Replacing a Spreadsheet-Run Manufacturing Plant

The workbook estate mixed master data, transactions, calculations and approvals in the same cells. Copying that structure would have preserved ambiguity behind a browser. The replacement separated effective-dated part revisions from bills of material, and bills from the production orders that consumed them. Routings described expected operations without rewriting orders already released against an earlier revision. A status model distinguished planned, released, in-progress, completed and closed work, with guarded transitions and an event history. Corrections were represented as compensating movements rather than edits to completed records. This made the sequence inspectable and prevented a retrospective spreadsheet change from silently altering what the plant had actually built.

Material requirements were generated from released demand and current supply, but recommendations remained recommendations until a planner accepted them. That distinction mattered because supplier constraints, substitutions and batch decisions contained judgement that no formula fully represented. Reservations linked stock to demand without pretending that physically unissued material had already been consumed. Issues, returns, scrap and completion each became explicit inventory movements with source references. The same movement ledger drove available stock and the finance export, removing the former gap between a planner’s balance and the valuation presented at close. Where units differed between purchasing, storage and production, conversions were governed against the item rather than embedded in individual formulas.

A shop-floor screen that merely displayed an error during a network interruption would have sent operators back to paper. The client application therefore retained the bounded information needed for the active operation and queued permitted observations locally. Each command carried a durable identifier, expected record version and operator context. On reconnection, the API could recognise a replay, reject a transition based on stale state or accept the event exactly once. Potential conflicts returned to a visible review queue; the client never resolved them by quietly choosing the latest timestamp. Work that affected allocation or traceability remained unavailable offline where a safe merge could not be defined.

This constraint changed interface design. Operators selected from the work already assigned to a station rather than searching an entire catalogue, and the screen made synchronisation state unambiguous. Label generation used server-issued identifiers, while local reprints preserved the original identity instead of creating another unit. Scanning validated part, revision and operation context before a movement was queued. The implementation favoured a small number of explicit commands over generic record editing because commands could express invariants such as preventing completion before required material declarations. Connectivity testing included interruption at each write boundary, repeated submission and an outdated assignment, not merely a demonstration after disconnecting a read-only page.

The spreadsheets could not be imported as if they shared one schema. Profiling exposed reused identifiers, descriptive variants, orphaned supplier references and formulas whose displayed value depended on unavailable linked files. A staging model retained source file, sheet, row and original value beside every proposed target record. Mapping rules were versioned and rerunnable, with unresolved values reported instead of coerced into defaults. Master data owners decided whether an apparent duplicate represented an alias, a revision or a genuinely distinct item. That decision trail was retained because later investigation often begins with the language used on an old purchase order or drawing.

Open transactions required event-level treatment. A purchase line partly received is not equivalent to a new line for its remaining quantity, and work in progress cannot be represented safely by importing only its current status. Rehearsals rebuilt opening stock by location and condition, established reservations, then loaded open purchasing and production against the same identifiers. Control reports compared source populations with staged and accepted records and exposed exclusions with reasons. Finance reviewed the opening valuation and the first operational posting batches as a bridge, not as unrelated totals. The cut-over plan consequently described which source could still change, when extraction occurred and who owned each difference, rather than relying on a final all-purpose import.

The platform did not reserve traceability for a specialist audit report. A planner could open a production order and follow its originating demand, revision, allocated material, floor observations, completions and stock consequences. Stores staff could see why stock was unavailable instead of overriding a balance, while purchasers could distinguish planned demand from an approved order. Role permissions followed operational authority: creating a part, approving a substitution and correcting a completed movement were separate capabilities. Sensitive changes required a reason and retained before-and-after values. This reduced dependence on informal knowledge without forcing every routine action through the same heavyweight approval path.

Operational reporting was built from the transaction model rather than a replicated set of spreadsheet calculations. Exception views showed shortages, stale reservations, receipts awaiting inspection and orders whose recorded state conflicted with expected progress. They linked back to the underlying events so the response could repair the source record instead of patching a report. The ledger interface followed the same principle. Posting batches were deterministic, traceable to movements and protected against duplicate export; rejection by finance produced an actionable state rather than an email attachment. The resulting system remained a set of bounded operational controls connected by identifiers and events, not a monolith that claimed to automate judgement it could not safely make.