Manual fallback and degraded modes — critical operations¶
Purpose¶
List critical operations for the two-site grazing-led operation and define manual fallback when automation, comms, or power degrades. Does not replace vault runbooks—indexes them and adds family coverage context.
Architecture package: Reference architecture — 5 ac + 120 ac, Automation principles.
Parent SOP: Automation degraded modes and manual fallback
Starlink / LEO WAN: Integrated operating assumption—see Two-site operations model — 5 ac / 120 ac (WAN table). Outages are weather/obstruction-sensitive; degraded behavior is not optional.
Off-grid farm (SITE_FARM / Demory): Power and WAN can fail together or separately — Off-grid degraded modes — power and connectivity (Demory) , Off-grid farm execution topology — Demory (Mermaid) .
Scenario model (explicit)¶
Design degraded behavior for travel, outages, sensor failure, comms failure, and maintenance burden—not only “broker down.”
| Scenario | What breaks | First response | Sustained posture | Labor tax |
|---|---|---|---|---|
COMMUTE_ONE_WAY too long for urgency |
Time to site | Tier risk; neighbor / call tree | Reduce closed-loop dependence | Extra checks or hired relief |
| Backhaul down (farm → hub internet) | Remote visibility | Assume stale data; physical round | Increase visit frequency (bounded) | Trip count ↑ |
| LEO satellite WAN impaired (e.g. Starlink rain fade / obstruction / power at terminal) | Same as backhaul if farm or home uplink is satellite | Treat as comms down for remote trust; verify physical water/gates | Paper rounds; defer non-critical cloud work | Trip or local operator at field |
PV / battery stressed at off-grid SITE_FARM |
Inverter cuts non-critical loads; gateway or mesh may drop before WAN fails | Assume stale or no telemetry; physical water/stock check | Shed Popt per Off-grid degraded modes — Demory; manual rounds; no remote actuation trust |
Often same or higher labor tax than comms down—drive may still be needed |
| Broker / cloud down | MQTT / integrations | Disable auto acting on stale topics | Local safe defaults | Triage ↓ if alerts quiet (dangerous calm) |
| Sensor wrong (Class B) | Bad input to logic | Triage runbook; manual measure | Remove sensor from control until fixed | Debug time |
| Maintenance backlog (unpatched / dirty sensors) | Drift, false alarms | Mute is not fix—clean, calibrate, replace | Fewer channels until healthy | Ops hours or contract |
Placeholder: COMMUTE_ONE_WAY = ___ min; MAX_ACCEPTABLE_TIME_TO_WATER_VERIFY = ___ min (policy).
Key decisions supported¶
| Decision | Use this page |
|---|---|
| Minimum viable manual capability | If row has no manual fallback → do not depend on automation |
| Spares inventory | Critical spare column |
| Who responds when telemetry lies | Link coverage Family labor and coverage matrix |
Critical operations matrix (fill)¶
| Op ID | Operation | Normal (automated / monitored) | Degraded trigger | Manual fallback | Safe default | Spares / kit | Runbook link |
|---|---|---|---|---|---|---|---|
| O1 | Water to stock | Tank level / pump status | No telemetry or pump fault | Visual tank check; backup haul plan | Pump off if electrical fault unknown | Hose, breaker labels, generator plan | Power loss — remote |
| O2 | Perimeter security | Fence visual + optional alarm | Unknown state | Walk or ATV patrol on schedule | Isolate animals to sacrifice paddock if needed | Fence repair kit | |
| O3 | Move stock | Planned rotation | Gate remote down | Manual gate | Closed vs open per policy | Tools, chain | Manual fallback — irrigation/gates/pumps |
| O4 | Comms / alerting | MQTT → phone | Broker down | Scheduled physical check increases | Assume worst until verified | Paper checklist in truck | Broker or backhaul down |
| O5 | Haul / marketing | N/A | Truck down | Hired haul # | Backup contact | ||
| O6 | Processing appointment | Calendar | N/A | Phone tree |
Add O7+ for your context (loading, hay barn, cold storage).
Degraded-mode principles¶
- Assume telemetry wrong until corroborated (
Sensor false positive / alert triage). - Increase visit frequency when comms down—bounded by labor reality (coverage matrix).
- Document “good enough” manual state—not perfect pasture during outage.
What must never be “automation-only”¶
| Item | Why |
|---|---|
| Animal welfare checks during extreme weather | Sensors miss down animal |
| Loading for sale | Safety + bruising = money |
| First response to escape on public road | Liability |
Known / assumed / open¶
| Class | Content |
|---|---|
| Known | Vault runbooks exist for broker, power, triage, water manual |
| Assumed | Vehicle always available for emergency trip |
| Open | Neighbor call list; vet after-hours |
What changed because of Starlink analysis: Satellite WAN is named as a common uplink—degraded-mode planning must include LEO outage behavior, not only “broker down.”