Aerospace Manufacturing Software Problems: The 7 That Cost AS9100 Suppliers Real Money

Why does first article scope get underestimated so often?

Almost every aerospace quality build is sold as generate the AS9102 forms. That framing is the failure. Forms 1, 2 and 3 are output. The thing that has to be built is the characteristic itself: part number plus revision plus balloon number, with design nominal, tolerance, key characteristic classification, inspection method, required gage type and frequency. Get that object right and the forms are a rendering exercise. Get it wrong and you have bought a document generator with an aerospace paint job.

The tell is in the estimate. If a proposal prices form generation in two weeks and says nothing about the characteristic model, the developer has understood the deliverable and not the domain. They will discover in month three that a revision diff is impossible without balloon level identity, and the change request will cost more than doing it properly at the start.

The second underestimate is the revision path. AS9102 requires a partial first article on affected characteristics only, which means the system has to compare two characteristic sets and produce the delta. That is straightforward when characteristics are records and impossible when they are cells.

The fix is to make the data model an acceptance gate before any user interface work. Have the team draw part, revision, characteristic, lot, heat lot, serial and operation instance as separate entities on a whiteboard. If they cannot separate those without prompting, that is the whole answer about whether the project will work.

What goes wrong migrating mill certs and job history?

The structured data moves fine. Parts, jobs, lots and operations come out of E2 Shop System, JobBOSS2 or Epicor Kinetic in weeks. The trouble is the fifteen years of PDFs in a folder tree named by job number, because that is where traceability actually lives.

Three things bite. Certs were filed under the job, not the heat lot, so the link you need for containment was never recorded anywhere. File names carry meaning inconsistently, sometimes a heat number, sometimes a purchase order, sometimes a scanner default. And a proportion of the archive is scans of faxes, which no extraction tool reads reliably.

Shops respond by trying to migrate everything and stalling. The archive is enormous, the recovery rate on the oldest material is poor, and the project spends its first quarter on documents nobody will query.

The workable approach is tiered. Migrate the last two to three years fully, with document extraction pulling alloy, heat number, specification revision and expiry off the cert and matching it to the receiving line, with a human queue for anything the parser is not confident about. Index the rest for full text search and leave it readable in place. Retention obligations generally require retrievability rather than live records, so an indexed archive satisfies them at a fraction of the cost.

Then commit to a rule going forward: no receipt closes without a cert linked to the heat lot. The backlog stops growing on day one, which matters more than how much of it you rescue.

Why do ERP and CMM integrations break after launch?

Two different failure modes, and both are predictable.

On the enterprise resource planning side, the shop systems in this market were not designed to be integrated with. Some offer no interface worth the name, some expose a read only database posture that the vendor may not support, and version upgrades change table shapes without notice. A read integration that worked in testing goes quiet after a service pack, and nobody notices until job data stops arriving and someone reconciles by hand.

On the coordinate measuring machine side, the break is subtler. Report output from PC-DMIS or Zeiss Calypso is parsed by matching balloon numbers, and the moment a programmer renames a feature or reorders the routine, the match rate falls. The system does not error. It silently matches fewer characteristics, and the quality engineer starts typing again without telling anyone.

The fix on both sides is monitoring the shape of success rather than the absence of errors. Alert when the nightly job did not run, when the record count falls outside its normal range, and when the balloon match rate on a report drops below a threshold. Every unmatched value goes to a review queue rather than being dropped.

Ask any developer what happened the last time a vendor changed a field silently. The answer you want mentions idempotency, a replay queue and an alert that reaches a person. The answer you do not want is that they added a retry.

What happens when ITAR and CMMC scope is not covered?

This is the gap that turns a working build into a rebuild. ITAR constrains where the data sits and who may touch it, including your developer's own staff. CMMC 2.0 Level 2 maps to NIST 800-171 and adds access control, audit logging, encryption requirements and a documented system boundary. Neither is a feature you add in phase two.

What actually happens when it is skipped: the system ships on general purpose cloud infrastructure, then a prime asks about your boundary during a flowdown review, and the answer requires moving hosting, re-doing identity, adding audit logging on every read, and possibly changing who on the delivery team is allowed to see the repository. That is a re-architecture priced against a budget that has already been spent.

The compliance gap has an operational twin. Point in time association is what an auditor tests, and it is routinely left out of scope. Auditors do not ask for the current revision of a work instruction, they ask which revision was in effect on the date serial 0042 ran, whether the operator's certification was valid that week, and whether the gage used was in calibration. If those links are resolved at query time rather than captured at the moment of use, the honest answer is that you cannot prove it.

The fix is to raise both in the first conversation. Any developer who has built in this sector will ask about ITAR and CMMC scope unprompted and will have an opinion about hosting. One who says hosting can be decided later has told you they will re-architect on your money.

Should you build custom or configure what you already own?

Keep what works. E2 Shop System, JobBOSS2, Global Shop Solutions and Epicor Kinetic are competent at jobs, routers, inventory and money, and replacing them is an expensive way to arrive where you started. Almost nobody in this market should be rewriting their shop system.

More than that, some shops should not build at all. Under roughly 25 people, single site, a handful of part numbers on repeat orders and low first article volume, the correct stack is E2 or JobBOSS2 plus High QA or InspectionXpert plus disciplined folder hygiene. Configure the characteristic library in High QA properly, standardise your folder naming, and the payback on a six figure build simply is not there. We would rather say that than sell you one.

Net-Inspect deserves the same treatment. If your prime mandates it and your volume is modest, use it as intended for submission and ballooning and stop. It solves its slice well.

The build case appears when quality headcount grows faster than revenue, when somebody's full time job is retyping data between systems, when a containment question takes more than a day, when you add a second site or a second Nadcap accredited process and the tribal knowledge does not clone, or when a prime has made a scorecard number a condition of the next package and you cannot see that number in real time. At that point the packaged stack is not cheaper, it is billed as payroll.

How do hidden costs get into the quote?

Five places, consistently.

Prime output profiles. Each portal, each part numbering scheme and each required field set is a small integration with its own quirks, and quotes tend to price one and assume the rest are copies. Count yours before you sign, because they are not copies.

Regulatory surface. CMMC and ITAR scope adds engineering for access control, audit logging, encryption and boundary documentation, and it pushes hosting toward government cloud. Priced in from day one it is a line item. Bolted on afterwards it is a project.

Unstructured document recovery. Extraction from clean modern certs is one problem. Extraction from scanned faxes is another, and the difference is in the review queue volume rather than in the software.

Multi site. Different Nadcap accreditations per site mean different approved process lists, different operator certification regimes and different audit evidence, which is more than a location field.

Point in time capture. Recording the work instruction revision, certification status and gage calibration state at scan in, and refusing the scan when the gage is out of calibration, sounds small and touches every transaction in the system.

Ask for those five as separate line items with their own days. What does not drive price much is user count, because cost scales with regulatory surface and integration count rather than seats.

What separates a build that works from one that fails here?

The successful ones ship a narrow first release that quality engineers use daily. Characteristic model, first article generation with report import and revision diffing, traceability spine with cert ingestion, and a read integration with the shop system. That is the release that stops the bleeding, and it is small enough to finish before the sponsor changes.

They put the data model under scrutiny before the user interface. The characteristic and the point in time association are the whole game. A team that gets those wrong finds out in month six, and by then the schema is load bearing.

They run in parallel for a quarter. Produce first articles both ways on real jobs, compare, and treat every difference as a defect in the model rather than a data entry error. That is also how you build the evidence that the system is trustworthy before an auditor tests it.

They keep the human sign off visible. Extraction from a ballooned drawing and a cert is genuinely useful, and the correct target is getting a first article from roughly 14 hours to under two, not to zero. The confirmation gate is what an auditor inspects, so design it to be inspected.

And they settle ownership before kickoff: repository in your organisation from the first commit, infrastructure in your accounts, a written exit path. When an auditor asks who can change a signed record, the answer has to be your organisation under your access controls.