Carry the release path onto machines already in the field.
A machine that has been working for years does not have to become a new machine to run a named way of working. It needs a path: something by which a person on the crew can choose a named, signed package before the work starts, and by which a signed count line comes back. Fitting that path is your business. Nothing in it touches the machine's safety case.
You are adding a way to choose and a way to count. You are not adding something that drives.
Say that to a fleet's maintenance manager in one breath and the conversation gets easier, because it is the thing they are actually worried about.
What the fitted path adds
- A way for a person on the crew to choose a named, signed package before the work starts.
- A way for that machine to take the package, or decline it and say why.
- A way for a signed count line to be written where the work happens, and returned.
What it never adds
- Anything that drives, steers, lifts or stops the machine.
- Anything inside the safety system, or in the path of a decision that system is entitled to take.
- Anything that sends a recording of the work anywhere, in either direction.
The machine you fit works the way it did the day before you arrived. Its controls are its controls, its interlocks are its interlocks, and its operator is still the person who decides what the machine is going to do next. What you have added sits alongside all of that: a named choice made before the work, and a signed row written during it.
The same specification, on the same terms.
One document. Every party that builds against it holds the same one — machine makers, kit companies, and the machine company inside our own group.
There is no kit-company edition, no reduced version for retrofit work, and no term available to a maker that is not available to you. Where a change affects what a fitted path must do, it is issued to everyone building against the interface at the same time, in the same words.
This matters to you more than it matters to anyone else on this site. You fit onto machines built by companies you do not control, and onto machines built by companies you do not control. A specification a maker could quietly extend is a specification you cannot build a business on, because the extension would arrive as a field failure on somebody else's iron. There is one document, so there is nothing to extend privately. The specification is available under NDA — tell us what you fit and what it goes onto.
The addition sits alongside. The dashed rules are the part to read.
Everything inside the dashed box was on the machine before you got there and is in the same condition after. The path you fit runs beside it and joins nothing.
Fig. 1 — The fitted path, drawn alongside what was already there. Dashed rules mark what the addition never touches.
A person on the crew chooses by name, before the work starts.
No default. No last-used. A machine carrying yesterday's choice forward would be running on nobody's authority.
The choice is an act, and the act has to be made every time. What you fit may not choose on its own, may not carry a choice from one job into the next, and may not present a name as already selected and waiting to be accepted. It offers the names the fleet holds a licence for, and it waits. If nobody chooses, nothing licensed runs and the machine works the way it always did.
The ordering behind that rule is the same one the whole site is built on, and it is absolute. The package proposes. A person authorizes. Safety has veto. Nothing you fit may sit between the second and the third, and nothing you fit may stand in for the second.
One name runs at a time, chosen deliberately, by a person, before the work starts. A machine that selects for itself is a machine running on nobody's authority.
The count comes off the machine you fitted, signed where it happens.
The act that clears the machine to run is the act that starts the meter. Clearance and invoice come off one signed row, so neither can be adjusted without the other. That row is signed at the machine, at the moment, and it is the same row the invoice is built from and the same row the person whose way of working ran is paid from. Not a copy of it. Not a reconciliation against it. The same row.
What that asks of the kit is exact: the count is written where the work happens and signed there. A count assembled somewhere else afterwards is a claim about hours rather than a record of them, and a fleet owner checking their invoice will find the difference immediately. The full mechanism, and what a second party can check against it, is on the count.
Nothing you fit ever sends a session anywhere.
A machine never receives a session and never returns one. This is the line that must not be crossed in either direction, and it is not a policy we state. It is the shape of the path.
What crosses towards a machine is a release: a sealed package a named person signed for, built for the controls that machine already has, carrying a digest of what went into it and never the contents. What comes back is a count line. Not a recording, not a fragment of one, not a stream of the work being done, and nothing from which anyone's way of working could be put back together.
The reason the boundary runs both ways is worth having in your own words when a customer asks. A machine that could return a session would be a machine collecting the work of whoever happened to sit in it that day, and that person consented to nothing. Consent is read at the moment of recording, in a seat, on the person's own say, and a consent given afterwards does not reach back over work already done. So there is no path by which a fitted machine gathers it later, because such a path would be gathering without it.
When a skill is withdrawn, what you must do is bounded and exact.
It is a short list of acts performed once, not an open-ended duty, and the timing is ruled rather than negotiated.
- 01Notice arrivesNo new job starts under that skill from that day. It stops being choosable, and what you fitted stops offering the name.
- 02The running job finishesA job already underway runs to its end, because stopping a machine mid-pass is its own hazard. That is the one delay in it, and neither we nor you can extend it.
- 03The package is unloadedIt comes off every driver it was loaded onto. Every copy is deleted, backups included.
- 04You confirm in writingThe confirmation is what closes the obligation. Two dates are carried and never collapsed into one: the out-of-service date, and the true date, the day the last copy is gone.
That is the whole of it. A withdrawal is never a breach by us and never a failure of supply, and it gives you no claim of any kind — which means it is not an event to write around in your contracts so much as one you need to be able to perform. Build the unloading and the confirmation into what you fit now, while it is a design question, rather than later, when it is a phone call. The ruled timing in full is on withdrawal.
Fitting kit onto machines that are already working?
Tell us what you fit and what it goes onto. The specification is available under NDA.