watchdog, hardware PWM and flash storage for the help latch, and costs about ₹425–499. A Pi boots an OS from an SD card that can corrupt on power loss and draws far more power. The laptop and API only observe; they are never in the control loop.
What happens when something fails?
A stalled fan raises a feedback fault after a 3-second start-up grace. A disconnected sensor turns readings into “unavailable”, never zero, and disables automatic mode while keeping manual. If the ESP32 itself dies, the fan's PWM line floats and the fan runs at full speed. A help request is stored in flash and survives reboot until someone acknowledges it locally.
What is novel, and is it patentable?
We claim no patent and have not done a formal search. The bounded contribution under test is the inspectable chain from command to measured actuator response to an uncertainty-aware, predeclared comparison, integrated into a low-cost shelter. That is a methodological contribution, and it is open for reviewers to inspect.
What does it cost compared with AC?
The bench prototype is about ₹10,400 today and about ₹4,700 with the costed budget profile. The full-size first article is an unquoted ₹94,000–1,71,000 allowance, more than a ₹36,990 AC unit's equipment price — but that AC has nothing to cool outdoors. We do not claim to beat AC on price; the fair comparisons are a fan in comparable shade and a retrofit of existing shade, which we plan to measure.
Why is there AI in it at all?
Only as an optional, local, read-only explainer of finished records. It has no actuator, cannot change evidence and is never used for control or for any safety decision. The system works fully without it.
What would you do next with funding?
Build the bench and two matched unoccupied rigs, run the co-location calibration, then run paired trials — single versus double roof, ground treatments, fan versus no fan — on at least three clear days each, and publish all runs including invalid ones. Then get a structural and electrical review and a dated local fabrication quote before any full-size build.
Limits
What this does not prove.
- No shelter has been built and no temperature has been measured. The model predicts; it has not been validated.
- Mean radiant temperature is not heat stress. A worker's strain depends on humidity, work rate, clothing, hydration, acclimatisation and health. SAAYA never labels a person safe or recovered.
- The full-size cost is an allowance, not a quote. A dated Vellore fabrication quote and an installed AC quote are both still needed.
- Structural, electrical, foundation and weather design need qualified review before anyone sits under a full-size build.
- Novelty is limited and stated as such: shade, reflective roofs and fans are prior art. The contribution under test is the fault-aware evidence chain integrated with a low-cost shelter.