Advisory Circular Subject: QUALITY ASSURANCE CONTROLS
FOR PRODUCT ACCEPTANCE
SOFTWARE Date: 8/11/93 Initiated by: AIR-200 AC No: AC 21-36 Change:
1. PURPOSE. This advisory circular (AC) provides information and guidance concerning control of software and related digital input/output data (used by production approval holders (PAM) and their suppliers during manufacture, inspection and/or test) designed for use in the acceptance of airborne products. This AC provides an acceptable means, but not the sole means, of compliance with the applicable Federal Aviation Regulations (FAR).
2. APPLICABLE FEDERAL AVIATION REGULATIONS (FAR) AND ADVISORY MATERIAL.
a. Part 21, Subpart F, Production Under Type Certificate Only.
b. Part 21, Subpart G, Production Certificates.
c. Part 21, Subpart X, Approval of Materials, Parts, Processes, and Appliances.
d. Part 21, Subpart O, Technical Standard Order Authorizations.
e. Advisory Circular 21-1, Production Certificates.
f. Advisory Circular 21-6 Production Under Type Certificates Only.
g. Advisory Circular 21-303.1, Certification Procedures for Products and Parts.
3. DEFINITIONS AND ABBREVIATIONS. For the purpose of this AC, the following definitions and abbreviations apply:
a. Acceptance. Represents approval (or buyoff) of a product in the production process to ensure that a product is in conformance with the design approved by the Federal Aviation Administration (FAA).
b. Software. Software is a pre-defined set of instructions that can be used to execute a function.
Par 3 2
c. Computer-Aided Manufacturing (CAM). Computer-Aided Inspection (CAI) and Computer-Aided Test (CAT) Software. The CAM/CAT/CAT software and related digital input/output is not incorporated into the flight hardware, but is used to manufacture, inspect and/or qualify airborne products and designed for use in the acceptance of those products. Any CAM methods which produce characteristics that are subsequently processed through an independent quality acceptance are not the subject of the guidance contained in this AC. The CAM/CAT/CAT software can be developed in-house or purchased from a supplier. Examples of this type of software include: numerical control programs, automated test stand software, coordinate measuring machine programs, automated process control software, and automated manufacturing cell controllers.
d. Configuration Management (CM). The process of documenting and identifying computer software and related documentation to ensure:
(1) Each software item is uniquely identified and traceable;
(2) Changes are controlled and properly recorded; and
(3) All stored data is recoverable.
e. Media. The actual memory device where the software is stored, such as floppy disks, hard disks, computer hard drives, and memory chips.
f. Master Files. The controlling copy of a software program.
g. Operating System Software. The software that improves the efficiency with which computers can be used by controlling the applications software. Operating system software may be commercially available, such as DOS or UNIX systems, or developed for specific environments, such as a test stand.
h. Input/Output Data. Geometric part definition data which establishes the approved configuration of an item or related extracts (portions thereof) of that configuration.
4. DISCUSSION. This AC addresses only those sections of FAR Part 21, Subparts F, G, K, and O where information on CAM/CAT/CAT software control would be helpful.
a. Acceptance. Product acceptance is the inspection in the manufacturing process that determines that the product conforms to the FAA approved type design. In-process inspections may constitute acceptance for certain characteristics that will not be accepted at a later step in the manufacturing process or for service items that may be delivered to customers as subassemblies. In-process inspection characteristics that will be inspected or tested at a later step in the production process are not considered acceptance. Procedures may allow for emergency non-routine use of non-released software in the
3 Par 4 acceptance process. These procedures should provide a means of locating and recalling the product that was manufactured, inspected or tested by non-released software when necessary. If unreleased software is used for product acceptance, the product involved must be identified as nonconforming until such time as the exact version of the software used is released. Each product affected should be identified by serial number to ensure recall if necessary. Product should not be shipped, unless an FAA approved alternate means of product acceptance is used, until all product acceptance software has been released. A recall system should not be considered an acceptable alternate means of product acceptance for shipment of products.
b. Approved Production and Fabrication Inspection Systems. A production inspection system acceptable to the Administrator is described in AC 21-6; and an acceptable fabrication inspection system is described in AC 21-303.1. If product acceptance CAM/CAT/CAT software is used with either of these systems, the following provisions may be used to demonstrate compliance with the applicable FAR:
(1) Release Methods. The objective of the release process is to ensure that only approved software that has been placed under internal control (e.g., configuration management, library control, etc.) is released to the users. Procedures should be developed that detail the methods to be used to formally release software.
(2) Documentation. Procedures should be developed that identify what documentation should be available with the software. The documentation may be in electronic or hard copy format and should detail the requirements satisfied by the software. If electronic documentation is used, FAA representatives must be allowed to review the documentation upon request.
(3) Software Configuration Management (SCM). The SCM procedures should describe the system to be used to manage the configuration of CAM/CAT/CAT software. Configuration management may be administered by the production approval holder, the supplier or a third-party, such as the original development activity. However, it is the responsibility of the PAH to ensure that all subject software is properly configured.
Elements of an acceptable software configuration management system include:
(i) Identification. Configuration identification procedures for the software and documentation should be developed. The procedure should define how programs which are not functionally interchangeable are distinguished (only identical copies of master programs are considered functionally interchangeable).
Par 4 4
(ii) Change Control Process. The objective of change control is to ensure that all changes have been approved, tested, correctly implemented, and that only the proper version of the program and its documentation are available for use. The change control procedures should provide explicit instructions regarding how and by whom CAM/CAT/CAT software and documentation may be changed. The instructions should ensure that procedures exist to verify that all approved changes are properly incorporated. Quick-fix changes maybe allowed, but the procedures should identify the method to be used to report those changes back to the change control authority and ensure the changes are properly documented and incorporated.
(iii) Media Distribution/Retrieval System. The media distribution and retrieval methods should ensure that all software can be recovered or restored in case of a disaster. This disaster preparation may be accomplished by duplicating master copies and ensuring that the master copies and duplicates are stored separately.
Methods should be developed to ensure master copies, archive duplicates, and user copies of the CAM/CAT/CAT software remain current and accurate. Additionally, procedures should be established to ensure that archive media and operational copies maintain the integrity of the stored data over time. The system should ensure that only controlled software is delivered to the users and can be recalled when needed.
(iv) Application of Software. A method should be developed that allows a determination to be made of which specific software programs, including operating systems software, are applicable to the CAM/CAT/CAT controls.
(4) Additional System Elements. The system should also
(i) How software will be used (during manufacture, processing, inspection and/or test) for product acceptance.
(ii) Methods used to track and correct problems discovered in the CAM/CAT/CAT software. Procedures developed should ensure that all deficiencies discovered are tracked until properly dispositioned.
(iii) Control provisions which ensure the software is not improperly modified, altered or changed.
(iv) The method used to ensure that changed or otherwise obsolete design data is not used for product acceptance.
(v) Employee responsibility for verifying that the correct software is being used.
(vi) Procedures for storing and handling the software media to preclude damage to the program.
5 Par 4
(vii) Specific software programs may interfere with and be dependent upon operating system software. In addition, specific software programs may interfere with and be dependent upon other inter-related software programs. Methods and/or procedures should be developed to ensure that the functionality and accuracy of the specific inspection software program is maintained when revisions and/or updates occur to inter-related inspection or operating system software.
c. Quality Control Systems. An acceptable quality control system for production certificate holders is described in AC 21-1. If CAM/CAT/CAT software or related digital input/output data is to be used for product acceptance, all provisions addressed in paragraph
4.a. above should apply to the production approval holders and suppliers that use CAM/CAT/CAT software.
The software quality assurance functional responsibilities should be part of the quality assurance system submitted to the FAA. The organization responsible for software quality assurance should have functional independence sufficient to allow objective evaluations to be made. The organization responsible for software quality assurance should have adequate authority, responsibility and freedom to identify and evaluate problems to ensure corrective action is completed on deficiencies discovered and should:
(1) Ensure all software tasks are clearly and adequately described in documented procedures.
(2) Verify that suppliers which use CAM/CAT/CAT software and related digital input/output data for product acceptance implement appropriate controls.
Par 4 6
(3) Have final authority for formal release of software. and related digital input/output data used for product acceptance.
(4) Ensure corrective action has been taken on any deficiencies previously discovered.
Michael Gallaghe Manager, Aircraft Manufacturing Division