RSC Colour: Extra Dark Blue

  • Local Variant

    A local variant commonly refers to a version of a product, process, data structure, or specification that is intentionally modified from a global or corporate standard to meet the specific needs of a particular plant, region, customer, or system.

    What a local variant typically includes

    In industrial and regulated manufacturing environments, the term is often used in the context of:

    • Product definitions: A base or global part number with site-specific or customer-specific variants, for example different packaging, localized documentation, or minor design differences.
    • Routings and process plans: A standard routing with local variants per plant reflecting different machines, labor skill mixes, or inspection steps while still producing the same qualified product.
    • Work instructions: A master work instruction with local variants tailored to a specific site, line, or piece of equipment, often managed via document control rules.
    • MES/ERP configuration: Local variants of master data such as operation codes, BOMs, or workflows used to align a global template with a specific facility or region.
    • Quality and inspection plans: A corporate standard inspection plan with local variants adding checks based on local regulatory, customer, or equipment requirements.

    A local variant usually maintains traceability back to the global standard or template, so that changes to the global definition can be assessed and selectively applied to each variant.

    What a local variant is not

    • It is not an uncontrolled deviation or ad hoc change. Local variants in regulated environments are typically documented, approved, and version-controlled.
    • It is not a completely independent design. There is normally a clear relationship to a base or global definition (for example a reference to a common item, specification, or template).
    • It is not the same as a temporary concession or deviation, which is usually time-bound or lot-bound and linked to nonconformance handling.

    Operational usage

    On the shop floor and in operations systems, local variants show up in several ways:

    • Master data and templates: Global templates for BOMs, routings, or work instructions are copied and adapted for a specific site, creating a local variant record in ERP, MES, or PLM.
    • Document control: Document management systems may maintain a master document and local variants, each with their own revision history and approval workflow.
    • System integration: When integrating MES and ERP, mappings are often needed so that local variants still report against global product families or common KPIs.
    • Compliance and audits: Auditors may look for evidence that local variants remain aligned with applicable standards and that variant-specific risks and requirements are documented.

    Common confusion

    • Local variant vs. deviation/concession: A local variant is a planned, approved configuration for ongoing use. A deviation or concession is typically a temporary authorization to ship or use product that does not meet the standard specification.
    • Local variant vs. customer-specific part: A customer-specific part may be set up as a unique item with its own drawings and requirements. A local variant may still share the same base item or design but differ in how it is produced or documented at a particular site.
    • Local variant vs. site parameterization: Parameterization adjusts configurable settings (for example cycle times or resource capacities). A local variant usually represents a distinct, versioned definition rather than only parameter values.
  • How is augmented reality being used in aerospace maintenance instructions?

    Augmented reality in aerospace maintenance is mainly used to present context-aware work instructions, not to replace underlying MRO, MES, or QMS systems. AR acts as a visualization and guidance layer on top of existing, validated processes and data sources.

    Common AR use cases in aerospace maintenance instructions

    In regulated aerospace MRO environments, AR is typically used for:

    In practice, this connects to MRO execution when teams need to turn the answer into repeatable execution habits.

    • Step-by-step maintenance guidance: Overlaying each operation directly on the asset (remove panels, disconnect lines, apply sealant, torque fasteners) with 3D cues, animations, and checklists tied to a specific tail/serial and configuration.
    • 3D part and assembly visualization: Showing “exploded” views, fastener locations, routing of lines and harnesses, and hidden components that are difficult to interpret from 2D maintenance manuals alone.
    • Visual inspection support: Highlighting inspection zones, damage limits, and no-go areas; capturing annotated photos/video as inspection evidence and linking them back to the work order or NCR.
    • Connector, wiring, and hose identification: Color-coding and labeling which connector or line to touch in crowded bays, reducing the risk of disconnecting or reconnecting the wrong item.
    • Parameter and tool overlays: Displaying torque specs, clearances, test parameters, or chemical application limits next to the actual feature instead of on a separate document or screen.
    • Guided test and troubleshooting sequences: Walking technicians through fault isolation trees with conditional steps, error code explanations, and embedded references to AMM/IPC/TSM content.
    • On-the-job training and qualification support: Using the same AR instruction set to train new technicians on real hardware while logging completion, timing, and observed errors as training records.

    How AR interacts with existing MRO, MES, and documentation systems

    In brownfield aerospace MRO, AR almost never stands alone. It must coexist with:

    • MRO and maintenance planning systems: Work orders, task cards, and scheduled maintenance come from existing MRO/ERP platforms. AR usually consumes these as read-only or synchronized tasks, then pushes back completion status, timestamps, and evidence.
    • MES / execution control: When a plant or depot uses MES or digital travelers, AR is an alternate front end for selected operations. The system of record for routing, configuration, and traceability typically remains the MES.
    • Technical publications and controlled documents: AMM, CMM, SRM, and other manuals are still the controlled source. AR content is derived from them and must track revisions. Many organizations keep the manuals and AR content in a PLM or tech pubs environment with explicit change control.
    • QMS, NCR, and CAPA workflows: AR can simplify defect capture (photos, annotations, measurements), but final NCR and MRB decisions live in the QMS. Integrations often pass reference IDs and attachments, not business rules.

    Because of validation and certification implications, most organizations treat AR as a user interface and visualization enhancement around existing, validated systems rather than a new, authoritative system of record.

    Benefits operators aim for

    When AR is deployed carefully and integrated with existing systems, typical objectives are:

    • Reduced maintenance errors: More precise guidance on which fasteners, harnesses, and panels to touch, and how, particularly in dense or similar-looking configurations.
    • Shorter task times: Less time flipping through manuals, searching for diagrams, or clarifying with senior technicians.
    • Improved training efficiency: Faster ramp-up for new technicians, with fewer supervision hours and reduced reliance on tribal knowledge.
    • Better evidence capture and traceability: Visual records tied to specific tasks, components, and time stamps that can be retrieved for audits, incident investigations, or recurring defect analysis.
    • Configuration clarity: For fleets with many service bulletins and mods, AR can help technicians see which instructions apply to the specific aircraft or tail number in front of them.

    Actual gains vary widely and depend heavily on instruction quality, integration maturity, and device usability in the real maintenance environment.

    Key constraints, risks, and tradeoffs

    Aerospace maintenance is highly regulated, and AR introduces nontrivial constraints:

    • Validation and change control: AR instructions that alter how a maintenance task is performed require validation and careful linkage to the underlying approved data. Any change to AR content must go through tech pubs/QMS change processes and be traceable.
    • Data readiness and 3D model quality: Effective AR usually needs accurate 3D models and consistent naming/numbering that match manuals and BOMs. Legacy platforms or heavy mods may not have usable, up-to-date CAD. Poor models yield misalignment and operator distrust.
    • Device ergonomics and safety: Headsets and tablets compete with PPE, tight access, FOD risk, and lighting conditions. In many bays, technicians still prefer tablets or small handhelds, and head-mounted devices are only viable for specific tasks.
    • Environmental durability: Temperature, fluids, dust, and vibration can affect device reliability in hangars and line maintenance areas. This can limit where AR is practical without protective measures.
    • IT, cybersecurity, and export control: AR applications often need access to technical data that may be export-controlled or defense-sensitive. That requires alignment with ITAR/DFARS, secure identity management, and network segmentation. Cloud-based AR services can be constrained or prohibited in some defense contexts.
    • Integration debt: Without robust integrations to MRO, MES, PLM, and QMS, AR can become another silo. Technicians end up double-entering data or ignoring the AR layer in favor of the system of record.
    • Qualification burden: If AR-guided steps are referenced in approved maintenance procedures, they may need to be treated as part of the qualified process. That increases the burden for updates and can slow iteration.

    Why full replacement strategies usually fail

    Attempting to replace manuals, MRO systems, or MES completely with an AR platform is rarely successful in aerospace MRO because:

    • Certification and regulator expectations: Authorities and OEMs expect traceable, document-controlled procedures. AR can present them in another form, but it does not remove the need for the underlying controlled content.
    • Long asset and system lifecycles: Aircraft and depot systems are kept for decades. Throwing away validated MRO/MES/QMS stacks and tech pubs in favor of a single AR layer creates long-term sustainment and interoperability risks.
    • Integration complexity: MRO involves configuration control, part interchangeability, service bulletin tracking, and complex routing. Replicating all of that logic in an AR platform is costly and fragile compared to integrating with existing systems.
    • Downtime and change risk: Replacing core systems is disruptive and carries high risk of grounding aircraft or slowing turnarounds. Incremental AR use around existing workflows is easier to justify operationally.

    Most successful AR programs in aerospace MRO target specific high-value tasks or pain points, integrate with current systems, and expand gradually as validation and trust build.

    Practical starting points

    For organizations exploring AR for maintenance instructions, workable early use cases often include:

    • Training on complex, infrequent tasks (e.g., heavy checks, structural repairs) using AR as a training overlay while keeping official manuals as the reference.
    • High-error or high-rework operations where misidentification of parts, connectors, or locations is common and can be mitigated with visual AR cues.
    • Inspection documentation where annotated AR photos can be attached to existing NCR or repair records.

    In each case, success depends on tight linkage to existing documentation, controlled change processes, and clear decisions about which system remains the source of truth.

  • How do we manage change for inspectors and engineers used to spreadsheets and email?

    Managing change for inspectors and engineers who live in spreadsheets and email is less about technology and more about minimizing risk to throughput, quality, and compliance. You have to treat this as a structured adoption program with guardrails, not a quick tooling swap.

    1. Start from their reality, not the target architecture

    Inspectors and engineers rely on spreadsheets and email because they are flexible, fast to tweak, and under their direct control. Replacing them outright creates real perceived risk: loss of agility, longer cycle times, and fear of being blamed if something breaks.

    In practice, this connects to implementation and adoption playbooks when teams need to turn the answer into repeatable execution habits.

    Before introducing new workflows:

    • Map current use cases: what decisions are actually made in Excel and email (inspection plans, sampling decisions, FAI data capture, NCR routing, concessions, etc.).
    • Identify what is working: speed, accessibility, ad-hoc analysis, small-team coordination.
    • Identify what is failing: version control, traceability for audits, rekeying into MES/ERP/QMS, missed emails, and non-reproducible calculations.

    Your change plan should explicitly preserve what works while addressing the real failure modes.

    2. Use a phased, mixed-mode approach instead of a big-bang cutover

    In regulated, long-lifecycle plants, big-bang replacements often fail because of validation burden, downtime risk, and integration complexity. For spreadsheet-heavy users this is especially true.

    Practical patterns:

    • Pilot by workflow, not by department: e.g. start with AS9102 FAI data collection or a specific inspection family, not “all inspection” at once.
    • Allow controlled coexistence: keep legacy spreadsheets for analysis while shifting official records (e.g. inspection results, NCR data) into a system with audit trails.
    • Define a single system of record for each object: for each part of the process (characteristics, inspection results, dispositions, approvals) state explicitly where the authoritative record lives.
    • Use time-boxed dual running: for a limited period, run both spreadsheet and digital workflow, compare outputs, and use that to tune the new process and build trust.

    3. Treat this as a change-controlled process change

    Moving from spreadsheets and email to digital workflows can impact validated processes, work instructions, and documented controls. It should go through normal change control rather than being treated as “just an IT project.”

    Key elements:

    • Impact assessment: determine which procedures, forms, and records are affected (inspection plans, FAI forms, NCR routing, sampling rules, etc.).
    • Risk analysis: capture risks like data migration errors, incorrect mappings, user workarounds outside the validated flow, and partial adoption.
    • Plan for validation and evidence: define what needs to be verified or validated (calculations, auto-populated fields, interfaces) and how evidence will be captured.
    • Update WI / SOPs: do not rely on training alone; align documented work instructions to the new workflows.

    4. Make the first wins obviously better than email + Excel

    Inspectors and engineers will not change unless the new way is measurably better for them, not just for IT or Quality.

    Choose first use cases that deliver visible, daily benefits, for example:

    • Pre-populated data: parts, revisions, operations, gage lists pulled from existing MES/ERP/QMS to avoid retyping.
    • Automated calculations: sampling decisions, capability indices, or tolerance checks that are currently buried in spreadsheet formulas.
    • Built-in traceability: automatic capture of who measured what, when, with which gage, and which revision of the spec.
    • Reduced email chases: digital routing for NCRs, concessions, or approvals with status visibility instead of buried email threads.

    If inspectors and engineers can clearly see “this saves me time or gets me out of being the admin of 20 spreadsheets,” adoption resistance drops significantly.

    5. Design for brownfield coexistence with MES, ERP, PLM, and QMS

    In most plants, inspection and engineering spreadsheets are the glue between MES, ERP, PLM, and QMS. Ripping them out without replacing the integration role is high risk.

    Practical coexistence patterns:

    • Read from existing systems, write back selectively: e.g. pull part and BOM data from ERP or PLM but only write inspection results or NCRs back to the systems that must own them.
    • Lock down structural spreadsheets, keep flexible ones at the edges: standardize templates used as formal records while allowing ad-hoc analysis in personal spreadsheets that do not drive official decisions.
    • Use governed exports instead of ad-hoc extracts: if users still need data in Excel, provide controlled exports with clear labeling (“view only, not a system of record”).
    • Plan for long equipment and system lifecycles: assume some legacy systems will not be replaced for a decade; design digital workflows to sit around them instead of depending on full replacement.

    6. Address trust, not just skills

    Resistance is often about trust in data and workflows, not only about technical comfort.

    • Involve inspectors and engineers in design: let them help define screens, fields, and rules, especially where today they maintain complex spreadsheets.
    • Validate critical logic with them: for any algorithm replacing a spreadsheet formula (sampling plans, risk scores, FAI characteristic handling), run side-by-side comparisons and document the results.
    • Make audit trails visible: let users see who changed what and when, so they are not afraid of being blamed for hidden system behavior.
    • Be explicit about failure modes: what happens if the new system is down, if an integration fails, or if a record is incorrect; define and train on fallbacks.

    7. Provide targeted training and support, not generic “systems training”

    Generic system overviews rarely work for inspectors and engineers under schedule pressure.

    More effective approaches:

    • Role-based scenarios: e.g. “Create a new inspection plan for a revision change”, “Record an NCR during in-process inspection”, “Complete an AS9102 FAI”.
    • Short, searchable job aids: quick references embedded in digital work instructions or accessible from the workflow itself.
    • Floor-level champions: experienced inspectors/engineers trained first and empowered to support peers in their cell or value stream.
    • Office-hours during early rollout: scheduled blocks where users can get help on real jobs, not just sample data.

    8. Set clear adoption metrics and governance

    Without explicit ownership and metrics, users drift back to spreadsheets and email over time.

    • Define adoption KPIs: proportion of inspections logged in the new system, percentage of NCRs routed digitally, reduction in untracked email approvals.
    • Establish quality ownership: assign a process owner (often in Quality) responsible for maintaining inspection workflows, templates, and records definitions.
    • Monitor for shadow spreadsheets: periodically sample for off-system tracking sheets and understand why they exist; either absorb the need into the system or formally approve their use with controls.
    • Align incentives: ensure that leadership expectations, audit readiness goals, and performance reviews support using the new workflows, not just hitting output numbers.

    9. Accept that some spreadsheets and email will remain

    In high-mix, low-volume and engineering-heavy work, some level of spreadsheet and email use is rational and will not fully disappear. The objective is to move critical, repeatable, and traceability-sensitive workflows into governed systems while:

    • Reducing rekeying and copy/paste between tools.
    • Ensuring inspection and NCR records are auditable and retrievable.
    • Keeping ad-hoc analysis and one-off engineering studies at the edges, not at the core of compliance-critical processes.

    Being explicit about where spreadsheets and email are acceptable, and where they are not, helps inspectors and engineers adapt without feeling that every practical tool they rely on is being taken away.

  • How do you prove that alerts are preventing AOG events?

    You usually cannot “prove” prevention, only build a defensible case

    In practice you cannot fully prove that alerts prevent AOG events, because you are trying to demonstrate that something did *not* happen. What you can do is build a defensible, evidence-based argument that links alerting to reduced AOG likelihood or impact. That argument needs clear definitions, audited data, and stable processes, or it will collapse under scrutiny. In regulated aerospace environments, this is less about marketing claims and more about traceability and statistical confidence. You should be prepared to show not only successes but also where alerts fired and did *not* prevent an AOG, and explain why. The standard is not certainty, but whether a skeptical engineer, quality lead, or regulator can follow the causal chain and challenge the assumptions.

    Start with precise definitions and scope

    Before you measure anything, define what counts as an AOG event in your context, and who is the source of record for that status. Without a stable AOG definition, any claimed reduction will look like reclassification rather than real improvement. Then define the class of alerts you are evaluating: maintenance prediction, configuration anomalies, part-life exceedances, documentation gaps, or supply-chain risks. Include only alerts that are realistically capable of influencing AOG risk, not every notification the system produces. Also define the time horizon you care about (e.g., last 12–24 months) to avoid mixing pilot phases, configuration changes, and immature models with current performance. Document these definitions formally so that future change control and audits can understand what was evaluated.

    In practice, this connects to MES execution control when teams need to turn the answer into repeatable execution habits.

    Establish a baseline using historical data

    A defensible claim requires a baseline period *before* the alerting was active or mature. Ideally this is data from the same fleets, routes, and maintenance providers, with the same AOG definition. You should extract historical AOG events, their causes, and indicators that could have been alerted on (e.g., fault codes, trend deviations, deferred defect patterns). This allows you to estimate the historical frequency of AOGs that were potentially preventable with earlier detection. Be explicit about gaps: missing telemetry, incomplete maintenance records, unreliable timestamps, or changes in reporting practices. If your data is too sparse or inconsistent, acknowledge that the baseline is low-confidence and frame any conclusions as directional, not proof.

    Build traceability from alert to action to outcome

    To argue that alerts prevent AOG, you need traceability from the initial alert to the work that was actually done and the eventual aircraft status. This typically requires integration or at least reliable manual linkage between alert logs, maintenance work orders, parts changes, and flight operations systems. Each alert of interest should show: what triggered it, when it was received, who saw it, what decision was made, and what corrective or preventive action occurred. You also need to record whether that asset subsequently experienced an AOG for the same subsystem or failure mode within a reasonable time window. Without this chain, you are left arguing on intuition rather than evidence, which will not survive internal reviews or regulatory questions.

    Use counterfactual reasoning and matched comparisons

    Because you cannot directly observe the alternate universe where the alert did not exist, you approximate it with matched comparisons. One approach is to compare assets, flights, or time periods with similar utilization and environment where some had actionable alerts and others did not. Another is to use past events as counterfactuals: identify historical AOGs that would have triggered today’s alerts and ask whether similar situations now resolve without AOG. Be cautious of confounding factors such as fleet renewal, maintenance policy changes, or pandemic-era schedule shifts. Clearly document your matching criteria and limitations so that a reviewer can see how close your counterfactuals really are.

    Apply basic statistics but avoid overstating causality

    Once you have baselines and traceability, you can compute metrics such as the rate of AOG events per flight hour before and after alert implementation, by fleet, system, or failure class. You can also measure the proportion of alerts that lead to timely action and the downstream AOG rate for those assets. Confidence intervals, trend charts, and survival analysis can help show whether changes are statistically significant rather than random noise. However, even strong correlations do not prove causality, especially in environments where maintenance standards, supply chains, and scheduling policies are changing. Present statistics as supporting evidence, not as absolute proof, and call out where sample sizes are small or model drift may be influencing results.

    Treat AOG-focused alerting as a change-controlled experiment

    In a regulated environment, the most convincing approach is to treat new alert logic as a controlled change rather than a background IT tweak. For some fleets or failure modes, you may be able to run phased rollouts or A/B-style comparisons, with one group receiving alerts and another using standard processes only. Each rollout should be documented through change control, including risk assessment, expected impact on AOG risk, and validation results. This creates a structured record for comparing AOG and near-AOG incidents between cohorts, even if the experiment is not statistically perfect. Be mindful that true randomized control is often impossible due to safety and contractual obligations, so you must explain why any partial or quasi-experimental design is still meaningful.

    Account for system coexistence and integration limits

    Most operators are working with a mix of legacy MRO, flight ops, ERP, and reliability systems, often with incomplete integration. This limits how cleanly you can connect alerts to work orders and aircraft status, especially across multiple maintenance providers or lessors. Full replacement of existing systems purely to instrument alert-to-AOG relationships is rarely practical, because of validation burden, data migration risk, and potential downtime. Instead, you typically layer alerting on top, then use interfaces, exports, or manual reference IDs to create a traceability spine. Be transparent about where that spine is fragile—manual data entry, spreadsheet-based joins, or delayed synchronization—because it affects how strong your prevention claims really are.

    Recognize and quantify failure modes of the alerting system

    To be credible, your evaluation must include cases where alerts did not prevent AOG and why. Common failure modes include: alerts generated too late to act, alerts routed to the wrong team, action recommended but deferred due to parts or slot constraints, or alert fatigue leading to disregard. You should measure false positives (alerts that led to unnecessary work) and false negatives (AOGs with no prior alert despite available data). When possible, classify AOGs by whether they were: preventable with current alerts, preventable with improved logic, or fundamentally unpreventable (sudden failures, external events). This helps leadership see that alerts are one lever among many, not a universal shield against AOG.

    Connecting this to your own AOG and alert environment

    If your organization is asking this question, it likely already has alerting in place but lacks a clear evidence trail tying it to AOG reduction. A practical path forward is to select one or two high-impact failure modes or fleets, define explicit alert-to-action workflows, and instrument them for traceability. Over 6–12 months, you can collect enough data to compare against historical patterns and refine the alerts or processes where prevention failed. In parallel, you can harden the integrations between alerting, maintenance, and operations systems just enough to make the analysis repeatable. The outcome will not be mathematical proof, but a level of evidence that experienced engineers and regulators can challenge and still accept as reasonable.

  • Security Assessment Report (SAR)

    A Security Assessment Report (SAR) is a formal document that records the scope, methods, findings, and conclusions of a security assessment performed on an information system, network, application, or operational environment. In regulated industrial and manufacturing contexts, it is commonly used to document cybersecurity evaluations of OT and IT systems that handle production, quality, engineering, or regulated data.

    The SAR typically consolidates evidence gathered during testing and reviews and presents an overall view of current security posture, identified vulnerabilities, control gaps, and associated risks. It serves as a key input for risk management decisions, remediation planning, and ongoing compliance activities.

    Typical contents of a Security Assessment Report

    While formats vary by organization or standard, a SAR commonly includes:

    • Scope and context: which systems, environments, locations, OT assets, applications, and interfaces were assessed, and under what assumptions.
    • Methodology: assessment approach, frameworks or standards referenced (for example, NIST 800-53 or NIST 800-171), tools used, and testing techniques.
    • System description: high-level architecture, data flows, external connections, and critical functions (for example, MES to ERP interfaces, remote access to shop-floor equipment).
    • Control evaluation results: which technical, physical, and administrative controls were examined, and their effectiveness.
    • Findings and vulnerabilities: detailed issues identified, such as misconfigurations, missing patches, weak access controls, or insecure integrations.
    • Risk ratings: likelihood and impact estimates, criticality to operations, and prioritized risk levels.
    • Recommended remediation: suggested corrective actions, compensating controls, and timelines.
    • Residual risk and conclusion: summary of remaining risk after existing controls, and overall assessment of system security posture.

    Use in industrial and manufacturing environments

    In industrial operations, a Security Assessment Report is often used to document:

    • Cybersecurity evaluations required for regulatory frameworks such as CMMC-related efforts or NIST-based programs.
    • Security reviews of MES, ERP, PLM, historian, and SCADA/ICS systems and their integrations.
    • Assessments of remote connectivity to production equipment, vendor access, or cloud-hosted manufacturing applications.
    • Evidence for internal audits and customer or regulatory reviews related to data protection and system hardening.

    The SAR becomes a reference for tracking remediation efforts, informing investment decisions, and demonstrating that security risks in production and support systems are being systematically evaluated and addressed.

    Common confusion

    • Security Assessment Report vs. Security Plan: A SAR describes the results of an assessment at a point in time. A security plan (or system security plan, SSP) describes how controls are designed and implemented, often before or independently of a specific assessment.
    • Security Assessment Report vs. Penetration Test Report: A penetration test report focuses on exploitation-focused testing and attack paths. A SAR usually has a broader scope, covering control design and effectiveness, documentation reviews, and interviews, and may incorporate penetration testing results as one input.

    Relationship to compliance frameworks

    Many cybersecurity and defense-related frameworks reference or imply the need for a Security Assessment Report. For example, NIST 800-53 and NIST 800-171 based programs often use SARs to document the results of periodic security control assessments. In defense and aerospace manufacturing, SARs can be part of the evidence set used to show alignment with contractual cybersecurity requirements, without themselves constituting certification or approval.