ITAR eliminates any test automation tool that routes data outside your network. That single requirement removes most of the test automation market before your technical evaluation begins.

TL;DR

• ITAR (22 CFR Parts 120-130) prohibits transmitting controlled technical data outside approved networks, test execution logs, screenshots, and reports for aerospace Windchill workflows contain part numbers, revision histories, and design specifications that qualify as controlled data
• AS9100D clause 8.5.6 requires structured, timestamped execution records per test step, standard automation logs are not the same as AS9100D execution records
• Windchill’s Java PDM Link thick-client renders BOM management and engineering change workflows entirely outside the browser DOM; standard web automation tools cannot reach them
• Canvas-rendered attribute grids inside Windchill’s Java panels require OCR-based identification; pixel-coordinate workarounds break on any layout change
• Sahi Pro is the only tool in this list with documented full air-gapped deployment, AS9100D-ready execution record output, Java PDM Link coverage, and canvas attribute grid automation via OCR in one product

Two Requirements That Change Everything Before You Run a Demo

Aerospace Windchill automation is not standard Windchill automation with a compliance label attached. Two requirements determine most of the evaluation before a single tool demo takes place.

The first is ITAR. The International Traffic in Arms Regulations (22 CFR Parts 120-130) govern the export of defense-related technology and data. For aerospace PLM programmes, test execution logs and screenshots are not neutral operational data. They contain part numbers, material specifications, assembly configurations, and design revision histories for flight-critical and weapons-adjacent systems. Any test automation tool that routes execution data, results, screenshots, or telemetry through external cloud infrastructure is incompatible with ITAR requirements. This rules out cloud-native automation tools before technical capability is even considered.

The second is AS9100D. AS9100D is the quality management standard for aviation, space, and defense. Clause 8.5.6 requires records of production and service provision activities. In test automation terms, that means timestamped execution records per test step, traceable to the test case and the quality system process it validates. Standard test reports, HTML dashboards, JUnit XML, console output, do not satisfy this without additional post-processing that your team builds and maintains.

These two filters applied together leave a short list.

Windchill’s Architecture in Aerospace Environments

Aerospace Windchill deployments are typically on-premise, often on Intranet-only networks, and frequently multiple versions behind the current PTC release due to the validation overhead of upgrades in regulated environments.

Windchill PDM Link is the Java thick-client that handles BOM management, engineering change, configuration management, and Creo integration. For aerospace teams, this is where ITAR-controlled design data lives, where AS9100D-required change records are maintained, and where the test scenarios that matter most for certification evidence run.

Inside the Java PDM Link panels, attribute grids render as canvas elements. Property values, classification attributes, and configuration parameters are painted to the screen by the Java runtime as pixel regions, not as accessible DOM or Windows UI elements. Standard tools return null on these elements. Coordinate-based automation requires knowing exact pixel positions, which break on any layout change including Windchill version upgrades.

Creo plugin windows add a third challenge. Creo integration points inside Windchill sessions open plugin windows that render in a separate process from the main Windchill client. Automating a design check that involves both Windchill workflow steps and Creo window interactions requires a tool that can cross application process boundaries in the same test script.

How to Actually Evaluate These Tools for Aerospace Windchill

Before requesting demos, apply these filters in sequence.

Filter 1: Air-gapped deployment. Ask vendors to describe their deployment model in detail. Specifically ask: does license activation require an internet connection? Does any part of the execution engine phone home? Can results, logs, and screenshots be stored entirely on your network? If any answer is unclear, request a written statement before proceeding.

Filter 2: AS9100D record output. Ask for a sample execution report from a completed test run. Review it against clause 8.5.6 requirements: is each test step timestamped individually? Are records attributable to a specific user or execution context? Can records be retrieved and presented during an audit without manual assembly?

Filter 3: Java PDM Link coverage demonstration. Request a live demo specifically in a Windchill PDM Link Java thick-client session, automating a BOM management workflow. Accepting a demo of the browser portal only is accepting a demo of the wrong layer.

Filter 4: Canvas attribute grid identification. Ask vendors to automate reading a value from a canvas-rendered attribute grid. If the answer involves pixel coordinates, ask what happens when the layout changes. If the answer involves OCR, ask which PLM versions have been tested.

Filter 5: PTC version upgrade stability. Ask how many scripts from a 100-script Windchill suite survive a major PTC version upgrade unchanged, and why.

The 6 Best Windchill Test Automation Tools for Aerospace QA Teams

1. Sahi Pro

Sahi Pro satisfies all five filters for aerospace Windchill automation. License activation, test execution, result storage, and reporting run entirely within your network, with no phone-home behavior and no cloud execution pathway. This is the standard configuration for Sahi Pro’s aerospace and defence customers, not a special air-gapped mode.

The execution record format produces timestamped, step-level records designed to simultaneously satisfy AS9100D clause 8.5.6, 21 CFR Part 11, and ISO 13485 from a single report. For programmes managing multiple concurrent regulatory frameworks, this eliminates the post-processing work of assembling separate compliance documentation per standard.

Java PDM Link automation runs through the Desktop add-on, which covers Java Swing, AWT, and SWT applications natively. BOM management panels, engineering change workflows, and Creo integration points are reachable in the same test script as Windchill’s browser-based portal navigation.

Canvas-rendered attribute grids are handled through the AI Assist OCR add-on, which reads text directly from rendered pixel regions without requiring accessible element handles. When Windchill layouts change after a PTC upgrade, OCR continues locating the correct attribute field by reading its visible label rather than relying on a fixed screen coordinate.

Proximity-based element identification on the browser and Java layers means tests locate elements by visible label and spatial context. PTC version upgrades that restructure the PDM Link interface or update the browser portal component tree do not break scripts that identify elements by what they visibly say and where they visibly sit relative to other elements.

Honest limitation: Desktop add-on and AI Assist OCR are separately licensed. Confirm full module stack compatibility with your specific PTC Windchill version and Creo release before evaluation is complete.

2. UFT One (OpenText)

UFT One has served aerospace and defence automation programmes for two decades with genuine Java Add-in depth for thick-client applications. Windchill PDM Link Java coverage is real and mature. On-premise air-gapped deployment is fully supported. UFT One’s compliance documentation capabilities developed over years of regulated programme deployments are among the strongest in this market.

For aerospace programmes that need a tool with long regulatory history and documented use in defence contexts, UFT One’s track record is a genuine asset.

Honest limitation: UFT One’s Java object recognition resets a meaningful portion of affected tests when major PTC versions restructure the PDM Link element tree. Canvas-rendered attribute grids are outside the Java Add-in’s standard scope. OpenText licensing costs have increased significantly and should be confirmed against programme budget early.

3. Tricentis Tosca

Tosca has aerospace and defence deployment references and handles Windchill automation through its model-based TCD approach. AS9100D compliance record configuration is available. On-premise deployment is supported.

Tosca’s structured model library creates a governance framework that works well for large programmes with multiple test workstreams requiring coordination across teams.

Honest limitation: Tosca TBox certification is required for test authoring and maintenance. Canvas-rendered Windchill attribute grids require additional modules beyond the standard Tosca installation. Year 1 cost for an aerospace QA team is among the highest of any option in this list.

4. Ranorex

Ranorex handles native Windows desktop automation through Windows UI Automation and Win32. For Windchill PDM Link components rendered as standard Windows controls with accessible element handles, Ranorex provides solid coverage. On-premise deployment is straightforward, and ITAR compliance is achievable in an air-gapped configuration.

For aerospace programmes where Windchill BOM workflows do not involve canvas-rendered attribute grids, Ranorex offers lower cost of entry than Tosca or UFT One.

Honest limitation: Canvas-rendered attribute grids in Windchill’s Java PDM Link panels are outside Ranorex’s coverage scope. For aerospace programmes where attribute grid validation is a primary test scenario, this is the gap that limits Ranorex’s usefulness.

5. TestComplete (SmartBear)

TestComplete covers Windchill through its browser automation and Java bridge, with flexible scripting and native CI/CD integration. For aerospace teams already running TestComplete for other applications in their stack, Windchill coverage within the existing tool reduces vendor complexity.

On-premise deployment is supported. AS9100D record output requires configuration beyond the default reporting format.

Honest limitation: Canvas attribute grid automation requires custom scripting beyond TestComplete’s standard capabilities. AS9100D-ready records are not produced out of the box. For programmes where both are primary requirements, the additional configuration work should be scoped before committing.

6. Selenium (Reference Baseline)

Selenium covers Windchill’s browser portal layer and can be deployed entirely on-premise. For ITAR compliance, on-premise Selenium running within your network satisfies the base data residency requirement if no external reporting or analytics services are added.

Selenium is included as a reference baseline to define the coverage boundary. Windchill PDM Link Java thick-client, canvas-rendered attribute grids, and AS9100D-ready execution record output are outside Selenium’s scope without substantial surrounding framework development.

Honest limitation: The Java PDM Link layer and canvas attribute grids are architecturally out of Selenium’s reach. AS9100D record production requires building custom reporting infrastructure on top of the framework. For aerospace programmes with both ITAR and AS9100D requirements and Windchill PDM Link coverage needs, Selenium is the starting point for a framework, not a production solution.

What AS9100D Clause 8.5.6 Requires From an Execution Record

Understanding what the standard requires helps evaluate vendor claims precisely. AS9100D clause 8.5.6 covers records demonstrating that products and services have been produced in conformance with requirements. In a software testing context, this means:

Traceability: Each executed test links to the quality system requirement it validates. An auditor can follow the chain from a production release decision back to the test that validated the relevant Windchill workflow.

Timestamping: Records capture when each test step executed, not just when the overall test completed. Session-level timestamps are insufficient.

Retention: Records are stored in a way that supports retrieval throughout the required retention period. Records stored in a tool’s local cache that disappear on the next test run do not satisfy this.

Non-repudiation: Records cannot be altered after generation. If your automation tool produces execution records that can be edited in place, that creates an audit exposure.

Ask vendors specifically about each of these four properties, not about whether they “support AS9100D compliance” in general.

Sources

• ITAR 22 CFR Parts 120-130: International Traffic in Arms Regulations, ecfr.gov
• AS9100D: Quality Management Systems Requirements for Aviation, Space, and Defense Organizations, Clause 8.5.6, sae.org
• PTC Windchill product documentation: PDM Link architecture and Java client overview, ptc.com/en/products/windchill
• Sahi Pro: PLM Test Automation Tools for Aerospace and Defence Compliance in 2026, sahipro.com/blog-plm-test-automation-tools-aerospace-defence-compliance-2026/
• Sahi Pro: Desktop Test Automation for IP-Sensitive PLM: On-Premise Guide, sahipro.com/desktop-test-automation-ip-sensitive-plm-on-premise-guide/