In build · running on one plant’s real data · design-partner round open
The operating system for WCM and TPM manufacturing excellence.
The method, enforced by the software — not remembered by three people.
Book a plant walkthroughThe stitched stack
Five tools on a plant floor, and none of them owns the loop.
Each one is defensible on its own. Between them sit four asset hierarchies that never agree, and a methodology that lives in the binder.
- CMMS
- Work orders, no losses, no pillar to report into.
- OEE tool
- Counts the loss. Owns none of it.
- Obeya boards
- The SQCDP wall, retyped by hand every week.
- Connected worker
- Competency, in a tool blind to who closed the breakdown.
- Excel and the binder
- Where the method actually lives.
One question no screen answers: which standard changed because of the stoppage in week 32?
What it refuses to do
Software that admits what it cannot see.
Every dashboard in this market opens green. This one opens grey, and grey means nobody has looked.
rows one plant can read of another’s
That number was not always nought. Auditing our own cell turned up forty tables leaking to a tenant that had never existed — 22,952 live rows, 8,372 of them notifications carrying names, employee codes and roles. Today all 214 tenant-stamped tables carry FORCE row-level security, and a gate in the pipeline re-proves it from scratch on every change. We publish the before-number because a vendor who has never found anything in their own product has not looked.
- It will not serve one plant a row belonging to another
- Every table in the cell that carries a tenant id has FORCE ROW LEVEL SECURITY, with no exceptions and no list of “except these”. A gate in the pipeline stands a whole cell up from migrations, clones a real row into each of those tables for two tenants, then reads the cell as a tenant that never existed — and it names the handful of tables it could not seed rather than quietly skipping them.
- It will not paint a machine green because nothing is wrong
- Green requires a measurable standard AND a reading taken against it. A machine nobody has measured is grey and the tile says “not monitored”. On the plant we demonstrate against, that is most of the plant, and the board says so above the grid where it cannot be scrolled past.
- It will not call an unassessed person compliant
- A person with no competency record reads “not assessed”, with a sentence explaining that this is not the same as compliant — nothing can be compared to a required level, so no gap can be claimed either way.
- It will not draw a total it cannot reconcile
- The cost matrix agrees with the KPI summary for the window on the screen, or it refuses to draw. A cost centre that went quiet keeps its column at zero rather than vanishing, because a missing column is the one defect a reviewer never spots.
- It will not let a breakdown cost anyone a grade
- A breakdown may raise a person’s level or leave it flat. It may never lower one. That is a database CHECK constraint rather than a line of service code, so it holds on every path — including a psql session and a backfill script.
- It will not close an EWO whose own countermeasures are still open
- A countermeasure spawns an assigned work order in the same transaction. Advancing the EWO to checked answers 422 and names every order still open. Closure also has to move a standard — the ledger, the SMP, the calendar or a person’s training.
Measured on the demonstration cell — one automotive plant’s real extract, alongside a second tenant that exists only to prove the two cannot see each other, 11 August 2026. Plant figures move; the mechanisms above do not.
EWO-native breakdowns
A work order loses the learning. An EWO cannot.
One numbering series — EWO, EWO-Q, S-EWO — so coverage is a number you can report, including the part of it that is still uncovered.
The record is the workbook your people already know: ten tabs, six MTTR phases, 5W1H, five parallel 5-Why chains, a three-level cause — and a closure that has to move a standard before it is allowed to close.
The WCM agent
It proofreads the plan. It never writes.
Ten deterministic rules, and one check that asks a model to read a 5-Why chain and say whether it holds. Both are advisory, both are dismissible with a reason.
The proposed interval is outside the reliability window.
PM pillar, step 4 — time-based maintenance holds while σ/MTBF ≤ 0.2. Beyond that, screen for condition-based work instead of shortening the interval.
Illustrative values on a real rule. The judgment check pseudonymises the text before it leaves the cell, and renders back the exact words the model was shown.
Ten pillars. One spine. One place the numbers agree.
Every fact carries the same three dimensions — where on the org tree, when in the CD-year, which pillar owns it. A rollup is always the sum of its children.
Pricing
Per site. Unlimited operators.
Per-seat pricing charges you for adoption, so plants ration licences and the pillar quietly dies. Banded by assets that carry an active machine ledger — a number your own ledger already holds.
Maintenance execution that is WCM-literate on day one.
The maintenance department
Pillar depth: criticality, roadmaps, reliability, quality, energy, safety.
The pillar leaders, with an assessment on the calendar
Cost deployment, the blue room, people development, early equipment.
The programme office, across plants
The whole pricing model — add-ons, the design-partner round, and the questions procurement asks first.
Design partners
We are choosing three to five plants.
Deep discount, in exchange for reference logos and real access to your WCM practitioners — the people who know where the standard and the spreadsheet disagree.