Five rings between the weighing room and the pallet

The problem

The worst possible failure, for three reasons at once.

It is the worst possible failure for three reasons. It is silent: it is not caught in the plant, it is caught in the market. The product is a chemical in contact with skin. And if it has crossed into another country, the incident multiplies by the number of jurisdictions involved. A cosmetics recall in mass retail is not a rework cost: it is recovery operations across thousands of points of sale, notification to each market's health authority, the reference frozen, public exposure of the brand and renegotiation with the retailer. The direct cost is high; the indirect cost, on a brand asset built over decades, is of another order. And one digit is enough.

• It is silent: it is not caught in the plant, it is caught in the market.
• The product is a chemical in contact with skin, so the scale of the incident is not set by the cost of the product.
• And if it has crossed into another country, it multiplies by the number of jurisdictions involved.
• A recall in grocery retail is not a rework cost: it is recovery operations across thousands of points of sale, notification to each market's health authority, the reference suspended, public brand exposure and renegotiation with the retailer.
• The failure modes are concrete: wrong shade, mis-coded batch, wrong expiry, a developer of a different volume than the carton declares, or a leaflet that does not match the market.

How it fits the IRIS system

Five rings that cross-check — if they do not agree, the line stops.

No single ring solves the problem: the strength is in the cross-check. Five independent sources contradicting each other are an alarm; a single source is an assumption, however reliable it looks.

• Ring 1 · Origin (cases 1 and 7): the active order and the photographed weighings define which shade, which formula and which raw-material lots make up the bulk. Traceability is born correct, not reconstructed.
• Ring 2 · Process (cases 2 and 6): the mixer curve read off the panel and the lab result confirm the bulk is the shade it claims to be, with deviation measured against the standard. Bulk off standard never reaches the line.
• Ring 3 · Coding (case 8): the coder prints on tube, bottle and carton what the ERP publishes from the active order, with no intermediate typing and with confirmation back.
• Ring 4 · Line (cases 9 and 10): the Edge camera reads what the coder has just printed and verifies that the three kit elements match each other and match the active order, on top of verifying closure and fill. If anything fails to match, JIDOKA AI stops the line. And that same Edge guarantees the line started clean of the previous shade.
• Ring 5 · Evidence (case 11): every pallet leaves with a dossier cross-referencing the four previous rings, with a photo of the coded kit and a quality signature. If tomorrow you have to investigate one specific unit, the dossier already exists.
• SMED AI accelerates the shade changeover so that coordinating five rings is not paid for in OEE: the system already knows which shade is coming, which cleaning it requires and which data set to publish to the coder, and prepares it while the line is still running the previous shade.
• Humans in command across all five rings: iLEAN stops, proposes and documents; a person always releases.

See the full IRIS architecture →

Before and after

The five rings, and what each one closes

Ring	Which cases it draws on	What failure it closes
1 · Origin	Order and weighing (1) + receiving (7)	Doubt about which shade and raw materials make up the bulk
2 · Process	Mixer panel (2) + laboratory (6)	Bulk that is not the shade it claims to be
3 · Coding	Coder to ERP (8)	Batch, expiry or market wrongly printed
4 · Line	Seal vision (9) + shade changeover (10)	A kit whose three elements do not agree
5 · Evidence	Evidence pack (11)	Traceability that has to be rebuilt after the incident

Impact estimate

Estimated impact — to validate with your own numbers.

The block below is an estimate to be validated against your plant's actual data. We put it forward so the committee has an order of magnitude; we refine it during the assessment.

• Estimated payback 6-12 months, but the reference is not the operational saving.
• The reference is the avoided cost of the first recall: in grocery retail with exported product it runs into hundreds of thousands of euros of direct cost.
• And the associated brand damage is of another order of magnitude, with no defined ceiling.
• From a latent risk only measured once it materializes, to a discrepancy caught on the line rather than in the market.

the benchmark is not operational saving, it is the avoided cost of the first recall, which in mass retail with exported product runs into hundreds of thousands of euros of direct cost plus brand damage of another order of magnitude. Estimated payback of 6 to 12 months against that first avoided recall, and permanent protection afterwards. *Estimate to validate with quality management and plant management*.

And the fair question from the production manager

«Do we have to deploy all twelve cases to get this?» — no, and framing it that way would be the way never to start. The rings are built in layers and each case pays for itself from the first month. A plant that starts with receiving and the coder already has half of ring 1 and all of ring 3, without committing to a two-year project.

^[1] OpenAI paper "Why Language Models Hallucinate", 2025 — on the reliability of AI in anchored tasks.