1Introduction
A critical-fastener warranty claim arrives from an original equipment manufacturer naming a vehicle identification number and a date. The supplier must establish which station built that unit, which tool performed the joint, which operator was signed on, what torque and angle were achieved, and whether the tool was within calibration at the time.
Every one of those facts was measured. None of them, in a conventional installation, was written down together. The torque controller recorded a result keyed to itself; the line recorded a build sequence; the calibration log lives in a quality system. Assembling them into an answer is a forensic exercise, and the claim has a response deadline that the exercise does not respect.
This paper describes a system built so that the answer is a stored record rather than a reconstruction. Its two load-bearing decisions are that every controller writes into one normalised schema regardless of vendor, and that every fastening is bound to a vehicle identity at the moment it occurs.
1.1The cost of not knowing
The direct cost of a forensic investigation is the labour it consumes, and that is the smaller half. The larger half is that while the investigation runs, the supplier cannot bound the population at risk. Containment must therefore be conservative, and a conservative containment quarantines vehicles that were never affected.
This is why traceability query time is an economic variable rather than a convenience. The product's own record states that containment requests are answered in minutes rather than days and that traceability queries resolve in under a minute. The value of that is not the time saved answering; it is the units not quarantined.
A supplier who cannot bound the affected population pays for the units they cannot exclude. Query speed is containment size by another name.
1.2Contributions
- A normalising acquisition layer that integrates five controller vendors over Open Protocol, ToolsNet and TCP/IP into one fastening-event schema.
- An identity-binding condition making a fastening record admissible only when it resolves to a vehicle identification number at capture time.
- Capability estimation per joint, per shift and per line, with the control-state distinction that determines whether capability or performance indices may be reported.
- An eight-dimension capability reference framework for torque traceability systems.
2Background and Related Work
Three regimes bound what a torque traceability system must be able to state: the quality-management obligation, the fastening risk classification, and the statistical treatment of the results it captures.
2.1The evidence obligation
IATF 16949 requires automotive suppliers to demonstrate effective process control, and demonstration means producing evidence on request. It further requires that error-proofing devices be verified and that a documented reaction plan exist for the case where a device fails.
Both requirements have architectural consequences rather than procedural ones. Verification must be scheduled and recorded per device, which means the system must know its own instrument estate. And a reaction plan must be enforceable rather than advisory — the station has to know what to do when its own sensor becomes suspect, which is a runtime behaviour rather than a document.
2.2Which joints must be detected, not merely tightened
VDI/VDE 2862 Blatt 1 classifies bolted joints in automotive applications by the consequence of failure — loosening, bolt breakage, or loss of the bolt or nut. The classification determines the minimum requirement for detecting incorrect tightenings, and therefore the minimum capability of the tightening system, ranging from a simple torque tool at the lowest category to a monitored and documented system at the highest.
The consequence for software is that joint classification must be governed master data enforced by the capture layer, not an attribute recorded in a quality document. Where classification lives in a document, it and the tooling actually applied will diverge, and the divergence is discovered during an audit rather than before one.
2.3Capability, performance, and the control state
Fastening results form a distribution, and ISO 22514 provides the indices that describe it. Part 1 supplies general principles and concepts; Part 2 addresses time-dependent process models and draws the distinction that matters operationally: processes in statistical control, for which capability indices Cp and Cpk are appropriate, and processes that are not, for which performance indices Pp and Ppk are the correct statistic.
This is not a technicality. A fastening station whose mean drifts with tool temperature across a shift is not in statistical control, and reporting Cpk for it overstates confidence in a way that is invisible in the number itself. A system that computes both pairs and states the control state alongside them is reporting something an auditor can act on.
Verification tooling carries its own governance. ISO 6789-1 specifies design and quality conformance requirements and the content of a declaration of conformance for hand torque tools; ISO 6789-2 specifies calibration and the determination of measurement uncertainty. A traceability record quoting a verification torque without the calibration state of the verifying tool is incomplete.
Two numbers with the same name mean different things depending on a property of the process that neither number shows. Reporting the control state is what makes capability reporting honest.
2.4Failure modes of conventional torque data collection
- Vendor-fragmented logs. Each controller writes its own format, so the audit trail has as many shapes as the plant has tool brands.
- Station-keyed results. A result identified by station and timestamp cannot be bound to a vehicle after the shift without an independent occupancy record.
- Late limit application. Where windows are applied in a reporting tool rather than at capture, the same raw result can be judged conforming or not depending on which limit version the report used.
- Capability without control state. Cpk is reported for processes that are not in statistical control, overstating confidence.
- Unverified verification. Hand-torque audit results are recorded without the calibration state of the tool that produced them.
3System Overview
The system is organised as an acquisition layer over a mixed controller estate, a governed master-data layer describing lines, controllers, model codes and joint specifications, a capture-time evaluation layer, and a reporting layer that produces buyoff certificates and traceability queries from the same stored events.
3.1The acquisition layer
Every major controller brand is integrated — Atlas Copco, Desoutter, Stanley, Cleco and Ingersoll Rand — over Open Protocol, ToolsNet or direct TCP/IP, with vendor adapters isolating the protocol differences. The design objective is that adding a vendor changes an adapter and nothing else.
Fault signalling runs in the reverse direction. Where a fastener is rejected, the system signals the programmable logic controller, so the line's own interlocks participate in the reaction rather than depending on an operator noticing a screen.
3.2Governed master data
Four master records govern what the capture layer will accept: the line, the controller, the model code, and the joint specification with its torque and angle window and its VDI/VDE 2862 classification. These are the objects an auditor's question resolves against.
3.3Capture and identity binding
Vehicle identity enters through barcode scanners, RFID or a programmable-logic-controller handshake — including Allen-Bradley over RS Linx — and is resolved before the fastening is written. A result that cannot be bound to a vehicle is not a weaker record; it is not a record at all for traceability purposes.
3.4Buyoff and the searchable archive
Station buyoff certificates print automatically at shift end or per vehicle, listing every critical joint with its achieved values, its verdict, the tool and the operator. Because they are generated from stored events, regenerating one for a historical vehicle reproduces the document rather than rebuilding it.
The archive is searchable by vehicle identification number, which is the access path a warranty investigation, a recall defence or an IATF 16949 audit actually uses. Section 4.3 states the query structure this supports.
4Computational Methods
Notation is collected in Appendix A; worked numerical examples in Appendix B.
4.1The admissibility condition
A fastening event is admissible as traceability evidence only when four things resolve at capture time: the vehicle identity, the joint identity, the specification version in force, and the calibration state of the tool.
Writing rather than dropping an inadmissible event is deliberate. A discarded event leaves a gap that looks identical to a fastening that never happened, and the difference between those two matters enormously in a dispute.
4.2Capability, performance, and which to report
Capability indices describe the relationship between the specification window and the observed distribution. Cp treats spread alone; Cpk penalises a mean that is off-centre.
Performance indices use the overall standard deviation instead, which includes drift between subgroups. The two coincide when the process is in statistical control and diverge when it is not — and the size of the divergence is itself diagnostic.
Reporting Cpk alone for a drifting station is the most common way a capability number flatters a process. The ratio to Ppk is the cheapest available check, and it costs nothing once both are computed.
4.3Traceability query structure
Two query directions matter, and they have different shapes. Backward traceability from a vehicle returns every fastening event bound to it. Forward traceability from a suspect condition — a tool that drifted, a specification version that was wrong, a shift — returns every vehicle affected.
Both are index lookups rather than joins because identity was bound at capture. This is the mechanism behind the product's reported sub-minute query time — not query optimisation, but the absence of a reconstruction step.
4.4Drift detection before non-conformance
Statistical-process-control dashboards flag torque drift before it produces an out-of-window result, which is the difference between a maintenance action and a containment action. The trigger is a shift in the subgroup mean relative to the specification window.
5Reported Outcomes and Field Evidence
Three kinds of number are separated, as in the other papers in this series.
5.1Figures published for this module
| Measure | Reported | Where stated |
|---|---|---|
| IATF 16949 audit preparation | Weeks to one day once the spine is live | Torque Traceability blog post |
| Response to an OEM containment request | Minutes, not days | Torque Traceability blog post |
| Per-VIN torque history retrieval | Within an hour | Torque Traceability blog post |
| Forward and backward traceability query | Sub-minute | Torque Traceability blog post |
| Critical-joint compliance | 100% of joints meet specification | Product page benefits |
The audit-preparation figure is the one with an architectural explanation rather than an operational one. Preparation did not become faster; it became unnecessary, because the audit trail generates itself continuously for every vehicle that leaves the line. What used to be a compilation is now a query.
The 100% compliance claim needs reading precisely. It states that every joint is evaluated against its specification and non-conforming results are caught, not that no non-conforming fastening ever occurs. The system's function is to ensure none passes undetected, which is a different and more defensible proposition.
5.2A deployment in which this module was one of four
MileSoft's published Industry 4.0 case study describes a deployment at a Tier-1 automotive supplier across plants at Pune and Nasik, in which Torque Traceability was installed alongside the Andon System, Material Traceability and the manufacturing ERP. More than forty controllers across twelve assembly stations were brought under unified traceability. The programme reported a 98% reduction in critical-fastener warranty rework and IATF 16949 audit preparation falling from three weeks to one day.
Those figures belong to the four-module programme. This module's individual contribution was not isolated, and this paper does not claim them for it.
The audit figure is nonetheless the one most plausibly attributable here, because the case study and this module's own published record report the same outcome independently — three weeks to one day in the deployment, weeks to one day in the product record. Agreement between two sources is not isolation, but it is more than a single assertion.
5.3Modelled error avoidance
| Parameter | Default |
|---|---|
| Torqued joints per month | 200,000 |
| Baseline torque error and rework rate | 0.5% |
| Reduction attributed to the module | 60% |
| Fastening errors avoided per year | 7,200 of 12,000 |
The 60% reduction is the model's central assumption and the least defensible part of it. Unlike a picking interlock, which makes a wrong action physically impossible, torque traceability detects rather than prevents — so its effect depends on what the plant does with a detection. The figure is best read as describing a plant that acts on its alerts.
6Discussion
6.1Identity binding is the decision everything else rests on
Of the design choices described here, binding vehicle identity at capture produces the rest. Sub-minute queries follow from it, because a bound record is an index lookup rather than a reconstruction. Bounded containment follows from it, because the forward set is computable. Reproducible buyoff follows from it, because a historical document can be regenerated against the identity it was written for.
The corollary is that improving any downstream capability without binding identity does not work. A faster reporting engine over station-keyed results still cannot answer the question an auditor asks, because the join it needs does not exist in the data.
6.2Detection is weaker than prevention, and should be described as such
Torque traceability detects a non-conforming fastening; it does not make one impossible. That is a real limitation relative to a physical interlock, and it is worth stating plainly in a paper that also argues for the system's value.
What the architecture provides is that detection is immediate rather than downstream, that the unit is flagged rather than passing, and that for the highest joint categories the station can be inhibited pending a documented rework. The gap between detection and prevention narrows to the extent that the reaction is enforced by the system rather than left to a person — which is why the reaction plan being a runtime state rather than a document is the load-bearing part.
6.3A capability reference framework for torque traceability systems
| Dimension | Question the system must answer by demonstration |
|---|---|
| D1 Vendor neutrality | Add a controller from a new brand. Does anything beyond an adapter change? |
| D2 Identity at capture | Is a fastening admissible without a resolved VIN, or is it flagged? |
| D3 Capture-time evaluation | Is the verdict stored with the raw value and the specification version that produced it? |
| D4 Version recovery | For a vehicle built a year ago, can the system state which torque window applied? |
| D5 Control state | Are Cp/Cpk and Pp/Ppk both computed, and is the control state reported alongside them? |
| D6 Forward closure | Name a suspect tool and a date range. How long to return the exact affected VIN list? |
| D7 Device verification | What happens when a controller is overdue for verification? Demonstrate the state. |
| D8 Reproducible buyoff | Regenerate a buyoff certificate from six months ago. Is it identical to the original? |
D8 is the strongest single test. A buyoff that regenerates identically proves the verdict and the specification version were stored rather than recomputed — which is what makes the document evidence rather than an assertion.
6.4Generalisability
The architecture generalises to any assembly process producing per-unit measured results against a governed specification — fastening, dispensing, welding, press-fit. It is automotive-specific only in its regulatory framing; the same structure serves AS9100 aerospace requirements with a different classification scheme. The reported figures come from automotive assembly with a high density of classified critical joints, and a plant with few such joints should expect the same architectural properties with smaller measured effects.
7Threats to Validity and Limitations
- Vendor-reported figures. Every claim in Section 5.1 is published by the vendor from its own record, without sample sizes, distributions or independent audit.
- Confounded deployment result. The 98% rework reduction belongs to a four-module programme with concurrent process change; this module's contribution was not isolated.
- Detection, not prevention. The system catches non-conforming fastenings; it does not make them impossible. Its effect therefore depends on the plant's reaction, which the reported figures do not separate from the software.
- The 60% modelled reduction is an assumption. Unlike an interlock's failure rate it describes organisational response as much as system capability, and no basis for the specific value is published.
- Query-time claims are unqualified. Sub-minute query performance is stated without the estate size, retention period or query complexity it was measured against.
- No cost data. Licence, integration and controller-adapter costs are not reported, so no return-on-investment conclusion is drawn.
The third limitation is the honest frame for the whole paper. This is an evidence system, and evidence changes outcomes only where someone acts on it.
8Future Work
- Separating detection from reaction. Instrumenting how often an alert produces a documented intervention would let the 60% modelled reduction be decomposed into system capability and organisational response.
- Query performance envelope. Publishing query time against estate size, retention period and query type would convert a claim into a specification a buyer can size against.
- Predictive drift. The Z-statistic of Equation (drift) detects a mean shift after it occurs; modelling the drift trajectory would allow a station to be flagged before the shift completes.
- Cross-plant capability benchmarking. Aggregating capability indices for equivalent joints across sites would show how much observed variation is process and how much is tooling.
- EPCIS interchange. The fastening record follows the ISO/IEC 19987 event shape but is not yet emitted as a conformant document for exchange with an OEM customer.
9Conclusion
The facts needed to defend a critical-fastener claim are all measured at the moment the joint is made. What conventional installations lack is a record in which they appear together, bound to the vehicle being built. Assembling them afterwards is a forensic exercise that a warranty deadline does not accommodate, and while it runs the affected population cannot be bounded — so containment is conservative and the over-containment costs more than the defect.
This paper has described a system built so the answer is stored rather than reconstructed: a normalising acquisition layer across five controller vendors, vehicle identity bound at capture through barcode, RFID or PLC handshake, evaluation against the governed joint specification at the moment of fastening, and capability reported per joint with the control state that qualifies it.
The capability reference framework of Section 6.3 is offered as the durable contribution, and its eighth question settles whether a system holds evidence or merely holds data: regenerate a buyoff certificate from six months ago, and see whether it comes back identical.
Appendix ANomenclature
| Symbol / term | Meaning |
|---|---|
| USL, LSL | Upper and lower torque specification limits for a joint |
| mu | Observed process mean of the fastening result distribution |
| sigma-within | Within-subgroup standard deviation, estimating short-term variation |
| sigma-overall | Overall standard deviation, including drift between subgroups |
| Cp, Cpk | Capability indices, valid where the process is in statistical control |
| Pp, Ppk | Performance indices, used where the process is not in statistical control |
| Z(k) | Standardised shift of the subgroup mean at subgroup k |
| n | Subgroup size |
| A(e) | Admissibility indicator for fastening event e |
| VIN(e) | Vehicle identification number bound to event e |
| j(e) | Joint identity of event e; J is the governed joint set |
| v(e) | Specification version in force when event e was captured |
| tau(cal) | Time since last calibration of the tool that produced event e |
| B(VIN) | Backward traceability set — all events bound to a vehicle |
| F(c) | Forward traceability set — all vehicles affected by condition c |
| MES | Manufacturing execution system |
| SPC | Statistical process control |
Appendix BWorked Numerical Examples
Appendix B.1When Cpk and Ppk disagree
A critical joint is specified at 52 Nm with a window of plus or minus 5 Nm, so LSL = 47 and USL = 57. Across one shift, 25 subgroups of four fastenings give a grand mean of 52.4 Nm, a within-subgroup standard deviation of 0.92 Nm, and an overall standard deviation of 1.48 Nm.
Applying Equation (cpk): Cp = (57 — 47) / (6 x 0.92) = 10 / 5.52 = 1.81. The upper margin is (57 — 52.4) / (3 x 0.92) = 4.6 / 2.76 = 1.67; the lower is (52.4 — 47) / (3 x 0.92) = 5.4 / 2.76 = 1.96. Cpk is the smaller, 1.67 — comfortably above any conventional acceptance threshold.
Applying Equation (ppk) with the overall standard deviation: Pp = 10 / (6 x 1.48) = 1.13, and Ppk = 4.6 / (3 x 1.48) = 1.04. The ratio Cpk / Ppk is 1.67 / 1.04 = 1.61, well above 1.
That ratio is the finding. Short-term variation is small, so the station looks excellent on Cpk. Long-term variation is 61% larger, which means the mean is drifting between subgroups — the signature of tool warm-up, a loosening reaction arm, or a joint whose surface condition changes through the shift. Reporting Cpk alone would have recorded a healthy station; ISO 22514-2 directs that Ppk be used here, and Ppk at 1.04 is marginal.
Same data, same shift, two defensible-looking numbers 60% apart. The control state is not a footnote to a capability report — it determines which number is the report.
Appendix B.2Catching the drift before it produces a reject
Take the same joint with an established process mean of 52.0 Nm, sigma-within of 0.92 Nm and subgroups of four, so the standard error of the subgroup mean is 0.92 / sqrt(4) = 0.46 Nm.
Successive subgroup means read 52.1, 52.4, 52.8, 53.2, 53.5 Nm. Applying Equation (drift): Z values are 0.22, 0.87, 1.74, 2.61 and 3.26.
Every individual fastening in those subgroups is still inside the 47 to 57 window — the last subgroup sits 3.5 Nm from the upper limit with a spread under 1 Nm, so no result has failed and no operator has seen an alert. But the mean has moved 3.3 standard errors in five subgroups, and continuing at that rate it reaches the specification limit within the shift.
This is the distinction between a maintenance action and a containment action. Flagging at Z = 2.0 produces a tool check on a station still making good joints. Waiting for a reject produces an investigation, a quarantine, and a question about every vehicle built since the drift began.
Appendix B.3What the forward set is worth
A controller is found to have drifted, and the drift is traced to a maintenance event four days earlier. The line builds 690 units per shift across two shifts, so roughly 5,520 vehicles passed through in that window.
Applying Equation (query) for the forward set: the condition is fastenings performed by that controller identity between the maintenance timestamp and the detection timestamp. Because each event carries a resolved VIN, the query returns the exact list — suppose 1,840 vehicles, since the controller serves one of three parallel stations.
Without identity binding, the containment population is every vehicle built in the window, or 5,520. Binding reduces it to 1,840 — a factor of three — and the 3,680 excluded vehicles are excluded provably rather than by argument. Neither the detection nor the drift changed; only the ability to bound the population did.