Stopping a vehicle remotely is one of the most useful things a fleet system can do, and one of the most dangerous if it is done carelessly. An immobilizer relay interrupts a circuit the vehicle needs in order to run. Sent at the wrong moment, the same command that protects a parked van could affect a vehicle on the road.
In LIOMO Fleet, the immobilize command is built around one principle: it must never reach a vehicle that might be moving. This article walks through the checks that enforce that principle, as an example of how we approach automation that acts on the physical world.
The real problem: commands arrive late
A tracker is not permanently connected to the platform. Commands can only reach it while it has an open connection, and trackers are often connected while the vehicle is being driven and seldom while it is parked. A command requested now may only be deliverable later, by which time the situation may have changed completely.
That is the core risk. A design that simply queued the command and sent it at the next connection could deliver it at exactly the wrong moment: just after someone has started the vehicle and driven away. Every check below exists to rule that out.
Before the command is offered
The Immobilize command is only offered when the latest information says the vehicle is parked. All of the following must hold:
- The tracker's last position is no more than 10 minutes old.
- That position shows a speed of no more than 3 km/h.
- The ignition is reported off.
- Nothing in the last 3 minutes showed the vehicle moving or its engine on.
If any of these conditions fails, the command is not offered and not sent. Old or uncertain data is treated as a reason to wait, not as permission to act.
While waiting for the tracker
Once requested, the command waits for the tracker to connect. During that wait, the platform keeps watching incoming data. If a newer position shows the vehicle moving or the engine on, the command is called off at once.
The wait itself is limited. An immobilize command waits at most 10 minutes. If the tracker has not connected by then, the command expires and is never sent later. A stale request cannot surface hours afterwards, when nobody remembers making it and the vehicle may be somewhere else entirely.
At the moment of sending
When the tracker connects, the platform does not rely on what it knew before. It asks the tracker on the spot about its setup, ignition, movement and position. Only if every answer is right is the command sent.
This final check matters because conditions can change between the last report and the moment of connection. Asking the device directly, just before acting, closes that gap. It also confirms that the tracker is still set up as expected.
Confirmation, and taking it back
Sending a command is not the same as the vehicle being immobilized. LIOMO Fleet counts a vehicle as immobilized only when the tracker confirms it. If no confirmation arrives within 2 minutes, or if the vehicle moves, the engine comes on or the connection closes, the platform takes the command back and requests a release automatically.
Release follows the opposite logic, because releasing is the safe direction:
- It is always available and never rate-limited.
- Once requested, it cannot be cancelled.
- It is retried until the tracker confirms it: after 1, 2, 4, 8, 16 and 32 minutes, then every hour.
Every command, whether immobilize or release, is logged together with who asked for it. When questions come later, there is a record to answer them.
What this says about careful automation
The pattern applies well beyond vehicles. Any system that sends commands to equipment, from a relay in a van to a pump on a farm or a switch in a building, faces the same questions about stale data, late delivery and unconfirmed results.
Immobilization in LIOMO Fleet is part of the Remote commands package and requires an immobilizer relay fitted by LIOMO. The checks described here are built into the command itself, so they apply every time it is used.