One mechanism, many names

Triple Pat rests on a single mechanism. A timer must be reset before it runs out. Each check-in resets the timer, and if the check-ins stop, the timer runs out and the phone app raises an alarm. In the situations where this is useful, there is no message that says something is wrong. The silence is the message.

This idea is much older than we are. Many fields discovered it independently and named it for what they saw. The names describe different set-ups and systems, but the systems share the same shape, so the one you already know is a fair guide to the others.

Watchdog timers

A hardware watchdog timer is a countdown register on a microcontroller. Firmware must write to it periodically - “kicking the watchdog”, in the idiom - or the countdown reaches zero and the watchdog resets the processor. The reasoning is that firmware which has wedged cannot be trusted to report that it has wedged, so the design makes the report unnecessary. Working firmware kicks on schedule; wedged firmware falls silent and gets rebooted.

A Triple Pat check-in timer is the same countdown with a different timeout action. The watchdog resets the machine; the phone app raises an alarm so that a person can look. Both treat an absent signal as the failure. Prometheus uses the name too. Its always-firing Watchdog alert exists to be pointed at a timer like this one, and checking in from that alert is the shortest path to a running drill.

Heartbeats

In a distributed system, each node sends a small message to its peers on a fixed interval. A failure detector counts arrivals; when a node misses enough consecutive intervals, it is marked suspect and the cluster routes around it. The message carries no information beyond its own arrival. The monitoring industry borrowed the word for this product category, so “heartbeat monitoring” is the term most people search for.

A check-in matches a heartbeat closely: a payload-free signal on a schedule, where absence is the alarm condition. The difference is in what produces the signal and how. A heartbeat is emitted by the thing being watched, about itself. A check-in is produced by a chain of work - the metric was produced, the collection job saved it, the alert evaluated, the notification was delivered - and its arrival is evidence that the whole chain executed. That is why we did not adopt the word: it names the signal but not the act that earns it.

Dead man’s switches

A dead man’s switch is the trigger held down by the villain in an action movie: a hand relaxes, and the bomb goes off. The real ones are less dramatic, a handle a train driver holds down so that releasing it applies the brakes, but the idea is the same. The device assumes that a person who stops holding on has been incapacitated, and it fails toward the safe outcome.

The name gets used loosely for any system where a missing human signal triggers a safe action, and some services in this category brand with it, but the machine itself is different. A dead man’s switch is held continuously; a check-in is a separate act, repeated on a schedule. A grip and a schedule fail in different ways, and only one of them can be satisfied by a cron job or a delivered alert. What the two share is the stance: when the system hears nothing, it should assume the worst.

Snooze buttons

An alarm clock rings unless you keep pressing snooze. Each press buys a fixed period of quiet; when the presses stop, the ringing resumes. This is the same countdown as the others, in a form everyone has operated.

The order of events is what differs. A snooze is pressed after the alarm has rung, to postpone the next ring. A check-in is pressed before the alarm, and as long as check-ins keep arriving the alarm never sounds. The alarm you eventually hear from Triple Pat is the snooze-button press that did not happen.

Fire drills

Nearly everyone has done a school fire drill. At least once a year the alarm goes off on purpose, and the whole building files outside in an orderly way. The school is not expecting a fire. It is checking that the alarm rings, that people hear it, and that everyone knows what to do, because an alarm that has not rung in years might not ring at all, and nobody would know.

The timer here is easy to miss because it is a calendar rather than a countdown. Somewhere there is a schedule and a log, and a year with no drill in the log is the alarm condition. A missed drill does not announce itself; someone has to notice the gap. The reset is different from the other names in one way: it is not a single press or a register write but a complete exercise, and the fact that it happened is proof that the system works.

The same shape

In most rows the check-in is one small action, and its arrival proves only that whatever made it is still there. In the last two rows the check-in is an exercise, and its arrival proves everything it passed through. That is the row Triple Pat is built for. Have your monitoring fire a synthetic alert on a schedule, with a Triple Pat timer as the alert’s notification target. Each delivered alert is a completed drill, and the check-in it lands is evidence that the whole pipeline ran, from the metric to the notification. If the check-ins stop, the drill failed and your alerting is broken, which is the one thing your alerting cannot tell you.

Why we say check in

Checking in is the metaphor we chose, and it comes from a common experience of growing up. You can stay out, but you have to call and check in, so your parents know everything is okay. The call does not mean something is wrong; the call itself is the news, and a missed call is what gets someone worried. That is the mechanism on this page exactly, and it is the one form of it that is about care rather than about death, kicking dogs, or being forced to wake up in the morning.

The word also says what the other names leave implicit: someone or something has to do it. You check in, and the check-in timer is current. You stop, and after the interval you configured the phone app raises an alarm. Nothing about the word requires a hardware or safety background, and nothing about it pretends the signal sends itself.

Our company name comes from the same instinct. The triple pat is the three-pocket pat for wallet, keys, and phone on the way out the door, a check-in performed every time you leave the house. Nobody thinks about it when everything is there. You only notice the pat that comes up empty.

The quickest way to see it work is to send your first check-in to a real timer, which takes a browser and a few minutes.