MES · Manufacturing execution

Every machine on one board.
Every part, provable.

The factory’s operating system, proven on a small scope first. It shows what every machine is doing right now, tells each operator what to run next, and refuses to let a job start or a certificate be issued when the conditions for it are not met.

How it works

One bus up from the machines, three ways back down to people.

Every asset publishes through a small edge gateway onto one event bus. The MES governs what happens next: which operation may start, which record may be written, which certificate may be issued. What comes back out is three views of the same truth, an operator terminal at the machine, a live board for the floor, and an assistant you can ask why.

MACHINING EDGE MEASURING EDGE SURFACE TREATMENT EDGE INSPECTION EDGE MACHINING EDGE ONE EVENT BUS · UNIFIED NAMESPACE MES execution quality record OP 130 · CELL 1 SIGN & START OPERATOR TERMINAL LIVE OVERVIEW · 5 ASSETS LIVE BOARD needs attention MES AI · ADVISORY Why is cell 2 behind? Its gauge falls out of calibration in 40 minutes. Suggest: run op 150 first Where is the queue building? Deburr holds six jobs while two machining cells idle. Suggest: move two to cell 4 What blocks release today? Order 4471 has an open NCR and an unsigned FAI report. Suggest: route it to MRB
01 Machines publish through an edge gateway. Nothing on the floor talks to the cluster directly.
02 One bus, one namespace. Adding the thirtieth machine costs what the third did.
03 The board shows every asset, and flags the one that needs a person.
04 Ask the assistant why. It explains from the data and suggests. You decide.

Modules

Nine modules, one record.

Execution, quality, metrology and traceability are not separate systems that reconcile overnight. They write into the same ledger, under the same interlocks, in the same transaction.

1 2 3

Live overview and flow map

A live board of every machine’s state, alarms and part flow, plus a material-flow map with visit numbers and documented return legs, updated by push rather than by refresh.

SIGN

Operator terminal

A machine-scoped touch terminal showing the dispatched operation and its work instruction, gating Start and Record behind refusing interlocks and an electronic signature.

MRB

Quality: FAI, NCR, MRB, CAPA

AS9102 first-article inspection with CMM auto-import, alongside the full non-conformance spine: NCR lifecycle with lot containment, MRB disposition with customer flow-down approval, and CAPA / 8D.

UCL LCL

Metrology and SPC

The calibrated-asset register, Zeiss Calypso and Q-DAS measurement ingestion, and SPC control charts. This is the authority behind the question “is this gauge trustworthy right now?”

Genealogy and Certificate of Conformity

An append-only as-built ledger per serial number with heat and lot where-used traceability, ending in a gated, immutable certificate archived to write-once storage.

Telemetry and historian

High-frequency machine telemetry lands in a time-series store with live state, alarm history and shift timelines, then egresses to the plant’s long-term historian.

Alerting and notifications

A configurable trigger catalogue turning quality, calibration, certification and integration events into localized email and in-app alerts, with platform alerts relayed into the operations Microsoft Teams channel.

ERP PLM MES

ERP and PLM integration

Anti-corruption adapters to ISAH ERP and Windchill PLM, each shipping with a simulator mode so the platform runs standalone before a single integration is live.

Identity and gateway

Microsoft Entra ID single sign-on, role- and permission-based access, and step-up MFA electronic signatures, all behind one API gateway that validates every call.

The design decision that matters most

Interlocks refuse. They never warn and continue.

A permissive interlock is the worst failure mode in a regulated quality process, because it produces a record that looks compliant and is not. Every gate in this system returns early rather than logging a warning and letting the operator through.

NADCAP PT LEVEL 2 START REFUSED the operator is not certified for this operation

Certification

Operator scope is checked before the operation starts, not after it finishes. Fluorescent penetrant inspection requires a PT Level 2 certification; anodizing requires NADCAP accreditation. Without it the operation does not begin.

CAL OVERDUE 12 d RECORD REFUSED the gauge fell out of calibration twelve days ago

Calibration

A gauge or measuring machine that is out of calibration cannot record a measurement. The calibrated-asset register is the authority, and it refuses rather than warns, so no result exists that would later have to be withdrawn.

110 130 150 REFUSED operation 130 has not been completed and no signed concession exists for skipping it

Sequence

An operation out of routing order cannot be started. If there is a legitimate reason to move it, a signed concession is recorded first and becomes a permanent part of the as-built record.

critical ops signed no open NCRs FAI report signed REFUSED one gate open, so the certificate is not issued

Certificate readiness

A certificate of conformity is issued only when three independent gates pass: every critical operation signed, no non-conformance open, and the first-article report signed. One gate open is one certificate not issued.

The event-driven factory

One data bus. No point-to-point wiring.

Most factories integrate machine by machine: every new controller means a new cable, a new script, a new screen. Adding the thirtieth machine should cost what adding the third did, and it does, because every machine publishes into the same namespace and nothing is integrated twice.

Most factories

Machine by machine

3 integrations per machine

Every consuming system needs its own cable to every machine. Four machines and three consumers is twelve separate integrations, each built and maintained on its own, and the fourth machine reused nothing the third had already solved.

How we build it

One event bus

1 integration per machine

A machine is integrated once, at the edge, and publishes into one broker. Everything above it subscribes to a namespace rather than to a machine, so the same four machines cost four integrations and adding the thirtieth touches nothing above the broker.

Inside the bus

Four layers, and what each one is for.

The right-hand architecture above, taken apart. Read it the way a machine’s data travels: it meets the edge, the edge publishes to the broker, the namespace organises what is on it, and the stores keep what has to outlast the shift.

01 Edge

Translate

Edge gateways convert proprietary controller and metrology protocols into one common event format, close to the machine, with local buffering and filtering. Machines never reach the cluster directly.

OPC UA · MTConnect · Calypso / Q-DAS

02 Broker

Transmit

The broker is the integration boundary. Producers and consumers depend on the broker contract, not on each other, which keeps machines, MES and analytics decoupled.

MQTT (Mosquitto) · RabbitMQ

03 Unified Namespace

Organise

One stable, hierarchical view of plant state on an ISA-95 topic tree, in a plain-JSON envelope that stays deliberately human-readable, because AS9100 auditors read it.

aero/sibiu/{area}/{cell}/{machine}/{metric}

04 Stores

Collect

Telemetry lands in a time-series store; relational and document stores hold only derived, aggregated and transactional data. Keeping the firehose off the database is what lets this scale factory-wide.

Time-series · PostgreSQL · WORM archive

The benchmark

Built to produce evidence, not just data.

We built against AS9100D, AS9102 and NADCAP because it is the most demanding evidence regime we could find, not because the system only works in aerospace. Certification belongs to your quality system, not to software, and we will never claim otherwise.

AS9100D

The aerospace quality system is the default throughout, not a lowest common denominator.

AS9102

First article inspection, with measurement results imported from the CMM rather than retyped.

NADCAP

Accreditation scope is enforced as an interlock before the process runs, not filed as a note.

HEAT 3.1

EN 10204 3.1

Material certificates are carried through the genealogy record of every serial number.

MFA

Electronic signature

Step-up MFA through Entra Conditional Access. The signature manifest is rendered verbatim.

40 YEARS

Retention

10 to 40 years per customer flow-down. Certificates of conformance 40 years, write-once.

IT ZONE OT ZONE

IEC 62443

Edge gateways publish northbound only. Nothing on the platform connects inbound to the edge.

Export control

Marked records need an authorization claim. Denials are audit logged and links are single use.

Rollout

Prove it on two machines. Then scale it across the factory.

Adoption is deliberately narrow at the start. Prove the pattern on two real machines and a simulated fleet, and every machine after them costs about a day.

  1. Stage one

    The pilot

    Two live machines, a machining centre and a coordinate measuring machine, prove every layer with real data. Simulated assets alongside them prove the scale, so a procurement lead time never blocks the work.

    • One controller type, one measurement device
    • One routing, end to end
    • Live board, operator terminal and quality spine
    • Simulated fleet for scale testing
  2. Stage two

    The other controller types

    One real machine per remaining controller family: Fanuc, Okuma, MTConnect, Siemens. Each needs one adapter, written once, at roughly two to four weeks per type.

  3. Stage three

    The whole factory

    Every remaining machine of a type already proven. No new software: a registry entry and a maintenance slot, at roughly half a day per machine.

MES

Start with the machine you argue about most.

The pilot pattern is deliberately small: one controller, one measurement device, one routing. Prove the layer works with real data from a machine your team already distrusts, and the rest of the factory becomes a registry entry.