Configuration Control

Configuration control is the discipline of ensuring that the engineering definition of a part (drawing, model, specification, process requirements, and acceptance criteria) is correct, current, complete, and consistently used from design release through procurement, manufacturing, inspection, and delivery. In defense and aerospace, configuration control is not paperwork—it is how you prevent nonconforming hardware, schedule slips, and quality escapes that can trigger MRB actions, rework, scrap, and customer notifications.

This matters even more in modern workflows that blend additive manufacturing (AM) (e.g., powder bed fusion (PBF), DMLS/SLM) with post-processing such as stress relief, Hot Isostatic Pressing (HIP) (including PM-HIP consolidations), 5-axis CNC machining, surface finishing, and inspection (CMM, CT scanning, NDE). Each handoff adds opportunity for a revision mismatch or an uncontrolled “tribal knowledge” process step to creep in. The result is often a part that looks correct but is not built to the correct configuration baseline.

Below is a practical, engineering- and procurement-ready approach to configuration control for drawings and related documentation. The goal is simple: when you buy or build hardware, everyone is working to the same approved definition—no surprises at FAI, no “we built Rev B because that’s what we had,” and no ambiguity about what must be certified.

Revision handling

Revision handling is the core of configuration control: ensuring the latest released revision is used, while preserving traceable access to the prior baseline. In regulated manufacturing environments (AS9100, ITAR-controlled programs, DFARS flow-down), “latest” is not a guess—it is defined by controlled release in your PLM/PDM/ERP system and referenced consistently across RFQs, POs, travelers, and inspection plans.

Start with a clear authority: define one system of record for part definition. For many organizations this is PLM/PDM for drawings and models, with ERP controlling the item master and revision. Avoid “shadow control” in email attachments and shared drives. If your supplier can download a file from an uncontrolled portal, you have already lost configuration control.

Define what constitutes the configuration: for AM and hybrid manufacturing, the part’s configuration typically includes (1) the drawing and/or MBD model, (2) applicable material and process specifications, (3) build orientation/support strategy requirements if they are design-critical, (4) HIP/stress-relief requirements, (5) machining datum schemes, (6) inspection and acceptance criteria (including CT scanning or NDE requirements when applicable), and (7) any customer-specific notes or key characteristics. Treat these as a single controlled package, not loosely associated files.

Control “minor” changes with major impact: a revision change that only adjusts a note can still be configuration-critical. Examples: changing a surface finish callout that affects post-processing, tightening a positional tolerance that changes fixturing and CMM strategy, updating a HIP cycle requirement, or adding DFARS or ITAR marking requirements. For PBF builds, changes to minimum wall thickness, hole size limits, or as-built-to-machined stock allowance can also alter build success rates and cost.

Implement a revision gate at receiving and at work release: receiving inspection should verify that the PO matches the supplier’s manufacturing plan revision (drawing/model revision and spec revision). Separately, the internal work release/traveler should include a step that confirms the correct revision is attached and that obsolete revisions are removed from the work area. This is especially important for work cells that run both legacy and current builds.

Don’t ignore model/drawing mismatch: when both 2D drawings and 3D models exist, explicitly define order of precedence. If your contract allows model-based definition (MBD), ensure suppliers have validated capability to interpret PMI and that downstream inspection programs (CMM/CT) are generated from the correct dataset revision. If a drawing is “for reference,” say so unambiguously, and ensure the inspection plan reflects the authoritative dataset.

Document packages

In aerospace and defense procurement, a “drawing” is rarely enough. A controlled document package should travel with the job from RFQ through delivery, with consistent revision references and a defined list of deliverables. A robust package reduces back-and-forth, prevents suppliers from making assumptions, and supports faster first-pass acceptance.

For RFQs (quote packages): include the released drawing/MBD, applicable specifications (material, heat treat/HIP, coatings, NDE), required inspection method (CMM, CT scanning, dye penetrant, etc.), and any quality clauses (AS9100, NADCAP for special processes, FAI requirements, sampling plan). If the part is ITAR-controlled, mark the package and distribution rules appropriately and ensure only authorized recipients receive the data.

For purchase orders (order packages): mirror the RFQ definition but add the commercial and compliance requirements: certificates of conformance (CoC) requirements, material traceability expectations (heat/lot numbers, powder batch, wire/rod lot for directed energy deposition, or powder blend records for PM-HIP), serialization/UID if required, record retention period, and any DFARS flow-down clauses applicable to the program. The PO should clearly state the drawing/model revision and spec revisions. If the supplier must use approved sources (e.g., powder vendor, HIP provider, NADCAP-approved NDE house), list them or define qualification criteria.

For internal manufacturing (traveler/build packet): configuration control must extend beyond the supplier boundary. Your build packet should reference: (1) released revision, (2) AM build file version (if controlled), (3) machine ID and parameter set identification, (4) powder lot(s) and reuse history, (5) preheat/stress relief schedule, (6) HIP cycle identification where applicable, (7) machining programs tied to revision-controlled toolpaths, (8) inspection plan with characteristic accountability, and (9) nonconformance escalation triggers. This is where quality escapes are prevented: the traveler is the “single truth” on the shop floor.

For delivery (certification pack): define expectations up front to avoid late surprises. Typical deliverables include CoC to the drawing/spec revision, material certs, HIP charts or reports (cycle parameters, vessel ID, date/time, load), heat treat records, NADCAP special process certs when required, NDE reports, CT scanning reports (including scan resolution and acceptance criteria), CMM reports, as-built and as-machined inspection results, and a First Article Inspection (FAI) per customer requirement when applicable. If the part is built via PBF and then machined, ensure both states are documented when required (e.g., as-built density/porosity verification prior to HIP, final dimensions post-machining).

Supplier communication

Even the best internal configuration control fails if suppliers do not receive clear, controlled inputs and a defined method for asking questions. Supplier communication is not just “send the drawing”; it is managing the interpretation, planning, and confirmation loops that occur before chips are cut or powder is fused.

Establish a single point of contact and a single channel for technical questions: use a controlled Q&A process tied to the PO/RFQ number and revision. When suppliers ask about ambiguous notes, missing datum targets, or conflicting tolerances, capture the question and your disposition in a controlled record. If the answer changes the definition, it should trigger an ECR/ECO (not an informal email instruction).

Require the supplier to acknowledge configuration: for complex parts, request a pre-production confirmation that lists the revision of each applicable document and spec, plus the supplier’s proposed manufacturing route (AM build + HIP + machining + NDE, etc.). This can be as simple as a signed “manufacturing plan acknowledgment” that becomes part of the job record.

Communicate critical-to-quality (CTQ) features and process sensitivities: in AM/hybrid manufacturing, CTQs often include thin walls, internal channels, threads, and datum features that must survive stress relief and HIP before machining. If a feature drives build orientation, support strategy, or post-processing constraints, document it. Otherwise suppliers may optimize for cost in a way that jeopardizes geometry or inspection accessibility.

Flow down special process requirements explicitly: NADCAP requirements for heat treat, NDE, or coatings should be stated as requirements, not assumptions. If HIP must be performed by an approved provider or per a specific cycle, communicate it in the contract language and the technical package. The same applies to CT scanning: define what constitutes an acceptable scan (resolution, coverage, artifact limits, defect acceptance) rather than simply writing “CT scan required.”

Control file formats and derivative data: if you provide STEP files, build preparation files, or inspection program exports, label them as controlled or uncontrolled. A common failure is an “uncontrolled” STEP file being used as the machining authority while the drawing was updated. If suppliers need derivative files for CAM or build prep, require them to regenerate derivatives from the released authority dataset and to record the dataset revision used.

ECR/ECO basics

Engineering Change Requests (ECR) and Engineering Change Orders (ECO) are the mechanism by which configuration control stays disciplined under real-world pressure. In aerospace/defense programs, change control must balance urgency (schedule, obsolescence, supplier constraints) against risk (airworthiness, mission assurance, contractual compliance).

Practical definitions: an ECR is a proposal to change the configuration or to document a problem; an ECO is the approved, released change that updates the baseline and authorizes implementation. Treat these as auditable records that tie together the technical rationale, the affected documents, and the implementation plan.

Step-by-step change workflow that works in production: (1) identify the issue or improvement (e.g., PBF build failures due to thin walls, or machining interference due to a datum selection), (2) perform impact analysis (fit/function, mass properties, stress, interface control, inspection method, downstream assemblies), (3) assess supply chain impact (lead times, tooling, special processes like HIP/NDE, approved sources), (4) determine disposition of in-process and finished goods (use-as-is, rework, scrap, retrofit), (5) update controlled documents (drawings, models, specs, travelers, inspection plans), (6) communicate to suppliers with clear effectivity, and (7) verify via FAI or delta inspection that the change is correctly implemented.

Effectivity is where many ECOs fail: define exactly when the new revision applies: by date, serial number, lot, or PO line item. For AM builds, effectivity may need to reference build ID or machine parameter set version. For PM-HIP parts, effectivity may reference powder lot and consolidation run. Without effectivity, you risk mixing configurations in the same assembly or delivering hardware that cannot be traced to the correct baseline.

Do not use ECOs to “paper over” nonconformance: if a part is out of tolerance, the correct mechanism is typically nonconformance reporting and MRB disposition, not retroactively changing the drawing to match what was built—unless engineering determines the change is safe and appropriate and then updates the baseline with full customer awareness as required. This distinction protects you during audits and preserves integrity of the configuration baseline.

Traceability

Traceability connects configuration control to evidence. In defense and aerospace manufacturing, it is not enough to claim you built to Rev C; you must be able to prove it, along with the exact material, processes, and inspections applied. Robust traceability is also a practical business tool: when a field issue arises, it lets you contain scope quickly instead of launching an expensive broad recall.

Material traceability in AM and PM-HIP: for PBF (DMLS/SLM), record powder supplier, alloy, batch/lot, sieve size distribution if controlled, reuse and refresh ratios, storage conditions, and any powder testing required (chemistry, flowability, oxygen/nitrogen content). For PM-HIP, trace the powder lots used in the can, can material/heat, consolidation run ID, HIP vessel, and post-HIP heat treatments. This data should map back to each serialized part or lot, depending on contractual requirements.

Process traceability: record the machine used (make/model/serial), build ID, parameter set identification, layer thickness, scan strategy identifier if relevant, stress relief cycle, HIP cycle, and post-processing steps (support removal, bead blast, machining operations, coatings). For machining, link NC program revision, fixture revision, tool lists, and in-process inspection checkpoints to the part revision. Configuration control extends to manufacturing process definition when the process is part of the approved configuration baseline.

Inspection traceability: ensure inspection records reference the correct drawing/model revision and characteristic list. For CMM, retain program versions and alignments tied to revision-controlled datum schemes. For CT scanning, retain scan setup parameters, voxel size/resolution, reconstruction settings, and acceptance criteria. For NDE, retain technician qualifications and procedure revisions. If NADCAP is required, ensure certificates and procedure compliance are retained in the job record.

Certificates of conformance (CoC) and compliance packs: a CoC should explicitly state the part number and revision, quantity, PO, and applicable specs. If DFARS requirements apply (e.g., specialty metals restrictions when invoked by contract), ensure material certs and traceability support compliance claims. For ITAR-controlled hardware, ensure distribution and storage of records comply with your program’s export control plan.

Link everything with unique identifiers: serialization, lot IDs, and build IDs are the glue. In hybrid AM + machining, one practical approach is to assign a build ID at AM completion, carry it through HIP and machining, and then assign final serial numbers at final inspection—while maintaining a cross-reference table. Whatever method you use, make sure you can reconstruct the full history of each delivered unit.

Common failure modes

Configuration control problems tend to recur in predictable patterns. Recognizing them early is often the fastest way to reduce cost and cycle time.

Failure mode 1: obsolete revision used in production. This happens when suppliers or internal teams keep local copies, or when a buyer attaches an old PDF to an email. Prevention: enforce controlled distribution (portal access with revision control), require revision acknowledgment on the PO, and include a receiving/work-release check that rejects mismatched revisions before work starts.

Failure mode 2: derivative files become the de facto authority. A STEP file generated from Rev A continues to drive CAM while the drawing moved to Rev B. Prevention: mark derivative files as uncontrolled unless they are revision-controlled, and require regeneration from the released dataset. Tie CAM and build prep outputs to revision-controlled inputs in the job record.

Failure mode 3: AM process changes occur outside change control. A technician modifies scan parameters to improve build stability, or a supplier changes powder reuse practices, and the result drifts from qualified performance. Prevention: treat parameter sets and powder handling rules as controlled process documents; changes require review, validation, and sometimes customer notification depending on contract and qualification basis.

Failure mode 4: HIP and heat treat requirements are ambiguous or incomplete. Notes like “HIP per spec” without specifying cycle class, temperature/pressure/time, or acceptance criteria cause variation that affects density, fatigue, and dimensional stability. Prevention: specify the exact HIP/heat treat requirements (spec revision and cycle), require HIP reports in the certification pack, and define effectivity when cycles change.

Failure mode 5: datum scheme changes break inspection comparability. A drawing revision updates datums or adds profile tolerances; the supplier continues using an old CMM alignment, resulting in apparent nonconformance or, worse, accepted parts measured against the wrong scheme. Prevention: update the inspection plan and CMM programs under document control; require delta FAI or re-qualification when datum schemes change.

Failure mode 6: unclear flow-down of quality and regulatory requirements. Suppliers deliver parts with incomplete CoCs, missing NADCAP evidence, or inadequate traceability, leading to receiving holds and schedule impact. Prevention: define deliverables and required certifications in the RFQ/PO package and verify early (e.g., at supplier kickoff) that the supplier can comply.

Failure mode 7: “email engineering” replaces ECOs. Under schedule pressure, teams approve a change informally. Later, audits and customer reviews cannot reconcile what was built versus what was released. Prevention: enforce that any change affecting form/fit/function, acceptance criteria, material, or special processes must go through ECR/ECO with effectivity and updated controlled documents.

Failure mode 8: mixed configurations in assemblies or spares. Without effectivity control, spares built to a newer revision get installed on older assemblies, creating interface issues or undocumented performance changes. Prevention: manage configuration at the assembly level with clear interchangeability rules and update interface control documents when needed.

When configuration control is executed well, it becomes a competitive advantage: fewer RFIs, smoother supplier execution, faster FAIs, and dramatically lower risk of costly scrap—especially in complex AM + HIP + machining routes where each step multiplies the cost of a late discovery.

Practical takeaway: treat configuration control as an end-to-end system, not a drawing admin task. Anchor it with a single source of truth, controlled document packages, disciplined supplier communication, ECR/ECO rigor with effectivity, and evidence-based traceability. That combination is what consistently prevents the mistakes that defense and aerospace programs cannot afford.