Configuration Management and Performance Verification of Explosives-Detection Systems (1998)

FAA Type Certification has primarily been applied to ensure that hardware and software that is manufactured for commercial aircraft is ''flightworthy.'' Throughout the development and manufacturing process, the FAA works with the manufacturer to achieve a product that is acceptable for the intended application.

FAA Type Certification requires that a Certification Program Plan is developed to assist with (1) defining the basis for certification, (2) addressing special conditions, and (3) providing a means to comply with specifications and regulatory requirements. Throughout the certification process, meetings are held between the manufacturer and the FAA to ensure that all FAA requirements are being met. The FAA requires that the manufacturer document and control product development, including design results and reviews, quality-assurance requirements, procurement of materials, and the build of product up to (and including, if necessary) final delivery. Once certified, the manufacturer is granted authority to certify that their product meets FAA standards. Manufacturer compliance is monitored through audits by the FAA or FAA-designated auditors.

The strengths of FAA Type Certification are that it allows the FAA first-hand knowledge of product design, control, and inspection of the product, as well as assurance that the manufacturer's process is under control. FAA Type Certification, however, is labor and resource intensive. Although the manufacturer may benefit from close involvement with the FAA, this arrangement may also constrict development of the product for alternative applications. Furthermore, periodic audits conducted by the FAA (or their designees) involve documentation only, that is, independent performance verification is not required.

The Food and Drug Administration's (FDA) mandate is to ensure the safety and effectiveness of medical devices through premarket submissions and postmarket regulations. Postmarket regulations employed by the FDA include surveillance reports from manufacturers and device users, as well as requirements regarding manufacturing practices.

The Administration's Good Manufacturing Practices (GMP) regulation requires that all medical device manufacturers prepare and implement a quality management program that is appropriate to the specific device manufactured and meets FDA requirements (21 Code of Federal Regulations, 1995). The regulation is used by the FDA to regulate the manufacture of a wide variety of medical devices, such as pacemakers and x-ray-based computed tomography scanners. GMP covers the methods, facilities, and controls used in preproduction design validation, manufacturing, packaging, storing, and installing medical devices. The FDA has a well-defined regulatory role in monitoring the compliance of manufacturers with the regulation.

The manufacturer has some flexibility, however, with respect to development and maintenance of a quality system. The primary elements of a quality system include (1) meeting the requirements of the GMP regulation, (2) identification of device as well as manufacturing process specifications, (3) validation of device design and manufacturing processes, (4) documented control of device manufacturing processes, and (5) feedback on the quality management program through in-process and final device inspection and testing, device complaints (e.g., internal, customers, regulatory), and audits (e.g., internal, customer, regulatory).

The attractive feature of applying the GMP regulation to the manufacture of explosives-detection equipment is that it would allow the FAA to monitor progress of the design, development, and manufacture processes. Furthermore, use of the GMP regulation would allow for feedback regarding existing and potential problems early in the development and manufacturing cycle. This would enable corrective action, resulting in higher-quality product and more-reliable manufacturing processes.

The major shortcoming of the GMP regulation is that it

would be labor intensive on the part of the FAA, especially in the case of new explosives-detection technologies. For example, the regulation would require that all changes to explosives-detection equipment be tracked, tested, and re-tested, with close FAA involvement.

The FDA is in the process of revising the GMP regulation to lessen its prescriptive nature, thus bringing it more in line with ISO 9000 series standards.

The FDA recognizes third-party certification to ISO 9001 or 9002 standards as a viable part of regulation. Third-party auditing, however, should not be accepted in lieu of the regulator. The regulator (e.g., FDA) would likely conduct an overview audit for ensuring regulatory compliance, whereas a third-party auditor would ensure that ISO standards were being maintained. This regulatory scenario may lend itself well to FAA regulation of explosives-detection equipment.