Automotive Manufacturing
MES built for IATF 16949 automotive suppliers
APQP gate reviews, PFMEA with AIAG-VDA Action Priority scoring, layered process audits, Gauge R&R, and SCAR 8D — all in one system. No spreadsheets reconstructed at audit time.
IATF 16949 quality modules
APQP — AIAG 3rd Edition Five-Phase Framework
New product launches follow the AIAG APQP 3rd Edition (March 2024) five-phase framework — the edition Ford, GM, and Stellantis mandate from their suppliers: Plan & Define Program, Product Design & Development, Process Design & Development, Product & Process Validation, Launch & Assessment & Feedback. Phase gates require multi-role e-signatures before advancing. AIAG deliverables tracked per phase with waiver workflow. Reopen log is immutable — auditors can see every gate decision with the name and timestamp of who made it. Gate 0 project-launch checklist, Sourcing Decisions, Supplier APQP cascade, Safe Launch Control Plan with required stop criterion, and Reaction Responsibility column are all shipped — see the APQP module page for the full list and current roadmap.
- • IATF 16949 §8.3.4.1 — APQP phase gates and monitoring
- • AIAG APQP 3rd Edition + Control Plan 1st Edition (March 2024)
PPAP — 18 elements, levels 1–5, and a hash-bound Part Submission Warrant
Every submission opens with all 18 AIAG PPAP elements already created, numbered to the AIAG element numbers rather than to a local convention, and marked required or waived by submission level: level 1 is the Part Submission Warrant alone, level 2 a five-element subset, and levels 3 through 5 the full eighteen. Elements are not re-typed attachments. An element points at the live record — the PFMEA, DFMEA, control plan, process flow diagram, MSA study, capability study, or engineering change order — and its snapshot carries that record's code, revision, status, owner, and last-modified stamp.
Sign-off is where PPAP normally leaks. When your quality lead signs the PSW, Qontiv re-verifies their password, writes a 21 CFR Part 11 signature whose recorded meaning is supplier sign-off on the warrant, and hashes the whole element set — every element, its status, its source type, and the exact record it points at — with SHA-256 onto the warrant. From that point the elements are locked: an edit is refused, not merged. The signature row is immutable and unique per role, so one submission cannot carry two supplier-quality signatures.
Submitting for review is gated on a legal state transition, a supplier signature already in place, and every level-required element sitting in Approved, Not Applicable, or Waived-at-level. The fourth gate is the one that catches real programs: your customer-specific requirement rules are evaluated at submission and can block it outright with a written reason, before the package ever reaches the customer. Customer approval, rejection, and recall are all terminal — a revision goes out as a new submission, and a repeat order can be cloned from an approved one. The warrant renders as a PDF carrying the AIAG-numbered element grid, and prints as pending customer authorization until it is countersigned.
- • IATF 16949 §8.3.4.4 — product approval process
- • AIAG PPAP 4th Edition — the 18 elements and submission levels 1–5, named on the warrant itself
- • IATF 16949 §9.1.2 — customer-specific requirement rules evaluated as a submission gate
Customer sign-off portal — no account for your customer to create
Your customer's quality engineer does not get a Qontiv login. Once a submission has been signed by you and submitted for review, you issue a single link. The token is 32 random bytes, disclosed to you once and stored only as a SHA-256 hash, and its lifetime is capped server-side at 14 days no matter what is requested. The link opens a read-only summary of the submission and the warrant. Requests are rate-limited by IP, and a link that is wrong, expired, or already used returns the same neutral expired page — the portal never tells a probing caller which.
Countersigning is deliberately out-of-platform: your customer signs the warrant in their own system and uploads the countersigned PDF. The upload is refused if you have not signed yet or if a customer signature already exists, and on success it is stored as a controlled document against the submission and moves it to customer-approved. A signature that arrives by email instead can be recorded against the submission as an external signature, with the signer's name, email, and the signed document all required. For a link that is marked one-time-use, consumption is settled by a single conditional update, so two simultaneous clicks cannot both spend it.
- • IATF 16949 §8.3.4.4 — customer approval evidence held against the submission
- • 21 CFR Part 11 §11.50 — in-platform signatures carry printed name, timestamp, and meaning
PFMEA & Control Plan — AIAG-VDA 2019
Action Priority scoring (High/Medium/Low) via the AIAG-VDA 2019 harmonized 1000-cell matrix — RPN is read-only for legacy imports only. Stellantis CSR June 2025 requires AP-only scoring; Qontiv generates AP by default. Control plans are derived automatically from PFMEA rows with Critical or Significant classification. PFMEA approval requires 3+ distinct disciplines from Quality, Process Engineering, Design Engineering, Manufacturing, Maintenance — enforced programmatically, not by honor system.
- • IATF 16949 §6.1.2.4 — risk analysis with PFMEA
- • AIAG-VDA FMEA Handbook 2019 — AP scoring, 7-step process
- • Stellantis CSR Jun 2025 — AP-only requirement
OCAP — the reaction plan that fires with the chart
A control plan's reaction column is usually a sentence in a cell. An Out-of-Control Action Plan in Qontiv is a governed document attached to a specific measurement characteristic: named adjustment and escalation responsibilities (operator, supervisor, process engineer, quality engineer, or maintenance technician, each optionally a named person), an adjustment matrix of trigger, condition, and required action, and two escalation thresholds. The trigger is free text, so a plan can cover a condition the rule engine never raises — audible tool chatter, a smell, a feel. A plan optionally links back to the control-plan row whose reaction portion it implements.
Only one plan can be effective per chart, and that is a database constraint rather than a convention. Activation and retirement are both password-signed acts; a plan that was never activated is deleted rather than retired. When a measurement trips a rule, the governing plan is resolved and stamped onto every violation row as it is created — the measurement, its violations, the escalation flag, and the escalation log entry all commit in one unit of work, so there is no window in which a violation exists without the plan that governs it.
Escalation is counted deliberately. Recurrence counts sampling intervals that carry at least one violation, not violation rows, so one point tripping three rules is one condition and not three recurrences. The control-not-restored clock runs from the oldest unacknowledged violation on the chart, and acknowledgment is what closes it. Ordering uses the chart's own subgroup sequence rather than the measurement timestamp, so a back-dated entry cannot reorder the chart. No second escalation stacks while the escalated condition is still open, and every escalation records a human-readable reason with the actual counts and thresholds substituted. The process log is immutable — a correction is a new entry — and the roster confirming that the people who apply the plan understand it is a set, so a double submission cannot inflate coverage.
- • IATF 16949 §9.1.1.3 — application of statistical concepts, with tamper-evident measurement records
Reaction plans are also treated in the AIAG-VDA SPC Manual. We cite its section numbers as pointers for orientation, never as a conformance statement — see "On the AIAG-VDA SPC harmonization" below.
Layered Process Audits (LPA)
Four-tier audit cadence per AIAG CQI-8: Operator (daily), Supervisor (weekly), Manager (monthly), Plant Manager (quarterly). Schedules are auto-generated — auditors receive their queue, complete findings digitally, and sign electronically. NonCompliant findings auto-create a CAPA; the audit cannot close until all linked CAPAs are closed. Stellantis SQA Connect June 2025 mandates weekly LPAs for certain suppliers.
- • IATF 16949 §9.2.2.2 — layered process audits
- • AIAG CQI-8 3rd Ed. (2014) — cadence and content
- • Stellantis SQA Connect Jun 2025 — weekly LPA mandate
Engineering Change Orders (ECO) & Management of Change
Revision-controlled items, BOMs, and routes. ECO promotes revisions atomically — either all revisions in the change set go Approved together or none do. Customer notification rules per OEM: Ford Q1 §3.4, GM SQ-IPPM §5.3, and Stellantis CSR baselines are pre-configured. Retroactive impact analysis walks lot genealogy to identify in-field units built against the superseded revision.
- • IATF 16949 §8.5.6 — control of changes
- • Ford Q1 §3.4 / GM SQ-IPPM §5.3 — customer notification
MSA, CAPA, and Supplier Quality
Gauge R&R (AIAG MSA 4th edition), CAPA state machine with root-cause method tracking, and ASL + SCAR 8D for supplier corrective action — all covered by dedicated modules.
SPC, from the instrument to the signed study
Most MES products treat SPC as a chart widget over numbers a human typed in. Qontiv treats it as a measurement chain: how the reading gets in, what the engine will and will not compute from it, and what has to be true before a capability number can be reported at all.
Measurements that arrive from the instrument, not the keyboard
The Qontiv edge gateway reads gauges and CMMs over five transports, each configured per instrument: an OPC UA subscription against a configured node with a selectable security mode and policy; MQTT; serial RS-232/RS-485 with configurable baud, data bits, parity, stop bits, and handshake, plus an optional regular expression whose first capture group is the value; generic USB-HID capture addressed by vendor and product ID with a report byte offset and a scale factor, as used with Mitutoyo U-WAVE-class receivers; and a watched drop directory for machines that only emit files.
The drop directory is where legacy metrology gets absorbed. Four parsers are tried in turn: QIF 3.0 results files, Zeiss Calypso semicolon-separated exports, Mitutoyo MCOSMOS result XML, and a generic CSV. All of them parse numbers culture-invariantly, so a European decimal comma does not silently become a different measurement, and each processed file is archived into a timestamped subdirectory rather than deleted. Every reading leaves the gateway as a store-and-forward outbox row with a de-duplication key, and lands in Qontiv as an SPC measurement against the characteristic that instrument is configured for.
- • OPC UA · MQTT · RS-232/RS-485 · USB-HID · file drop — five transports, one instrument catalog
- • QIF 3.0 · Zeiss Calypso · Mitutoyo MCOSMOS · generic CSV — parsers selected by content, not by folder
Capability that refuses to be mislabeled
Whether a study reports Cp/Cpk or Pp/Ppk is decided by demonstrated stability at computation time. It is not a field anyone can set, and the two are stored in separate columns with exactly one pair populated — so a performance index cannot be quoted as a capability index by editing a label. Stability itself is a three-part test: an active control chart with real spread must exist, replaying the window must raise zero special-cause signals, and where the data can be classified, the time-dependent model must imply statistical control. The signal count and a written basis for the decision are returned alongside the numbers.
Every study computes both a percentile-based geometric result and a z-score result, fits the data across eight candidate distribution families — normal, log-normal, three Johnson forms, three-parameter Weibull, folded normal, and a mixed-normal fit — and records which family won. It reports expected nonconformance in parts per million below and above the specification from the fitted distribution, and 95% confidence intervals on both index types: an exact chi-square interval for the potential index and a normal-theory approximation for the minimum index, with a flag raised whenever the fitted family is not normal so the interval is never read as exact when it is not. One-sided specifications are handled rather than fudged. A within-subgroup index is available as a diagnostic and is marked as one — it is not offered as a reportable capability number.
Eight violation rules ship — the four Western Electric rules and Nelson rules 5 through 8 — and the run rule fires at nine consecutive points on one side of the center line, not eight. Attribute charts use exact cumulative binomial and Poisson limits rather than the ±3σ normal approximation, and flag when no lower signal is mathematically possible. Zone rules are measured in sigmas of the plotted statistic, so the zones on an X-bar chart are not √n too wide. One rule engine serves the live chart, the capability stability scan, and machine performance, so the three never disagree.
Two things a capability study will not do. It will not complete unless the governing gauge study's stored verdict is Accepted or Conditional — a missing verdict and a not-applicable verdict are both refused, because the study feeds PPAP element 11. And it will not manufacture a number from degenerate input: below the minimum sample count, or with zero spread or inverted limits, it returns no index rather than a plausible one. Raw measurement recording is deliberately never gated, so operators are never blocked from collecting data. Once a study completes, its snapshot is written exactly once and the record is append-only.
- • IATF 16949 §9.1.1.3 — application of statistical concepts
- • IATF 16949 §7.1.5.1.1 — MSA required for gauges named in the control plan, enforced here as a study-completion gate
- • ISO 22514-2 — time-dependent process model classification, using an Anderson–Darling normality test
Machine acceptance — Pm / Pmk with a signed release decision
Accepting a new or rebuilt machine is a different question from monitoring a running process, and Qontiv keeps it structurally separate. A machine-performance study runs on its own consecutive-part run rather than a window of the live stream, stores its samples and its result on their own tables, and carries a third index label that can never be promoted into a capability label, because a release run has no control chart to prove stability against. Samples can be entered on the line or bulk-imported, and a live preview shares one implementation with the completion freeze, so the preview can never disagree with the signed result.
The verdict is an isolated rule: inconclusive with no Pmk or no target for the characteristic's class; fail when Pmk falls below target, or when a two-sided specification produced a Pm below its own target; otherwise pass. Comparison happens on exact decimals rounded to the stored scale first, so the signed verdict is reproducible from the stored numbers. Targets start from a tenant-editable base per characteristic class — critical, major, minor, other — with the reduced-sample-size adjustment applied on top as a ratio; the confidence level is fixed platform-wide rather than per study, so no study can lower its own acceptance bar. Five guards turn degenerate input into an inconclusive study with a named basis instead of a persisted number, including a value that would overflow the stored scale.
Stability evidence is computed for the run and reported — but it is never an input to the verdict, never sets the stability flag, and never changes the index label. Draft, data collection, and completed lead to an approved or rejected outcome; both are electronically signed and both are terminal, and the PDF report is rendered from the frozen result rather than recomputed, so the printed numbers always match the signed record.
- • IATF 16949 §9.1.1.3 — application of statistical concepts
- • 21 CFR Part 11 §11.50 — the release and rejection decisions are identity-bound signatures
On the AIAG-VDA SPC harmonization
AIAG and VDA are consolidating their separate SPC manuals into a single reference, and that changes the vocabulary your control plans and supplier requirements are written against — capability versus performance, run and pattern rules, chart selection, and machine acceptance are treated in one place, at §9.2.2, §9.3.2, and §7 among others, with reaction plans at §5.6 and §5.7. If your customer's next requirement letter cites a section number you have not seen before, that is why. The volumes are still landing, so treat any section number you receive as the thing to confirm, not to assume.
Qontiv makes no conformance claim against that manual. No vendor certification to it exists. The sections above describe what Qontiv computes, which rules fire at which thresholds, what is gated, and what is frozen and signed — and section numbers are cited as pointers, not as a compatibility statement. We would rather you check the arithmetic than take a badge.
EV drivetrain and traction battery programs
Battery cell, module, and pack work sits inside this wedge rather than beside it: the forcing function on a traction-battery supplier is IATF 16949, arriving through its vehicle-OEM customers. The process depth is real and specific — cell, module, and pack consumption recorded as links at the point of work, formation-line OEE, electrode-coating and OCV/ACIR control charts, and torque-plus-angle fastening evidence on high-voltage joints — and it runs on the same APQP, PPAP, PFMEA, and SPC modules described above.
See battery & energy manufacturing →Which plan carries this
- Core — production tracking and work orders, lot and serial genealogy, electronic signatures, the tamper-evident audit trail, quality events, and downtime tracking.
- Professional — full SPC (X-bar/R, I-MR, p, c, capability indices, Nelson rules) and the edge gateway with OPC-UA and MQTT. The SPC, OCAP, instrument-capture, and machine-acceptance sections above assume this tier.
- IATF 16949 compliance package — APQP, PPAP, PFMEA and control plans, layered process audits, MSA and gauge management, and customer-specific requirements and scorecards. Available today, and available on every plan as a priced annual add-on including Core — it is not bundled into a tier and not Enterprise-gated.
There is no free trial and no self-signup. Evaluation runs as a paid four-week pilot on one of your lines, at a published fee that credits in full against a first annual contract — the ladder and the pilot terms are atqontiv.com/pricing.
What this is — and what it isn't
Qontiv is not IATF 16949 certified — the certification belongs to your organization. Qontiv is designed to be compatible with the evidence and records that IATF 16949 auditors and customer-specific requirement assessors look for. Your certification body audits your QMS; Qontiv provides the records.
IATF surveillance audit coming up?
APQP, PFMEA, LPA, supplier corrective action — native to the MES, ready for the auditor.