800 stations, 100 million sprays: what running a fleet unattended taught us

In 2020 hand sanitiser became, for a few months, the most important product on the planet, and Woolworths needed it at scale, fast, in every store. The brief we took on was for a station that did more than dispense. It had to know how much liquid it had left, how many people it had served and when something had gone wrong, and it had to tell someone. Five of us designed the station, the board and the firmware, and built the platform that keeps every unit refilled and accounted for, under lockdown, without the option of handing any of it to anyone else.

The fleet now stands at more than 800 units in 500 stores. Together they have counted over 100 million sprays. What follows is what we learned from running them, and it applies to any product that has to live on a wall somewhere without a person standing next to it.

1. The device has to know its own state

The cheapest sanitiser station is a pump and a bottle. Ours measures its own level, counts every spray and reports both, which made the hardware more expensive and everything after it cheaper. A unit that knows it is running low can ask to be refilled before a customer finds it empty. A unit that knows it has not been used for a day in a busy store can flag that it is probably blocked. Every useful thing the platform does downstream starts with the device reporting honestly on itself. Build the sensing in from the start; it cannot be added to a fleet later.

2. Design the refill, not the dispenser

The dispenser is the easy part. The hard part is the loop around it: when does a unit need attention, who gets told, how do they know which unit, and how does the system know the job is done? We spent far more of the design on that loop than on the mechanism, and it is why the fleet runs unattended. The store app shows each unit's level and days to empty, the person doing the rounds knows exactly which stations to carry refills to, and the counts reconcile against stock. The product is the loop. The hardware is the part of the loop you can touch.

3. Everything breaks in ways the lab never showed you

In the lab, a unit sat on a bench with good power and good signal. In a store, it is mounted near a door that opens every few seconds, in a mall with patchy connectivity, cleaned by someone with a wet cloth, bumped by trolleys and occasionally unplugged by a shopfitter. Firmware that assumed a steady connection had to learn to buffer readings and catch up. Sensors had to be read in ways that tolerated a knock. Mounting hardware changed after the first stores. None of this was knowable from a desk; all of it was knowable from the first twenty units. Put a small number into real stores early and treat what they teach you as the specification.

4. Over-the-air updates are the product's life support

With 800 units in 500 stores, a firmware fix that needs a technician and a ladder is a project, with a budget and a schedule of its own. Over-the-air updates were in the design from the first version, and they are the reason the fleet has kept improving rather than slowly rotting. The discipline around them matters as much as the mechanism: updates go to a few units first, the platform watches them for a day, and only then do they roll on. A fleet update that goes wrong everywhere at once is the nightmare, and it is avoidable.

5. The data pays for itself, but only some of it

A hundred million sprays is a satisfying number. The useful numbers are smaller. Sprays per unit per day tells a store where to put its stations. Level against time tells the operations team how many refills a week each store needs and lets them plan a route instead of reacting to complaints. A unit with a sudden drop to zero use in a busy store is almost always a fault, found hours before anyone would have reported it. We log a great deal more than that, and most of it has never been looked at. Decide early which three or four numbers somebody will act on, design the screens around those, and keep the rest cheap.

6. Unattended means boring, and boring is the goal

The best thing anyone has said about the fleet is that they do not think about it. Units report, refills happen, faults get flagged, updates roll out, and the people responsible for 500 stores spend their attention elsewhere. Getting there took every one of the lessons above, and the measure of a connected product in the field is exactly this: how little attention it needs from the humans around it.

What this means for your product

If you are planning a fleet of anything, the sanitiser station is a useful mirror. Make the device honest about its own state. Design the loop around the device before the device itself. Get a small number into the real environment early and let them rewrite the spec. Build over-the-air updates in from day one and roll them out carefully. Pick the few numbers that drive action. And aim for a product that nobody has to think about, because that is what unattended actually means.

We built all of this once under lockdown. We would be glad to build yours in calmer conditions. Send us a brief, or write to hello@handee.co.za.