Skip to content
design

Data integrity

Every live value says how far to trust it. A value is never shown blank and never shown silently stale.

On this page
1 min
heading frozen
last seen 8 min
The four integrity states, rendered live by the kit's Reading component.

A reading on a boat can be fresh, late, wrong or gone, and the crew decides on it either way. So every live value carries its integrity with it: the screen shows how much to trust a number, not only the number. The colors come from MSC.191 §5.6: yellow marks a stale or low-integrity reading, red marks an invalid or lost one.

01Never blankA lost reading keeps its last known value and states how old it is. An empty slot tells the crew nothing.
02Never silently staleA late value is dimmed and carries its age. It never looks as current as a fresh one.
03Missing is not zeroAn absent reading is invalid. Zero is a measurement, and drawing it would claim something the sensor never said.

The four states

StateWhenTreatment
FreshThe reading arrived within its freshness windowShown normally, with its source
StaleThe reading is late, and its last value is usefulDimmed, with a yellow age badge
DegradedValues arrive, but the quality evaluator distrusts themThe evaluator's reason, and deliberately no age
InvalidThe reading is lost or absentRed marking, the last known value, and how long ago it was seen

A degraded reading is flowing, so an age would misdescribe it. It shows the reason in the quality evaluator's own words ("heading frozen", "no GPS fix") so the UI never invents a caption.

Anatomy of a trusted value

Each readout carries its value, unit, source, and the evidence of its integrity in the same place.

DepthSOUNDER
8.4m
▲ +0.3 m / 10 min
Fresh
DepthSOUNDER
8.4m
95 s old
Stale
DepthSOUNDER
8.4m
Bottom lock weak
Degraded
DepthSOUNDER
8.4m
Last seen 8 min ago
Invalid

The system pattern for each state. Yellow is the low-integrity token, red the invalid token; both follow the theme.

Missing is not zero

The sensor feed publishes some readings as plain numbers. A dead sounder can therefore arrive as 0, the shallowest possible water, and raise a permanent shoal alarm. An untrusted reading is withheld and rendered as invalid, while the last known value stays on screen with its age.

Do
last seen 8 min
Render a lost depth as invalid: the last known value, its age, and the red marking.
Don't
Depth0.0m
Don't draw a dead sounder as 0.0 m. It claims the boat is aground and sets off a false shoal alarm.
Do
1 min
Dim a late value and give it a yellow age badge, so it never looks as current as a fresh one.
Don't
TWS14.2kn
Don't keep showing a late value at full brightness with no age. The crew reads it as live.

Derived values take the worst integrity

A value computed from several readings is only as trustworthy as the weakest of them. Set and drift need both GPS and boat speed, so if the log goes stale, set and drift go stale with it, and they carry the oldest of the input ages.

SOG / COGGPS · Fresh
Speed through waterLOG · Stale · 95 s
Set and driftStale · 95 s

The derived value inherits the worst integrity of its inputs and the oldest age.

Sources

Every value names where it came from (SOUNDER, MAST, GPS, IMU · 10Hz), as part of the readout rather than in a tooltip. With two sensors for one quantity, the crew can tell which one they are reading.

DepthSOUNDER
8.4m
▲ +0.3 m / 10 min
True windMAST
14G22kn
TWD 214°
SOGGPS
0.4kn
COG 087°
Readouts with their sources
  • Reading: the live component and all of its states.
  • Alarms and severity: the alarm ramp that shares these colors.
  • Color: the integrity tokens in every theme.