UX Design · Study deck

Device Lifecycle Management: Review Stages

A connected product needs evidence from setup through retirement.

UX Uma is your guide for this deck.

device-lifecycleprovisioningota-updates
UX Uma, the module guide, in a scene from this chapter.
iotclass.org

After studying this chapter

Learning objectives

You will be able to:

  • Trace lifecycle review path across its components and failure boundaries.
  • Validate worked review: shared building device with a concrete scenario and pass criteria.
  • trace lifecycle review path across its components and failure boundaries
  • 'validate worked review: shared building device with a concrete scenario and pass criteria'
iotclass.org

Major section

Lifecycle Review Path

Retire: revoke credentials, wipe local data, remove cloud records, recycle or dispose, and close the asset record.

  • The review is incomplete if any stage depends on informal knowledge that is not recorded.
Connected device lifecycle review path.
Connected device lifecycle review path.
iotclass.org

Major section

Lifecycle Stages

The strongest planning output is not a long document.

  • Identity, ownership, firmware baseline, cloud or gateway enrollment, and reset behavior are also part of the lifecycle record.
  • In Figure: Device provisioning flow from manufacturing through user setup, retain: Phase 2 beside: Activate so manufacturing and provisioning remains explicit.
  • Commissioning checks whether the device works in its real context.

Key terms

Ownership transfer
Ownership transfer is a lifecycle stage, not an edge case.
IoT device lifecycle state model.
IoT device lifecycle state model.
iotclass.org

Major section

Lifecycle Stages (continued)

A device that passes bench testing can still fail after it is placed near metal, water, concrete, heat sources, moving machinery, human bodies, or sealed cabinets.

  • Operation evidence shows whether the device can be trusted after deployment.
  • Monitoring should distinguish healthy silence from a failure.
  • OTA and configuration updates change a deployed device.
  • They need their own lifecycle gate.
iotclass.org

Major section

Lifecycle Stages (continued)

Connected devices often change owners, accounts, sites, gateways, or tenants.

  • A low-rate sensor may report rarely by design, but the system still needs a way to tell whether the device is asleep, offline, misconfigured, blocked, or retired.
  • Maintenance covers the recurring work needed to keep the device useful.
  • Ownership transfer is a lifecycle stage, not an edge case.
iotclass.org

Major section

Lifecycle Stages (continued)

A sealed device can still need cleaning, reset, update, replacement, or retirement.

  • Devices that cannot be safely transferred can create privacy, support, and security risks.
  • Decommissioning removes a device from service without leaving active trust relationships behind.
  • The decommissioning record should make it clear that the device no longer has authority in the system.
iotclass.org

Major section

Lifecycle Readiness Record

Together, what remains and who signs frame the lifecycle readiness record claim: connected device lifecycle readiness record.

  • For lifecycle readiness record, what remains supplies visible evidence; who signs constrains the decision.
  • Health signals: heartbeat, last-seen rule, battery or power state, local logs, error states, and safe-state behavior.
Connected device lifecycle readiness record.
Connected device lifecycle readiness record.
iotclass.org

Major section

Worked Review: Outdoor Battery Sensor

A battery-powered outdoor sensor reports site conditions through a local gateway.

  • Lifecycle evidence to request: Unit identity and firmware baseline are recorded before installation.
  • The installation record includes mounting, enclosure orientation, signal path, and service access.
  • Battery level is checked before any update attempt.
  • OTA update path includes compatibility, staged rollout, verification, and rollback.
iotclass.org

Major section

Worked Review: Outdoor Battery Sensor (continued)

Maintenance includes cleaning, battery replacement, seal inspection, and reset.

  • Decommissioning revokes credentials and removes the unit from gateway and cloud inventory.
  • A field sensor also needs evidence for update, maintenance, failure recovery, transfer, and retirement.
  • Change condition: Rerun the review when the enclosure, mounting, antenna path, battery, gateway, firmware, update policy, reporting interval, maintenance access, or deployment environment changes.
iotclass.org

Major section

Worked Review: Shared Building Device

A shared building device provides local status and accepts commands from authorized users.

  • Lifecycle evidence to request: Device authority and user roles are separated from normal telemetry.
  • Local status shows whether the device is online, offline, updating, or locked out.
  • Maintenance instructions cover physical access, cleaning, logs, and support escalation.
iotclass.org

Major section

Common Findings

The lifecycle record stops at installation and ignores operation, update, transfer, or retirement.

  • Provisioning is treated as Wi-Fi setup only, with no identity or ownership evidence.
  • The device has no clear way to distinguish sleeping, offline, failed, reset, and retired states.
  • OTA readiness is claimed without power, storage, compatibility, staging, rollback, or post-update evidence.
iotclass.org

Major section

Common Findings (continued)

Maintenance depends on physical access, tools, accounts, or permissions that are not recorded.

  • Ownership transfer does not wipe local data or rotate credentials.
  • Decommissioned devices can still reconnect or appear active in dashboards.
  • Environmental evidence was collected on the bench instead of in representative deployment conditions.
  • The record lacks an owner, known limit, open issue, or change condition.
iotclass.org

Deck summary

Key takeaways

Retire: revoke credentials, wipe local data, remove cloud records, recycle or dispose, and close the asset record.

  • The strongest planning output is not a long document.
  • A device that passes bench testing can still fail after it is placed near metal, water, concrete, heat sources, moving machinery, human bodies, or sealed cabinets.
  • Connected devices often change owners, accounts, sites, gateways, or tenants.
  • A sealed device can still need cleaning, reset, update, replacement, or retirement.
iotclass.org

Retrieval practice

Recall check

UX Uma says: answer from memory, then check your reasoning.

Q1A device record shows successful first-day installation, but it does not explain firmware rollback, low-power update deferral, ownership transfer, or credential revocation. What is the strongest review response?

AHold lifecycle acceptance until update recovery, transfer, and decommissioning evidence are recorded
BApprove the lifecycle record because the device connected successfully on the first day
CIgnore ownership transfer because most devices keep the same owner forever
DTreat OTA rollback as optional if the update server is reliable
Show answer

Answer: A A lifecycle review must cover the full device journey from provisioning through retirement, with evidence for update recovery and authority removal.

iotclass.org

Print reference

Answers

Answer key.

  1. A · A lifecycle review must cover the full device journey from provisioning through retirement, with evidence for update recovery and authority removal.
iotclass.org