How to Commission a Thousand Devices

The pilot went well. Ten devices, installed by two engineers who knew the system, each one configured by hand over a laptop and USB cable, each one verified by the person who built it. Then the rollout is approved and the number becomes a thousand, installed by contractors who have never seen the product, and every assumption that made the pilot work quietly fails at once.

Commissioning is not installation. Installation is the bracket, the cable and the power. Commissioning is everything after: the device gets an identity, joins a network, receives its configuration, registers with the platform, proves it is working, and becomes a named asset in a system somebody can maintain. At ten units you can do that by hand. At a thousand the manual steps are not merely slow, they are the source of the defects.

Identity comes first, because everything else depends on it. Every device needs a unique credential that cannot be forged or copied off a sibling. A shared key baked into the firmware is the tempting shortcut and the one that ends worst: one extracted key compromises the entire fleet and there is no revocation short of a firmware campaign. The alternative is a per-device credential — an X.509 certificate is the usual form — with the private key generated inside a secure element or TPM and never leaving the chip. The better products do this at manufacture, so the device arrives with a birth certificate and the installer never handles a secret at all.

That enables zero-touch provisioning, which is the pattern worth building toward. The device powers on, reaches a bootstrap endpoint, proves who it is with its manufacturing credential, and receives its operational credentials and configuration in return. It then stops using the bootstrap identity. Nobody types a password, no spreadsheet of keys exists, and the installer's job shrinks to mounting the hardware and confirming a green light.

The step most often missing is claiming — binding a device to a site, an asset and a customer. A fleet of a thousand correctly provisioned devices that nobody can locate is a worse outcome than a hundred installed slowly, because every subsequent alarm is unactionable. The usual mechanism is a code on the enclosure that the installer scans with a phone, tying serial number to site, position and asset tag at the moment of installation. If that record is created later from memory or a photograph of a clipboard, it will be wrong for a meaningful fraction of the fleet, and the errors will surface one at a time over years.

Configuration should be data, not keystrokes. The device asks for its configuration and the server answers based on identity and role, with the result versioned and reproducible. When an installer chooses settings on site, the fleet becomes a population of one-offs, and the first firmware update that assumes a common baseline finds out the hard way. It also means a device can be replaced by shipping a blank one: the new unit claims the old one's asset position and inherits its configuration.

Design the procedure for the person who will actually perform it. That person has no laptop, may be on a ladder in poor light wearing gloves, has patchy cellular coverage, and gets one visit. The target is a few minutes with an unambiguous success signal — a status light or a tick in an app — and no decisions. If the device cannot tell the installer it has succeeded, nobody knows until the data does not arrive, and a second visit costs more than the device.

Verification belongs inside commissioning rather than after it. When a device registers, the platform should run an automated acceptance check before marking the asset live: the expected sensors are reporting, their values are physically plausible, the clock is synchronised, signal strength is above the threshold that predicts reliable delivery, and the firmware is the version it should be. A device that passes is commissioned. A device that does not raises a ticket while the installer is still on site, which is the only moment when fixing it is cheap.

Then plan for the unglamorous paths, because at a thousand units they are all common. Partial commissioning, where the device is claimed but never verified, needs a state of its own and a queue somebody owns. Replacement needs identity to attach to the asset position rather than the hardware, so that history survives the swap. Decommissioning needs credential revocation, or the fleet accumulates valid identities in skips and on eBay. And certificates expire: a device with a ten-year service life and a one-year certificate needs automated renewal designed on day one, because the alternative is a fleet-wide outage on a date somebody already knows.

Measure three things and the rest follows: the proportion of installations that succeed first time, the median time on site per device, and the second-visit rate. They convert commissioning from a story about installers into a number that engineering can improve — and a fleet you can commission reliably is, not coincidentally, a fleet you can update, monitor and eventually retire.