Engine-control qualification
Engine-control equipment qualification evidence review
An engine-control qualification evidence review checks that the hardware assurance, software verification, and environmental qualification behind engine-control equipment meet their assigned levels and cover the current article. A certification engineer runs it for the supplier before qualification evidence is relied on in a submission, or when qualification from an earlier program is proposed for reuse. It examines DO-254 hardware assurance against its assigned level, DO-178C verification coverage, DO-160G environmental coverage, and whether the qualified configuration still matches the build. You receive a qualification coverage assessment across both assurance streams, a list of levels or configurations that fall short, and the re-qualification items needed to close them.
When this review is needed
- Engine-control qualification evidence is about to anchor a submission and its coverage against the assigned levels is unconfirmed.
- Hardware qualified for one assurance level is proposed for reuse where the safety assessment now assigns a higher one.
- A device revision or software change means the existing qualification may not cover the current build.
- The DO-160G environmental runs predate the current installation and their category selection has never been rechecked.
The problem
Engine-control qualification has to satisfy two assurance streams and an environmental case at once, each judged against an assigned level and each tied to a specific build. Suppliers reuse a hardware design, revise a device, or carry software forward from an earlier program, and the qualification that came with any of those pieces may not reach the level the current safety case assigns or may describe a build the article has moved past. The engineer relying on it has to confirm both the level and the configuration hold across hardware, software, and environment.
What gets reviewed
- DO-254 hardware assurance coverage against the assigned hardware assurance level
- DO-178C software verification coverage against the assigned software level
- DO-160G environmental coverage checked against the intended installation environment
- The qualified hardware and software configuration reconciled to the current build
- Reused or legacy qualification assessed for whether it meets the current levels and build
- Re-qualification or retest items scoped where coverage falls short
Scope this review
Tell us the asset, the event, and the evidence in scope, and we will outline a focused first engagement.
Identify what is missing against the means of compliance.
What gets validated
- DO-254 evidence meets every objective the assigned hardware assurance level requires
- Software verification coverage meets the objectives the assigned software level requires
- DO-160G coverage matches the intended installation environment, including engine-bay severity
- The qualified build matches the article's current hardware and software definition
- Any reused qualification is shown to meet the current levels and describe the current build
Evidence normally required
- The assigned hardware and software assurance levels and their basis
- The DO-254 hardware assurance data and the DO-178C verification data
- DO-160G environmental qualification results and test plan
- The current hardware and software configuration definition
- Any earlier qualification records proposed for reuse
Common discrepancies
- DO-254 evidence that meets a lower hardware assurance level than currently assigned
- Environmental coverage below the engine-bay severity the installation demands
- Qualification tied to a device revision the article has since superseded
- Reused software or hardware qualification whose original build differs from the current one
What is at stake
Hardware qualification short of the assigned level is slow to remedy, because complex electronic hardware evidence takes longer to regenerate than software, so a late finding lands hard on the schedule. Qualification tied to a superseded build can be entirely valid and still unusable, and an environmental category shortfall discovered inside a submission forces a retest at the worst time.
How the work runs
Fix the assigned levels
Take the hardware and software assurance levels the current safety assessment assigns as the measure for the qualification.
Inventory all three streams
Read out what the DO-254, DO-178C, and DO-160G evidence covers, at what level, for which build.
Test coverage against the measure
Compare each stream to its required level and to the current build, marking every shortfall.
Scope re-qualification
Define the re-qualification or retest needed to close the gaps, ordered by lead time and criticality.
What the buyer receives
- A qualification coverage assessment across the hardware, software, and environmental streams
- A list of assurance levels or configurations that fall short
- A scoped set of re-qualification or retest items to close the gaps
Who uses the output
- Certification engineers relying on engine-control qualification in a submission
- Hardware and software assurance leads planning any re-qualification the gaps require
- Program managers deciding whether reused qualification meets the current levels and build
How the work fits into the transaction or program
The review runs upstream of the engine-control TSO and STC work, both of which assume the qualification holds at its assigned levels for the current build. Confirming that here keeps a hardware or environmental shortfall from surfacing inside a submission, where complex hardware evidence is the slowest thing to regenerate.
Start with a single asset
Confirm requirements map to substantiating evidence.
Jurisdiction-specific considerations
FAA and EASA both recognize DO-254, DO-178C, and DO-160G, so the objectives align, but each authority differs in how it expects hardware assurance reuse to be justified. The assessment marks where a reuse argument acceptable to one authority will need strengthening for the other, especially on the DO-254 side.
Regulatory limits
The review assesses whether existing qualification meets the assigned levels and covers the build. It does not perform hardware assurance, software verification, or environmental testing, assign any level, or determine that the equipment is airworthy. It shows where coverage is short, not that the article passes.
What this review does not cover
- Executing DO-254 hardware assurance, software verification, or environmental testing
- Revising the article to match a prior qualification
- Assigning the assurance levels or approving the qualification evidence
Specific to this review
- Engine-control qualification is checked on three fronts at once, and the hardware assurance front is the slowest to remedy because DO-254 evidence cannot be regenerated as fast as software verification.
- Qualification tied to a superseded device revision is a frequent trap: the evidence is genuine but no longer describes the article being certified.
- Environmental coverage is often the quiet shortfall, because engine-bay severity exceeds the generic profile the original DO-160G plan was written against.
Sources
U.S. Government (eCFR). Type certificates, STCs (Subpart E), TSO authorizations (Subpart O), PMA (Subpart K), and export airworthiness approvals (Subpart L).
European Union / EASA. EASA design and production certification, STCs, ETSO authorizations, and EASA Form 1 release.
RTCA. Environmental qualification test categories and procedures referenced by TSO and equipment qualification.
RTCA. Objectives and lifecycle data for airborne software assurance, by design assurance level (DAL A-E).
Frequently asked questions
Can we reuse hardware qualification from a previous device?
Only where the previous device's assurance level and build match what the current program needs. Reuse fails when the earlier qualification meets a lower level or describes a superseded revision. The review checks both explicitly and scopes the re-qualification needed where the earlier evidence does not carry over.
Relevant glossary terms
Related pages
Where this fits
Talk to an engineer who has done this work
We will walk through your current state, the records or evidence involved, and a scoped first engagement.
Talk through the aircraft, records, evidence, deadline, and next useful step.