中文版 · Blockchain learning guide · Previous article
Blockchain learning · Article BC096
A sensor reading does not become an accurate physical measurement merely because it is signed and recorded on a blockchain. Its identity, unit, sampling time, calibration context and transformations still matter. The chain can preserve the submitted representation while an earlier measurement or conversion error survives intact.
This lesson follows one synthetic temperature record from a sensor through a gateway to an onchain entry and a reader. Seven independent cases change one part of that path. We identify whether the failure concerns physical measurement, transport integrity, transformation, freshness, coverage or calibration evidence.
The example is a classroom data pipeline, not a system for food, healthcare, industrial safety or valuable collection protection. No real device is accessed and no operational temperature decision is made. Sources were checked on 12 October 2026.
Choose your reading route
In this guide
- 1. Begin with the measurement identity
- 2. Distinguish the source record from the gateway record
- 3. Make the teaching acceptance rule explicit
- 4. Recompute the unit conversion
- 5. Place the four times in order
- 6. State what the chain has checked
- 7. Diagnose seven independent cases
- 8. Do not fill the missing sample with a story
- 9. Preserve the evidence needed to locate a failure
- 10. Exercise: name the evidence category
- 11. Write a pipeline report instead of a truth badge
- Frequently asked questions
- Sources and further reading
Sections 1–3 define the record and its two signatures. Sections 4–6 check conversion, timing and what blockchain inclusion contributes. Sections 7–9 diagnose the seven cases and a missing-sample interval. The exercise and model report show how to preserve the original reading while explaining exactly which evidence is acceptable.
Back to contents · Next section
1. Begin with the measurement identity
The fictional sensor is S7. Its measurement is an indication of temperature at a specified classroom observation point. The exercise supplies a trusted mapping from the physical device identifier S7 to its signing verification material. A string saying S7 in a payload would not independently establish that connection in a real system.
The source record contains:
- Device identifier S7.
- Sequence number 41.
- Sampling time 100 seconds on the shared exercise clock.
- Numerical indication 20.
- Unit degrees Celsius, written °C in the lesson.
- Calibration-profile reference V3.
All these fields are covered by the supplied sensor signature. The clock is given as synchronised for this exercise, and the identity mapping is trustworthy. We are not silently using a block timestamp to establish the sampling time.
Profile V3 identifies the measurement interpretation and quality context approved for this exercise. Its identity does not mean uncertainty is zero or that future drift is impossible. The model supplies its applicability unless a case explicitly changes that evidence.
Back to contents · Next section
2. Distinguish the source record from the gateway record
Gateway G receives the source record at time 102. It preserves the original signed representation and creates a derived record. The derived record identifies the source through a digest of that exact representation and names conversion rule U1.
U1 changes the numerical unit representation from Celsius to kelvin: add 273.15 to the Celsius value. Thus the derived value is 293.15 K. It is the same indicated temperature expressed in a different unit, not a new sensor measurement or an adjustment for calibration error.
G signs the derived record, including its source digest, conversion-rule identifier, output value and unit. That gateway signature is different from S7’s signature. It shows which derived record G protected under the supplied cryptographic assumptions; it does not automatically prove G performed U1 correctly.
The reader therefore has two objects to relate: the signed original and the signed derivation. If the gateway publishes only a number without the source link and rule, the reader cannot reconstruct this particular transformation from that output alone.
Back to contents · Next section
3. Make the teaching acceptance rule explicit
The classroom reader requires the trusted S7 identity mapping, a passing source signature, applicable profile V3, a passing G signature, a matching source digest and a correct U1 transformation. It also requires the identified ledger inclusion evidence to pass.
For freshness, it requires the reading’s sample age to be between zero and ten seconds inclusive, measured from the authenticated sampling time. Ten seconds is an invented teaching parameter, not a recommended sensor or network specification.
If a supplied quality finding establishes that the sensor was drifting at the sampling time, the reader must not treat the value as an acceptable measurement under this exercise’s rule, even if the recorded bytes are intact. A separate sequence-coverage requirement asks whether all expected sample identifiers for a stated interval are present.
These are different conditions. The model reports the failed link instead of compressing everything into “blockchain failed” or “sensor data verified.” A real system would need a suitable measurement model, uncertainty assessment, implementation and decision rule for its actual purpose.
Back to contents · Next section
4. Recompute the unit conversion
NIST’s SI relationships explanation gives the Celsius-to-kelvin offset relationship using 273.15 K. In our example, 20°C corresponds to 20 + 273.15 = 293.15 K. NIST SI Base Units Relationships
The decimal conversion is exact as a relationship between the stated numerical unit representations. It does not add measurement accuracy. Printing 293.150000 K would not make S7’s physical indication more precise than the supplied measurement evidence supports.
Now imagine G signs an output of 20 K while claiming it applied U1 to the 20°C source. The gateway signature can still verify for those output bytes. Recomputing U1 reveals that the derivation is wrong. This is a transformation error, not evidence that the sensor’s original signature was forged.
A chain that accepts G’s permitted record may preserve that error perfectly. Whether the receiving application independently enforces U1 is an architectural fact that must be supplied. In this model the reader performs the comparison; ledger acceptance alone does not implement it.
Back to contents · Next section
5. Place the four times in order
The source was sampled at 100, received by G at 102 and included in the identified ledger record at 106. The baseline reader evaluates it at 108.
Sample-to-gateway delay is 2 seconds. Sample-to-inclusion delay is 6 seconds. At the reader, sample age is 108 − 100 = 8 seconds, while time since inclusion is 108 − 106 = 2 seconds. These are different intervals.
The baseline sample meets the invented ten-second age limit. At time 112, the same sample is 12 seconds old and fails that limit, even though its inclusion is only 6 seconds old. Using inclusion age instead of sample age would answer the wrong freshness question.
RFC 8428, Sensor Measurement Lists, defines fields for measurement names, units, values and times, and discusses resolving relative time in its communication context. That reinforces why a timestamp must retain its meaning. Our small integer exercise clock is not presented as an actual encoded SenML absolute timestamp. RFC 8428
If the sensor clock were unreliable, a correct signature would preserve the unreliable timestamp rather than fix it. The synchronised-clock assumption is therefore part of the evidence boundary, not something cryptography silently supplies.
Back to contents · Next section
6. State what the chain has checked
In this fictional system, the ledger validates G’s permission to submit, the required record structure and its own transaction rules. It does not independently observe the classroom point, recalibrate S7 or enforce U1. The reader is given verified inclusion in an identified accepted block and the required finality evidence.
That supports the limited conclusion that this derived record was accepted in that ledger context. It does not establish that the physical temperature was exactly 20°C, that no sample was missed or that the conversion was correct. Those questions refer to other parts of the path.
NISTIR 8202’s oracle discussion identifies the gap between recording external input and determining whether it reflects real-world events. Our sensor pipeline makes the gap inspectable by separating the original observation, transformation and ledger evidence. NISTIR 8202, section 7.3
The value of the record is not erased by these limitations. It can still help identify who submitted which representation and how it relates to a preserved source. The point is to use that evidence for the claim it supports rather than ask it to perform an unobserved physical check.
Back to contents · Next section
7. Diagnose seven independent cases
Case A is the complete baseline. Identity, signatures, source link, profile, U1 and inclusion checks pass, and sample age at 108 is eight seconds. The individual record is admissible under the classroom rule. This is not a zero-uncertainty physical guarantee.
Case B keeps the signed source at 20°C but G’s correctly signed derived output says 20 K. The source link is correct, so the reader can detect the U1 mismatch. The derived record fails the transformation condition even if included onchain.
Case C preserves both messages and the correct 293.15 K conversion. A separately supplied, reliable quality investigation establishes that S7 was drifting at the sampling time and its indication is unsuitable under the exercise’s measurement requirement. The signatures still pass; the physical-measurement condition fails. The case gives this finding directly rather than inferring a cause from one unexplained numerical difference.
Case D changes the protected source value from 20 to 21 without a valid replacement sensor signature. The source verification fails under the supplied checks. This is an integrity failure in the presented source, distinct from C’s intact but unsuitable measurement.
Case E supplies valid records with sequence numbers 41 and 43 for an interval whose expected sample identifiers are 41, 42 and 43. Record 42 is absent. The supplied records may each pass individual checks, but the interval fails the completeness requirement. The missing value and reason are unknown.
Case F presents the unchanged baseline at reader time 112. Its sample age is 12 seconds, so it fails freshness. Neither a valid signature nor a recent inclusion turns it into a new sample.
Case G changes the source’s declared profile to V2 with a valid signature, while the exercise requires applicable V3 evidence. The profile requirement fails. That does not prove the numerical value must be false; it means the required interpretation and quality evidence is not established for this record.
Back to contents · Next section
8. Do not fill the missing sample with a story
In E, the expected sequence is supplied by the sampling plan. Seeing 41 and 43 without 42 establishes a gap in the received interval. It does not tell us whether S7 failed to measure, the gateway failed to forward, a later store omitted the record or another cause occurred.
It also does not establish that the missing temperature was zero, 20°C or the average of adjacent values. An interpolated value would be a new derived estimate requiring its own label and assumptions. It must not be presented as an original signed sample that the evidence packet does not contain.
Even if the surrounding readings were equal, an unobserved short change could remain possible. Whether such a gap matters depends on the intended question and the physical process, not merely on the convenience of drawing a continuous chart.
For this classroom rule, individual-record validity and interval completeness are reported separately. That avoids rejecting every available record as forged while also avoiding an unsupported claim that the entire period was observed.
Back to contents · Next section
9. Preserve the evidence needed to locate a failure
A useful pipeline record keeps the original signed object, its identity and timestamp context, the calibration-profile reference, the gateway transformation description and the derived object. It also identifies the ledger record and the reader’s evaluation time and policy.
These links allow different failures to remain distinguishable. A wrong unit at G does not require claiming that S7 was inaccurate. A drift finding does not require claiming a transport alteration. A late reading does not require claiming a false signature. An absent sequence does not require accusing a particular actor of deletion.
This is why keeping only a final dashboard number can be costly. If the dashboard displays 293.15 without a unit, source or sampling time, a later reviewer loses the ability to reconstruct the value’s meaning. Adding an “onchain” badge does not restore those missing relationships.
The exercise does not require publishing raw real-world observations or personal information broadly. Evidence availability and access control must fit the actual use. Here every value is synthetic, and the pipeline is a reasoning object rather than a deployment plan.
Back to contents · Next section
10. Exercise: name the evidence category
- What is the U1 output for the source indication 20°C?
- At reader time 108, what are sample age and inclusion age?
- At time 110, does the sample meet the inclusive ten-second limit? What about time 112?
- In B, which signature can pass while the transformation still fails?
- In C, does intact transport establish a suitable physical measurement?
- In E, can the reader assign a temperature to sequence 42 from the supplied facts?
- In G, does a profile mismatch prove the indicated number is necessarily wrong?
Answers and reasoning
- 293.15 K. This is a unit conversion, not a calibration correction.
- Sample age is eight seconds; inclusion age is two seconds.
- At 110 the age is exactly ten seconds and passes. At 112 it is twelve and fails. The parameter is invented for this exercise.
- G’s signature can pass for its wrong output. The reader must still check the source link and conversion rule.
- No. The supplied quality finding concerns the measurement process, which signatures do not repair.
- No. The value and cause of absence are unknown; interpolation would need to be identified as an estimate.
- No. It establishes failure to provide the required profile evidence, not automatic falsity of the number.
Extension: if a reader cannot retrieve the signed original but can verify the ledger inclusion of G’s output, has it completed the source-to-derived comparison? No. It has evidence for one downstream record, while the source signature and transformation relationship remain unverified by that reader.
Back to contents · Next section
11. Write a pipeline report instead of a truth badge
For A, write: “The presented S7 source identifies sample 41 at time 100 with indication 20°C and profile V3. Source identity and signature checks pass under the supplied mapping. G’s output references that source and correctly applies U1 to obtain 293.15 K. The output’s signature, identified ledger inclusion and finality checks pass. At evaluation time 108, sample age is eight seconds, within the classroom limit. This report does not claim zero measurement uncertainty.”
For B, preserve the successful checks but state the failed conversion. For E, report the two available records and the missing identifier rather than claiming a complete interval. For F, report the old sampling time instead of calling the same bytes newly measured.
A real measurement system needs qualified assessment appropriate to its purpose. The pipeline method helps that assessment by keeping identity, transformation, timing, record integrity and physical suitability visible. It does not replace calibration science or turn a shared ledger into a sensor.
Back to contents · Next section
Frequently asked questions
Does signing a sensor reading prove accuracy?
No. It can protect the specified message under the relevant key assumptions. Accuracy and fitness for purpose require measurement evidence.
Does converting Celsius to kelvin improve the measurement?
It changes representation. It does not remove drift or reduce uncertainty by itself.
Is a recent block proof of a recent sample?
No. The sample may have waited before publication. Check the relevant sampling timestamp and its trust basis.
Does a sequence gap prove data was deliberately removed?
No. It establishes missing expected evidence in this packet. The reason needs investigation.
Back to contents · Next section
Sources and further reading
Primary references checked on 12 October 2026:
- RFC 8428, Sensor Measurement Lists: Standards Track, August 2018; structured names, units, values and time context. The toy signature envelopes are additional assumptions, not a claim that SenML alone supplies them.
- NIST SI Base Units Relationships: Celsius/kelvin offset relationship.
- NISTIR 8202: October 2018, section 7.3 on external input.
For the measurement mathematics, read Thermometer Calibration, Interpolation and Measurement Uncertainty. For record assurance, use Digital Record Authenticity. This lesson adds the complete sensor-to-ledger evidence path and its distinct failure cases.