Accredited
Scope Available
Programmes
Plus Certified
Expertise
Test Evidence
Understanding Engineering Qualification Models, Protoflight Models and Flight Models is fundamental to defining a credible space-hardware verification strategy.
Within the ECSS framework, the model philosophy determines which physical and virtual models will generate evidence, when they will be used and how the project will demonstrate qualification, acceptance and flight readiness.
An Engineering Qualification Model, or EQM, is primarily used for engineering qualification, functional performance and selected verification activity. A Protoflight Model, or PFM, is the first flight model used to combine qualification and acceptance objectives. A Flight Model, or FM, is the article intended for launch and operation.
These models do not represent three interchangeable test labels. They support different evidence routes, hardware configurations and risk positions.
The selected approach affects programme cost, schedule, test severity, manufacturing effort, hardware availability and recovery options. A model strategy that reduces hardware cost may increase risk to the flight article. A dedicated qualification route may provide greater separation between design learning and flight hardware, but it requires additional manufacturing and integration effort.
The correct choice depends on project requirements, design maturity, heritage, product level, mission consequence and approved tailoring.
✓ Environmental Test Expertise
✓ Space Industry Experience
✓ ECSS-Aligned Verification Support
✓ Independent Technical Guidance
✓ Qualification and Verification Focus
An Engineering Qualification Model is a model that reflects the design of the Flight Model, except potentially for the standard of some parts.
For example, lower-grade parts may sometimes be used where they come from the same manufacturer and use the same packaging as the flight-standard components.
An EQM can support:
functional verification;
performance verification;
EMC verification;
failure detection and recovery testing;
redundancy-management testing;
software and hardware integration;
procedure development; and
selected qualification activity.
An EQM may be used for environmental testing where the customer accepts the risk. Where it is used for qualification, the applicable Qualification Model rules must be followed.
This means an EQM should not automatically be presented as a full environmental Qualification Model.
A Qualification Model fully reflects the Flight Model design and is used for complete functional and environmental qualification.
The Qualification Model is normally not intended for flight because it is exposed to qualification margins and may be overtested relative to the flight article.
A dedicated Qualification Model is normally required for newly designed hardware or when delta qualification is needed following relevant changes.
A Protoflight Model is the first flight model used to combine qualification and acceptance objectives.
ECSS-E-ST-10-03C Rev.1 requires protoflight testing to provide evidence that the product:
performs according to specification;
operates in its intended environments;
demonstrates the applicable qualification margins;
is ready for delivery and subsequent use; and
is free from workmanship defects and flawed materials.
The general ECSS protoflight approach uses qualification test levels with acceptance test durations. The applicable ECSS tables, product level, customer requirements and approved tailoring remain controlling.
A Flight Model is hardware intended for launch and operation in space.
Under a traditional qualification route, the design is qualified using separate qualification hardware. Each Flight Model then undergoes the applicable acceptance programme.
Acceptance testing provides evidence that the individual flight article performs according to specification with acceptance margins and is free from workmanship defects or flawed materials.
| Model | Primary purpose |
|---|---|
| EQM | Support engineering qualification, functional performance, EMC and selected verification activity. |
| Qualification Model | Complete functional and environmental qualification of the design. |
| PFM | Combine qualification and acceptance objectives on the first flight model. |
| FM | Provide flight hardware and demonstrate article-specific acceptance. |
The project defines:
verification objectives;
product levels;
model philosophy;
qualification and acceptance strategy;
use of analysis and similarity;
heritage assumptions;
test facilities;
schedule constraints; and
required evidence.
The model philosophy should be selected early enough to influence design, procurement and manufacturing.
The project manufactures the agreed models.
The required build standard, materials, parts, interfaces, software, instrumentation and configuration controls depend on each model’s intended use.
Activity may include:
integration;
alignment;
functional testing;
vibration testing;
shock testing;
thermal vacuum testing;
EMC verification;
performance testing;
inspections; and
formal reviews.
Test, analysis, inspection and review evidence are assessed against the applicable requirements.
The evidence must remain traceable to the model, configuration and conditions used.
The customer or appointed project authority determines whether:
qualification objectives have been met;
flight items can be accepted;
open nonconformances are controlled;
verification requirements can be closed; and
the product may progress towards delivery or flight.
The laboratory provides evidence. It does not make the complete flight-readiness decision.
A dedicated qualification route allows design weaknesses to be exposed without placing the first flight article under the same level of risk.
A protoflight route avoids a separate qualification article but concentrates qualification exposure in flight hardware.
An EQM can support early learning, functional development and selected qualification evidence. Its configuration and limitations must remain clear.
Reducing model count can lower manufacturing, procurement and integration costs.
However, the apparent saving can be offset by:
A PFM route is not automatically the lowest-cost route. It is a cost and risk trade-off.
Fewer models can shorten the manufacturing programme.
The disadvantage is reduced schedule resilience. If a PFM is damaged, modified or produces ambiguous evidence, qualification and flight-delivery schedules may both be affected.
Each model creates a different form of evidence.
The model philosophy should explain:
A strong model philosophy balances:
technical confidence;
There is no universally correct model philosophy.
ECSS-E-ST-10 provides the wider system-engineering framework.
It connects model philosophy with:
product requirements;
system design;
verification strategy;
technical risk;
project reviews;
interfaces; and
engineering documentation.
ECSS-E-ST-10-02 addresses verification.
It supports the definition of:
verification objectives;
verification methods;
verification levels;
verification stages;
model philosophy;
qualification and acceptance strategy;
Verification Plans;
Verification Control Documents; and
verification reporting.
ECSS-E-ST-10-03C Rev.1 addresses testing.
It defines requirements for:
development testing;
qualification testing;
acceptance testing;
protoflight testing;
environmental testing;
functional and performance testing;
test sequencing;
test reviews;
retesting;
tolerances;
measurement uncertainty; and
test documentation.
Product assurance and quality assurance requirements support control of:
qualification status;
configuration;
manufacturing quality;
nonconformances;
critical items;
test centres;
inspections;
records; and
product acceptance.
ECSS-S-ST-00-01 provides the controlled model definitions.
ECSS-E-HB-10-02 and ECSS-E-HB-10-03 provide supporting guidance on verification models and testing.
The handbook guidance is informative unless made applicable by the customer.
Qualification testing provides evidence that the design performs according to specification in the intended environment with qualification margins.
Complete qualification is normally performed using a dedicated Qualification Model unless an approved protoflight strategy is used.
The model must be sufficiently representative of the flight design.
Acceptance testing applies to each flight product except the first flight model used under an agreed protoflight approach.
It provides evidence that the article:
performs according to specification;
meets the applicable acceptance conditions;
remains free from unacceptable workmanship defects; and
is suitable for delivery and subsequent use.
Protoflight combines qualification and acceptance objectives on the first flight model.
The general approach is:
qualification test levels; and
acceptance test durations.
This general rule should not be converted into one universal profile. The applicable ECSS tables and controlled project requirements remain decisive.
Dedicated hardware is still required where destructive or life-consuming activity should not be performed on the PFM.
| Characteristic | EQM | PFM | FM |
|---|---|---|---|
| Intended for flight | Normally no | Yes | Yes |
| Primary role | Engineering qualification and selected verification | Combined qualification and acceptance | Operational flight article |
| Environmental qualification | Possible if agreed and representative | Yes, within the approved protoflight route | Normally no under a traditional qualification route |
| Acceptance objective | Not its primary purpose | Included | Yes |
| Design-margin evidence | Depends on agreed scope and configuration | Yes | Normally inherited from qualification evidence |
| Workmanship evidence | Limited relevance | Yes | Yes |
| Exposure severity | Defined by its approved role | Generally qualification levels | Acceptance levels |
| Exposure duration | Defined by its approved role | Generally acceptance durations | Acceptance durations |
| Hardware-life concern | Lower flight-life concern because it is not intended to fly | High, because the article will fly | High, because the article will fly |
| Schedule resilience | Can preserve flight-hardware recovery options | Lower if the PFM is damaged or delayed | Depends on production quantity and available spares |
| Cost tendency | Additional hardware and integration cost | Can reduce model count | Required flight-hardware cost remains |
| Main risk | Model may differ from flight configuration | Qualification risk is concentrated in flight hardware | Acceptance evidence depends on prior qualification validity |
EQM: engineering model that can support qualification activity within an agreed scope.
PFM: first flight model used for combined qualification and acceptance objectives.
FM: flight article normally subjected to acceptance testing after the design has been qualified.
A Flight Model is a hardware designation. It is not, by itself, a complete model philosophy.
A new or immature design may benefit from development models and dedicated qualification hardware.
A mature design with strong heritage may support a reduced model route, but the relevance of that heritage must be demonstrated.
The project should identify differences involving:
materials;
parts;
manufacturing processes;
interfaces;
structure;
thermal paths;
software;
mechanisms;
wiring;
connectors;
mass properties; and
operating modes.
Unassessed differences can invalidate conclusions.
A high-consequence mission may justify stronger separation between qualification activity and flight hardware.
Lower-cost missions may accept greater concentration of risk where the decision is explicit and justified.
A PFM strategy may be necessary where only one flight article can be manufactured.
This does not remove the possible need for:
structural models;
engineering models;
representative assemblies;
life-test articles;
burst-test articles;
development units; or
material samples.
Ask what happens if the test article:
fails;
requires repair;
needs redesign;
produces ambiguous evidence;
experiences facility interruption; or
requires retesting.
The model philosophy should include realistic recovery routes.
Define applicable requirements.
Select verification methods.
Establish product levels.
Define the model philosophy.
Identify qualification and acceptance objectives.
Agree tailoring with the customer.
Establish the Verification Plan and AIT Plan.
Manufacture the required models.
Control model configurations.
Complete development testing.
Prepare Test Specifications.
Prepare Test Procedures.
Confirm fixtures and instrumentation.
Complete Test Readiness Reviews.
Conduct qualification, acceptance or protoflight testing.
Perform functional and performance checks.
Record environmental conditions.
Record deviations and anomalies.
Maintain as-run procedures.
Protect model and flight-hardware integrity.
Conduct Post-Test Reviews.
Assess achieved conditions.
Review anomalies and nonconformances.
Compare pre-test and post-test performance.
Assess model representativeness.
Conduct the Test Review Board.
Produce Test Reports.
Produce Verification Reports.
Update the Verification Control Document.
Close actions and nonconformances.
Confirm qualification or acceptance status.
Support the customer’s flight-readiness decision.
An EQM campaign may include:
functional and performance testing;
software and hardware integration;
EMC verification;
redundancy testing;
fault detection and recovery;
vibration testing where approved;
thermal vacuum testing where approved;
shock testing where approved;
procedure development; and
engineering investigations.
The approved scope must identify whether the EQM is providing development, engineering or formal qualification evidence.
A PFM campaign can include:
qualification-level environmental exposure;
acceptance-duration testing;
functional and performance verification;
vibration testing;
shock or SRS testing;
thermal vacuum testing;
EMC verification through a suitable provider;
pre-test and post-test inspections;
residual-life control; and
close configuration management.
Life tests, burst-pressure qualification and ESD qualification should use dedicated hardware where required by the applicable ECSS baseline.
An FM campaign can include:
acceptance vibration testing;
acceptance thermal vacuum testing;
functional testing;
performance testing;
mechanism checks;
electrical checks;
leak testing;
configuration verification;
visual inspection; and
final performance confirmation.
The applicable baseline depends on product type, product level and approved tailoring.
A model that does not represent the flight configuration can produce misleading evidence.
Late model availability, failed qualification or an anomaly on the PFM can affect programme milestones.
Additional models increase manufacturing cost. Reducing model count can increase contingency and recovery costs.
Qualification-level exposure on a PFM can consume thermal cycles, mechanism operations and environmental life.
A completed test may not close a requirement if the model, configuration, conditions or acceptance criteria were unsuitable.
Weak configuration records can make it unclear which design was qualified or accepted.
Previous evidence may not remain valid after changes to the design, manufacture, environment or intended use.
They are related but distinct ECSS definitions.
An EQM can support qualification activity, but complete environmental qualification requires the appropriate model standard and customer agreement.
PFM may reduce model count, but it concentrates technical and schedule risk in flight hardware.
Acceptance testing does not normally demonstrate qualification margin.
Evidence only applies where the model is sufficiently representative of the flight design.
Heritage must be relevant to the current product, manufacture, mission and environment.
Each model has a defined purpose. Applying the same severity to every article can create unnecessary cost or damage.
Identify exactly what was tested.
Record hardware, software, fixture, instrumentation and interface configurations.
Link every activity to the Verification Plan, VCD and intended close-out evidence.
Sequence testing to represent the expected lifecycle where practicable.
ECSS also uses sequencing to support early detection of defects.
Control changes after qualification and acceptance.
Relevant changes require assessment and may require delta verification.
Record vibration exposure, thermal cycles, pressure cycles, mechanism operations and powered test time.
This is especially important for PFMs and FMs.
Where a dedicated model is simplified, it must still represent the function or characteristic being verified.
Use Test Readiness Reviews, Post-Test Reviews and Test Review Boards to control progression.
Plan for anomaly investigation, repair, redesign, retest and schedule recovery before testing begins.
| Document | Purpose |
|---|---|
| Verification Plan | Defines verification methods, levels, stages and model philosophy. |
| Verification Control Document | Tracks requirements and close-out evidence. |
| AIT Plan | Defines assembly, integration and test activity. |
| Model Philosophy | Describes the models, build standards, uses and relationships. |
| Test Specification, TSPE | Defines the test objectives, configuration, conditions and criteria. |
| Test Procedure, TPRO | Provides controlled step-by-step execution. |
| Test Report, TRPT | Records execution, results and conclusions. |
| Verification Report | Supports formal requirement close-out. |
| Configuration Status Records | Identify the model and article configuration. |
| Configuration Status Records | Identify the model and article configuration. |
| Nonconformance Reports | Control unexpected results or departures from requirements. |
| Requests for Deviation or Waiver | Record authorised departures from the baseline. |
| Qualification Status List | Records qualification status and supporting evidence. |
The evidence demonstrates the applicable requirements within the agreed model strategy.
The customer or appointed verification authority accepts the evidence used to close the relevant requirements.
Differences between tested models and flight hardware are understood, justified and controlled.
The PFM or FM completes the required campaign without unacceptable degradation.
The project can connect each requirement to the model, configuration, activity, result and conclusion.
The customer or appointed project authority determines that the complete evidence set supports progression towards flight.
Resonate can review customer-supplied requirements, environmental profiles, model information and expected outputs.
This helps identify missing facility and test inputs before quotation.
Subject to technical review, Resonate can support the practical definition of:
qualification testing;
acceptance testing;
protoflight testing;
vibration testing;
shock and SRS testing;
thermal vacuum testing; and
functional monitoring during exposure.
Resonate can review the facility-facing implications of:
model type;
dimensions;
mass;
centre of gravity;
mounting;
thermal interfaces;
electrical interfaces;
software state;
operating modes; and
instrumentation.
The customer retains ownership of the model philosophy and verification strategy.
Resonate can contribute test-specific information to:
AIT Plans;
Test Specifications;
Test Procedures;
Test Readiness Reviews;
as-run records;
Test Reports; and
evidence packages.
The objective is not to maximise test severity or facility time.
It is to help deliver controlled activity that answers the project’s engineering question and protects the validity of the evidence.
Vibration, shock, SRS and thermal vacuum activity can be coordinated through one engineering team where technically suitable.
EMC and acoustic testing are not claimed as direct Resonate capabilities on this page. They should be coordinated with appropriate specialist providers.
Resonate provides test evidence. The customer or appointed project authority retains responsibility for model selection, requirement closure, qualification, acceptance and flight readiness.
Your Test Facilitator. Not simply a test facility.
These FAQs explain the practical differences between EQM, PFM and FM hardware.
Requirements vary by project and approved tailoring. If anything needs clarification, please contact us. We welcome feedback and are happy to discuss your programme.
An EQM reflects the Flight Model design but may use a different parts standard. It supports functional, performance, EMC and selected qualification activity.
A Qualification Model fully reflects the Flight Model design and is used for complete functional and environmental qualification.
An EQM is normally non-flight engineering hardware used to support qualification and verification.
An FM is manufactured for launch and operation in space.
A Protoflight Model is the first flight model used to achieve both qualification and acceptance objectives.
No. A project may use an approved protoflight strategy or another tailored model philosophy.
The decision must be justified through the project’s verification approach.
A PFM generally experiences qualification test levels with acceptance test durations.
The applicable ECSS tables and project requirements remain controlling.
No. PFM can reduce model-manufacturing costs but can increase risk, analysis effort and recovery costs if an anomaly occurs.
A dedicated Qualification Model followed by Flight Model acceptance provides the clearest separation between design qualification and flight-hardware exposure.
It also requires additional hardware and programme effort.
Potentially. ECSS permits an EQM to be used for environmental testing where the customer accepts the risk and the applicable Qualification Model rules are followed.
A Qualification Model is normally not intended for flight because it has been exposed to qualification testing.
Any proposed flight use requires explicit project assessment and customer authority.
Normally no. Acceptance testing provides article-specific evidence and helps detect workmanship or material defects.
Design qualification should already be supported by the approved qualification route.
They are derived from the applicable ECSS baseline, product level, mission environment, customer requirements and approved tailoring.
The model philosophy is agreed through the customer-supplier and project-verification process.
The test laboratory does not unilaterally select or approve it.
The model philosophy affects every later decision, including hardware manufacture, qualification exposure, acceptance activity, facility selection, schedule and verification evidence.
Bring Resonate Testing your Verification Plan, proposed model philosophy, hardware information, environmental profiles, drawings, fixture assumptions, operating modes, instrumentation needs and reporting expectations.
We can review the practical test implications and identify facility, readiness or evidence issues before the campaign is committed.
Editorial compliance note: This page provides practical guidance based on ECSS terminology and testing principles. It does not replace the contractually applicable ECSS baseline, project-specific model philosophy, customer-approved tailoring, launcher requirements or controlled verification documentation.
Whether you’re looking to contact us for the first time or have another testing requirement, we’d love to hear from you.
