Ahmet İhtiyar
TR
Data Path Case Studies Systems Invariants Contact
00 · POSITIONING & DOSSIER

From raw sensor to signed audit report: engineering the entire path of data.

Diverjans IT · Distributed Telemetry, Embedded Edge & Systems Architecture

Based in Istanbul, engineering distributed data infrastructure at Diverjans IT. Building end-to-end telemetry pipelines from physical microcontrollers (ESP32, Modbus) and message brokers up to high-throughput time-series storage (TimescaleDB), Apache Arrow zero-copy streams, and legally binding audit reports.

Inspect Case Studies Send Email
Ahmet İhtiyar — Portre
Istanbul
Diverjans IT
01 · Backbone Architecture

The Path of Data

Device → Transport → Queue → Storage → Delivery → Trust

A 6-station telemetry and data processing backbone from physical sensor to signed audit report. Hardened against industrial field dropouts and network partitions.

Station Index
01 Hardware Edge

Edge Device & Sensors

Protocol & Stack: ESP32 · Modbus RTU (RS-485) · Modbus TCP · FreeRTOS · GPIO / UART
What I Engineered

Developed FreeRTOS firmware polling Modbus holding registers from industrial chillers and environmental sensors, with a circular flash ring-buffer for offline durability.

Architectural Rationale

Enforced static memory allocations over dynamic malloc to eliminate heap fragmentation, ensuring devices operate for months without watchdog resets.

Alternative Eliminated

Eliminated Raspberry Pi and embedded Linux due to SD card corruptions during power drops, thermal throttling at 70°C, and high idle power draw.

Challenge & Mitigation

Electromagnetic interference (EMI) from heavy industrial compressors inducing RS-485 CRC corruptions; solved via optical isolation and sliding-window retries.

Related Engineering Dossier Case 01: Plasmon Case Study
Infrastructure Ground Plane
· Proxmox VE 8 · ZFS RAID-Z · PBS · Docker · Nginx / Caddy · Prometheus / Grafana · Oracle Database
02 · CASE STUDIES

Engineering Dossiers

3 Selected Systems · Production Verified

Architectural blueprints of three critical systems engineered for harsh industrial environments and high-throughput telemetry. Focusing on root problems, architectural trade-offs, live metrics, and real code kernels.

Dossier Jump Index
01 · Plasmon
100K+ Edge Devices
02 · Sapmapayı
Zero-Copy IPC Stream
03 · Common Auth
<1ms Revocation Latency
Case 01 PROD VERIFIED

Plasmon: Telemetry Architecture Designed for 100K+ Edge Devices

ESP32 firmware, MQTT/TLS RPC, local ring-buffer & RabbitMQ ingestion pipeline

Stack: ESP32 (C/FreeRTOS) · Modbus RTU/TCP · MQTT/TLS
100K+ Edge Devices
85% Cellular Quota Saved · 0 Packet Loss
Problem

Cellular 4G connectivity suffered periodic tower dropouts, causing volatile RAM overflows and data voids with conventional HTTP polling. The system required reliable offline telemetry buffering alongside secure remote setpoint writing and OTA firmware updates.

Architectural Decisions

C on FreeRTOS with static memory allocations eliminated malloc heap fragmentation. Persistent MQTT over TLS (QoS 1) preserved 85% cellular quota over HTTP. An automated transistor power-cycling switch resolved cellular modem hangs.

What I'd Do Differently: Telemetry originally transmitted JSON frames (~180 bytes). Adopting Protobuf or packed binary structs from day one would have reduced bandwidth consumption by 65% upfront.
Open Full Dossier Page
Architecture & Data Flow
Failover Topology
Field Equipment
Industrial Chiller & HVAC
Temperature, Pressure, Motor Current
RS-485 Modbus →
Edge Gateway FreeRTOS
ESP32 Firmware (C)
Static RAM Allocations · HW Watchdog
Dual-Path Cellular Routing
4G LTE / GSM Failover
Network Outage (Offline)
Flash Ring-Buffer (~320KB)

Circular logging on internal flash. Zero RAM fragmentation, telemetry preserved until link recovers.

Connected (Online)
EMQX MQTT Broker (TLS 1.3)

Persistent QoS 1 socket. 85% cellular quota saved; drained with 0 packet loss.

Message Ingestion
RabbitMQ Cluster
Dead-Letter Exchange (DLX) · Backpressure Guard
Ingest →
Time-Series Store
TimescaleDB
Hypertables · Continuous Compression · 100K+
Case 02 PROD VERIFIED

Sapmapayı: Cold-Chain Compliance & Zero-Copy Reporting

TimescaleDB, Apache Arrow Zero-Copy IPC stream, X.509 e-Signature & RFC 3161 Timestamping

Stack: TimescaleDB · Apache Arrow (IPC) · C# .NET 10
Zero-Copy IPC Stream
<15ms Browser Latency · 87% Network Savings
Problem

Querying a 30-day thermal history returned ~250,000 datapoints. Serializing to JSON generated a 25MB payload that froze browser JavaScript threads for 800ms+. Reports also required legally binding digital signatures and RFC 3161 timestamping.

Architectural Decisions

Adopted Apache Arrow IPC binary streaming over JSON; columnar buffers map directly into Float64Array memory without intermediate copies. Replaced headless Chromium with QuestPDF in C#, slashing memory footprint from 400MB to 15MB. HSM cryptographic signing was offloaded to dedicated background queues.

What I'd Do Differently: Initially used headless Chromium (Puppeteer) which drew 400MB+ RAM per instance and failed under burst loads. I should have engineered native C# vector rendering from day one.
Open Full Dossier Page
Architecture & Data Flow
Zero-Copy Pipeline
Telemetry Store
TimescaleDB Hypertables
250K+ High-Frequency Temp & Humidity Rows
Continuous Aggs →
Binary Streamer .NET 10
Apache Arrow IPC Streamer
RecordBatch Columnar Stream · Zero JSON Cost
Zero-Copy Binary Highway
24.8MB JSON → 3.1MB Arrow (87% Saved)
01 · Frontend Visualization <15ms Render
Browser Canvas GPU

Binary buffers map directly into Float64Array memory without JSON.parse thread blocking, smoothly plotting 250K points.

02 · Legal Compliance 5070 Sayılı Kanun
PKCS#11 HSM + QuestPDF

Certified RFC 3161 timestamps and X.509 digital seals produce legally admissible audit compliance documentation.

Case 03 PROD VERIFIED

Common Auth Service: Instant Revocation in Distributed Microservices

Decoupling roles from JWT payloads into versioned Redis claims; unified across Plasmon, Sapmapayı & Diventra WMS

Stack: Spring Boot 3 · C# .NET 10 · Redis (Redlock)
<1ms Revocation Latency
O(1) Redis Complexity · <400B Token Overhead
Problem

Pure stateless JWTs created a severe vulnerability: revoked operators retained full access until token expiry (e.g. 60 mins). Embedding deep role trees inflated Authorization headers to 6KB, wasting bandwidth across millions of IoT calls.

Architectural Decisions

Engineered a hybrid model: JWT contains only immutable ID and an incrementing version integer (ver). Dynamic rights reside in Redis. Bumping user version instantly revokes all active tokens in <1ms without unbounded blacklist memory growth.

What I'd Do Differently: An in-memory local fallback cache (5s TTL) should have been included earlier to handle transient Redis cluster partitions gracefully, avoiding fail-closed rejection during momentary network blips.
Open Full Dossier Page
Architecture & Data Flow
Revocation Flow
Client / Field Device
Authorization Header
Bearer JWT (ver=3, <400 bayt)
JWKS →
Phase 1: Stateless Validation Gateway
Local Cryptographic Signature
Asymmetric public key check on local CPU (0 network call)
Phase 2: Redis In-Memory Version Check
<0.3ms Gecikme · O(1) Sabit Karmaşıklık
Komut: GET auth:ver:{userId} → Matches current Redis version integer against token 'ver' claim.
ver == 3 (Match / Active)
HTTP 200 OK
Permission Authorized

Request immediately routed downstream to Plasmon, Sapmapayı, or Diventra WMS.

ver != 3 (Mismatch / Revoked)
HTTP 401
Instant Session Revocation (<1ms)

Incrementing the version integer instantly invalidates all active tokens. Zero blacklist overhead.

03 · SECONDARY WORKS

System Registry

5 Systems · Operational Infrastructure

Production systems, bare-metal hypervisors, network infrastructures, and open-source developer tooling maintained across operational environments.

REG-01 MetaDB

Multi-tenant enterprise metadata catalog & lineage platform; zero-lock catalog extraction across multi-terabyte production databases

Stack: Spring Boot 3 · Memgraph (Bolt/Cypher) · FastAPI · PostgreSQL · TimescaleDB
2024–2025
REG-02 Diventra WMS

Warehouse management system and enterprise ERP integration; palletizing, lot tracking, mobile terminal flows and shared auth

Stack: C# .NET · SAP/Logo Entegrasyonu · PostgreSQL · Redis
2024–2025
REG-03 Ulusal Medya Kuruluşu Ödeme Motoru (Anonim)

Multi-client virtual POS and central payment engine; idempotent execution, Redis distributed locking, and Keycloak SSO federation

Stack: .NET 10 · Keycloak · Redis Distributed Lock · RabbitMQ · SQL Server
2025
REG-04 Saha Servis PWA

Offline-first field technician service app with route optimization, work order tracking, and equipment diagnostics

Stack: .NET 10 · PostGIS · SignalR · Workbox PWA · PostgreSQL
2024
REG-05 Proxmox & Linux Hipervizör Altyapısı

Bare-metal KVM/LXC virtualization cluster, ZFS storage pools, automated PBS deduplicated backups, and WireGuard tunnels

Stack: Proxmox VE 8 · Fedora Linux · ZFS · PBS · Docker · Caddy
2023–günümüz
04 · ARCHITECTURAL INVARIANTS

Invariants & Failure Modes

Rule → Failure Mode → Solution → Verification

Rigid engineering rules forged under production stress and hardware limits. No architecture is established without defining its failure mode and production defense.

01 · Veritabanı

Zero-Lock Catalog Statistics

ENFORCED
Invariant Rule

Full table scans (Seq Scan) and SELECT COUNT(*) are strictly prohibited when extracting metadata from multi-terabyte production databases.

How It Breaks

On tables with hundreds of millions of rows, full scans thrash disk I/O, evict active buffer cache pages, and induce lock starvation on concurrent transactions.

Engineering Solution

Native database catalog metadata (pg_class.reltuples in PostgreSQL, ALL_TABLES.NUM_ROWS in Oracle) is read asynchronously, obtaining approximate row cardinality in <5ms without table locking.

Production Verification

Verified in production on multi-terabyte enterprise Oracle and PostgreSQL instances within the MetaDB project.

Failure Mode Assurance 01 · Veritabanı
02 · Donanım & Edge

Edge Flash Ring-Buffer

ENFORCED
Invariant Rule

Telemetry frames are never retained in volatile MCU RAM during cellular dropouts; they are written to a local circular flash buffer.

How It Breaks

The ESP32 free heap (~320KB) exhausts after minutes of buffering, triggering malloc failures, watchdog resets, and unrecoverable frame loss.

Engineering Solution

A fixed-size circular ring-buffer is maintained on SPIFFS/LittleFS flash. During outages, the ~320KB ring-buffer retains approximately ~48 hours of continuous telemetry frames; upon capacity, oldest records are overwritten (FIFO). Frames drain sequentially on reconnect.

Production Verification

Verified on Plasmon IoT gateways and industrial refrigeration controllers during 4G/GSM cellular failover simulations.

Failure Mode Assurance 02 · Donanım & Edge
03 · Dağıtık Arka Uç

Idempotent Execution & Distributed Lock

ENFORCED
Invariant Rule

Network timeouts and client retry loops must never generate duplicate ledger entries or double billing.

How It Breaks

When a client times out awaiting a response, it re-issues the transaction. Without atomic idempotency guards, downstream payment processors charge twice.

Engineering Solution

A unique Idempotency-Key is locked atomically in Redis (SET NX EX). Downstream execution results are cached to the key, ensuring repeated requests receive the cached result instantly.

Production Verification

Verified in production on the national media corporation payment microservice and Plasmon telemetry ingestion pipelines.

Failure Mode Assurance 03 · Dağıtık Arka Uç
04 · Altyapı & Depolama

ZFS Scrub & PBS Deduplication

ENFORCED
Invariant Rule

Silent storage corruption (bit rot) and unverified backup snapshots on physical hosts are strictly prevented.

How It Breaks

Standard filesystems (ext4) do not detect silent block corruption; corrupted bits propagate into backup archives, rendering disaster recovery impossible.

Engineering Solution

Automated weekly ZFS zpool scrub jobs compute block-level checksums, self-healing corrupted data from mirror/parity disks. Proxmox Backup Server (PBS) generates deduplicated, verified incremental snapshots.

Production Verification

Continuously verified across personal Proxmox VE bare-metal clusters and production homelab hypervisors for 3+ years.

Failure Mode Assurance 04 · Altyapı & Depolama
05 · Güvenlik & Yetki

Instant Session & Privilege Revocation

ENFORCED
Invariant Rule

User permissions must never be embedded permanently into stateless JWT payloads without an instant revocation path.

How It Breaks

When an operator is revoked, their signed JWT remains valid until expiration (e.g. 60 min), enabling unauthorized commands against critical machinery.

Engineering Solution

The JWT contains immutable identity and a version counter; mutable permissions reside in Redis. Bumping the user version takes <0.3ms, cutting off subsequent requests immediately.

Production Verification

Verified on the shared Auth microservice unifying Plasmon, Sapmapayı, and Diventra WMS platforms.

Failure Mode Assurance 05 · Güvenlik & Yetki
05 · CONTACT

Get in Touch

Direct Contact

No form walls. Direct engineering channels for distributed architectures, telemetry pipelines, and database optimization discussions.

Email
[email protected]
GitHub
github.com/ihtiyar07
Inspect Repositories
LinkedIn
in/ahmet-ihtiyar
View Profile