Looking for quick help in understanding "Configuration Management", what in general is required. We are being required as a supplier to have an AS 9100 compliant system, at this time. I am ordering the ISO 10007 for future reference, but don't yet have.

The requirement states that the config mgmt system must be "appropriate to the product" which seems to be somewhat open to interpretation by the auditor. Our system is quite complex as are our products. We also develop software for airborne systems so the config mgmt of that process is done in accordance with RTCA DO-178B. We use some fairly elaborate software tools to manage configuration during the software development/lifecycle because the task is so complex. We have never had a registrar/auditor write an observation against our system so I must conclude that it is somewhere in the adequacy ballpark relative to our products.

I don't have much knowledge of other systems and have not read 10007 so maybe somebody who is more "worldly" can enlighten us.

Reference - 4.3 Config. management.
When you receive the guide ISO 10007, you will find the "key elements", to document within your QMS manual. I don't remember exactly how many, but you should see them in several areas.

Best regards

Hello All!

Would anyone out there like to share how they meet the requirement for clause 4.3 Configuration Management?

I ask this because our QM has a section stating the following below, and would like some feedback on wether you all feel it is adequate.

4.3 Configuration Management
Maricopa Controls Inc. has established, documented and maintains a Configuration Management process to ensure that our products continue to function safely and reliably when individual components are changed.
This is achieved through the use of a Product Matrix, located on the Server and in the Blue Books listed by Part Number.

We have no seperate process for CM at this time, our CM is broken down by part number.

Thanks Paula :)

When looking at configuration management the standard defines configuration as the functional and physical characterisitcs of a product as defined in technical documents and is achieved on the product.

Looking at the configuration of the product first identify the configuration item, whether it is a part or an assembly. From that point, usually an engineering drawing, look to how the organization documents and justifies changes to the product, evaluates the risk of the change, shows evidence that the change of the configuration has been approved (usu. and ECN) and that the change has been implemented (changed production orders) or a process deviation or waiver has been received.

Structure of CM is normally acheived in the project design phase and includes all the functional or performance characteristics of the product that are to be maintained throughout the life cycle of the product.

Configuration identification should include such things as a listing of the technical specifications used, the numbering system that will identify the specification, drawing or any changes, how serial numbers or other traceability will be addresses and the proper procedure or tech. specs required for release of the product.

Hope this is of some assistance to you.

Ann Morgan

When looking at configuration management the standard defines configuration as the functional and physical characterisitcs of a product as defined in technical documents and is achieved on the product.

Looking at the configuration of the product first identify the configuration item, whether it is a part or an assembly. From that point, usually an engineering drawing, look to how the organization documents and justifies changes to the product, evaluates the risk of the change, shows evidence that the change of the configuration has been approved (usu. and ECN) and that the change has been implemented (changed production orders) or a process deviation or waiver has been received.

Structure of CM is normally acheived in the project design phase and includes all the functional or performance characteristics of the product that are to be maintained throughout the life cycle of the product.

Configuration identification should include such things as a listing of the technical specifications used, the numbering system that will identify the specification, drawing or any changes, how serial numbers or other traceability will be addresses and the proper procedure or tech. specs required for release of the product.

Hope this is of some assistance to you.

Ann Morgan

:thanx: Ann,
This is right on with what I was thinking and is verifiable during an audit and also during everyday operations. Great Response! :bigwave: Paula

...Would anyone out there like to share how they meet the requirement for clause 4.3 Configuration Management?...

This is something I've been wondering about for us. We manufacture products in accordance with someone else's configuration management plan - we're not design responsible. So I think our procedures need to address cmp's as they pertain to us - like change control/contract review and document control, etc. In the same manner that we control and use technical orders and repair manuals given to us by some of our customers (customer specific requirements).

I'm also not sure about configuration audits - who does them? The design responsible function who created the CMP? Or is it our final product inspection? 10007 says "A CA may be required for the formal acceptance of a configuration item."

What do you guys think?

I got this in my personal e-mail so I guess someone pushed the wrong button:

The organization shall establish, document and maintain a configuration "management process", "appropriate to the product":.
****
Sounds a little confusing, almost describes why we need a change process.

I do not see the whole, so its inadequate. looking for something in other processes. What's the QMS scope, and its exclusions, if any?

Phillip

I am also waiting on my copy of ISO 10007 for clarification on configuration management. I am curious if this affects products which are altered per OEM (bulletins), FAA (AD's), and/or customer requirements (PMA manufacturing)?
As an aerospace rework facility we continually update products per customer request and FAA mandate. This usually is accompanied by a part number and/or change letter/number change. We also provide a number of FAA/DER internal repairs. Would this procedure only include those internal processes, or will it need to include the additional requirements?

It should include whatever processes you use to control the configuration of product. This would apply to both internal and external requirements. Here are a few quotes from ISO 10007 that may be helpful:
5.1 The configuration management process should focus on customer requirements for the product and should take into account the context in which it will be performed.
5.4.1 After the initial release of product configuration information, all changes should be controlled. The potential impact of a change, customer requirements and the configuration baseline will affect the degree of control needed to process a proposed change or concession.
A.3 The configuration management plan should detail the configuration management policies that have been agreed with the customer or suppliers.

Even though you are not responsible, you must assure that the Technical Data Package (TDP) you receive is complete and sufficient for production, changes are approved and communicated, change implementation is controlled and reported and the output of production meets the physical and functional requirements of the TDP. This covers all aspects of Configuration Management, Configuration Identification, Change Control, Status Accounting and Audits.

The attachment may help describe activities for each phase.

But the standard specifically requires:
AS9100 - 4.3 Configuration Management: The organizatioin shall establish, document and maintain a configuration management process appropriate to the product.

What do I do?

Could the requirement be implying a product specific configuration management plan?

In our organization, we design, develop, and certify (TSOA) most of our products. Hence, we are required by FAA to develop and maintain separate hardware and software CMP’s. However, I see a boilerplate requirement for a product specific CMP in some customer contracts which may be intended to apply when the supplier is not design responsible and the CMP is not a regulatory imposition. Are your customers flowing down such a requirement?

Otherwise, who would decide what is appropriate? For a registrar to determine that your system is inappropriate there would need to be some objective evidence of a system shortcoming, IMO.

I am not familar with ISO requirements but I found the attached article to be very helpful. At least it gives some background and info on the topic. I bookmarked it from somewhere but can't remember where from.

Even though you are not responsible, you must assure that the Technical Data Package (TDP) you receive is complete and sufficient for production, changes are approved and communicated, change implementation is controlled and reported and the output of production meets the physical and functional requirements of the TDP. This covers all aspects of Configuration Management, Configuration Identification, Change Control, Status Accounting and Audits.

The attachment may help describe activities for each phase.
That's what I mean. All of the things you mention above are covered in a number of our Level II procedures: Contract Review, Advanced Product Quality Planning, Engineering Drawing Control, Control of Customer Specific Requirements and Preservation of Product.

AS9100 says we need to establish, document and maintain a configuration management process appropriate to the product. It's not exactly its own process here; a lot of our processes include identifying configuration management requirements flowed down to us from our customers and making sure they are included in our product realization plans and instructions.

Do you think it would be ok to say something to that effect in my quality policy manual? Maybe just a couple of sentences directing the reader to the various procedures?

That's what I mean. All of the things you mention above are covered in a number of our Level II procedures: Contract Review, Advanced Product Quality Planning, Engineering Drawing Control, Control of Customer Specific Requirements and Preservation of Product.

AS9100 says we need to establish, document and maintain a configuration management process appropriate to the product. It's not exactly its own process here; a lot of our processes include identifying configuration management requirements flowed down to us from our customers and making sure they are included in our product realization plans and instructions.

Do you think it would be ok to say something to that effect in my quality policy manual? Maybe just a couple of sentences directing the reader to the various procedures?



If your company does not design and or assembly products that require in process configuration changes and/or if you are not required to incorporate in process configuration changes the following paragraph in the Quality Policy Manual will meet the requirements. Should your organization be required to do any of the above hire a Configuration Management Engineer. I have spent hours trying to understand the over all requirements of ISO 10007. The Standard is very involved.


4.3 CONFIGURATION MANAGEMENT

AQC, LLC does not design and manufacture end products. There is no necessity for AQC, LLC to develop a formal configuration management system. However, customer configurations are acknowledged. Customer designated revisions and drawing changes are controlled throughout the process. Part number and revisions supplied by the customer are noted on all required documentation. Drawing revisions are reviewed for applicable changes to the product or processes. Review and or changes are noted on the fixed or frozen processes when required. Configuration Management is also a means by which identification and traceability may be maintained. (Ref. AS9100 paragraph 7.5.3 note).

In the event additional Configuration Management is required, ISO 10007 will be referenced for developing additional requirements.

I am not familar with ISO requirements but I found the attached article to be very helpful. At least it gives some background and info on the topic. I bookmarked it from somewhere but can't remember where from.
Thanks, Jim, this article is a great help for me. I will give an EN 9100 training in a couple of weeks and I am still trying to get more information on this topic, to make it more clearly to the trainees. What I was looking for was an example of a drawing tree showing the structure of a product or component (P/N-system). Can anybody share something like this with me?

Angelika

I'm a little late on this thread but it's very relevant to my CM plan template that I'm working on. We provide software and PM services to aerospace company's, which makes us a little different than someone who manufactures a product. I've been struggling with a few things and this is one. I did some checking and found several copies of CM plans on the internet, including one from NASA. I've tried to incorporate things that looked important to me but am still trying to clarify it. For what it's worth, here are the sections of my CM plan template (still filling in details):

Purpose
Scope
References
Definition of Terms
Risks and Contingencies
Assumptions
Responsibilities
Staffing and Training Needs
Schedule
Organization
SCM Responsibilities
Interface Control
SCM Plan Implementation
Applicable Policies, Directives, and Procedures
Configuration Identification
Configuration Control
Configuration Status Accounting
Audits and Reviews
Release Process
Library Management
Subcontractor Software
Vendor Software
Records Collection and Retention

If your company does not design and or assembly products that require in process configuration changes and/or if you are not required to incorporate in process configuration changes the following paragraph in the Quality Policy Manual will meet the requirements. Should your organization be required to do any of the above hire a Configuration Management Engineer. I have spent hours trying to understand the over all requirements of ISO 10007. The Standard is very involved.


4.3 CONFIGURATION MANAGEMENT

AQC, LLC does not design and manufacture end products. There is no necessity for AQC, LLC to develop a formal configuration management system. However, customer configurations are acknowledged. Customer designated revisions and drawing changes are controlled throughout the process. Part number and revisions supplied by the customer are noted on all required documentation. Drawing revisions are reviewed for applicable changes to the product or processes. Review and or changes are noted on the fixed or frozen processes when required. Configuration Management is also a means by which identification and traceability may be maintained. (Ref. AS9100 paragraph 7.5.3 note).

In the event additional Configuration Management is required, ISO 10007 will be referenced for developing additional requirements.

Hello,

I have one quick question.

We are an aerospace engineering services company and we do design activities based on customer requirements and specifications using software’s like CATIA, Nastran etc. But We do not hold any pattern rights for the design.So we exclude clause 7.3 and also we are not manufacture any parts or components.

so company like us using COTS for development work, should develop configuration management process or can we follow customer CM ?

Hi AS_Quality Engineer
I came across this post whilst reading a new question on CM and hope you managed to get an answer to your question and your suggestion that CM was not applicable to you as a Design Organisation was of concern.

If you're the designer or doing fatique and stress work using COTS tools then CM is an essential part of what you do. There are some useful documents around that may help, in particular, the Airbus spec AUK/SA/001-4 'Quality Management Requirements for Externally Procured supplies and services'. It is specifically written for Design Sub-contractors like yourself. If you're not doing work directly for Airbus then I would approach the OEM or Prime you are working for to ask about a similar specification.

Written as it is, clause 7.3 is not ideal when auditing a company like yours as there can be an argument put that your design output is controlled through the product realization clauses. I don't subscribe to this and would discourage you from excluding 7.3. In my view it is more applicable to what you do than section 7. In a recent audit I did 7.3 was used for the design work and section 7 to control the process of taking on the work and delivering it to the customer.

Cheers,