Olstral · Precision CNC app (B2B) — case study

Summary

Olstral is an industrial client running CNC grinding machines at micron-level precision. They needed a specialized application to orchestrate recipes, track tolerances, and maintain a full audit trail — plus security consulting, because on the shop floor process IP is worth as much as the machine itself. I intermediated the project end-to-end: I ran discovery, picked the right execution team, and coordinated delivery. The client had one single point of contact throughout — me.

Client context

We're talking about an industrial client doing precision CNC grinding, with machines producing parts where tolerance is measured in microns. At that level, it's not enough for the operator to press "start" — every cycle has to start from a validated recipe, be tracked end-to-end, and leave behind proof that the part met spec.

The environment: production hall, operators working shifts, industrial PCs next to the machines, network connectivity that sometimes drops, and one very clear requirement — the software is not allowed to stop the line. If the app fails, the machine must continue safely, and data must reconcile later.

Problem

First problem — grinding recipes were floating around as loose files between engineers and operators. Nobody could say with certainty which recipe version produced which part. In a quality audit, that means vague answers in an industry that doesn't accept vague answers.

Second problem — the operator sees the machine, not the history. If a part goes out of tolerance, there's no place to look quickly and see: which recipe is running now, what adjustments happened in the last 10 cycles, whether the tool wore faster than its average.

Third problem — security. Grinding recipes are process IP. A USB left on the wrong desk, or an unpatched workstation, can walk tens of thousands of engineering hours out of the factory. For a serious B2B operation, that's not a theoretical risk.

My role

Consultant & intermediary — hub model in action. Olstral is the textbook example of my model: the client came with a serious industrial problem, I owned it end-to-end, picked the right team from my network, and coordinated everything. The client didn't have to hunt for vendors — I brought the right people to the table.

• Discovery with process engineers — I sat next to the machines, asked them to walk me through every field in a recipe, what "good" and "scrap" mean in their language. I translated between business and tech.
• Team selection — I identified the right partners for each component (operator app, machine integration, security layer) and brought them in.
• Delivery coordination — I kept the technical team in sync with the client's process engineers via short meetings and clear decisions. The client got weekly updates without chasing anyone.
• Single point of contact — any question, any adjustment, any issue: it came to me. The client didn't have to track who did what.
• Security consulting layer — attack-surface analysis, hardening recommendations, role-based shop-floor access plan. That part I delivered directly.

Solution

Recipes with strict versioning. Every recipe carries a version, an author, an approver, and a hash. The machine only runs signed recipes; any modification creates a new version instead of overwriting. At audit time, for any part produced there's an exact answer: recipe X.Y, validated by Z, on date T.

Per-part audit trail. For every cycle — recipe run, measured process parameters, deviations detected, operator interventions. Stored locally, synced to backend when the network is available. At micron tolerances, proof that the process was followed matters as much as the part itself.

Operator UI designed for the shop floor. Large screen, glove-friendly, high contrast, no deep submenus. The operator sees machine state, current recipe, last few cycles, active alerts. That's it. The rest sits behind a higher-privilege role.

Offline-first behavior. The app keeps running and recording even when the network drops. On reconnect, it reconciles with the backend. The line doesn't stop because a switch blinked.

Security layer built for the factory, not the office. Hardening recommendations included: code-signing on the application binaries, recipes encrypted at rest and in transit, network segmentation between production stations and the office network, role-based authentication for operators vs engineers vs administrators, plus an update plan that doesn't require taking the line down.

Outcome

Olstral gained the traceability a serious audit demands and reduced the risk of a cycle running from the wrong recipe. On the security side, the attack surface tightened visibly — without the operator on the line feeling any added friction.

Metrics that matter:

Lessons learned

Two lessons. First — in an industrial setting, good software is the kind the operator forgets. If the person on the line notices the application, something is in their way. All the complexity — versioning, audit, telemetry, security — lives in the back; the machine stays in front. On the shop floor you don't sell features, you sell the confidence that the flow won't stop.

Second, more important for my model — an industrial client doesn't want (and doesn't have time) to source three vendors: one for software, one for security, one for machine integration. They want one person they can tell "solve this" and go back to running the factory. Olstral confirmed it: the intermediary role of picking the right team is worth as much as the delivery itself.

Tech stack

RO — translation pending

• Aplicația de operator: desktop / industrial PC, framework cu suport offline solid (de ex. .NET pe Windows industrial sau Electron + Node, în funcție de hardware-ul utilajului)
• Integrare cu utilajul: protocol industrial pe stratul de control (Modbus / OPC-UA sau echivalent, ales împreună cu echipa de mentenanță)
• Stocare locală: bază de date embedded pentru audit trail offline
• Backend de sincronizare: API care primește loturi de telemetrie, validează semnături și reconciliază rețetele
• Securitate: code-signing pe binare, criptare a rețetelor la repaus și în tranzit, segmentare de rețea VLAN între producție și birou
• Autentificare & roluri: operator / inginer / administrator cu permisiuni separate; opțional cititor de card pentru schimburi
• Monitorizare: logging structurat pe ciclu, alerte pe abateri de toleranță