Design and Evaluation of a QR-Based Unmanned Car Wash Bay with Gateway-Free UPI Verification, Presence-Bound Sessions and Fault-Tolerant Recovery

DOI

https://www.doi.org/10.59256/indjcst.20260503081

Published In

Volume 5, Issue 3 (2026)

Published Online

September-December 2026

Pages

639-653

Article Type

Case Study

Check for updates

Small car and bike wash centres in India still keep an attendant to collect money and run the pump, even though most customers now pay by UPI QR code. Existing IoT wash and vending systems either confirm payment through a paid gateway or do not say how a paid session is protected against duplicate credits, late payments, remote misuse and power failure. This paper presents and evaluates an unmanned pay-per-use wash bay built from an ESP32 bay controller, a Next.js customer page, an Express API server and a Kotlin merchant app on the owner's phone. Customers pay the owner's UPI ID directly, and the server confirms each payment without a gateway. Its matching algorithm gives every order a unique amount, uses the bank's 12-digit UTR as an idempotency key, collects evidence from two independent channels (the UPI app notification and the bank SMS), allows a grace window for late payments and falls back to a UTR entered by the customer. Each wash is tied to the bay by a rotating HMAC token on the display and a physical START button, and every pump command carries a monotonic counter so that it cannot be replayed. Remaining paid time is journalled in the ESP32's non-volatile storage and restored with a one-time resume code after a power or network failure. In a 30-replication discrete-event simulation of one to eight bays, the proposed matcher confirmed 99.5 to 99.8% of paid orders and made two wrong-order confirmations in about 21,600 simulated orders (0.09 per 1000). Amount-only matching confirmed 80.9 to 92.3% and made up to 144 wrong-order confirmations per 1000. On the bench prototype, the mean time from payment to an armed bay was 3.12 s (95% CI [2.98, 3.26]), the mean signed timer error was +0.14% (mean absolute error 0.18%), and the bay recovered from all 100 forced failures (50 power cuts and 50 network losses) without losing paid time.