The single most repeated workflow inside any FTTH ISP is "activate a new subscriber." Done by hand, it is fifteen to forty-five minutes of NOC time, mostly in copy-paste, with a 6–12% error rate that produces some of the most expensive truck rolls in the business — the ones you create yourself. Done correctly, the same workflow is unattended, 8 minutes wall-clock, and the customer goes online before the engineer hangs up.
What "zero-touch" actually requires
Many vendors will sell you "automated provisioning." Few of them deliver the full path. End-to-end zero-touch has four moving parts, all of which have to be present:
- 1Order intake — a structured plan + customer record arrives from the CRM, not a human in a chat thread.
- 2ONU identity discovery — the OLT sees a new unregistered serial number and the ACS sees a new TR-069 inform — they have to be reconciled to the order in the CRM.
- 3Profile push — service profile, VLAN, QoS, RADIUS state, IP plan all pushed to the right scope (OLT port, ONU index, CPE LAN).
- 4Verification — the platform actually measures that the line came up, the speed matches the package, and the CPE responds to a synthetic test, then closes the order.
A test that exposes most vendors
Ask a vendor to provision a new subscriber start-to-finish using only API calls — no UI clicks, no shell access. If the answer requires manual steps anywhere in the four blocks above, it is not zero-touch; it is partial automation.
The OLT-side mechanics
On the OLT, zero-touch hinges on two things working together: the OLT vendor's pre-config policy (auto-find / auto-authorise unregistered ONUs against a serial-number whitelist), and the platform's ability to inject the whitelist entries the moment the order is created. The most common production breakage is a race condition between the two — the ONU is on the line before the whitelist has been pushed, the OLT rejects it, and the platform has to retry. Robust implementations idempotently re-push the whitelist and tolerate the race.
The CPE-side mechanics — ACS does the rest
Once the ONU is authorised on the OLT and gets an IP address (or PPP session), the CPE checks in with the ACS via TR-069 (or TR-369). At this point the ACS pushes the configuration the subscriber's plan dictates: WiFi SSID and password (or per-subscriber WPA3 PSK), firmware version if a downgrade/upgrade is needed, WAN settings, QoS classes, and feature flags. Modern ACS implementations can do all of this in one connection — versus the chatty older pattern of three round-trips and a reboot.
CRM ↔ NMS ↔ ACS — the data plane
The reason most operators end up with "automated except for one step" is that the data does not flow cleanly between the systems involved. The CRM knows the customer, plan and address. The NMS knows the OLT, port and ONU. The ACS knows the CPE serial number. Tying these three together at the moment of activation is the actual integration work — not the configuration push itself.
NetXol short-circuits this by holding all three in a unified data plane. The activation flow is a single transaction that touches the subscriber object, the network object and the CPE object — never a row in three different databases that has to be reconciled later.
What gets measured
| Metric | Before | After | Δ |
|---|---|---|---|
| Activation wall-clock | 3 days (queue-bound) | 8 min | −98% |
| Engineer minutes per activation | 22 min | 0 (only exceptions) | −100% |
| First-week error rate | 7% | 0.6% | −92% |
| Avoidable truck rolls / 1k activations | 24 | 3 | −87% |
The exception path matters more than the happy path
You will get fully zero-touch on roughly 92–97% of activations. The remaining 3–8% are exceptions — wrong serial number on the box, fibre splice not done, customer not actually at the address. Where automation lives or dies is in how cleanly those exceptions are escalated. The platform should pause the order, attach the diagnostic evidence, route to the right role and not block the other 95%.
The 95th percentile customer experience
In a zero-touch pipeline, the customer's first interaction with your network is not waiting on a NOC ticket — it is the WiFi SSID that auto-appeared with the name the agent told them on the call.
