A bench instrument, not an oracle

A gearbox part comes back from the field with a complaint attached to it and very little else. Someone photographs it, someone writes a sentence in a spreadsheet, and the part goes in a bin. Six months later the same mode appears on a different batch, and nobody can prove it, because the first record said “worn” and the second said “pitting” and neither cited anything.

The failure was never the hard part. The record was. Witness makes the record the product: a damage mode with a clause number, a severity with an action attached, a cause mechanism, and a link back to the batch that produced the part.

• The bench inspector

  Gets a starting position and a clause number instead of a blank field, and keeps the final call.

• The quality engineer

  Gets a defensible record that cites a standard, and a fleet view that separates a supplier problem from a duty problem.

• The warranty team

  Gets findings linked to batches and a printable report, so a repeated mode becomes a case rather than an anecdote.

Witness uses two stages, because the two questions are different and a single model answers them both badly.

A confidence gate sits after stage two. High confidence files the record. Low confidence queues it for a person. The gate is the only place in the system where the software decides whether a human is needed, and its threshold is visible rather than buried.

The modes carry the standard’s own numbering. The cause mechanisms are a separate axis on purpose: the same pit can come from fatigue at end of life or from a contaminant dent that seeded it early, and the action a fleet takes is different in each case. The taxonomy page lists every code.

Each workspace is a tenant. Postgres row-level security scopes every reference photograph, finding and batch to the tenant that created it, so one workspace cannot read another’s rows. The anomaly model runs as a stateless function that receives feature vectors and returns a score. It holds no database credentials.

Confirmed records export as JSON on demand, with the model’s suggestion and the human decision side by side. That pairing is the asset. It belongs to the plant that produced it.

• It does not measure. A photograph gives no hardness, no roughness and no dimension. Witness classifies appearance, and appearance alone cannot close every diagnosis.
• It does not judge remaining life. Severity maps to an action, not to a number of hours.
• It does not work outside its two part families. A part that is neither a rolling bearing nor a gear tooth is out of scope, and the system says so rather than guessing.
• It does not treat its own suggestion as a fact. An unconfirmed record stays marked as unconfirmed until a person confirms or corrects it.

An inspection tool that hides its uncertainty is worse than no tool, because it moves the error somewhere nobody is looking. The model card states the current limits in full.

1. 1

   Enrol the reference set

   Normal is defined per workspace. A plant that runs its gearboxes hot has a different normal from one that does not, and the memory bank must hold the right one.

2. 2

   Accumulate confirmed records

   Each confirmation or correction is a labelled pair. The set grows with use rather than with a separate labelling project.

3. 3

   Train on the plant's own labels

   Once the confirmed set is large enough, it trains a classifier that matches the parts this plant actually returns, not a public benchmark.

4. 4

   Close the loop back to the batch

   Findings link to batches and suppliers. The fleet cube then shows which mode concentrates where, which is the point of the whole exercise.