In-Line Inspection at the Station: A Build Guide for Per-Unit Disposition

You’re at the station. The camera catches a dark mark on the part — real defect, or glare off a coolant film? The bore’s SPC chart is creeping toward its upper limit but hasn’t crossed. The conveyor doesn’t care: it indexes every 1.8 seconds, and this unit needs a verdict — pass, reject, or pull for a human look — in less time than that, and it needs to be right. Reject a good part and you’ve burned margin and stalled the line; pass a bad one and it’s in a customer’s hands. That sub-second call, made tens of thousands of times a shift, is the problem this guide is about.

If you’re a controls or quality engineer wiring up inspection, or the MES integration lead who has to make the disposition stick to a per-unit record, this is a reference design for exactly that: fusing vision with sensor and SPC into a defensible score, keeping nuisance rejects from eating the gains, knowing when to pull a human in, and leaving a quality record that survives an audit and a field return.

The station pipeline: three signals into one score

A camera alone is a brittle inspector. Glare, part-to-part sheen, a fixture that shifts a millimeter — any of these turns a clean part into a false reject when vision is the only voice. The fix is fusion: at each instrumented station, the pipeline reads the vision frame, the in-process sensors (force, torque, dimensional gauge, thermal), and the running SPC window for that characteristic, and combines them into one defect score with its evidence attached.

Capturevision frame · in-process sensors · SPC windowthree independent reads of the same unit at the station

→

Fuse & scoredefect model + sensor agreement + SPC stateone defect score with per-signal evidence, computed in-cycle

→

Dispositionpass · reject · holdthe per-unit call, written to the MES quality record

Two design rules make this defensible. First, the model that turns pixels and readings into a score is a replaceable component, not the system itself — you’ll retrain it as defect classes change, and the pipeline around it (capture, fuse, gate, record) has to outlive any single model version. Second, the MES stays authoritative and the station writes back only the disposition and its evidence: the station decides, the MES remembers. That line lets you swap a camera, retune a threshold, or drop in a new model without re-validating the whole quality record.

And the corpus this builds can’t be copied plant to plant — the labeled marginal images, the confirmed defect classes, the thresholds tuned to your parts and lighting. Two plants buy the same smart cameras; only yours holds the accumulated judgment of every borderline call an engineer has adjudicated, kept versioned in the pipeline rather than in the head of the inspector who’s seen the most parts.

Pass / reject / hold: the gate per unit

A pass/fail gate is the wrong shape for inspection: it forces the score’s gray zone into one of two confident answers, and that gray zone is exactly where nuisance rejects and missed escapes both live. The useful action space is three states:

• Pass — score below the reject threshold, signals agreeing. The unit flows, but the pass is logged with its score, so a clean part is accountable, not merely waved through.
• Reject — score above the reject threshold, with sensor or SPC corroboration. The unit is diverted and tagged with the defect class and the evidence that condemned it. A reject with no reason is a complaint; a reject with its evidence is a data point.
• Hold — the score lands in the band between pass and reject, or the defect matches no known class. The unit is pulled to a hold queue and routed to a quality engineer. This state protects yield and coverage: it’s where the ambiguous part waits for a human instead of being force-called wrong.

The width of that hold band is the most consequential tuning knob in the build, set by the cost geometry of the part. Pulling a good unit to hold costs a few seconds and an engineer’s glance; passing a defect into a safety-critical assembly can cost a recall. Set the thresholds to that imbalance, not to the model’s headline accuracy — a 99%-accurate model that errs in the expensive direction is worse than a 96% one that fails toward hold.

RULE StationDisposition
WHEN defect_score < pass_threshold[station]
  AND sensor_agreement >= 2_of_3
THEN disposition = "Pass"

WHEN defect_score >= reject_threshold[station]
  AND (sensor_corroborates OR spc.state == "out_of_control")
THEN disposition = "Reject"
  AND attach defect_class, contributing_signals

WHEN defect_score BETWEEN pass_threshold AND reject_threshold
  OR defect_class == "novel"
THEN disposition = "Hold"
  AND route_to = "QualityEngineer"

WHEN product.safety_critical == true AND disposition == "Reject"
THEN require second_station_recheck = true

DECISION: emit disposition WITH score, per_signal_evidence, unit_id

Every evaluation emits one disposition record — the per-unit verdict the MES carries forward:

{
  "eventType": "StationDispositioned",
  "plant": "PLT-03",
  "station": "STN-VIS-07",
  "unitId": "U-2026-0224-118842",
  "characteristic": "weld_seam",
  "defectScore": 0.71,
  "perSignal": { "vision": 0.81, "thermal": 0.62, "spcState": "in_control" },
  "disposition": "Hold",
  "reason": "score in confidence band; vision-thermal disagreement",
  "defectClass": "unclassified",
  "routedTo": "QualityEngineer",
  "modelVersion": "defect-vis-4.2.0",
  "thresholdSet": "stn-vis-07.v9",
  "decidedAtEdge": true,
  "cycleMs": 380,
  "evaluatedAt": "2026-02-24T14:11:03Z",
  "correlationId": "stn-6d8605e2"
}

The fields that earn trust: the per-signal breakdown (so you see why the score landed where it did), the threshold-set version beside the model version (so a disposition is reproducible after a retune), and cycleMs — proof the call was made inside takt at the edge, not after a cloud round-trip the line couldn’t wait for.

Drift detection: adjust before the first reject

Disposition is the goalkeeper; drift detection is the defense that means fewer shots. The inspection gate catches the defect that already exists; a drift watcher reads the process telemetry — tool-wear trend, thermal ramp, torque creep, the SPC chart’s slope — and flags an out-of-control trajectory while parts are still passing, so a controls engineer adjusts the setpoint before the score ever climbs.

That’s the difference between sorting scrap and preventing it. By the time scores start tripping rejects, the bad units are already made; the drift signal arrives parts earlier, on the trend not the breach. A seven-point rise toward a control limit at part 40 is the chance to nudge the process before part 60 fails inspection — which is why the drift model sits beside the disposition gate, not downstream of it.

• First-pass yield82–93%→92–98%Drift-flag adjust before rejects
• Escape rate (defects passed)300–1200 ppm→30–200 ppmFused score + hold on the gray zone
• Nuisance reject rate3–9%→0.5–2%Sensor agreement before reject
• Disposition latencycloud / offline→< takt at edgeEdge inference at the station
• Engineer touches per shiftevery reject→hold queue onlyEscalation gate, not full review

Keeping nuisance rejects down — and pulling a human in

A score that’s only ever right when it’s confident is easy; the engineering is in the band where it isn’t, and two controls keep that band from costing you. Corroboration before reject: no single signal condemns a unit alone — a vision flag becomes a reject only when a sensor or the SPC state agrees, and a lone vision flag the gauge contradicts drops to hold, costing a glance instead of a good part. And a calibrated, station-specific threshold tuned against labeled outcomes — not one global setting copied across stations with different lighting and different parts.

The escalation gate is what makes the whole thing safe to leave running. Clear defects auto-reject, clear passes auto-pass, and everything in the confidence band — plus anything the model can’t fit to a known class — escalates to a quality engineer. That gate is also how the pipeline learns: every adjudicated hold is a labeled example, and a new or recurring class confirmed there becomes a candidate threshold or model class. Autonomy is granted per station and per defect class, never as one switch — a deterministic dimensional check can auto-reject from day one, while a cosmetic-vs-functional surface call stays at hold under review until the labeled corpus earns the move.

1. 01Capturevision + sensor + SPC read
2. 02Scorefuse to defect score
3. 03Auto-passclear-good units flow
4. 04Holdgray zone · engineer gate
5. 05Auto-rejectcorroborated clear defects
6. 06Learnadjudication → labels → thresholds

The RACI keeps the gate honest about who owns what:

Role	RACI	Responsibility
Quality Engineering	A	Owns thresholds and defect classes, adjudicates the hold queue, confirms new classes
Controls/Process Eng	R	Tunes drift models and station setpoints, acts on drift flags before rejects
MES Integration	R	Binds disposition + evidence to the per-unit record, keeps station↔MES contract
Line Operator	R	Works the reject divert and the hold pull, flags fixture/lighting changes
OT/Cyber	C	Approves edge deployment and OT/IT segmentation at the station
Plant Manager	A	Accountable for ppm, nuisance rate, and throughput outcomes

Per-unit traceability: the quality record the MES keeps

In-line inspection only earns its keep if the verdict sticks to the part for life. Every disposition writes a per-unit record to the MES — score, per-signal evidence, model and threshold versions, the engineer’s call if it was held — keyed to the unit’s serial. That makes a field return answerable: given a complaint, you pull the record and see which station scored the unit, what the signals said, and whether a human touched it.

-- Reconstruct one unit's inspection history for a field return.
-- Disposition records already streamed from each station to the MES.
SELECT d.station_id, d.characteristic, d.defect_score,
       d.disposition, d.defect_class, d.model_version,
       d.threshold_set, d.routed_to, d.decided_at
FROM   unit_disposition d
WHERE  d.unit_id = 'U-2026-0224-118842'
ORDER  BY d.decided_at;        -- full station-by-station trace for this serial

Run that query in reverse — by model_version and threshold_set across a date window — and you scope a containment when a model regression surfaces: every unit dispositioned under the suspect version, not the whole day’s output. That record is what separates this build from a catalog-correctness or an asset-degradation problem: a physical, per-serial disposition trail, traceable from the station that made the call to the customer who received the part.

Commissioning a station: the runbook

1. Week 1–2 — characterizePick one station and one defect class. Collect labeled images and sensor traces across good, marginal, and known-bad units. Baseline current ppm, nuisance rate, and takt. Confirm the fusion signals available at this station.
2. Week 3–6 — shadowRun the pipeline scoring every unit but disposition advisory-only — operators still call it, the engine logs what it would have done. Tune pass/reject thresholds and the hold band against the labeled outcomes. Stand up the drift watcher on the process telemetry.
3. Week 7–12 — gate onTurn on auto-pass and auto-reject for corroborated, in-class cases; hold the gray zone and novel defects to the engineer. Wire dispositions to the per-unit MES record. Watch nuisance rate and escape rate daily.
4. Ongoing — widen the gateFeed adjudicated holds back as labels. Promote defect classes to auto-disposition as the corpus earns it. Extend to the next station and the next class on the same pipeline. Weekly: hold-queue depth, nuisance and escape rates; monthly: ppm and yield; quarterly: threshold and model-version review.

The shadow weeks are what teams skip and regret: running advisory-only against labeled outcomes is how you catch the station where coolant sheen inflates the vision score, or the fixture that drifts after warm-up, before the gate makes live calls. The second station is a fraction of the first’s cost — the pipeline, gate, MES contract, and drift watcher are already built, so you add only this station’s signals, classes, and thresholds, and the labeled corpus carries forward so each station inherits every borderline call its siblings adjudicated.

What we covered

Good inspection isn’t a smarter camera bolted onto the line — it’s a station that scores every unit from more than one signal, calls pass, reject, or hold inside takt, knows when to ask a human, and leaves a record that tells you, serial by serial, exactly why each part walked out the door the way it did.

---

References: Western Electric / Nelson SPC rules · automated optical inspection (AOI) practice · process capability (Cpk) and ppm reporting · MES/ISA-95 genealogy and traceability · OPC UA event integration · machine-vision false-reject calibration · NIST AI RMF · NIST Privacy Framework · NIST CSF 2.0 · CISA Secure by Design.