1. Where it is used
Mines, ships, and islanded plant networks drop often. A cellular site under maintenance, or a cut fiber, can take the northbound link away for hours or days. The edge gateway has to hold telemetry, alerts, image metadata, and the critical audit fragments on local NVMe or an industrial SSD, then send them up in order when the link returns, so the site does not go blind while it is offline. The SimtoLink Device Management Platform treats the buffer as a first-class policy: a capacity cap, eviction by business priority (LRU inside a tier, then a priority weight), guidance on the disk path and the file system, and encryption for data at rest and for the cache files.
Industries do not ask for the same completeness. A power relay-protection event may allow zero loss. Environmental noise samples can be downsampled when things get extreme. Make that a product policy and bind it to sub-device mapping, so a critical sub-circuit on the same gateway always keeps a place in the queue.
Evict by priority
Rank by business priority. Critical alerts and audit records keep their place in the queue. Lower-priority data is dropped first when space runs short.
Idempotent catch-up
A catch-up message carries a monotonic sequence number or a content hash. The cloud rules engine drops duplicates, so a brief disconnect and reconnect is not counted twice.
Disk health and backpressure
Watch free space, bad blocks, and write amplification. When the queue crosses its threshold, drop the low-priority data and raise an alert at the same time.
How the buffer runs
| Capability | What it does |
|---|---|
| Durable queue | Local cache on NVMe or SSD. WAL or dual-write keeps the metadata consistent |
| Priority eviction | LRU plus a weight. Keep critical alerts. Drop lower-priority data first |
| Encrypted on disk | Encrypt buffer files at rest with a tenant key, and wipe them securely at retirement |
| Idempotent catch-up | Deduplicate by sequence or hash. Catch up in a token-aware way so recovery does not flood the link |
| Backpressure | Past the threshold, drop low-priority data and raise an alert. Do not silently overwrite a high-priority event |
2. Staying consistent with the cloud
A catch-up message should carry a monotonic sequence number or a content hash as the idempotency key. The platform and the rules engine drop duplicates, so a short disconnect is not counted twice. Use UTC, and attach a flag for how far the local clock can be trusted, so the cloud can correct messages that arrive out of order. With connection resilience, report a queue-health summary first after reconnect, then flush. That avoids another connection storm.
If the cloud caps the write rate for one device, the edge should catch up in a token-aware way and keep the OTA window off the telemetry peak, so the link is not flooded the moment it returns.
3. Security and compliance
The buffer may hold production parameters, a location track, or an image thumbnail. Encrypt files at rest with a tenant key, and take the key material from key governance. After an unexpected power loss, WAL or dual-write should keep the metadata consistent, so a damaged index does not make the whole disk unreadable. When a device is retired or a gateway is replaced, wipe it and produce a proof, for China's classified cybersecurity protection (MLPS) and for the owner's acceptance.
A read-only mount and a boot that resists tampering reduce the chance that someone plants a fake catch-up package locally. With the secure boot chain, the boot path can check the signature on the buffer index.
4. Backpressure and the disk
When the queue crosses its threshold, drop data that is marked low priority first, and raise an alert at the same time. Do not silently overwrite a high-priority event. Watch free space, the growth of bad blocks, and write amplification, and warn early when the hardware is near the end of its life. On a gateway with several partitions, do not put the buffer directory and the system logs on a small partition that fills easily.
5. What operations can see
Expose queue depth, the age of the oldest message, catch-up throughput, and the drop count to Prometheus, and show them next to the online rate on the operations board. The SimtoLink Device Management Platform can plot, per site, offline duration against how long catch-up took, which shows a bad setting or a disk that cannot keep up.
6. Test and acceptance
In the lab, cover pulling the uplink repeatedly, a throttled link, a full disk, recovery after a process crash, and a gateway active-standby switch. Write the acceptance bar as zero loss for P0 events, and P1 catch-up finished within N times the offline duration. Tested with gateway high availability, a two-node switch must not break the queue lease.
7. Mistakes that show up in the field
Growing the disk without a priority, until historical noise pushes a critical alert out. Catching up without the cloud's ordering rules, which throws the business state machine off. Leaving the buffer unencrypted, so a device sent for repair leaks data.
8. Summary
Offline buffering is the insurance for data completeness on an industrial site. It is not an endless disk. SimtoLink provides policy templates, default monitoring, and an acceptance checklist so cost, reliability, and security can be balanced. Further reading: gateway high availability and digital shadow sync. For a capacity worksheet for offline sites, contact the SimtoLink edge architecture team.