Norma Containment: campaigns, screening and evidence

Open: Norma Containment from the product switcher, then Campaigns in the Containment sidebar. Purpose: when a nonconformance leaves suspect material in your shop, in stock, in transit or at the customer, a containment campaign screens and controls that material and ends with a result stated in numbers. Every accepted lot keeps a statement such as 0 failures in 125 samples: at 95% confidence the lot's defect rate is at most 2.4%. Closing the campaign records one combined statement, and a Quality Manager then issues a signed evidence package your customer can read through a link.

Norma Containment is a separate product. An organization that does not hold it sees no Containment menu, no Containment entry in the product switcher, and no screen disposition on its nonconformances.

This chapter covers:

• Who can do what
• Open a campaign
• The suspect population
• The rework package and its sampling plan
• MRB approval and customer concurrence
• Revise an approved package
• The readiness gate
• The floor station: tablets, PINs and recording
• Questions from the station
• QC verification and what a lot statement says
• Correct a result
• A lot that fails verification
• Rejected material
• Close a campaign
• The signed evidence package and the customer link
• The effectiveness check and its supplement

The screens call the person who plans a campaign and rules on the floor's questions the quality engineer. In Norma that person holds the Quality Manager role (an administrator can do the same).

Who can do what

Action	Who
Open Norma Containment and read campaigns, packages, lots and results	Any member with a functional role, an administrator, or a consultant's Build key (read only). An Advise key has no access to Containment. An auditor's session goes to the audit room instead
Start a campaign, enter the population, edit the rework package, name the MRB signers, submit, record customer concurrence, revise, start work, cancel	Quality Manager or administrator
Rule on station questions, disposition rejected material, choose a failed lot's path, make and revoke customer links	Quality Manager or administrator
Satisfy readiness gate items	Quality Manager, Quality Inspector / Technician, or administrator
Sign the rework package as an MRB signer	Only the person named for that function, signing with their own Norma login. An Internal Auditor cannot sign
Verify a lot, correct a result, record an effectiveness lot	Quality Inspector / Technician, Quality Manager, or administrator
Close the campaign, issue the evidence package and the effectiveness supplement, complete the effectiveness check	Quality Manager or administrator
Sign a corrective-action waiver	Quality Manager or administrator
Approve a waiver	A different person named on the MRB of the package in force, who can sign packages
Register tablets, add floor people, set and unlock PINs (Floor devices & PINs)	Quality Manager, owner or administrator who is a member (never a consultant)
Record results, ask questions and send a lot to QC at the station	Anyone on the people register with a floor PIN, on a registered tablet

An Engineer, an Operator with a desk login, or a Department Manager reads the campaign and signs the package when named on its MRB. A consultant with a Build key reads only: every Containment decision is the client's own.

Open a campaign

There are two ways in.

From a nonconformance (when your organization also holds Nonconformance). Disposition the NC Screen (containment campaign) or Rework. Its page then shows a Containment campaign card. A Quality Manager chooses how the population is counted, ticks Customer concurrence required if the customer must agree to the package, and chooses Open a containment campaign. The campaign cites the NC, its title names the NC's reference and item, its origin is the NC's reference, item and actual condition, and its dispositioned by is the NC's. An NC opens one campaign at a time: once a campaign cites it (and is not canceled), the card lists that campaign instead of the button. A closed NC opens none.

New. On Campaigns, fill in Start a campaign: Title, Tracking, Where the problem came from, Dispositioned by, Dispositioned on (a real date, not after today in your organization's time zone), and The customer must concur with the package if that applies. Choose Start campaign.

Tracking fixes how the population is counted for the life of the campaign:

Tracking	Use it when
By lot	You count lots: inspected, passed, failed by failure mode
By lot, then by serial number	Each unit has a serial number and you record each one
By quantity	One population with a count, such as the parts on one job

A campaign is numbered CTN-0001, CTN-0002 and so on (SBX- in a sandbox). It opens as a Draft with revision 1 of its rework package. Its status then moves through Awaiting MRB approval, Approved, In progress (with Paused while a revision waits), and ends Closed, Closed, effectiveness pending, or Canceled.

Cancel a campaign. Before work starts, a Quality Manager can open Cancel campaign at the bottom of the campaign page, say why, and confirm with the button that names the campaign. It cannot be undone, and the campaign and its packages stay on record. Once work has started a campaign is never canceled; it ends by closing it.

The suspect population

Open Lots and serial numbers from the campaign page. Enter each suspect lot by hand (Add lot) or import a CSV file (Import the file):

• By lot: one row per lot, with columns lot, quantity, location.
• By lot, then by serial number: one row per serial number, with columns lot, serial, and optionally quantity and location. A lot's quantity is its serial count; a stated quantity that disagrees is reported as a problem.
• By quantity: exactly one row.

Location is optional: work in progress, in stock, in transit or at the customer. Lot references and serial numbers are your own identifiers and are stored exactly as typed (trimmed), so a serial such as +5 still matches what a scanner reads.

A file takes up to 50,000 rows and 5 MB. If any row has a problem (the same serial twice, the same lot twice, a serial or lot already in the campaign, a bad quantity or location), nothing is imported, and the page lists each problem with its row number. Row 1 is the header. Fix the file and import it again.

Lots and serials can no longer be entered here once the package is submitted for MRB approval, and a package revision never changes them. After approval, the only addition is a serial the quality engineer adds when ruling on a station question.

The rework package and its sampling plan

Open Instruction, failure modes and sampling plan. While the package is a draft, a Quality Manager edits it and chooses Save the package. It holds:

• Work instruction: pin an effective work instruction from Document control, or attach a file with its own label (one or the other).
• Failure modes: each with a name and a severity (critical, major or minor), and an optional code and description. Codes default to FM-1, FM-2 and so on. Operators pick from this list.
• What the plan should show: the outcome you want, from which Norma proposes the plan.
• Change Norma's plan: use a different sample, with the reason.
• Effectiveness check: the production lots to watch after the campaign closes.
• Gate items: what must be in place before work starts.

The plan Norma proposes. Choose the outcome:

Outcome	What Norma proposes
No escapes	Screen every unit, then a verification sample that accepts only when no failure is found, sized for your confidence and the largest defect rate you can tolerate
A stated confidence and reliability	A sample that accepts only when no failure is found, such as 59 units for 95% confidence and 95% reliability
A standard AQL sampling plan	MIL-STD-105E normal single sampling at your AQL and inspection level
The customer's own plan	The sample size, acceptance number and 100% screen exactly as the customer gave them

The starting proposal follows the most severe failure mode: critical proposes no escapes at 95% confidence and a 1% defect rate, major proposes 95% confidence and 95% reliability, and minor proposes AQL 1.0 at level II.

How to read the numbers. The plan is a rule, worked out again for each lot from that lot's size. Once the population is entered, Norma's proposed plan shows a row for each lot size (up to 12: the smallest, the largest and evenly spread ones) with:

• Sample (n): how many units are inspected. It is never more than the lot; a sample as large as the lot means every unit is inspected.
• Accept / reject: the most failures the sample may hold and still accept the lot, and the number that fails it.
• 100% screen: whether every unit is screened first.
• What the plan can show: the statement a sample with no failures would support, such as 0 failures in 125 samples: at 95% confidence the lot's defect rate is at most 2.4%. It is a bound on the lot's defect rate, not a promise about every unit.
• Operating characteristic curve: open it to see how likely the plan is to accept a lot at each defect rate. The marks show where that chance falls to 95% and to 10%.

Changing the plan. Tick Use a different sample than the one proposed and give the sample size, how many failures it may accept, and whether every unit is screened. A change from Norma's proposal needs a reason in Why this plan differs from the proposal; the customer's own plan needs none. The acceptance number must be smaller than the sample size, or no lot could ever fail.

Customer concurrence. If the campaign needs the customer's agreement, the package is approved only when the concurrence is recorded as well (see the next section).

The effectiveness watch. Choose No effectiveness check, Watch a number of production lots (1 to 50), or Watch production lots until a date (your organization's own day, not one already past when you save). The package page says it in words, such as Watch the next 3 production lots.

MRB approval and customer concurrence

Open MRB signers, approval and customer concurrence.

Signers. A new package names three functions, Quality, Manufacturing and Engineering, with no one chosen yet. For each function choose the person who signs. You can rename, add or remove functions; removing or renaming one of the three asks for a reason, which is kept with the package. One person signs for one function. A person without a Norma login can be named, but cannot sign, and the page says so beside them. Under Minimum number of signers a Quality Manager sets how many signers every package in the organization needs (1 to 20).

Submit. Choose Submit for MRB approval. Norma checks that the package has an instruction (a pinned one must still be effective), a failure mode, a plan, a suspect lot, at least the minimum number of signers, and every function assigned to an active person with a Norma login who can sign packages (not an Internal Auditor, and not someone with no role). Submitting fixes the package and records its fingerprint (a SHA-256 hash of every fact in it), shown on the page.

Sign. Each named signer opens the page and chooses Sign as their function, then Sign and approve after entering their password again. The signature records the name, the meaning Approved — MRB, the date and time, and the package fingerprint. The package is approved when every named signer has signed (and the customer has concurred, when required).

Customer concurrence. Once the package is submitted, a Quality Manager records the customer, the customer's reference, who concurred, the date (not after today and not before the package was submitted) and the concurrence document, then chooses Record concurrence. It can be recorded before or after the last signature.

When a signer cannot sign. A Quality Manager can choose Reassign for any unsigned function, with a reason. That voids every signature already given on the package (they stay on record) and collects them all again. There is no reject button: if the MRB will not approve the first package, cancel the campaign.

Revise an approved package

An approved package is fixed. To change it, a Quality Manager chooses Revise the package on the package page and says why. The new revision copies the instruction, plan, failure modes, gate items and signers (never the signatures).

• While the revision is a draft, work goes on under the approved revision.
• Under Lots to re-screen, choose the lots the change sends back for screening. Lots verified under an earlier revision keep their result unless you mark them. A rejected lot is never re-screened.
• Submitting the revision pauses recording: the page says Recording is paused until revision 2 is approved. Every named signer signs again, and the customer concurs again when the campaign requires it.
• When it is approved, it replaces the earlier revision. The marked lots return for re-screen, and any gate item the change affected must be satisfied again.
• If the person whose signature or concurrence completes the approval is a Quality Manager (or an administrator), the campaign returns to Approved; otherwise the page says Revision 2 is approved. A quality manager resumes recording. and a Quality Manager chooses Resume recording. Either way, choose Start work again once the readiness gate is satisfied.

A submitted revision that cannot be approved can be taken back with Withdraw revision, with a reason. It returns to draft, its signatures are voided and any customer concurrence recorded for it is set aside. Recording stays paused until the revision is approved, or until it is discarded and a Quality Manager chooses Resume recording, then Start work. Discard revision drops a draft revision and the approved package stays in force. A revision that was never submitted is deleted; one that was submitted and then withdrawn is kept, marked Discarded, so its signatures still resolve.

A revision draft whose effectiveness until date has passed must be given a new date (today or later) before it can be saved.

The readiness gate

After approval, the campaign page shows the Readiness gate: each gate item the package defined, and what will satisfy it. A Quality Manager or a Quality Inspector / Technician satisfies them:

Kind	How it is satisfied
Validation, with a validation subject	Record as satisfied once the subject is currently validated in Norma. A blocked or lapsed subject is refused with its status in words
Validation, with no subject	Attach the validation record, then Sign as checked
Training, with a document revision	Record as satisfied once every named person is current on that revision. If Norma holds no training records for the document at all, Attest and sign instead
Training, with no document	Attest and sign that the people named are trained
Workstation, or other	Attach evidence, then Sign as checked

A satisfied item is a record of what was true when it was checked: it is never undone by hand, and only a package revision reopens it. When every item is satisfied, a Quality Manager chooses Start work. A package with no gate items can start straight away. Work cannot start while the pinned work instruction is no longer effective.

The floor station: tablets, PINs and recording

Operators record on a registered tablet. A shop that holds only Containment sets this up from Floor devices & PINs in the Containment sidebar; it uses the same devices and people as the desk app (see The shop-floor tablet: devices, PINs and sign-offs).

• Register this tablet while you stand at it, signed in on it. There is no code to carry over.
• People on the floor: add each operator with a name and, optionally, a job title and email. They get a PIN, not a Norma login.
• Floor PINs: set or reset each person's PIN (4 to 6 digits) and Unlock a locked one.
• Revoke a tablet you no longer use.

On the tablet, the operator opens Containment from the person home, picks the campaign, then scans or types the lot number and chooses Open lot. The lot page says what the plan asks, for example Check a sample of 50 units out of 500. for an AQL 1.0, level II plan on a lot of 500. When the plan screens every unit first, it says Screen every unit, then the size of the check sample that follows. When the form asks for the PIN, the operator enters it; it is asked again after a minute and a half.

By serial number. Scan the serial (a keyboard-wedge scanner presses Enter for you) and it records Pass. For a fail, tap Fail, then the failure mode. The last scan's result is said in plain words above the field, such as SN-1042: PASS recorded. When the plan has both a screen and a check sample, choose Screen or Check sample first. If a component was swapped on the unit, open A component was swapped on this unit and fill in what was removed, what was installed and why; it is recorded with the next scan.

• A unit is counted once: a second scan of the same serial says it is already recorded and adds nothing.
• A serial that is not on the lot's list records nothing. It goes to the quality engineer as a question, and the operator is told to set the unit aside.

By lot or by quantity. Under Enter counts, enter the number passed and the number failed for each failure mode, then choose Record counts. When the plan has both a screen and a check sample, first choose Screen or Check sample under What you counted. Each entry adds to the lot's tally, never past the lot's quantity (less anything rejected from it).

Not sure? Choose Not sure? Ask the quality engineer, type the question (and the serial, if it is about one unit), and Send question. Operators never decide edge cases.

Done? Choose Done with this lot? Send it to QC, then Yes, send lot ... to QC. After that nothing more is recorded on the lot.

While a campaign is paused the tablet says Recording is paused for this campaign. Set the parts aside and check with your quality engineer. When no campaign is in progress it says No containment work right now.

Questions from the station

Questions in the Containment sidebar (for a Quality Manager) lists the open station questions, oldest first, with a link to each lot. Each open question is also an item in that person's My Work, and in the daily digest. Choose a ruling and Record the ruling:

• Add the serial to this lot, or Not part of this campaign, for a serial that was not on the list.
• Pass or Fail (with its failure mode), recorded for the operator who asked, with the ruling as its source.
• Answer (records no result), with the answer's text.

A lot with an open question cannot be verified until it is ruled on.

QC verification and what a lot statement says

A lot sent to QC reads Waiting for QC on the campaign page. A Quality Inspector / Technician or Quality Manager opens it and chooses Verify this lot. Norma judges the lot's check sample against the lot's plan:

• more failures than the plan accepts: the lot fails, whatever the count;
• a complete sample within the acceptance number (and, when the plan screens every unit, a complete screen): the lot is accepted;
• a sample or screen that is not complete yet: the lot goes back to the station, and QC is told why, for example Sent back to the station: 2 more samples are needed.

An accepted lot keeps a statement of what the evidence shows:

• 0 failures in 125 samples: at 95% confidence the lot's defect rate is at most 2.4%. This is an upper bound: with 95% confidence, the share of bad units in the lot is no more than 2.4%. It does not say the lot has no bad units.
• A lot screened 100% first says what the screen found and removed, then the verification sample in the same form.
• When the sample was the whole lot, it says every unit in the lot was inspected, and states no bound.

Norma never states that a lot has no bad units. A sample shows what it shows, at the stated confidence.

Correct a result

A wrong result is never edited. While the campaign is in progress, a Quality Inspector / Technician or Quality Manager opens Correct this result on the desk lot page, chooses the right outcome (and failure mode for a fail), says why, and chooses Record the correction. The old result stays on the record, struck through, beside the new one. If the lot was already verified, Norma verifies it again against the plan it was verified under.

An effectiveness lot is never corrected at the desk. A mistake on one is handled through its corrective action and, where it applies, the signed waiver.

A lot that fails verification

A failed lot goes on hold: the rework or screen process did not hold. Norma raises a corrective action for it at once. When your organization holds CAPA, that is a CAPA with the source Containment, described as, for example, CTN-0004 lot L-17 failed verification: the rework/screen process did not hold. Without CAPA, the campaign keeps its own corrective-action record. Either way it is listed under Corrective actions on the campaign page.

The quality engineer then chooses the lot's path:

• Re-screen every unit and take a fresh sample. The lot's results are retired (kept on the record and in the statistics) and the station screens it again. In a lot or quantity campaign, disposition the failed quantity first.
• Reject the whole lot, to a disposition (see the next section).

Either way the failed sample stays on the record and in the statistics.

The corrective action stays open until its CAPA is closed in the normal way (when there is one), or until it is waived. To waive it, a Quality Manager chooses Sign the waiver, writes why, and signs (Waived — justification recorded). It is waived only when a different person named on the MRB of the package in force chooses Approve the waiver and signs (Waiver approved).

Rejected material

On the desk lot page, under Rejects, the quality engineer gives each failed unit or failed quantity its disposition, Repair, Scrap or Return to supplier, and chooses Record the disposition. A return to supplier names its supplier: one of your supplier records, or the supplier's name when you keep none.

• By serial number: one disposition per failed unit.
• By lot or by quantity: a quantity, once QC has decided the lot (accepted or failed) or while it waits for a re-screen. Until then the page says Hold failed material apart; it is dispositioned once QC has verified the lot.

A disposition ends the material's life in the campaign. A repaired unit goes back to production under its own process, not into the campaign, and is never counted again. When your organization holds Nonconformance, the first reject of a lot raises a nonconformance that cites the campaign and the lot; later rejects of that lot join it while it is open.

Close a campaign

On an In progress campaign, a Quality Manager sees Close the campaign. It lists what is still open, in this order, or says Ready to close:

1. a suspect lot that is not accepted or rejected (a failed lot included);
2. an open station question;
3. an open corrective action;
4. failed material without a disposition;
5. a package revision still open;
6. an accepted lot without its statement;
7. the CAPA decision.

The CAPA decision is one of Raised in Norma (choose the CAPA; the one this campaign raised is offered first), Linked to a CAPA kept outside Norma (its reference), or Not required (why no CAPA is needed). Choose Close CTN-.... No signature is taken at close.

Closing records the closing statement: every accepted lot's verification samples pooled into one bound, such as Across all 4 lots' 500 verification samples: 0 failures; at 95% confidence the defect rate is at most 0.6%. Rejected lots are left out and counted apart. When every suspect lot was rejected, it says so and states no bound. After close, nothing more is recorded on the suspect lots.

If the plan names an effectiveness watch that is not yet satisfied, the campaign closes as Closed, effectiveness pending.

The signed evidence package and the customer link

Evidence package. Once work has started, a Quality Manager can choose Issue an evidence package under Evidence and sign it (Released as evidence, with the password). Norma makes a numbered PDF. A package issued before the campaign closes says IN PROGRESS on every page and carries a notice at the top. Issuing again makes the next number; a package already issued never changes. Each package lists its stage, who issued it, when, its SHA-256 and a download.

The package holds: the campaign, its status and who dispositioned it; the references of the nonconformances that opened it; the suspect population; each approved package revision with its plan, instruction, failure modes and MRB signatures; the readiness gate items; every lot with its size, screen, sample, statement and state; the combined statement; failures by failure mode; component swaps; rejected material with dispositions and supplier names; the CAPA decision as its kind and reference; and the effectiveness check when there is one.

It never holds an operator's or inspector's name, a question or a ruling, a correction's reason, an NC's or CAPA's description, the campaign's origin text, or any internal record id. Free-text fields such as swap reasons appear as typed, so write them as you would for the customer.

Customer link. Under Read-only links, a Quality Manager gives the link a label (who it is for, up to 80 characters) and chooses Make a read-only link. Copy it then: Norma shows it once and never again. The customer opens it with no account and sees the latest evidence package (and the latest effectiveness supplement), rendered from the same record as the PDF, with the release signature, a download of the signed PDF, and Check a file, which compares a PDF they hold with the signed one on their own device. Choose Revoke to end a link: it then answers This evidence link is not active. A link keeps working if your subscription lapses.

The effectiveness check and its supplement

When the plan names a watch, the campaign page shows Effectiveness check: the watch in words, its progress, the lots recorded with their statements, and the effectiveness statement.

Record an effectiveness lot. While the campaign is in progress or closed with its effectiveness pending, a Quality Inspector / Technician or Quality Manager enters the Production lot reference, Lot quantity, Units inspected and the failures by failure mode, and chooses Record the lot. Norma judges it with the package's plan on its quantity, from the sample alone, and stores its statement. Inspect at least the plan's sample for that lot quantity; Norma refuses an entry that is short of it, unless the failures found already fail the lot. Effectiveness lots are recorded at the desk; the tablet refuses them.

A count watch is satisfied when that many effectiveness lots are decided; a date watch when your organization's today reaches the date.

A failed effectiveness lot raises a corrective action, and a CAPA when you hold CAPA, exactly as a failed verification does. It has no re-screen and no whole-lot path. Only its sampled failures are dispositioned in Containment, under Rejects, as a quantity. Handle the rest of that production lot through the CAPA, or open a new campaign for it.

The supplement. Once the campaign is closed with its effectiveness pending, issue the closing evidence package first (a package issued while the campaign was in progress does not count). When the watch is satisfied, no corrective action is open and no failed material waits for a disposition, a Quality Manager chooses Issue the effectiveness supplement and signs it. It is a separate numbered PDF; the evidence package it adds to stays unchanged.

Complete. When the supplement covers every effectiveness lot, choose Complete the effectiveness check. The campaign moves to Closed, and nothing more is recorded on it. If anything changed after the supplement (a new lot, a new package), Norma asks for a new supplement first.

In the user guide

This article is chapter 26, "Norma Containment", of the NormaQMS User Guide (NORMA-UG-001), which is under Help > User guide. Chapter numbers in the text refer to that guide.