Early Production Containment (GP-12 / Safe Launch): enforce 200% inspection walls, zero-defect reset clocks, and exit gates

During the first 30 to 90 days of a new automotive, heavy-truck, appliance, or industrial program launch—or immediately following a major Engineering Change (ECN), line relocation, sub-tier tooling transfer, or a customer Quality Escape (PRR / 8D CAPA), standard statistical sampling in the Production Control Plan is not enough to protect the customer's assembly plant from ramp-up instability. Under IATF 16949 Section 8.3.4.4 / 8.5.1.1 and AIAG CQI-16 (Early Production Containment / GP-12), the supplier must operate a Pre-Launch / Safe-Launch Containment Wall: a dedicated, offline $100%$ redundant inspection station (200% inspection when combined with the regular $100%$ in-line operator check) that audits high-risk characteristics and applies a unique physical witness mark (such as a colour-coded UV/paint dot) to every part.

When plants manage GP-12 / Safe Launch on paper tally sheets, three severe compliance failures occur. First, when the offline GP-12 inspector catches 3 porous castings on Day 8, the supervisor simply scraps those 3 castings, pats the GP-12 inspector on the back, and graduates the line out of GP-12 on Day 14—completely violating the core rule of Early Production Containment! (A defect caught at the GP-12 wall is a failure of the upstream manufacturing process, requiring the GP-12 exit countdown clock to reset to zero!) Second, shipping clerks print standard barcoded labels and ship pallets that bypassed the GP-12 audit cage during night-shift overtime. Third, nobody tracks the true labour cost of staying stuck in GP-12 for 4 months due to repeated counter resets.

The direct solution is to build a state-governed EPC / GP-12 Containment Wall and Zero-Defect Reset Engine inside the MES and ERP (ERPNext Quality Inspection & Delivery Note Gates). Distinct from M001 (which governs routine sampling-based incoming inspection of purchased raw materials) and M039 (which covers the initial 18-element PPAP submission dossier), this guide (M128) specifies offline redundant inspection routing, consecutive zero-defect counter resets, green-dot shipping label interlocks, and formal GP-12 exit governance.

Scope and quality-authority boundary

This article defines the MES, QMS, WMS shipping, and Supplier Portal data architecture for managing Early Production Containment (EPC / GP-12 / Safe Launch) for both internal outbound manufacturing and inbound post-CAPA suppliers:

• What this workflow governs: Activating Op 99-EPC redundant inspection routings, tracking serialized/lot-level consecutive_zero_defect_count ($N_{\text{consec}}$), resetting $N_{\text{consec}} \to 0$ and triggering mandatory upstream Control Plan CAPAs on any EPC wall finding, interlocking container shipping labels, and verifying exit criteria.
• What this workflow does not replace: Software counter thresholds never override OEM Customer Specific Requirements (CSRs) or the authority of the Customer Supplier Quality Engineer (SQE). Where a customer contract specifies Customer-Approved Exit (as opposed to Supplier Self-Exit), reaching $N_{\text{consec}} = 3,000$ zero-defect parts only makes the part eligible to submit an Exit Request Packet—the ERP must keep the Op 99-EPC wall active until the signed customer exit approval is uploaded.

Bounded early production containment gp12 software verification and exception-routing workflow

Follow the workflow below, or open its complete text version.

Read the complete workflow as text

1. Capture early production containment baseline record → Verify revision, unit Basis and cutoff alignment
2. Verify revision, unit Basis and cutoff alignment → Run deterministic reconciliation and tolerance check
3. Run deterministic reconciliation and tolerance check → Quarantine mismatched or unapproved lines
4. Quarantine mismatched or unapproved lines → Route exception to named domain and finance owner
5. Route exception to named domain and finance owner → Release verified record with immutable audit trail

Engineering the four-pillar GP-12 / Safe Launch governance engine

1. Why an EPC wall finding resets the countdown clock to zero. New quality engineers frequently confuse Containment Sorting with Early Production Containment (GP-12) (AIAG CQI-16):

• In regular production, the Production Control Plan (Op 10..Op 80) is supposed to deliver $100%$ conforming parts to the shipping dock.
• The Offline EPC Station (Op 99-EPC) is an independent audit wall staffed by trained quality auditors using dedicated check fixtures, bore-scopes, and master boundary samples.
• Therefore, if Op 99-EPC inspects Piece #1,892 and discovers a missing thread or casting blowhole, the defect already escaped the regular production line (Op 10..Op 80)! If you removed Op 99-EPC tomorrow, that defect would go straight to the OEM assembly plant. Consequently, the MES enforces a strict mathematical state transition on the consecutive zero-defect counter ($N_{\text{consec}}$) after every inspected piece $i$:

$$N_{\text{consec}}(i) = \begin{cases} N_{\text{consec}}(i - 1) + 1, & \text{if } \text{EPC_Result}(i) == \text{PASS} ;\land; \text{Customer_Claim} == 0 \ 0, & \text{if } \text{EPC_Result}(i) == \text{FAIL} ;\lor; \text{Customer_Claim} over 0 \end{cases}$$

Additionally, whenever $N_{\text{consec}}(i)$ resets to $0$, the system prevents the counter from resuming above $0$ until Engineering logs a Verified Upstream Countermeasure (e.g., adding a thread-presence eddy-current sensor at Op 40) so the regular production line now catches the failure mode.

2. Dual-envelope exit rule (Minimum Consecutive Quantity $\land$ Minimum Production Days). OEM Customer Specific Requirements (IATF OEM CSRs / VDA Volume 2) typically define GP-12 exit using both a minimum consecutive zero-defect piece count ($N_{\text{exit}}$, e.g., $3,000\text{ pieces}$ or $2\text{ weeks}$ of full SOP volume) and a minimum number of distinct production days/batches ($D_{\min}$, e.g., $15\text{ production days}$) so a high-speed stamping press cannot clear GP-12 in a single 4-hour shift run:

$$\text{Exit_Eligible} = \left(N_{\text{consec}} \ge N_{\text{exit}}\right) ;\land; \left(D_{\text{consec_clean}} \ge D_{\min}\right) ;\land; \left(\text{Open_Upstream_CAPAs} == 0\right)$$

3. Shipping label and ASN interlock (GP-12 Green Dot verification). To make it physically impossible for an un-audited tote to slip onto an outbound truck during EPC_ACTIVE:

1. Production completion at Op 80 places finished totes into a virtual quarantine warehouse: WH-PENDING-EPC-WALL (blocked from Delivery Note picking).
2. Only scanning the tote through Op 99-EPC—where the auditor verifies 100% of pieces, stamps each piece with the required witness mark, and attaches the physical green containment dot to the container label—moves the tote into WH-FG-EPC-CLEARED and enables printing the AIAG shipping label carrying the EPC / GP-12 VERIFIED flag.

under div over under table over under thead over under tr over under th over EPC / GP-12 Lifecycle Stage under /th over under th over Trigger / Gate Rule under /th over under th over MES & WMS System State under /th over under th over Mandatory Evidence Required to Advance under /th over under /tr over under /thead over under tbody over under tr over under td over under strong over 1. Containment Entry (SOP or CAPA) under /strong over under /td over under td over New PPAP launch, ECN, or Customer PRR / 8D escape under /td over under td over under code over EPC_STATUS = ACTIVE_CONTAINMENT under /code over ; $N_{\text{consec}} = 0$ under /td over under td over Pre-Launch Control Plan (Op 99-EPC characteristics), boundary samples, auditor signoff under /td over under /tr over under tr over under td over under strong over 2. Daily Redundant Wall Audit under /strong over under /td over under td over $100%$ of pieces after final Op 80 pack under /td over under td over Transfer WH-PENDING-EPC-WALL $\rightarrow$ WH-FG-EPC-CLEARED under /td over under td over Per-piece/lot Op 99-EPC check log + witness mark confirmation; increment $N_{\text{consec}}$ under /td over under /tr over under tr over under td over under strong over 3. Wall Defect Reset Event under /strong over under /td over under td over $\ge 1\text{ defect}$ found at Op 99-EPC or OEM plant under /td over under td over under strong over Reset $N_{\text{consec}} \to 0$ under /strong over & $D_{\text{consec}} \to 0$; COUNTER_FROZEN_CAPA under /td over under td over Upstream Op 10..80 poke-yoke/station fix + updated PFMEA & Production Control Plan under /td over under /tr over under tr over under td over under strong over 4. Exit Eligibility & Graduation under /strong over under /td over under td over $N_{\text{consec}} \ge N_{\text{exit}}$ AND $D_{\text{consec}} \ge D_{\min}$ under /td over under td over under code over EPC_STATUS = EXIT_ELIGIBLE_PENDING_SIGNOFF under /code over under /td over under td over Zero-defect summary chart + Quality Manager signoff (+ OEM SQE letter if required) under /td over under /tr over under /tbody over under /table over under /div over

Illustrative worked example: 3,000-piece steering knuckle GP-12 launch with a Day-8 porosity reset

All figures below are illustrative and synthetic. A Tier-1 chassis supplier launches a cast-and-machined aluminium steering knuckle (PART-KNK-550) for an OEM customer at a daily production rate of $250\text{ knuckles/day}$.

• Contractual GP-12 / EPC Exit Criteria (EPC-PLAN-KNK550):
  • Minimum Consecutive Zero-Defect Quantity ($N_{\text{exit}}$): $3,000\text{ consecutive pieces}$
  • Minimum Consecutive Clean Production Days ($D_{\min}$): $15\text{ production days}$ (Note: if zero defects occur from Day 1, $15\text{ days} \times 250/\text{day} = 3,750\text{ pieces}$; if a reset occurs later, the post-reset run must satisfy both $\ge 3,000\text{ pieces}$ and $\ge 15\text{ total/post-reset days}$ per the OEM CSR—here governed by $\ge 3,000\text{ consecutive clean pieces}$ after any reset).
• Offline Op 99-EPC Inspection Economics: Dedicated EPC auditor checks $6\text{ critical characteristics}$ and applies a green witness dot in $45.0\text{ seconds/piece}$ ($0.0125\text{ hours/piece}$) at a burdened quality technician rate of $$32.00/\text{hour}$ ($$0.4000/\text{piece}$).

Step 1: Track Days 1–7 and the Day-8 counter reset at Piece #1,892.

1. Days 1 through 7 (Lots #01–#07, $7 \times 250 = 1,750\text{ pieces}$):
   • Op 99-EPC inspects $1,750\text{ knuckles}$ with $0\text{ defects}$ ($N_{\text{consec}} = 1,750$, $58.33%$ toward the $3,000\text{-piece}$ quantity target).
2. Day 8 (Lot #08, Pieces #1,751 to #2,000) — Defect Caught at Piece #1,892:
   • Pieces #1,751 through #1,891 ($141\text{ pieces}$) pass cleanly ($N_{\text{consec}} = 1,891$).
   • On Piece #1,892, the offline EPC auditor discovers a $1.8\text{ mm}$ subsurface gas porosity blowhole exposed on the machined brake-caliper mounting boss (DEF-POROSITY-04) that the Op 60 CNC operator missed!
   • MES Reset Action: The system immediately resets $N_{\text{consec}}$ from $1,891$ to $0$, quarantines Lot #08, and freezes the EPC counter until Manufacturing Engineering installs a high-intensity oblique LED surface inspection check at Op 60.

Step 2: Compute post-reset graduation volume and the $$756.80$ containment labour penalty.

Once the Op 60 countermeasure is verified, the plant must run a full $3,000\text{ new consecutive zero-defect pieces}$ (Piece #1,893 through Piece #4,892 across the remaining $108\text{ pieces}$ of Day 8 plus Days 9 through 20, totaling $12\text{ additional clean days} = 3,000\text{ pieces}$):

• Total Pieces Inspected at Op 99-EPC to Achieve Exit: $$N_{\text{total_inspected}} = 1,892\text{ pcs (pre-reset)} + 3,000\text{ pcs (post-reset clean run)} = \mathbf{4,892\text{ pieces}}\quad (\text{across } 20\text{ production days})$$
• Financial Cost of the Day-8 Reset:
  • Baseline Planned EPC Cost ($3,000\text{ pieces}$): $3,000 \times $0.4000/\text{pc} = \mathbf{$1,200.00}$ ($37.50\text{ auditor hours}$)
  • Extra Containment Penalty from Piece #1,892 Reset: $1,892\text{ wasted count} \times $0.4000/\text{pc} = \mathbf{$756.80}$ ($23.65\text{ extra auditor hours}$)
  • Total EPC Wall Labour Spend: $4,892 \times $0.4000/\text{pc} = \mathbf{$1,956.80}$ ($61.15\text{ total auditor hours}$).

Independent arithmetic verification.

1. Pre-reset piece count: $1,750\text{ (Days 1–7)} + 141\text{ (Day 8 clean)} + 1\text{ (Piece #1,892 defect)} = 1,892\text{ pieces}$.
2. Total campaign piece count: $1,892\text{ pre-reset} + 3,000\text{ post-reset consecutive clean} = 4,892\text{ total pieces}$ ($4,892 / 250 = 19.568\text{ days} \implies \text{Day 20 completion}$).
3. Containment labour arithmetic: $45.0\text{ s/pc} / 3,600\text{ s/hr} = 0.0125\text{ hr/pc}$; $0.0125\text{ hr/pc} \times $32.00/\text{hr} = $0.4000/\text{pc}$; $(1,892 \times $0.40 = $756.80\text{ penalty}) + (3,000 \times $0.40 = $1,200.00\text{ base}) = $1,956.80\text{ total}$.

Workflow, owner roles, exception handling and recovery controls

Bounded pilot and implementation check

Pilot the MES Op 99-EPC redundant inspection gate, zero-defect counter reset engine, and green-dot shipping label interlock on 2 newly launched or post-CAPA part numbers over 3 weeks:

• Pilot boundary: Configure WH-PENDING-EPC-WALL to WH-FG-EPC-CLEARED transfers, enforce badge separation between production operators and EPC auditors, and test the automatic counter reset and CAPA lock.
• Acceptance tests:
  • ACT-M128-01 (Operator Self-Signoff Prohibition): Attempt to log an Op 99-EPC pass using the same badge ID that logged the upstream Op 60 machining operation; confirm the MES blocks the self-check.
  • ACT-M128-02 (Single-Defect Counter Reset to Zero): Advance $N_{\text{consec}}$ to $1,891$, log $1\text{ porosity defect}$ on Piece #1,892 at Op 99-EPC, and confirm $N_{\text{consec}}$ immediately drops to 0 and freezes until an upstream CAPA is linked.
  • ACT-M128-03 (Un-Audited Tote Shipping Block): Attempt to add a tote sitting in WH-PENDING-EPC-WALL to an outbound Delivery Note / ASN; confirm the WMS blocks shipment.
  • ACT-M128-04 (Customer SQE Exit Signoff Gate): Reach $N_{\text{consec}} = 3,000$ and $D_{\text{consec}} = 15$ on a part with customer_exit_approval_required = TRUE; confirm Op 99-EPC cannot be deactivated until the signed SQE exit document is uploaded.

Next actions

1. Enforce strict badge and physical separation between Final Production Inspection (Op 80) and the EPC Wall (Op 99-EPC): GP-12 is a redundant audit of the production process—the same operator cannot perform both checks.
2. Automate the $N_{\text{consec}} \to 0$ reset whenever Op 99-EPC catches a defect: Stop treating defects caught inside the GP-12 cage as "successes that count toward graduation"; every GP-12 catch proves an upstream station needs a poka-yoke fix.
3. Interlock AIAG shipping label printing to WH-FG-EPC-CLEARED status: Make it systemically impossible for a night-shift shipping clerk to print a master label for a pallet that bypassed the GP-12 containment wall.
4. Track GP-12 containment labour hours ($0.40/pc in our fixture) in a dedicated Cost-of-Poor-Quality (COPQ) account: Showing management that a single Day-8 reset cost $$756.80$ in extra inspection labour drives rapid investment in upstream poka-yoke sensors.

Frequently Asked Questions

How should OEMs and Tier-1 plants enforce Early Production Containment (EPC / GP-12) 100% inspection walls and zero-defect exit criteria for newly launched or post-CAPA suppliers?.

Teams should govern early production containment gp12 software by linking every transaction to its source evidence, timestamp, and assigned owner before permitting downstream posting. Distinct from M001 (initial supplier onboarding) and M039 (engineering change PPAP); M128 governs the time-boxed 30/60/90-day heightened containment wall, mandatory extra check stamps, and formal exit criteria before reverting to normal sampling. Rather than relying on informal spreadsheet overrides, the workflow enforces a documented verification gate and preserves the original observation whenever a correction is recorded.

How does apqp ppap software handle exceptions and mismatches?.

When a discrepancy occurs during apqp ppap software, the system routes the blocked record into an owned exception queue rather than silently dropping or auto-adjusting the balance. Assigned operational, quality, and finance owners must review and approve exceptions before posting. Each exception retains the original quantity, date, and counterparty reference until the designated reviewer resolves the variance with supporting evidence.

What should teams test before automating incoming quality control software?.

Before scaling incoming quality control software, run a bounded pilot using historical records that include partial receipts, late updates, duplicate messages, and rejected lines. Verify that the integration preserves idempotency, maintains a clear segregation of duties between operational entry and financial approval, and produces an auditable trail for every state transition.