What it does
WITNESS ingests four things about a production line: the electrical drawings, live equipment telemetry, the maintenance history, and the site safety rules. From those it produces one output, a written recommendation with citations, delivered with enough lead time to act on.
Telemetry arrives over MQTT or a Modbus poll, lands in a ring buffer for the live view and a Parquet archive for the historical one. A feature pipeline turns raw channels into hourly windows. Three detectors run over those windows: deterministic threshold rules, an IsolationForest anomaly model per channel group, and a lead-time estimator that answers the only question a maintenance planner actually asks, which is how long they have.
Every one of those steps writes an event to a hash-linked provenance chain. The project rule is blunt: if it is not in the chain, it did not happen.
Measured, not claimed
Phase 3 closed against a fixed ten-seed simulation set. Recall was 1.0 on fault classes f1 through f3, false alarms ran at 0.5 per simulated day, and median lead time ranged from 3.4 to 25.6 hours depending on the fault.
Precision measured 0.89 against a 0.90 target. That gap is written into the repository rather than rounded away, along with the reason: the line simulator's per-channel random walk does not mean-revert, which produces excursions a real process would pull back. A number that misses its target and says why is worth more than one that hits it and cannot be reproduced.
In the code
SCHEMA = """
CREATE TABLE IF NOT EXISTS events (
seq INTEGER PRIMARY KEY,
ts_utc TEXT NOT NULL,
actor TEXT NOT NULL,
kind TEXT NOT NULL,
payload TEXT NOT NULL,
payload_hash TEXT NOT NULL,
prev_hash TEXT NOT NULL,
chain_hash TEXT NOT NULL
);
"""
@dataclass(frozen=True)
class VerifyResult:
ok: bool
first_divergence_seq: int | None
events_checked: intTampering with an event breaks every chain_hash after it, and witness chain verify reports the exact sequence number where the record diverges. This is the same instinct as a CMMS work order that cannot be backdated.
FAULT_ANOMALY_GROUP: dict[str, str] = {
"f1": "electrical",
"f2": "mechanical",
"f3": "electrical",
"f4": "tension",
}
HISTORY_MAX_POINTS = 4 * 3600 # per-channel history kept for trend estimation
DEBOUNCE_WINDOWS = 3 # 3 consecutive triggering windows before alarmThree consecutive hourly windows must trigger before anything alarms. A single noisy sample cannot page anyone at 2am, which is the difference between an alerting system people keep and one they mute in week two.
How this differs from the ordinary version
The model is not in the control path
This is the whole design. The language model produces text artifacts only, no tools, no actuator access, no write path to the PLC. Where WITNESS is permitted to influence equipment at all, it does so through a deterministic permissive relay that hardwired E-stop, guard and safety circuits always override. A dashboard that lets a model write a setpoint is a different product with a different risk profile, and it is not this one.
Evidence or silence
A recommendation that cannot cite the telemetry window, the drawing reference and the maintenance record behind it does not survive the validator. There is no fallback to a plausible-sounding paragraph. When the evidence is thin the output says so, which is the behavior a maintenance planner can actually build a schedule on.
It reads the drawings
Most predictive-maintenance tooling sees a stream of numbers with no idea what they are wired to. WITNESS parses schematic sheets into an interlock graph first, so a current anomaly on one channel can be related to the contactor it feeds and the interlock that will trip because of it. The prediction comes with a circuit, not just a chart.
In the field
A stamping line in Ciudad Juárez
Juárez shed roughly 57,500 maquiladora jobs between mid-2023 and mid-2025, about 18 percent of its manufacturing workforce, while output targets held. The gap gets closed with automation and with fewer people watching more machines. That is exactly the condition where a 3-to-25-hour warning on a motor or a hydraulic circuit changes the week: the repair moves from an unplanned line-down at 02:00 into a planned window on Sunday, with the part already on site.
A 480V distribution panel in Santa Teresa
Nuisance trips at shift change are one of the most common and least diagnosed problems on a plant floor, because the evidence is gone by the time anyone looks. With telemetry archived and hash-chained, the question stops being "what do you remember about Tuesday" and becomes a query: show me every window in the last ninety days where this channel behaved this way, and what else was running.
What changes over a year
The first month is instrumentation and honest baselines, most lines do not know their own normal. By month three the threshold rules are tuned to the actual process and the false-alarm rate is low enough that operators trust the pages. By month twelve the fault labels accumulated from real events are worth more than the simulator that bootstrapped them, and the model is being retrained on the plant it actually runs on rather than a synthetic line.
Questions
- Can WITNESS control equipment?
- No. The language model produces text only. Any actuation path is a deterministic permissive that hardwired safety circuits override, and the model has no write access to it.
- Does it need cloud access?
- No. The ingestion, archive, feature pipeline and detectors run on site. This matters for maquiladora operations where telemetry crossing a border is a compliance question rather than a technical one.
- What lead time does it give?
- Median lead time measured 3.4 to 25.6 hours across fault classes f1 to f3 on the standard ten-seed evaluation set, at a false-alarm rate of 0.5 per simulated day.