Think Autonomously.

Whatever your product is, it should be self-sufficient in certain important ways. You have to be prepared to deal with the possibility that the network goes down, and that other nodes can appear or disappear at any time. Your node has to tbe able to operate autonomously.

Specifically, this means:

This last item carries with it a critical corollary. You cannot assume that an incoming command is safe to process. Each node is responsible for its own safety interlocks. Those interlocks may be based on data from other nodes, such as the CHASSIS_MOBILITY_STATUS, but the logic must be held locally. You have to assume that other devices - and the users - are ignorant about the safety issues with your product.