By Badanga Ishak
On Sunday 24 November, a counter that had been running since 1 January 1993 filled up. The counter is a 24-bit field called the Token Identifier, buried inside every twenty-digit electricity token sold to a prepaid meter built to the Standard Transfer Specification. It stores the number of minutes elapsed since a base date, and its only job is to stop a customer from entering the same token twice.
Thirty-one years of minutes is roughly 16.7 million, and 16.7 million is what 24 bits will hold. When the field overflowed, every affected metre’s sense of time reset to zero, and every token generated after that moment began to look, to an un-upgraded metre, like a token from the distant past. Old tokens stopped working. New ones were rejected as stale.
The remedy had been known for more than a decade and was, technically, trivial: two twenty-digit key change tokens entered by hand at the meter, resetting its base date from 1993 to 2014 and buying the specification another twenty years. Nigeria’s regulator, the Nigerian Electricity Regulatory Commission, had begun telling customers to collect those tokens from their distribution companies in August 2023, fifteen months ahead, and had made clear they were free.
The distribution companies published portals and call-centre scripts. Eko Electricity Distribution Company set its own deadline to match the global one. By the week after the rollover, it was telling customers who had missed it that they could still upgrade, but that until they did, they would not be loading credit onto anything.
It was, in the way these things are usually described, a Y2K problem: a fixed date, a known fix, a long runway, and a tail of assets that would not be reached in time. Y2K was, for most systems, a rollback problem. If the patch went wrong you restored the previous build, replayed the batch, and reconciled overnight. The TID rollover was not that.
A meter is a small computer in a locked box on the outside wall of a house, with no network, no operator console, and no undo. Once a token had been generated against a stale key and handed to a customer, no amount of engineering discipline on the vending side could reach into that box and take it back. The money had left an account. The token existed. The electricity did not arrive.
For a certain kind of engineer working in Nigerian financial and utility infrastructure, that gap between an action being complete and an action being correct is not a once-in-thirty-one-year’s event. It is Tuesday.
Software quality culture inherited its instincts from environments where undo is cheap. A database transaction either commits or it doesn’t. A migration has a down script. A deployment has a previous image still sitting in the registry. Version control turns a mistake into a revert.
Nearly every tool a modern engineer touches in a working day is built on the premise that the last action can be withdrawn, and the mental model that premise produces is difficult to switch off at the boundary where it stops being true.
Nigeria’s payment infrastructure crossed that boundary years ago and has been accelerating away from it since. The Central Bank’s own half-year figures put the NIBSS Instant Payment platform at 5.6 billion transactions worth about ₦477 trillion in the first six months of 2024 alone, up 39 per cent in value on the preceding half-year, with July setting a fresh single-month record. NIP is account-number-based and real time, and its defining promise to the beneficiary is instant value. Instant value is another way of saying that the credit leg is final on arrival.
What the regulations describe as a reversal is therefore not a rollback in the engineering sense at all. It is a second, compensating transaction, and the rulebook reads accordingly. A failed NIP transaction that is not reversed into the customer’s account within 24 hours of a complaint attracts a ₦10,000 penalty per item.
Where a sending institution has pushed value in error — wrong account, wrong amount, a duplicate it must request the reversal in writing within fourteen working days, and the receiving institution obliges within one business day only if the funds are still sitting there. If they are not, the receiving institution’s job changes from correcting a record to persuading a human being to give money back, with watch-listing and law enforcement at the end of the escalation path. Unresolved cases go to a dispute resolution system operated at NIBSS.
Read that as an engineer rather than a compliance officer and the point becomes stark. The industry’s entire reversal apparatus exists because the platform itself cannot reverse anything. Every mechanism in it is social and procedural: a written request, a counterparty’s cooperation, an inferred indemnity, a regulator’s fine, a dispute forum. The rulebook is not a rollback feature. It is the industry’s collective admission that no rollback feature is possible, and an attempt to civilise the aftermath.
The same structure holds, in a cruder form, in electricity vending. A third-party vending platform sits between a customer’s bank, its own float, and a distribution company’s token-generation infrastructure. Three ledgers, none of which it fully controls, and one physical device at the end of the chain that will accept exactly one valid token and cannot be queried about what it did with it.
The canonical example in vending is the retry. A customer pays, the platform calls the token-generation service, and the call times out. Nothing about a timeout tells the caller whether the request was received. The obvious behaviour, try again, is also the behaviour that mints a second token against the same payment, or the same token against a second debit, depending on which side the ambiguity fell. Neither outcome can be corrected by writing a better error message afterwards.
The defence has to exist before the request is made, in the form of an idempotency key that lets the platform ask “did this exact instruction already happen?” and get an answer it can trust, and in the form of a reconciliation process that treats disagreement between the three ledgers as an expected state rather than an incident.
That is why, in his practice, reconciliation is treated as a feature under test rather than an operations chore performed after the fact. A test case that confirms a successful vend is a low-value test case; the platform will produce thousands of successful vends a day without help. A test case that confirms the system’s behaviour when the debit succeeded and the token did not, when the token was generated but never delivered, or when a customer’s meter rejects a perfectly valid token because it has not taken its key change, is the one that pays for itself.
There is a limit to what pre-release testing can promise on systems of this kind, and Ishak is direct about where it sits. You cannot test your way to certainty on a system that touches real money in the real world,” he says. “What you can do is make sure the system tells you quickly when it is wrong and that there is a defined path back to correct.”
In practice, this means treating post-release measurement as part of the quality function rather than as reporting. The Superset dashboards he works with across the bank’s customer, loan and revenue data are, in the conventional reading, business intelligence. Read as a QA instrument, they are a continuous assertion about the health of the system: a disbursement volume that moves without a corresponding movement in customer acquisition, a revenue line that steps rather than curves, a loan cohort that behaves unlike every cohort before it.
None of those is proof of a defect. All of them are the shape a defect makes when it has already reached production, and on an irreversible system the interval between a defect reaching production and someone noticing is the interval in which the damage is denominated.
The most consequential part of the work, though, may be the least technical. He has built and delivered a structured three-month quality assurance curriculum inside the organisation an attempt to make quality a property of how the team works rather than a checkpoint one person guards. The reasoning follows directly from everything above.
A single QA engineer positioned at the end of the pipeline is, structurally, a rollback: a last chance to catch what is already built. On systems where the real risk sits in the design of the compensating path, the useful intervention happens when the developer is deciding what the system should do about a timeout, not when a tester is reviewing a pull request three weeks later.
The TID rollover has now passed, and the industry’s attention has moved on with the speed reserved for problems that did not become catastrophes. Meters that took their key change are counting minutes from 2014 and will do so until roughly 2045. Meters that did not are dark boxes waiting for two twenty-digit numbers, and the distribution companies are working through the tail.
What does not pass is the class of problem it illustrated. The trend line in African digital infrastructure runs firmly toward finality: instant interbank transfers that settle in seconds, prepaid utility tokens that live in devices with no network, credit disbursed to a phone number, and agent networks moving cash in places where the only meaningful record is the one the system wrote. Each of those is a system where the interesting question is not whether the software can be rolled back, because it cannot, but whether the organisation building it has been honest with itself about that.
The rollback illusion is the belief, inherited from environments where it was true, that a mistake is a temporary state. Quality assurance for the systems Nigeria is now building starts by giving that belief up and by treating the compensating path, the reversal, the reconciliation, the dispute, and the second token as a first-class feature that deserves the same scrutiny as the transaction it exists to correct.
Somewhere in Lagos this week, a customer is standing at a meter, entering a twenty-digit number that will not be accepted, having already paid. Nothing in that sequence was reversible. Everything in it was testable.
**Badanga Ishak is a Quality Assurance Engineer
