Commissioning and Handover¶
This chapter answers one question: what has to be true before a robot leaves the building?
Not "how do I install the software" — that is a build step and lives with the code. This is the list a service technician works through before a device goes onto the truck, and the state that device has to be in when the customer switches it on for the first time.
The rule behind all of it, in one sentence: after switching on, nothing must be visible except our application. No desktop, no browser chrome, no launcher, no error dialogue of an operating system nobody at the customer site has ever seen. If somebody at the customer site can reach a file manager, we have shipped a computer instead of a robot.
The five states of a device¶
A device moves through these in order. Each one is checkable, and none may be skipped.
| State | What is true | Checked by |
|---|---|---|
| Assembled | chassis runs, tablet mounted, network wired | manufacturing |
| Identified | own key pair generated, serial number read from the chassis | Identity |
| Enrolled | known to the cloud, certificate issued, assigned to a customer node | Cloud enrolment |
| Locked down | kiosk mode active, technician password set, our app is the only thing on screen | Kiosk mode |
| Accepted | acceptance list signed off, log clean, handover documented | Acceptance |
A device that has not reached Enrolled must not go out. That is not a formality: an unenrolled device cannot report a fault, cannot be updated remotely, and cannot be found again if the customer moves it to another floor.
Why enrolment happens here and not at the customer site¶
It would be technically possible to enrol the device on arrival. We do not, for three reasons, and each has cost us something in the past.
The customer network is not ours. Enrolment needs an outbound connection. Whether that exists at the customer site is discovered on the day of installation, in front of the customer, and by then the technician has two hours and no second option. Done at our site, it either works or we notice weeks earlier.
A device without identity cannot be told apart. Two identical robots on a truck differ by exactly one thing: the serial number of their chassis. If that is not tied to a certificate and a customer node beforehand, the first fault report reads "one of the two".
The reset secret is issued during enrolment. Whoever forgets the technician password on an unenrolled device has no way back except a factory image.
What travels with the device and what does not¶
Travels with it: the certificate, the assignment to a customer node, the fleet key of that site, the technician password, the maps recorded during commissioning.
Does not travel with it: our internal measurement data, tour histories from the test bench, the map archive of other customers, and any account of ours. A device leaving the house is checked for exactly these — see Acceptance.
Data location
In every customer-facing channel the correct statement is: data in Europe, data centre Frankfurt. Any wording that claims data stays inside Germany is not to be used.