FASTag.

How Do You Charge a Truck That Never Stops, From a Bank It Has Never Heard Of?

(An illustrative scene: Rajesh, his truck, his son and every fare and time below are invented.) It is 11:41 pm on a December night on NH-19 west of Kanpur. Rajesh Yadav, 46, owner and driver of a twelve-wheel truck carrying cement to Agra, rolls through a toll plaza without stopping. The barrier lifts; his phone buzzes: ₹845 debited. A second message follows: his FASTag is in low balance. His wallet is down to ₹160.

At 11:52 his son Ankit, at home in Kanpur, scans the UPI QR code printed on the tag and tops it up by ₹5,000. At 12:04 am Rajesh reaches the next plaza. The lane's display flashes amber: LOW BALANCE. The plaza's copy of the exception list was refreshed at 11:50, two minutes before Ankit paid. The toll clerk asks Rajesh to pay another way; he pays by UPI, at 1.25 times the fee, the UPI rate for a vehicle without a valid, functional FASTag, and drives on, angry.

At 12:31 am, at the third plaza, the antenna above the lane reads Rajesh's tag 37 times while the truck crawls behind a bus, and the barrier lifts once. The plaza's fibre link to its bank has been cut since midnight. His phone stays silent. At 9:14 the next morning, outside Agra, it buzzes: ₹845 debited, for a crossing nine hours earlier, settled through a bank Rajesh has never dealt with, routed through a switch he has never heard of, to a plaza operator that was paid the next day.

This is the system we'll design today.

The Interview Begins#

You're interviewing at a payments company that wants to become an acquirer for toll plazas. The interviewer puts two phone screenshots side by side. The first, at 12:31 am, shows nothing at all. The second, at 9:14 am, reads: "Rs. 845 debited from your FASTag for toll at plaza 4021, reader time 00:31:07."

People sometimes call FASTag "UPI for tolls", and the comparison is useful for the shape: NPCI runs both, many banks sit on both sides, and a central switch routes between them. It is misleading for the mechanics. A UPI payment is a user-initiated transfer that both sides see in seconds; we designed it in UPI (Bonus Problem 1). A toll payment is initiated by a reader at the roadside, without the payer's involvement, often from a lane with a flaky link, and the network is built to let the vehicle go first and settle the money afterwards.

Your Questions#

Functional Requirements#

Non-Functional Requirements#

The Lane and the Plaza#

The Central Switch and Mapper#

Exception Lists and Settlement#

Key Metrics Summary#

System Architecture#

%% title: NETC: lanes decide locally, banks settle centrally
flowchart TD
  subgraph L1["Layer 1 · The lane"]
    direction LR
    V@{ icon: "sd:truck", label: "Vehicle with FASTag<br/>passive RFID, signed data" }
    RDR@{ icon: "sd:scan", label: "RFID reader<br/>ISO 18000-6C" }
    CAM@{ icon: "sd:camera", label: "AVC, camera, ANPR<br/>class and image" }
    LC["Lane controller<br/>dedupe reads, verify, local lists"]:::hot
  end
  subgraph L2["Layer 2 · Plaza and acquirer"]
    direction LR
    PS@{ icon: "sd:server", label: "Plaza server<br/>store and forward" }
    ACQ["Acquirer host<br/>fare engine, list sync"]:::core
  end
  subgraph L3["Layer 3 · NPCI's NETC system"]
    direction LR
    MAP@{ icon: "sd:database", label: "NETC Mapper<br/>tags, class, exception lists" }
    SW["NETC Switch<br/>routes acquirer to issuer"]:::core
    NRCS@{ icon: "sd:bank", label: "NRCS<br/>clearing, settlement, disputes" }
  end
  subgraph L4["Layer 4 · Issuers and users"]
    direction LR
    ISS["Issuer host<br/>debit wallet, manage lists"]:::core
    USR@{ icon: "sd:phone", label: "Tag holder<br/>SMS, UPI top-up" }
  end
  V ==> RDR ==> LC
  CAM --> LC
  LC ==> PS ==> ACQ
  ACQ -->|"request details"| MAP
  ACQ ==>|"request pay"| SW
  SW ==> ISS
  ISS -.->|"add, remove exceptions"| MAP
  MAP -.->|"exception lists"| ACQ
  ACQ -.->|"diff every 10 min"| PS
  SW --> NRCS
  ISS --> USR
  class V client
  class RDR,CAM edge
  class PS service
  class MAP store
  class NRCS store
  class USR client

KEY INSIGHTS:

• The lane decides; the centre settles. The barrier decision uses only what's already in the lane: the tag's signed data, the local exception list and the vehicle classifier. The debit can happen seconds or hours later
• Lists flow out, crossings flow in. Issuers change a tag's status in the Mapper; acquirers pull the lists and push diffs to plazas; crossings travel back from lane to issuer through the acquirer and the switch
• Liability is written down for every delay. Who pays when a transaction arrives late, or a tag was blocked minutes before the read, is a rule with a number in it, not a judgement call

Data Flow: Rajesh's First Plaza#

%% title: An online crossing, from read to SMS
sequenceDiagram
  autonumber
  participant L as Lane controller
  participant P as Plaza server
  participant A as Acquirer host
  participant M as NETC Mapper
  participant S as NETC Switch
  participant I as Issuer host
  L->>L: 31 reads of tag T, one passage, txn 4021-5-88123
  L->>L: signature valid · not in local exception list
  L->>P: crossing · tag T, class from AVC, image
  P->>A: request details for T
  A->>M: get tag details T
  M-->>A: class multi-axle truck · active · issuer bank B
  A-->>P: OK to pass
  P-->>L: lift barrier
  A->>A: fare from mapper class · ₹845
  A->>S: request pay · txn 4021-5-88123
  S->>I: debit request
  I->>I: debit wallet · balance ₹160
  I-->>S: debit response OK
  S-->>A: response pay OK
  I->>M: add T to low balance

MEANWHILE, IN PARALLEL:

• The issuer sends Rajesh an SMS with the plaza, the fare, and the date and time, as NPCI's guidelines require
• The switch hands the transaction to NRCS, which counts it in the next settlement cycle
• Within ten minutes, the acquirers of the other plazas pull the Mapper's changes and push a diff to their plazas, with tag T now marked low balance

Deep Dive 1: The Lane Decides Alone (Week 4 Concepts: Multi-Tier Caching, Cache Invalidation; Week 9: Security Architecture)#

This builds on Week 4, Day 5 · Multi-Tier Caching, Week 4, Day 2 · Cache Invalidation and Week 9, Day 5 · Security Architecture.

What is published: NPCI's guidelines specify passive tags conforming to EPC Class 1 Gen 2, with an ISO 18000-6C air interface. The tag's EPC follows IHMCL's GS1 code: after a fixed 38-bit header come a 20-bit issuer ID ("up to 1048575 issuer ids"), an 8-bit issuer key index ("256 keys per Issuer ID"), a 20-bit vehicle ID and 10 bits reserved. The TID "should be unique and come from the chip manufacturer". At personalisation, the issuer signs the concatenated TID and EPC (SHA-256, then an ECC signature with the issuer's private key); the manufacturer writes the EPC, then a dummy registration number, the vehicle class and the signature into user memory, and locks both. Issuers' public keys are certified by NPCI, and the guidelines describe "NETC FASTag Static Data Authentication (TSDA)" as "the offline authentication method" used by the plaza server or lane controller. Acquirers "shall ensure Tag signature validation at all their acquired plazas" and must keep each plaza's list of issuer IDs updated within 7 days. Acquirers "shall ensure the toll plazas to use the request details API to validate the tag before allowing the vehicle to pass", with the exception-query API or SFTP files as fallbacks. A lane carries a reader, automatic vehicle classification (usually an infrared profiler), a camera and optionally weigh-in-motion; the guidelines recommend that no personal data be readable over the tag's radio interface.

%% title: The lane's decision, from first read to barrier
flowchart TD
  READ@{ icon: "sd:scan", label: "Reads: TID, EPC,<br/>user memory" }
  FMT{"Known issuer ID<br/>and format?"}
  LIST@{ icon: "sd:file", label: "Local exception list<br/>INIT daily + diffs" }
  SIG["Verify signature<br/>NPCI cert, issuer key"]:::core
  ONL{"Request details<br/>answers in budget?"}
  PASS["Lift barrier<br/>record crossing"]:::core
  OTHER["Other payment mode<br/>UPI or cash"]:::bad
  READ ==> FMT
  FMT ==>|"yes"| LIST
  FMT -->|"no"| OTHER
  LIST ==>|"clean"| SIG
  LIST -->|"blocked"| OTHER
  SIG ==>|"valid"| ONL
  SIG -->|"invalid"| OTHER
  ONL ==>|"active, or no answer"| PASS
  ONL -->|"blocked"| OTHER
  class READ edge
  class LIST cache

• A three-tier cache of tag status. Tier 1 is the lane's in-memory list, tier 2 the plaza server's copy, tier 3 the Mapper behind the acquirer. The lane reads tier 1 always and asks tier 3 when it can; the Week 4 multi-tier pattern, with the twist that the bottom tier is the only one that can be wrong in the user's favour.
• Fail open for valid tags, by rule. A gazette notification of 7 May 2018, quoted in NPCI's guidelines, says a vehicle with "a valid, functional NETC FASTag" and enough balance that can't pay because the plaza's ETC equipment malfunctions "shall be permitted to pass the fee plaza without payment of any user fee", with a zero-transaction receipt. So an ETC outage at the plaza costs the operator, not the driver. NPCI's guidelines apply the same principle when the lane loses its plaza server: the lane authenticates the tag, checks its exception list and lets the vehicle pass, and the crossing is sent later.
• Signatures are the offline trust anchor. With the issuer key certified by NPCI and the signature locked into the tag, the lane can authenticate any of 11.73 crore tags without a lookup. Key rotation is built into the EPC: an 8-bit key index lets an issuer sign new tags with a new key while old tags stay valid.
• The issuer checks again. The guidelines ask the issuer host to validate the signature from the TID, EPC and user memory in the transaction message, and to blacklist a tag whose signature is invalid. The lane catches forgeries at the roadside; the issuer catches a lane that didn't check.

# lane/decide.py

"""
The lane's barrier decision (illustrative). Uses only data already in the lane:
issuer IDs, the local exception list, NPCI and issuer public keys. The online
request-details check is used when it answers within the budget.
"""

import hashlib

BUDGET_S = 0.6                      # our choice: leaves time for the barrier to lift
BLOCKING = {"HOTLIST", "LOW_BALANCE", "BLACKLIST", "CLOSED"}


def decide(read, issuers: set, exceptions: dict, keys, online) -> str:
    iid = read.epc_issuer_id()                                    # 20-bit field of the EPC
    if iid not in issuers:
        return "OTHER_MODE"                                       # not a known NETC issuer
    status = exceptions.get(read.epc)
    if status in BLOCKING:
        return "OTHER_MODE"                                       # pay by UPI or cash
    issuer_key = keys.issuer_key(iid, read.epc_key_index())       # certified by NPCI's key
    digest = hashlib.sha256(bytes.fromhex(read.tid + read.epc)).digest()
    if issuer_key is None or not issuer_key.verify(read.user_mem.signature, digest):
        return "OTHER_MODE"                                       # forged or copied tag
    answer = online.request_details(read.epc, timeout_s=BUDGET_S)
    if answer is not None and answer.status in BLOCKING:
        return "OTHER_MODE"
    if status == "EXEMPT" or (answer is not None and answer.status == "EXEMPT"):
        return "PASS_EXEMPT"
    return "PASS"                                                 # online OK, or no answer in time

Deep Dive 2: Forty Reads, One Crossing, One Debit (Week 2 Concepts: Idempotency; Week 8: Event Ingestion)#

This builds on Week 2, Day 2 · Idempotency in Practice and Week 8, Day 1 · Event Ingestion.

What is published: NPCI's guidelines list duplicate checks at the acquirer, "Multiple requests from same Plaza with same transaction number", and at the issuer, "Checks on requests from the same NETC FASTag ID within same time or at far Plaza location". The lane controller or plaza server "should have the ability to detect multiple NETC FASTag affixed on the same vehicle", and an induction loop "may be used at the NETC Lane to identify incoming & outgoing of a vehicle". Chargeback reasons include duplicate processing by one or several issuers; for dispute code 3002, "Duplicate transaction done at Toll Plaza", the issuer submits the original transaction's RRN, reader read time and merchant ID. A tag processed at two plazas in "near time", an implied speed above 120 km/h, is treated as cloned; NHAI/IHMCL keep a compensation fund for proven cloning fraud. In July 2026 a Kochi resident was charged ₹125 at a toll plaza in Guwahati while his car was parked at home; the report lists the routes to recover such a charge: the 1033 helpline, an IHMCL email address for false deductions, and a dispute with the issuer bank (Onmanorama, 19 July 2026).

%% title: Removing duplicates at every hop, each with its own key
flowchart TD
  R@{ icon: "sd:scan", label: "37 reads<br/>tag T, lane 5" }
  G["Lane: group by tag and lane<br/>between loop enter and leave"]:::hot
  X["One passage<br/>plaza txn number"]:::core
  P@{ icon: "sd:server", label: "Plaza server<br/>outbox, resend on reconnect" }
  A{"Acquirer: seen plaza,<br/>txn number, read time?"}
  DROP["Drop duplicate"]:::bad
  S["Switch and issuer:<br/>same tag, far plaza, near time?"]:::core
  FR["Flag possible clone<br/>chargeback path"]:::bad
  R ==> G ==> X ==> P ==> A
  A -->|"yes"| DROP
  A ==>|"no"| S
  S -.->|"implied speed over 120 km/h"| FR
  class P service
  class R edge

• Three keys, three scopes. In the lane, the key is (tag, lane, passage); at the acquirer, (plaza, transaction number, reader time); at the issuer, (tag, time, place). Each removes a different kind of duplicate: radio repeats, network retries, and the physically impossible.
• The passage window comes from the road, not the radio. Grouping reads by a fixed time window fails in a jam, where one truck can sit in the field for minutes. Use the loop detector's enter and leave events, the classifier's vehicle profile and the barrier cycle to bound a passage.
• Cross-lane reads lose. When the same tag is seen by two lanes' antennas, the lane whose loop, classifier and barrier saw a vehicle wins; the other lane's reads are discarded. That's also how a tag on a dashboard waved across two lanes is caught.
• Impossible travel is a fraud signal, not a dedupe rule. Two genuine crossings can be minutes apart at neighbouring plazas. Only an implied speed that no vehicle could manage marks a clone; NPCI draws that line at 120 km/h.

# lane/passages.py

"""
Collapsing raw reads into passages (illustrative). Reads are grouped by tag and
lane between the loop detector's enter and leave events; a passage gets one plaza
transaction number, the idempotency key for everything downstream.
"""

import itertools

_seq = itertools.count(1)


class PassageBuilder:
    def __init__(self, plaza_id: str, lane_id: int):
        self.plaza, self.lane = plaza_id, lane_id
        self.open = None                                  # the vehicle now in the loop

    def on_loop_enter(self, t: float):
        self.open = {"start": t, "reads": {}}

    def on_read(self, epc: str, tid: str, antenna_lane: int, t: float):
        if self.open is None or antenna_lane != self.lane:
            return                                        # stray read: no vehicle, or a neighbour's antenna
        self.open["reads"].setdefault((epc, tid), []).append(t)

    def on_loop_leave(self, t: float):
        p, self.open = self.open, None
        if not p or not p["reads"]:
            return None                                   # no tag read: camera and ANPR handle it
        if len(p["reads"]) > 1:
            return {"violation": "MULTIPLE_TAGS", "tags": list(p["reads"])}
        (epc, tid), times = next(iter(p["reads"].items()))
        return {
            "txn": f"{self.plaza}-{self.lane}-{next(_seq)}",  # minted once, carried everywhere
            "epc": epc, "tid": tid, "reader_time": min(times), "reads": len(times),
        }

Deep Dive 3: Four Parties and a Switch (Week 2 Concepts: Timeout Hell; Week 5: Consistency Models)#

This builds on Week 2, Day 1 · Timeout Hell and Week 5, Day 1 · Consistency Models.

What is published: NPCI's guidelines say processing "between acquirer host, NETC switch, and Issuer host is always online", over stateless XML APIs on HTTPS. "All transaction which are processed by the NETC system to the issuer will be considered as successful transactions for the clearing and settlement in subsequent settlement cycle. The Issuer must honour all such transactions irrespective of whether Issuer is able to debit the NETC FASTag holder's account." A failed debit stays queued at the issuer; an unreachable issuer gets debit advice until it acknowledges or the settlement cut-off, and the acquirer sees "Deemed Accepted". Acquirers retry only after a status check, 60 to 180 seconds depending on the error, within 72 hours of the read. The NETC system and every member host target 99.95% availability, with health-check APIs, active-site pings and disaster-recovery drills; IHMCL's SLA penalises NPCI ₹10 lakh to ₹25 lakh a month if switching availability falls below 99.5%. Issuers must wait 5 seconds after registering or updating a tag, and 1 second after an exception change, before the next operation on it.

%% title: One debit across four parties, with the published failure rules
sequenceDiagram
  autonumber
  participant A as Acquirer host
  participant S as NETC Switch
  participant I as Issuer host
  A->>S: request pay · txn 4021-5-88123
  S-->>A: 202 accepted
  alt issuer answers
    S->>I: debit request
    I-->>S: debited, or queued for later
    S-->>A: response pay · success
  else issuer unreachable
    S->>I: debit advice, repeated until ACK or cut-off
    S-->>A: deemed accepted
  else no final response at the acquirer
    Note over A: wait 180 s after a 202 · then check transaction
    A->>S: check transaction 4021-5-88123
    S-->>A: found, success · nothing to resend
  end

• The switch is a router plus a ledger. It doesn't hold balances; it routes by issuer ID (from the tag's EPC or the Mapper), records every transaction, and hands them to NRCS for settlement. Its consistency guarantee is simple: what it processed, it settles.
• The issuer is the only party that knows the balance. So the issuer carries the credit risk of every transaction the switch forwards, and manages that risk by putting tags on the low-balance list early. A prepaid wallet with a minimum balance is the issuer's buffer.
• Status check before retry is idempotency by lookup. If the API doesn't carry an idempotency guarantee you can rely on, ask whether the first attempt landed before trying again. NPCI writes the waits into the rules, so a retry storm can't form from every acquirer timing out at once.
• Deemed accepted is eventual consistency with a deadline. The acquirer is told "success" before the issuer has debited; the issuer must catch up before the settlement cut-off. It's the right choice for a lane that has already lifted the barrier: the vehicle is gone, and the only open question is who pays whom.

# acquirer/present.py

"""
Presenting a crossing to the NETC Switch (illustrative). Before any retry the
acquirer checks whether the first attempt landed, with waits from NPCI's
guidelines, and gives up after 72 hours from the reader read time.
"""

import time

WAIT_S = {"202": 180, "NO_ACK": 90, "READ_TIMEOUT": 90, "CONNECT_TIMEOUT": 90, "HTTP_ERR": 60}
MAX_AGE_S = 72 * 3600


def present(switch, txn, now=time.time):
    outcome = switch.request_pay(txn)                       # same txn id every time
    while outcome.kind not in ("SUCCESS", "DEEMED_ACCEPTED", "DECLINED"):
        if now() - txn.reader_time > MAX_AGE_S:
            return "EXPIRED"                                # beyond 72 h: can no longer be presented
        time.sleep(WAIT_S[outcome.kind])
        found = switch.check_transaction(txn.id)
        if found is not None:
            return found.kind                               # it landed: never present it twice
        outcome = switch.request_pay(txn)
    return outcome.kind

Deep Dive 4: Low Balance, Hotlist and Blacklist: a Race Between Lists (Week 4 Concepts: Cache Invalidation; Week 5: Consistency Models)#

This builds on Week 4, Day 2 · Cache Invalidation and Week 5, Day 1 · Consistency Models.

What is published: NPCI's guidelines define the Mapper's exception lists. Low balance: the issuer adds a tag when the linked balance falls below a threshold and notifies the user. Hotlist: tags "in negative balance or with violation"; no new tag may be issued to a vehicle with a hotlisted tag. Blacklist: added by the issuer on written orders from RBI, NHAI/IHMCL, police, defence or other law enforcement, or with an FIR for a stolen vehicle, and removed only with the same authority's written approval. Exempted and invalid carriage cover vehicles exempt by law and vehicles used by people with disabilities. Closed/replaced (code 06) is final. A vehicle whose tag is low balance, hotlisted, blacklisted or closed is asked to pay another way. The issuer is "liable for the transactions up to 20 minutes" after adding a tag to a list; from 17 January 2025, transactions on tags "in exception for more than 60 minutes prior to the reader read time" and not removed within 10 minutes after it are declined by the switch with reason code 176 (another passage in the same guidelines gives 20 minutes for that check). Acquirers fetch the lists from the NETC system or as SFTP files and push them to plazas. IHMCL's SLA asks for a Blacklist_Diff file in each plaza's folder every 10 minutes and a full INIT file daily, and puts "All chargeback for low balance and blacklist" on an acquirer that misses them. Passes and exemptions travel in a separate discount (DIS) file. Issuers must offer top-ups through UPI and BBPS, print a UPI QR code on new tags, and offer AutoPay: RBI's circular of 22 August 2024 put auto-replenishment of FASTag, when "the balance falls below a threshold set by the customer", under its e-mandate framework without a pre-debit notification.

%% title: Status changes flow out; staleness has a price at every hop
flowchart TD
  ISS["Issuer host<br/>balance below threshold"]:::core
  MAP@{ icon: "sd:database", label: "NETC Mapper<br/>status change, timestamped" }
  ACQ["Acquirer host<br/>pull or SFTP"]:::core
  DIFF@{ icon: "sd:file", label: "Blacklist_Diff<br/>every 10 min" }
  INIT@{ icon: "sd:file", label: "INIT full list<br/>daily" }
  PS@{ icon: "sd:server", label: "Plaza server" }
  LANE["Lane's in-memory list"]:::hot
  ISS ==>|"add or remove"| MAP
  MAP ==> ACQ
  ACQ ==> DIFF ==> PS
  ACQ --> INIT --> PS
  PS ==> LANE
  class MAP store
  class DIFF,INIT queue
  class PS service

• Version the list, not just the entries. Every change in the Mapper gets a sequence number; every diff file says "changes from n to m". A plaza that missed a diff knows it, and asks for a catch-up instead of silently running on a gap. That's what turns "missed two diffs" into an alert rather than a loss.
• The liability windows are an SLA on invalidation. Twenty minutes of issuer liability says how long the network allows a block to take effect; the 60-minute rule says how stale a plaza is allowed to be before the loss is its own. Week 4's cache-invalidation trade-offs, priced in rupees.
• The lane's list is small enough to hold whole. At an assumed ~1.2 crore entries, a hash set of 96-bit IDs and status codes fits in a few hundred megabytes. A Bloom filter in front of it makes "not on any list", the common case, a single memory probe.
• Top-ups are the race to win. Ankit's ₹5,000 hit the issuer at 11:52 and the Mapper at 11:53. A design that lets the lane ask the Mapper directly for tags its list marks low balance would have let Rajesh through; that's why the request-details check sits above the local list in NPCI's priority order.

# switch/exception_rule.py

"""
The switch's decision on a transaction whose tag is in an exception list
(illustrative, following NPCI's published windows). Times are seconds; the
history comes from the Mapper's timestamped exception changes.
"""

DECLINE_IF_LISTED_BEFORE_S = 60 * 60     # in exception > 60 min before the read
UNLESS_REMOVED_WITHIN_S = 10 * 60        # ... and not removed within 10 min after it
ISSUER_GRACE_S = 20 * 60                 # issuer liable up to 20 min after adding


def decide(read_time: float, history) -> str:
    added = history.listed_since(at=read_time)          # None if the tag was clean at the read
    if added is None:
        return "FORWARD_TO_ISSUER"
    removed = history.removed_after(read_time)
    still_listed = removed is None or removed > read_time + UNLESS_REMOVED_WITHIN_S
    if read_time - added > DECLINE_IF_LISTED_BEFORE_S and still_listed:
        return "DECLINE_176"                            # plaza or acquirer carries the loss
    if read_time - added <= ISSUER_GRACE_S:
        return "FORWARD_ISSUER_LIABLE"
    return "FORWARD_ISSUER_MAY_CHARGE_BACK"             # our label: outside the grace window

Deep Dive 5: Offline Plazas and Settlement Three Times a Day (Week 3 Concepts: Transactional Outbox, Audit Logs; Week 2: Distributed Cron)#

This builds on Week 3, Day 2 · Transactional Outbox, Week 3, Day 5 · Audit Log System and Week 2, Day 5 · Distributed Cron.

What is published: NPCI's guidelines say transactions "should reach NETC Switch within 15 minutes of transaction initiation"; between 15 minutes and 3 days the switch processes them, but the issuer may charge back for insufficient balance "after the cooling period (currently 15 days)" and the acquirer "will not have any re-presentment rights"; after 3 days the switch declines them. A lane cut off from its plaza server "should authenticate the NETC FASTag data, check the exception list and allow the authenticated vehicle to pass through". An early revision required plazas to send a "Zero transaction file every 15 minutes". IHMCL's SLA has acquirers send each toll transaction from the plaza's folder to NPCI within 5 minutes, send reconciliation files to the plaza by 6:00 am and pay clean transactions within T+1 working day. There is no separate clearing file: "Each processed transaction is considered directly for settlement by the NRCS system." Three cycles a day settle through RTGS on all 365 days except RBI holidays: 16:00–23:59 at 10:30 the next day, 00:00–07:59 at 12:30, 08:00–15:59 at 18:30. (The same document's IHMCL SLA annex still lists four switch cut-overs, at 10:00, 14:00, 17:30 and 23:00; we follow NPCI's settlement table, and NPCI says it may add cycles by circular.) A Settlement Guarantee Fund, 10% from members and 90% through bank lines of credit, covers a member's default, with loss sharing among the rest. Disputes run through NRCS: debit adjustments within 5 days, credit adjustments within 30, chargebacks within 40, then re-presentment, pre-arbitration, arbitration and, since 15 October 2024, an NPCI Review Panel, a Panel for Resolution of Disputes and RBI as appellate authority. Payment data, including vehicle images, is kept for 10 years.

%% title: A crossing's life, from the lane to settlement
stateDiagram-v2
  [*] --> READ: tag read, passage formed
  READ --> STORED: written to the lane outbox
  STORED --> PRESENTED_ONTIME: reaches switch within 15 min
  STORED --> PRESENTED_LATE: reaches switch in 15 min to 3 days
  STORED --> EXPIRED: not presented within 3 days
  PRESENTED_ONTIME --> SETTLED: next NRCS cycle
  PRESENTED_LATE --> SETTLED: next NRCS cycle
  PRESENTED_ONTIME --> DECLINED: code 176, tag long in exception
  PRESENTED_LATE --> DECLINED: code 176, tag long in exception
  SETTLED --> DISPUTED: chargeback or adjustment
  DISPUTED --> SETTLED: resolved, net amounts moved
  SETTLED --> [*]
  DECLINED --> [*]
  EXPIRED --> [*]
  class SETTLED ok
  class EXPIRED bad
  class DECLINED bad
  class PRESENTED_LATE queue

• The outbox is the barrier's precondition. Write the crossing durably, then open. The order matters for the same reason as Week 3's transactional outbox: an action in the world (a barrier lifting) and a record of it must not be able to diverge.
• A heartbeat makes silence visible. A zero-transaction file every 15 minutes means a plaza with no traffic is distinguishable from a plaza with no link. Without it, an outage looks like a quiet night until the morning reconciliation.
• Late is priced, not refused. Fifteen minutes, three days and a 15-day cooling period draw the lines between "issuer's risk" and "plaza's risk". A network that refused late transactions would make every fibre cut a revenue loss; one that accepted them forever would make every wallet's balance meaningless.
• Settlement is a scheduled netting job. Three windows a day, each a distributed-cron run over everything the switch processed: sum each pair of banks, net each bank to one figure, send one instruction per bank to RTGS. The sum of all positions must be zero; if it isn't, the job stops.
• The guarantee fund turns credit risk into a known number. If an issuer can't pay its net debit, the fund pays the acquirers, and the defaulter, then the survivors, make it good. Plazas never wait on one bank's trouble.
• Every dispute is a new record, never an edit. Adjustments, chargebacks and verdicts are new messages with their own references and deadlines, settled in later cycles. The original transaction stays as it was: Week 3's audit log, with money attached.

# nrcs/net.py

"""
Netting one settlement window (illustrative). Every processed transaction moves
its amount from the issuer to the acquirer; each bank's net position is the sum.
The positions must sum to zero before one instruction per bank goes to RTGS.
"""

from collections import defaultdict
from decimal import Decimal


def net_positions(transactions) -> dict:
    pos = defaultdict(Decimal)
    for t in transactions:                       # every txn processed in this window
        pos[t.issuer] -= t.amount                # issuer pays
        pos[t.acquirer] += t.amount              # acquirer receives, then pays the plaza
        for party, fee in t.interchange():       # fees as published by NPCI, if any
            pos[party] += fee
    if sum(pos.values()) != 0:
        raise RuntimeError("window does not balance: stop and reconcile")
    return dict(pos)


def instructions(pos: dict, window: str) -> list:
    return [{"bank": b, "window": window, "debit" if v < 0 else "credit": abs(v)}
            for b, v in sorted(pos.items()) if v != 0]

Deep Dive 6: One Vehicle, One Tag, Across Forty Issuers (Week 5 Concepts: Conflict Resolution; Week 9: Tenant Isolation)#

This builds on Week 5, Day 4 · Conflict Resolution and Week 9, Day 1 · Tenant Isolation.

What is published: NHAI launched "One Vehicle, One FASTag" on 15 January 2024 after "reports of multiple FASTags being issued for a particular vehicle and FASTags being issued without KYC in violation of RBI's mandate"; only the latest tag would stay active, and tags with incomplete KYC would be deactivated or blacklisted after 31 January 2024. The deadline moved to 31 March 2024 because of Paytm FASTag users' difficulties (Onmanorama, citing PTI, 1 March 2024): RBI had directed on 16 February 2024 that Paytm Payments Bank accept no top-ups to wallets and FASTags after 15 March 2024, while balances stayed usable. NPCI's guidelines require that "Only the latest issued tag must stay active, and all the previous tags must be closed"; block migrating customers with hotlisted tags until dues are cleared; close tags issued on a chassis number that aren't updated with the registration number within 90 days; and require VAHAN verification, a linked mobile number, vehicle photos, re-KYV every 3 years, and a ₹10,000 penalty per data mismatch or badly affixed tag. NHAI charges double for a tag not fixed on the windscreen (July 2024) and has operators report loose tags for blacklisting (July 2025). From 1 February 2026, new car tags may be activated "only after validation of vehicle details from the VAHAN database", with no post-activation KYV. In April 2026 NHAI told issuers to validate the registration numbers on their tags and blacklist invalid ones, since MLFF enforcement depends on them.

%% title: Issuing a tag when the rule spans every bank
flowchart TD
  REQ@{ icon: "sd:user", label: "Rajesh asks bank D<br/>for a new tag" }
  VAH@{ icon: "sd:id", label: "VAHAN check<br/>VRN, chassis, class" }
  LOOK["Mapper: all tags<br/>on this VRN"]:::core
  HOT{"Any tag hotlisted?"}
  DUES["Collect dues by UPI QR<br/>then continue"]:::bad
  CLOSE["Old tags: low balance 15 days,<br/>then closed, code 06"]:::service
  ISSUE["Register and activate<br/>new tag, the only active one"]:::hot
  REQ ==> VAH ==> LOOK ==> HOT
  HOT -->|"yes"| DUES
  DUES --> CLOSE
  HOT ==>|"no"| CLOSE
  CLOSE ==> ISSUE
  class REQ client
  class VAH external

• A global uniqueness constraint needs a global index. Forty issuers are forty tenants with their own customer data, isolated from one another; the Mapper is the one shared index keyed by registration number. The new-tag check is a conditional write there: "register tag X for VRN V only if no other tag for V is active", the same pattern as a unique constraint across partitions.
• Conflicts resolve to the newest, by policy. When two tags exist, the latest issued wins and the rest close: a last-writer-wins rule chosen by the regulator, not by clocks, and made safe by keeping the losers in low balance for 15 days so in-flight transactions and chargebacks can still settle.
• Identity moved upstream. NPCI's guidelines let issuers activate a tag in real time and finish verifying it within T+3 days, blacklisting it otherwise. Since 1 February 2026, NHAI requires new car tags to be validated against VAHAN before activation. Checking at the door is cheaper than chasing millions of records afterwards.
• Accurate registration numbers matter more once barriers go. At a barrier, a wrong number on a tag is harmless if the tag pays. Without a barrier, the number is how an unpaid crossing becomes a notice to the right owner, which is why NHAI ordered the April 2026 clean-up.

# mapper/register.py

"""
Registering a new tag under one-vehicle-one-tag (illustrative). The check and the
write happen in one conditional operation on the Mapper's VRN index, so two banks
can't both activate a tag for the same vehicle at the same moment.
"""

class Blocked(Exception):
    pass


def register(mapper, issuer: str, tag: dict, vahan) -> str:
    v = vahan.lookup(tag["vrn"], tag["chassis"])
    if v is None:
        raise Blocked("vehicle not found in VAHAN: verify the RC before activation")
    tag["class"] = v.vehicle_class
    existing = mapper.tags_for_vrn(tag["vrn"])
    if any(t.status == "HOTLIST" for t in existing):
        raise Blocked("dues on a hotlisted tag must be cleared first")
    with mapper.tx(index=("vrn", tag["vrn"])) as tx:          # serialises writes for this vehicle
        for t in tx.active_tags():
            tx.set_status(t.epc, "LOW_BALANCE", reason="OVOT", close_after_days=15)
        tx.insert(tag["epc"], tag, status="ACTIVE", issuer=issuer)
    return tag["epc"]

Rajesh's Night#

What Changed: the Annual Pass#

What is published: NHAI launched the FASTag Annual Pass on 15 August 2025, at about 1,150 National Highway and National Expressway fee plazas: a one-time ₹3,000 for one year or 200 toll plaza crossings, for non-commercial vehicles with a valid FASTag. It "gets activated within two hours on the existing FASTag linked to the vehicle" after payment through the Rajmargyatra app or NHAI's website; it is non-transferable and valid only at NH and NE fee plazas, while at state highway and other plazas "the FASTag will use the existing wallet balance". On the first day, about 1.4 lakh users activated it by 7 pm and pass users received SMS messages "for zero deduction of toll fee". NHAI reported 25 lakh users and 5.67 crore transactions by 15 October 2025; MoRTH reported 36.13 lakh passes sold and ₹1,084 crore collected by November 2025; NHAI reported 50 lakh+ users and 26.55 crore transactions by 6 February 2026, with about 28% of car transactions on the NH network now made with the pass, and 56 lakh+ users by March 2026, when the fee for FY 2026–27 was revised to ₹3,075 from 1 April 2026. A pass can be gifted through the app by entering another vehicle's number.

• The pass is an entitlement on the tag, kept centrally. Our design: a pass registry keyed by tag and VRN (valid from, valid to, crossings used), owned by the programme rather than by any one issuer, with the pass bought once and honoured by every acquirer.
• Plazas learn about passes the way they learn about exemptions. NPCI's guidelines already carry passes and exemptions in a discount (DIS) file that takes priority over the blacklist file. Our design pushes new passes in the same diffs, which is consistent with a published activation time of "within two hours" rather than seconds.
• Count crossings centrally, idempotently. In our design, each pass crossing is still a transaction with a transaction number, presented through the switch for ₹0; the registry increments "crossings used" once per transaction number. The 200th crossing flips the pass to expired and the next diff removes it from the discount file.

Edge Cases#

Monitoring Dashboard#

SLOs for a Toll Network#

The interviewer leans back. "One more."

What is published: IHMCL signed the agreement with ICICI Bank for the Chorayasi MLFF system on 30 August 2025, with a second for Gharaunda on NH-44 in Haryana, and NHAI said it planned MLFF at around 25 fee plazas in that financial year; NHAI described MLFF as transactions "through reading of FASTag and Vehicle Registration Number (VRN) by High performance RFID Readers and ANPR Cameras". The e-notice rules above are from NHAI's launch release of 2 May 2026. MoRTH clarified in April 2025 that no decision had been taken to replace FASTag with satellite-based tolling nationwide from 1 May 2025, and that the "ANPR-FASTag-based Barrier-Less Tolling System" would be implemented at selected plazas. Satellite tolling is legal and piloted, not rolled out: MoRTH's amendment of 9 September 2024 (S.O. 3856(E)) added a GNSS on-board unit, an ANPR device or FASTag "or any combination thereof" as ways of collecting fees, allowed exclusive GNSS lanes (double fee for vehicles entering without a working unit), and set a zero fee for up to 20 km of journey in each direction a day under GNSS-based collection, for vehicles other than National Permit vehicles. GNSS pilots were run on the Bengaluru–Mysore section of NH-275 and the Panipat–Hisar section of NH-709 (MoRTH, Rajya Sabha reply, 24 July 2024).

Summary: Concepts Applied from 10-Week Course#

Why FASTag Matters#

Self-Assessment Checklist#

After studying this case study, you should be able to:

The lane:

The network:

Money and identity:

Sources#

NPCI and IHMCL:

• Book

  NPCI — Procedural Guidelines, National Electronic Toll Collection Network, version 2.1, hosted by IHMCL (four-party model; Switch, Mapper, NRCS; tag standards, EPC layout and static data authentication; request details first; transaction flow, 15-minute, 3-day and 72-hour windows, retry waits, deemed acceptance; exception lists, 20- and 60-minute rules, reason code 176; duplicate checks and the 120 km/h near-time rule; three settlement cycles, netting, guarantee fund, disputes and dispute code 3002; one tag per vehicle, VAHAN, re-KYV; 99.95% availability; IHMCL SLAs for list files, processing, reconciliation and T+1 payment; the 2018 gazette rule on unread tags), document history to "29th February 2025": https://ihmcl.co.in/wp-content/uploads/2025/12/NETC_PG_V2.1.pdf

• Paper

  NPCI — NETC Procedural Guidelines, version 1.9, 10 March 2023 (for comparison): https://ihmcl.co.in/wp-content/uploads/2023/02/NETC_PG_V1.9_.pdf

MoRTH, NHAI and PIB:

• Book

  PIB (MoRTH) — Year End Review 2025 (40 issuers, 12 acquirers; 11.73 crore tags; ~₹184 crore and ~120 lakh ETC transactions a day in FY 2025–26 till November; FASTag lanes from 15–16 February 2021 and M and N vehicles from 1 January 2021; user fee by year, ₹61,408.15 crore over 52,748 km in FY 2024–25; 36.13 lakh Annual Passes, ₹1,084 crore), 30 December 2025: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2209837

• Paper

  NHAI — 'One Vehicle One FASTag' initiative, 15 January 2024: https://nhai.gov.in/nhai/sites/default/files/2024-01/Press_Release-One_Vehical_One_FASTag_0.pdf

• Read

  PIB (MoRTH) — Double toll for non-affixed FASTag, 18 July 2024: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2034064

• Read

  PIB (MoRTH) — New Toll Collection System (GNSS pilots on NH-275 and NH-709), Rajya Sabha reply, 24 July 2024: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2036273

• Paper

  MoRTH — S.O. 3856(E), National Highways Fee Amendment Rules, 2024 (GNSS, ANPR or FASTag; GNSS lanes; zero fee up to 20 km), 9 September 2024: https://acma.in/uploads/otherdocmanager/Final_S.O.3856(E)_GNSS_On_Board_Unit_9Sept24.pdf

• Read

  PIB (MoRTH) — NHAI debars 14 fee collection agencies (Mirzapur raid; ₹100 crore+ securities forfeited), 20 March 2025: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2113332

• Read

  PIB (MoRTH) — Clarification on satellite-based tolling from 1 May 2025 (no nationwide decision; ANPR-FASTag barrier-less tolling at selected plazas), 18 April 2025: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2122632

• Read

  PIB (MoRTH) — Reporting 'Loose FASTag' for blacklisting, 11 July 2025: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2143962

• Read

  PIB (MoRTH) — FASTag Annual Pass implemented (15 August 2025; ~1,150 plazas; ₹3,000 for a year or 200 crossings; ~1.4 lakh users on day one), 15 August 2025: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2156992

• Paper

  NHAI — Agreement for India's first MLFF tolling system (IHMCL and ICICI Bank; Choryasi and Gharaunda; ~25 plazas planned), 30 August 2025: https://nhai.gov.in/nhai/sites/default/files/2025-09/NHAIPressRelease-NHAI-Gujarat.pdf

• Read

  PIB (MoRTH) — Annual Pass crosses 25 lakh users (5.67 crore transactions; NH and NE plazas only; non-transferable), 15 October 2025: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2179426

• Read

  PIB (MoRTH) — Gift a FASTag Annual Pass, 18 October 2025: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2180638

• Read

  PIB — Redefining India's Highways (~98%, 8 crore+ users; cash 2× and UPI 1.25× for non-FASTag users from 15 November 2025), 11 November 2025: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2188705

• Paper

  NHAI — KYV discontinued for cars on new FASTags from 1 February 2026, 1 January 2026: https://nhai.gov.in/nhai/sites/default/files/2026-01/NHAI_Press_Release-01-01-2026-Eng.pdf

• Read

  PIB (MoRTH) — One Year, Many Journeys Made Easier (40 lakh+ passes; UPI at 1.25×; MLFF at Choryasi scheduled for 2026), 14 January 2026: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2214528

• Read

  PIB (MoRTH) — Annual Pass crosses 50 lakh users (26.55 crore transactions; ~28% of car transactions now on the pass), 6 February 2026: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2224484

• Read

  PIB (MoRTH) — Annual Pass fee revised to ₹3,075 from 1 April 2026 (56 lakh+ users), 15 March 2026: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2240305

• Read

  PIB (MoRTH) — NHAI directs validation of FASTag registration numbers, 15 April 2026: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2252275

• Read

  PIB (MoRTH) — India's first MLFF tolling system launched at Chorayasi (~41,500 vehicles on day one; e-notice rules), 2 May 2026: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2257491

Reserve Bank of India:

• Read

  RBI — Paytm Payments Bank Ltd under Section 35A (no FASTag top-ups after 15 March 2024), 16 February 2024: https://www.rbi.org.in/scripts/BS_PressReleaseDisplay.aspx?prid=57345

• Read

  RBI — Processing of e-mandates for recurring transactions (FASTag auto-replenishment without pre-debit notification), 22 August 2024: https://www.rbi.org.in/scripts/FS_Notification.aspx?Id=12722

Reporting:

• Read

  Onmanorama (PTI) — 'One Vehicle, One FASTag' deadline extended to March end, 1 March 2024: https://www.onmanorama.com/news/business/2024/03/01/one-vehicle-one-fastag-deadline-extended.html

• Read

  Onmanorama — What if your FASTag wrongly debits highway toll charges (₹125 charged in Guwahati to a car parked in Kochi), 19 July 2026: https://www.onmanorama.com/news/kerala/2026/07/19/fastag-fraud-recovery.html

Design note: the internals of lanes, plazas, acquirers, NPCI's switch and Mapper, and issuers, the code, thresholds, dashboards and every number labelled as an assumption are an illustrative design, not the systems of NPCI, IHMCL, NHAI, any bank or any toll operator. Peak factors, lanes per plaza, reads per crossing, exception-list sizes, lookups per crossing, the final challenge's figures and the Annual Pass registry are assumptions. Rajesh Yadav, his son, his truck and the plazas, times and fares in his story are invented. NPCI's rules change by circular; check current instructions before relying on any window or fee.

Further Reading#

Related systems to study:

• Side quest

  UPI (Bonus Problem 1 in this series): NPCI's other big switch, where the payer starts the payment and both sides see the result in seconds

  ↗(opens in new tab)
• Side quest

  Visa and Mastercard (Bonus Problem 4): authorisation now, clearing and settlement later, chargebacks and arbitration

  ↗(opens in new tab)
• Side quest

  Razorpay (Bonus Problem 18): settlement and reconciliation from a payment aggregator's side

  ↗(opens in new tab)
• Side quest

  IRCTC (Bonus Problem 11): another national public system where identity rules and a central registry shape the design

  ↗(opens in new tab)

Foundational concepts (this course):

• Lesson

  Week 2, Day 1 — Timeout Hell

  ↗(opens in new tab)
• Lesson

  Week 2, Day 2 — Idempotency in Practice

  ↗(opens in new tab)
• Lesson

  Week 2, Day 5 — Distributed Cron

  ↗(opens in new tab)
• Lesson

  Week 3, Day 2 — Transactional Outbox

  ↗(opens in new tab)
• Lesson

  Week 3, Day 5 — Audit Log System

  ↗(opens in new tab)
• Lesson

  Week 4, Day 2 — Cache Invalidation

  ↗(opens in new tab)
• Lesson

  Week 4, Day 5 — Multi-Tier Caching

  ↗(opens in new tab)
• Lesson

  Week 5, Day 1 — Consistency Models

  ↗(opens in new tab)
• Lesson

  Week 5, Day 4 — Conflict Resolution

  ↗(opens in new tab)
• Lesson

  Week 8, Day 1 — Event Ingestion

  ↗(opens in new tab)
• Lesson

  Week 9, Day 1 — Tenant Isolation

  ↗(opens in new tab)
• Lesson

  Week 9, Day 5 — Security Architecture

  ↗(opens in new tab)

"Let the lane decide with what it already holds, mint one number per crossing, and write down who pays for every minute of delay."