Vision system validation: how to qualify an inspection station with IQ, OQ, PQ and gage R&R.

Vision system validation is documented proof that an inspection station does what its requirements say, under the conditions it'll actually see. It's usually three qualification stages (IQ, OQ and PQ), a controlled test set of good, bad and boundary parts, a gage R&R or attribute agreement study, and a rule for when to repeat the work.

We commission robotic cells with machine vision inspection built in. A medical device auditor and an automotive customer will ask for different binders, but they'll both want to know whether the station catches the defect it was bought for. That's the part we care about most, so this guide follows a validation in the order it really runs.

What is vision system validation?

It's the evidence that a vision inspection station was installed as designed, makes the right accept and reject call across every part variant and operating condition, and keeps doing so on production. The evidence is written down before the station's released, and it's repeated in part whenever something changes the decision.

Validation and verification get mixed up a lot. Verification asks whether you built the station to spec. Validation asks whether it does the job on real parts. A station can pass every verification check and still miss a defect nobody wrote into the requirements, which is why the requirements and test set matter more than the forms.

Is machine vision validation required by FDA and ISO 13485?

For U.S. medical device makers, yes. The FDA's Quality Management System Regulation took effect on February 2, 2026 and incorporates ISO 13485:2016 by reference. ISO 13485 requires validation of software used for monitoring and measurement before first use and after changes, which covers a vision inspection station.

The FDA's QMSR is the amended 21 CFR Part 820, and on the same date the agency retired its old QSIT inspection approach in favor of a new compliance program.12 For a vision station the operative clauses are now ISO 13485's. Clause 7.6 covers monitoring and measuring software, and clauses 7.5.6 and 4.1.6 cover software used in production and in the quality system.

How much testing that software needs is covered by the FDA's Computer Software Assurance guidance, finalized in September 2025 and reissued in February 2026.3 Its core idea is worth borrowing even if you've never met an FDA inspector. Work out the intended use, ask what happens if the software fails, and scale testing to that risk. A camera that's the only check between a sterile-barrier defect and a patient sits at the top of that scale. A camera that double-checks a label that's also scanned downstream doesn't.

Other industries don't use the same words, but they get to much the same work.

Automotive's the most explicit. IATF 16949 wants statistical studies of variation for every inspection, measurement and test system named in the control plan, using methods from customer reference manuals, which in practice means the AIAG Measurement Systems Analysis manual.87 A camera on the control plan needs its study like any other gauge, and your customer's quality engineer won't forget to ask.

In an unregulated plant, validation has no legal definition and it's tempting to skip. We'd argue against that for one plain reason. An unvalidated station has never been shown to catch the defect you bought it for. The study that satisfies an auditor is the same study that tells you the real miss rate, so do a lighter version, but do it.

What are IQ, OQ and PQ for a machine vision system?

IQ checks that the camera, optics, light, software and wiring went in as designed. OQ challenges the station across its whole operating window with known good, bad and boundary parts. PQ shows it's still right on real production, across lots, shifts and operators.

The structure comes from process validation. The Global Harmonization Task Force's process validation guidance, still widely used as the reference, defines IQ as establishing installation to the approved specification, OQ as establishing the limits within which the process makes acceptable product, and PQ as showing it does so consistently under anticipated conditions.6 Fig. 01 translates that to a camera on a line.

Fig. 01IQ, OQ and PQ for a vision inspection station

Before IQ, write the requirements and do the risk assessment

Everything downstream gets tested against a written user requirement, so write it first. List every defect the station must catch, with the faintest version that counts as a reject and a boundary sample for each. Add variants, cycle time, reject handling, logging and the acceptance criteria (target miss and false alarm rates, or a %GRR limit). Then ask what happens if each defect escapes, or if the station fails silently. That answer decides how deep the rest goes, and it's the page auditors read first.

IQ checks the station was installed as specified

IQ is a checklist against the design, and it's the quickest stage. Record the camera, lens, light and controller with part and serial numbers, firmware and software versions, working distance against the drawing, I/O and network addresses, and any calibration certificate. Archive the job file with its version. You'll lean on those version records hardest later, when someone asks what changed.

OQ proves the station is right across its operating window

OQ's where a vision station earns its validation. Run the challenge set on every variant and record each decision. Then push the edges, with the light at the low end of its range (our machine vision lighting guide covers why that end matters), parts at the extremes of fixture position and the line at top speed. Then break things on purpose. Pull the camera cable, block the reject confirmation sensor, trigger with no part present. The only safe answer in each case is a reject or a stop. You finish OQ with the measurement system study.

PQ shows it stays right on production

PQ runs the station on real production for an agreed length, long enough to see variation the challenge set couldn't predict. Quality re-inspects a sample of passed parts and all rejected parts by the reference method, and the miss and false alarm rates get compared with the acceptance criteria. The signed PQ report is what releases the station.

How do you build a test set to validate vision inspection?

Mix golden samples, boundary samples and challenge parts, serialize every one, have quality label each against the reference method, and weight the set toward the boundary. The worst acceptable good parts and the faintest rejects are what decide whether the station's valid. Nominal parts and gross defects prove very little.

Golden samples are the few known-good and known-bad parts that run every shift. They prove the station hasn't drifted, not that it's valid. Boundary samples are good parts at the worst acceptable condition and bad parts just outside the limit. Challenge parts are failure cases you build or pick on purpose, like each defect at its minimum size, a missing component, the wrong variant and an empty fixture.

Fig. 02What goes into a 200-part validation test set · illustrative

Photograph every part and store the set where it can't get mixed into production. For a deep-learning station, keep it completely separate from the training images. A model scored on its own training images will look perfect and prove nothing, which our AI visual inspection post covers in more depth. If you're scoping your first station, starting your first machine vision project shows where the test set fits in the schedule.

How many parts do you need to validate a vision system?

For an attribute study, 20 to 30 parts with a roughly even good and bad mix is the common starting point. But to claim a low miss rate you'll need far more bad-part presentations. Zero misses on 30 bad parts only supports a miss rate below about 10% at 95% confidence.

The 20 to 30 part guidance, with a 50-50 split and samples spread across real production variation, comes from attribute gage R&R practice.10 It's fine for showing that the station agrees with the reference. It's not enough to put a number on a small miss rate, and that's where the arithmetic gets unforgiving.

If a station catches every one of n bad parts, the 95% upper confidence bound on its miss rate is about 3 ÷ n. (That's solving (1 − p)ⁿ = 0.05 for p.) Thirty bad parts with zero misses supports a miss rate below roughly 10%. Showing below 1% takes about 300 bad-part presentations. Repeat trials on the same parts tell you about repeatability, but they aren't new evidence about new defects, so make the defect population as varied as you can. We agree up front what claim the test set can support. It's a much easier conversation before the results are in.

Should you use gage R&R or attribute agreement analysis for a vision system?

Use a variable gage R&R if the station reports a measurement, like a diameter, gap or position. Use attribute agreement analysis if it reports pass or fail. A gauging station that also makes the call can need both. They're both in the AIAG MSA manual, now in its fourth edition.

A vision gage R&R measures ten or so parts spanning the tolerance several times each, and splits repeatability from reproducibility.7 On an automated station the operator term usually shrinks, so we'd study reproducibility across what really changes, like re-loading the part, another fixture nest or the second camera on a twin line. The commonly cited MSA guidance treats a %GRR under 10% of tolerance as acceptable, 10% to 30% as possibly acceptable depending on the application, and over 30% as unacceptable. Our dimensional gauging with machine vision guide and the post on how to choose a machine vision lens cover what sets the floor on that number.

For pass and fail checks like presence, a surface defect, a code read or assembly verification, attribute agreement analysis is the right tool. You show the station parts with a known reference decision several times each, in random order, and count. Four numbers come out of it, as Fig. 03 shows. Effectiveness is the share of parts where every trial matched the reference. Miss rate is the share of bad-part decisions that passed, which is your customer's risk. False alarm rate is the share of good-part decisions that failed, which is your scrap. And kappa is agreement corrected for chance, the statistic Cohen introduced for exactly this job.9

Fig. 03Attribute agreement: station vs reference · illustrative

The criteria most often quoted from the MSA manual for attribute systems are effectiveness of at least 90%, a miss rate of 2% or less and a false alarm rate of 5% or less, with kappa above 0.75 read as good agreement. Treat them as a starting point. The method was written with human inspectors in mind, and an automated station that'll see millions of parts can usually be held tighter. Your customer's requirements override them either way.

The station isn't the only appraiser in the room. The reference decision comes from people, and if your inspectors disagree with each other on boundary parts, the station's being scored against noise. Run the same attribute study on the human reference panel first. It often turns up boundary samples that need a clearer definition before any camera's involved, and our post on manual vs automated visual inspection gets into why.

When does a vision system need revalidation?

Whenever a change can affect what the station decides. A retrained model, a new threshold or new optics means repeating the OQ challenge and attribute study. A like-for-like camera swap with the archived job restored usually needs only a rerun of the golden and challenge sets.

Vision stations change all the time. Cameras fail, vendors push firmware, someone nudges a threshold to stop vision system false rejects, and a deep-learning model gets retrained on last month's images. Each needs a written decision about how much retesting it gets, and Fig. 04 is the tree we write into change-control procedures.

Fig. 04Revalidation decision tree · how much retesting a change needs

Three habits make it work. Keep the challenge set and the expected result for every part, so re-verification is a rerun rather than a new project. Version everything that touches the decision, meaning the job file, thresholds, model weights and firmware. And treat a retrained model as a new model. Its scores on the fixed test set get compared with the old model's before release, and a model that fixes this month's false rejects by missing a defect class it used to catch doesn't ship. The deep learning vs rule-based inspection comparison explains why that discipline costs more on AI tools.

Does 21 CFR Part 11 apply to machine vision systems?

It applies when the station's electronic results or images are records an FDA predicate rule requires you to keep, or when electronic signatures replace handwritten ones. If the station only drives a reject gate and the official record lives in another system, Part 11 scope sits with that other system.

21 CFR Part 11 itself is short.4 The FDA's 2003 scope and application guidance narrowed how it's enforced. The agency said it'd use enforcement discretion on the specific Part 11 requirements for validation, audit trails, record copies and retention, while predicate rules stay fully in force and other controls (access limits, operational and authority checks, device checks, training and the e-signature rules) still apply.5 In practice a vision station producing regulated records needs a handful of things.

• Individual user accounts with role-based permissions, not one shared admin login on the camera or HMI.
• A record of who changed a job, threshold or model, when and why, whether the platform keeps it or the MES around it does.
• Results stored with a timestamp, serial or part ID, recipe version and, where the procedure says so, the image.
• Backups with a tested restore, and retention that matches the predicate rule.

Smart cameras vary a lot here. Some vendors sell user management and audit trail options, and others lean on the PLC or MES around them. It's one of the less obvious differences in our Cognex vs Keyence comparison. Check during platform selection, because it's a painful thing to retrofit. Our machine vision software compared post, the smart camera vs PC-based vision guide and the inspection system comparison are good places to start.

What documents go in a vision validation package?

A complete package has the requirements and risk assessment, a validation plan, IQ, OQ and PQ protocols and reports, the test set register, the measurement study, deviations, archived job and model files, and the change-control procedure. Here's the checklist we work from.

1. User requirement specification, with the defect list, boundary samples and acceptance criteria.
2. Risk assessment linking each defect and each failure mode to its control.
3. Validation plan with scope, responsibilities, test set, statistics and acceptance criteria, signed before testing starts.
4. IQ protocol and report covering hardware, versions, drawings, wiring and calibration certificates.
5. Test set register with serial numbers, reference labels, photos and storage location.
6. OQ protocol and report with challenge results per variant, limit tests, fail-safe tests and the gage R&R or attribute agreement study.
7. PQ protocol and report with the production run, re-inspection results and final miss and false alarm rates.
8. Deviations and how each was closed, plus a signed summary releasing the station.
9. Archived job, threshold and model files with version identifiers.
10. Change-control procedure with the revalidation tree, plus the golden-sample routine and its log.

Validation's much cheaper to build in than to bolt on. That's how we approach our machine vision workcells, and why qualification and safety work starts at the first drawing. If you're still pricing a station, the machine vision system cost post shows where validation hours land in a budget, and the machine vision maintenance checklist covers keeping it valid once it's running.

Frequently asked questions

Can you use the vendor's IQ and OQ protocols?

Yes, as a starting point. Camera and integrator protocols often cover most installation and functional checks, and reusing them saves time. But they're written for the product, not your parts. You still need your own challenge set, boundary samples, acceptance criteria and PQ, and someone in your quality system has to review and approve whatever you adopt.

Should IQ and OQ be done at the factory acceptance test?

Often they're done twice. A first pass at the integrator's shop during the factory acceptance test catches problems while they're cheap to fix. Then IQ is repeated on site, because shipping and installation can change mounting, wiring and lighting, and OQ is rerun under your plant's light and your line speed. Only the on-site results release the station.

What's the difference between computer software assurance and computer system validation?

Computer system validation became known for heavy scripted testing and documentation of everything. The FDA's computer software assurance guidance asks you to scale assurance to risk instead, with scripted testing where a failure would matter and lighter unscripted testing where it wouldn't. It's still validation. It just puts the effort where a failure could hurt someone.

Does a daily golden sample check count as revalidation?

No. A golden sample run shows the station hasn't drifted since validation, which is valuable, but it uses a handful of parts and can't show the station still catches every defect type at its limit. Revalidation reruns the challenge set and, for a decision change, the attribute study. Keep the golden-sample log, though, because auditors like seeing it.

How long does vision system validation take?

It depends mostly on how ready the test set is. If boundary samples and challenge parts are collected and labeled before commissioning, IQ and OQ can run in days. Waiting on quality to find and agree boundary parts is what usually stretches it to weeks. PQ's length is whatever run you agreed in the plan.

Who should sign off on a vision system validation?

Quality should own approval of the plan, the acceptance criteria and the final reports, because they own the reference decision the station is scored against. Engineering or the integrator runs the protocols. Production should sign the PQ too, since they'll live with the false rejects. Keep the people who labeled the test set independent of whoever tuned the station.