EQM vs PFM vs FM Under ECSS

An Engineering Qualification Model is a model that reflects the design of the Flight Model, except potentially for the standard of some parts.

For example, lower-grade parts may sometimes be used where they come from the same manufacturer and use the same packaging as the flight-standard components.

An EQM can support:

• functional verification;

• performance verification;

• EMC verification;

• failure detection and recovery testing;

• redundancy-management testing;

• software and hardware integration;

• procedure development; and

• selected qualification activity.

An EQM may be used for environmental testing where the customer accepts the risk. Where it is used for qualification, the applicable Qualification Model rules must be followed.

This means an EQM should not automatically be presented as a full environmental Qualification Model.

A Qualification Model fully reflects the Flight Model design and is used for complete functional and environmental qualification.

The Qualification Model is normally not intended for flight because it is exposed to qualification margins and may be overtested relative to the flight article.

A dedicated Qualification Model is normally required for newly designed hardware or when delta qualification is needed following relevant changes.

A Protoflight Model is the first flight model used to combine qualification and acceptance objectives.

ECSS-E-ST-10-03C Rev.1 requires protoflight testing to provide evidence that the product:

• performs according to specification;

• operates in its intended environments;

• demonstrates the applicable qualification margins;

• is ready for delivery and subsequent use; and

• is free from workmanship defects and flawed materials.

The general ECSS protoflight approach uses qualification test levels with acceptance test durations. The applicable ECSS tables, product level, customer requirements and approved tailoring remain controlling.

A Flight Model is hardware intended for launch and operation in space.

Under a traditional qualification route, the design is qualified using separate qualification hardware. Each Flight Model then undergoes the applicable acceptance programme.

Acceptance testing provides evidence that the individual flight article performs according to specification with acceptance margins and is free from workmanship defects or flawed materials.

The project defines:

• verification objectives;

• product levels;

• model philosophy;

• qualification and acceptance strategy;

• use of analysis and similarity;

• heritage assumptions;

• test facilities;

• schedule constraints; and

• required evidence.

The model philosophy should be selected early enough to influence design, procurement and manufacturing.

The project manufactures the agreed models.

The required build standard, materials, parts, interfaces, software, instrumentation and configuration controls depend on each model’s intended use.

Models enter the controlled AIT flow.

Activity may include:

• integration;

• alignment;

• functional testing;

• vibration testing;

• shock testing;

• thermal vacuum testing;

• EMC verification;

• performance testing;

• inspections; and

• formal reviews.

Test, analysis, inspection and review evidence are assessed against the applicable requirements.

The evidence must remain traceable to the model, configuration and conditions used.

The customer or appointed project authority determines whether:

• qualification objectives have been met;

• flight items can be accepted;

• open nonconformances are controlled;

• verification requirements can be closed; and

• the product may progress towards delivery or flight.

The laboratory provides evidence. It does not make the complete flight-readiness decision.

A dedicated qualification route allows design weaknesses to be exposed without placing the first flight article under the same level of risk.

A protoflight route avoids a separate qualification article but concentrates qualification exposure in flight hardware.

An EQM can support early learning, functional development and selected qualification evidence. Its configuration and limitations must remain clear.

Reducing model count can lower manufacturing, procurement and integration costs.

However, the apparent saving can be offset by:

• additional analysis;

• more extensive development testing;

• limited anomaly-investigation hardware;

• repair or refurbishment;

• repeat testing;

• launch delay; or

• loss of the flight article.

A PFM route is not automatically the lowest-cost route. It is a cost and risk trade-off.

Fewer models can shorten the manufacturing programme.

The disadvantage is reduced schedule resilience. If a PFM is damaged, modified or produces ambiguous evidence, qualification and flight-delivery schedules may both be affected.

Each model creates a different form of evidence.

The model philosophy should explain:

• what each model represents;

• which requirements it will address;

• which differences exist from flight hardware;

• how those differences will be assessed;

• which tests will be performed;

• where analysis will supplement testing; and

• how evidence will support VCD closure.

A strong model philosophy balances:

• technical confidence;

• cost;

• schedule;

• hardware availability;

• residual hardware life;

• design maturity;

• manufacturing maturity;

• heritage;

• mission consequence; and

• recovery options.

There is no universally correct model philosophy.

ECSS-E-ST-10 provides the wider system-engineering framework.

It connects model philosophy with:

• product requirements;

• system design;

• verification strategy;

• technical risk;

• project reviews;

• interfaces; and

• engineering documentation.

ECSS-E-ST-10-02 addresses verification.

It supports the definition of:

• verification objectives;

• verification methods;

• verification levels;

• verification stages;

• model philosophy;

• qualification and acceptance strategy;

• Verification Plans;

• Verification Control Documents; and

• verification reporting.

ECSS-E-ST-10-03C Rev.1 addresses testing.

It defines requirements for:

• development testing;

• qualification testing;

• acceptance testing;

• protoflight testing;

• environmental testing;

• functional and performance testing;

• test sequencing;

• test reviews;

• retesting;

• tolerances;

• measurement uncertainty; and

• test documentation.

Product assurance and quality assurance requirements support control of:

• qualification status;

• configuration;

• manufacturing quality;

• nonconformances;

• critical items;

• test centres;

• inspections;

• records; and

• product acceptance.

ECSS-S-ST-00-01 provides the controlled model definitions.

ECSS-E-HB-10-02 and ECSS-E-HB-10-03 provide supporting guidance on verification models and testing.

The handbook guidance is informative unless made applicable by the customer.

Qualification testing provides evidence that the design performs according to specification in the intended environment with qualification margins.

Complete qualification is normally performed using a dedicated Qualification Model unless an approved protoflight strategy is used.

The model must be sufficiently representative of the flight design.

Acceptance testing applies to each flight product except the first flight model used under an agreed protoflight approach.

It provides evidence that the article:

• performs according to specification;

• meets the applicable acceptance conditions;

• remains free from unacceptable workmanship defects; and

• is suitable for delivery and subsequent use.

Protoflight combines qualification and acceptance objectives on the first flight model.

The general approach is:

• qualification test levels; and

• acceptance test durations.

This general rule should not be converted into one universal profile. The applicable ECSS tables and controlled project requirements remain decisive.

Dedicated hardware is still required where destructive or life-consuming activity should not be performed on the PFM.

EQM: engineering model that can support qualification activity within an agreed scope.

PFM: first flight model used for combined qualification and acceptance objectives.

FM: flight article normally subjected to acceptance testing after the design has been qualified.

A Flight Model is a hardware designation. It is not, by itself, a complete model philosophy.

A new or immature design may benefit from development models and dedicated qualification hardware.

A mature design with strong heritage may support a reduced model route, but the relevance of that heritage must be demonstrated.

The project should identify differences involving:

• materials;

• parts;

• manufacturing processes;

• interfaces;

• structure;

• thermal paths;

• software;

• mechanisms;

• wiring;

• connectors;

• mass properties; and

• operating modes.

Unassessed differences can invalidate conclusions.

A high-consequence mission may justify stronger separation between qualification activity and flight hardware.

Lower-cost missions may accept greater concentration of risk where the decision is explicit and justified.

A PFM strategy may be necessary where only one flight article can be manufactured.

This does not remove the possible need for:

• structural models;

• engineering models;

• representative assemblies;

• life-test articles;

• burst-test articles;

• development units; or

• material samples.

Ask what happens if the test article:

• fails;

• requires repair;

• needs redesign;

• produces ambiguous evidence;

• experiences facility interruption; or

• requires retesting.

The model philosophy should include realistic recovery routes.

• Define applicable requirements.

• Select verification methods.

• Establish product levels.

• Define the model philosophy.

• Identify qualification and acceptance objectives.

• Agree tailoring with the customer.

• Establish the Verification Plan and AIT Plan.

• Manufacture the required models.

• Control model configurations.

• Complete development testing.

• Prepare Test Specifications.

• Prepare Test Procedures.

• Confirm fixtures and instrumentation.

• Complete Test Readiness Reviews.

• Conduct qualification, acceptance or protoflight testing.

• Perform functional and performance checks.

• Record environmental conditions.

• Record deviations and anomalies.

• Maintain as-run procedures.

• Protect model and flight-hardware integrity.

• Conduct Post-Test Reviews.

• Assess achieved conditions.

• Review anomalies and nonconformances.

• Compare pre-test and post-test performance.

• Assess model representativeness.

• Conduct the Test Review Board.

• Produce Test Reports.

• Produce Verification Reports.

• Update the Verification Control Document.

• Close actions and nonconformances.

• Confirm qualification or acceptance status.

• Support the customer’s flight-readiness decision.

An EQM campaign may include:

• functional and performance testing;

• software and hardware integration;

• EMC verification;

• redundancy testing;

• fault detection and recovery;

• vibration testing where approved;

• thermal vacuum testing where approved;

• shock testing where approved;

• procedure development; and

• engineering investigations.

The approved scope must identify whether the EQM is providing development, engineering or formal qualification evidence.

A PFM campaign can include:

• qualification-level environmental exposure;

• acceptance-duration testing;

• functional and performance verification;

• vibration testing;

• shock or SRS testing;

• thermal vacuum testing;

• EMC verification through a suitable provider;

• pre-test and post-test inspections;

• residual-life control; and

• close configuration management.

Life tests, burst-pressure qualification and ESD qualification should use dedicated hardware where required by the applicable ECSS baseline.

An FM campaign can include:

• acceptance vibration testing;

• acceptance thermal vacuum testing;

• functional testing;

• performance testing;

• mechanism checks;

• electrical checks;

• leak testing;

• configuration verification;

• visual inspection; and

• final performance confirmation.

The applicable baseline depends on product type, product level and approved tailoring.

A model that does not represent the flight configuration can produce misleading evidence.

Late model availability, failed qualification or an anomaly on the PFM can affect programme milestones.

Additional models increase manufacturing cost. Reducing model count can increase contingency and recovery costs.

Qualification-level exposure on a PFM can consume thermal cycles, mechanism operations and environmental life.

A completed test may not close a requirement if the model, configuration, conditions or acceptance criteria were unsuitable.

Weak configuration records can make it unclear which design was qualified or accepted.

Previous evidence may not remain valid after changes to the design, manufacture, environment or intended use.

They are related but distinct ECSS definitions.

An EQM can support qualification activity, but complete environmental qualification requires the appropriate model standard and customer agreement.

PFM may reduce model count, but it concentrates technical and schedule risk in flight hardware.

Acceptance testing does not normally demonstrate qualification margin.

Evidence only applies where the model is sufficiently representative of the flight design.

Heritage must be relevant to the current product, manufacture, mission and environment.

Each model has a defined purpose. Applying the same severity to every article can create unnecessary cost or damage.

Identify exactly what was tested.

Record hardware, software, fixture, instrumentation and interface configurations.

Link every activity to the Verification Plan, VCD and intended close-out evidence.

Sequence testing to represent the expected lifecycle where practicable.

ECSS also uses sequencing to support early detection of defects.

Control changes after qualification and acceptance.

Relevant changes require assessment and may require delta verification.

Record vibration exposure, thermal cycles, pressure cycles, mechanism operations and powered test time.

This is especially important for PFMs and FMs.

Where a dedicated model is simplified, it must still represent the function or characteristic being verified.

Use Test Readiness Reviews, Post-Test Reviews and Test Review Boards to control progression.

Plan for anomaly investigation, repair, redesign, retest and schedule recovery before testing begins.

The evidence demonstrates the applicable requirements within the agreed model strategy.

The customer or appointed verification authority accepts the evidence used to close the relevant requirements.

Differences between tested models and flight hardware are understood, justified and controlled.

The PFM or FM completes the required campaign without unacceptable degradation.

The project can connect each requirement to the model, configuration, activity, result and conclusion.

The customer or appointed project authority determines that the complete evidence set supports progression towards flight.

Resonate can review customer-supplied requirements, environmental profiles, model information and expected outputs.

This helps identify missing facility and test inputs before quotation.

Subject to technical review, Resonate can support the practical definition of:

• qualification testing;

• acceptance testing;

• protoflight testing;

• vibration testing;

• shock and SRS testing;

• thermal vacuum testing; and

• functional monitoring during exposure.

Resonate can review the facility-facing implications of:

• model type;

• dimensions;

• mass;

• centre of gravity;

• mounting;

• thermal interfaces;

• electrical interfaces;

• software state;

• operating modes; and

• instrumentation.

The customer retains ownership of the model philosophy and verification strategy.

Resonate can contribute test-specific information to:

• AIT Plans;

• Test Specifications;

• Test Procedures;

• Test Readiness Reviews;

• as-run records;

• Test Reports; and

• evidence packages.

The objective is not to maximise test severity or facility time.

It is to help deliver controlled activity that answers the project’s engineering question and protects the validity of the evidence.

Vibration, shock, SRS and thermal vacuum activity can be coordinated through one engineering team where technically suitable.

EMC and acoustic testing are not claimed as direct Resonate capabilities on this page. They should be coordinated with appropriate specialist providers.

Resonate provides test evidence. The customer or appointed project authority retains responsibility for model selection, requirement closure, qualification, acceptance and flight readiness.

Your Test Facilitator. Not simply a test facility.

These FAQs explain the practical differences between EQM, PFM and FM hardware.

Requirements vary by project and approved tailoring. If anything needs clarification, please contact us. We welcome feedback and are happy to discuss your programme.

An EQM reflects the Flight Model design but may use a different parts standard. It supports functional, performance, EMC and selected qualification activity.

A Qualification Model fully reflects the Flight Model design and is used for complete functional and environmental qualification.

An EQM is normally non-flight engineering hardware used to support qualification and verification.

An FM is manufactured for launch and operation in space.

A Protoflight Model is the first flight model used to achieve both qualification and acceptance objectives.

No. A project may use an approved protoflight strategy or another tailored model philosophy.

The decision must be justified through the project’s verification approach.

A PFM generally experiences qualification test levels with acceptance test durations.

The applicable ECSS tables and project requirements remain controlling.

No. PFM can reduce model-manufacturing costs but can increase risk, analysis effort and recovery costs if an anomaly occurs.

A dedicated Qualification Model followed by Flight Model acceptance provides the clearest separation between design qualification and flight-hardware exposure.

It also requires additional hardware and programme effort.

Potentially. ECSS permits an EQM to be used for environmental testing where the customer accepts the risk and the applicable Qualification Model rules are followed.

A Qualification Model is normally not intended for flight because it has been exposed to qualification testing.

Any proposed flight use requires explicit project assessment and customer authority.

Normally no. Acceptance testing provides article-specific evidence and helps detect workmanship or material defects.

Design qualification should already be supported by the approved qualification route.

They are derived from the applicable ECSS baseline, product level, mission environment, customer requirements and approved tailoring.

The model philosophy is agreed through the customer-supplier and project-verification process.

The test laboratory does not unilaterally select or approve it.

• To Follow

• ECSS Official Website

• ECSS Standards Library

• European Space Agency

• UK Space Agency