Updating a Rented Robot: Agree on Approval, Recovery and Return Records

A rented robot may need a software update or configuration change while it is at the customer's site. The rental company, the site operator and the equipment manufacturer may each have a role, so the decision should not be left to an undocumented button press. Agree who can authorize the change, what evidence is kept and how the machine will be checked before returning to service.

Establish the delivered configuration

At handover, record the robot and controller identities, installed software and relevant options, connected accessories and the configuration that supports the agreed task. Note who owns the equipment and who is responsible for its operation. A version shown on a screen is useful, but it does not describe every parameter, external device or safety setting in the workcell.

Protect backups and configuration records according to the parties' information-security requirements. If the customer supplies its own programs or production data, agree how those materials are stored and returned. The rental record should identify the approved configuration without exposing credentials or confidential process files.

Define who can request and approve a change

Before a change is applied, identify its purpose, affected equipment, proposed timing and the people who must approve it. The rental agreement and site procedures should clarify whether the customer may change settings, whether the rental provider must perform updates and how manufacturer support is involved. A temporary user's operational need does not automatically grant authority to modify safety or system settings.

NIST's Guide to Operational Technology Security discusses documented maintenance, approved tools and configuration checks after maintenance or patching. It is general guidance; the robot's manufacturer instructions, site risk assessment and contract determine the actual process.

Review compatibility and recovery before updating

Ask whether the proposed software is intended for the exact controller, robot and installed options, and whether it affects the customer's application or connected devices. Identify the source of the update, the expected downtime and a manufacturer-supported recovery plan. A version number from a different model or a file received through an unverified channel is not sufficient evidence of compatibility.

NIST's software and firmware update profile discusses incorporating updates into configuration and change management. It is an organizational reference rather than a procedure for a specific robot. The responsible team should determine the appropriate backup, verification and recovery steps for the equipment.

Coordinate the work at the rental site

Schedule the change with the people responsible for the machine, the surrounding process and site safety. Record the approved window and the person performing the work. If remote support is involved, agree how access is authorized and terminated and which actions are permitted. A successful network connection does not authorize an unapproved configuration change.

For a hypothetical rental, the provider proposes an update to address a reported issue during a customer's production run. The customer needs to know the affected software, planned interruption and verification plan; the provider needs to know about the customer's connected equipment and operating constraints. If either party cannot confirm the scope, the change should remain pending until the responsible people resolve it.

The parties should also identify who communicates the planned work to operators and whether a backup or copy of the customer's approved program is needed. A backup may contain sensitive production information and should be protected under the agreed access and retention rules. Ask where the copy will be held, who can retrieve it and how it will be handled after the rental. Do not assume that a backup created for one controller can safely be restored to a different machine without the manufacturer's approval.

Verify and document the resulting state

After an authorized change, qualified personnel should perform the checks required by the manufacturer and site procedures. Record the version installed, configuration changes, checks performed, outcome and any remaining restrictions. A screen showing the new version is not by itself evidence that the application, safeguards and connected equipment all function correctly.

If the expected checks cannot be completed within the approved window, record the incomplete status and identify who decides the next step. A rollback, a later service visit or an extension of downtime may each have different implications. The rental provider and customer should agree on communication and approval before work resumes, rather than assuming that either side can decide for the other.