Sensor systems
Sensor systems certification data support
Sensor systems certification is the path a supplier follows to authorize an air-data, inertial, or environmental sensing article and substantiate that the measurement it produces is accurate and that a bad reading is caught. It is used by avionics and equipment teams whose unit senses a physical quantity that downstream systems trust. The data support covers the certification basis, the measurement-accuracy and fault-detection case, the environmental and exposure qualification, and the lifecycle data behind any embedded processing. You receive a gap read against the applicable standards and an evidence set arranged for review.
When this review is needed
- A sensing article is heading toward authorization and the accuracy and fault-detection case has to be built against the basis.
- A sensor changes its measurement range, exposure, or mounting and the qualification has to reflect it.
- Findings against undetected sensor error have stalled the program and need reconciling.
- A supplier wants an independent read of the sensor package before the basis is locked.
The problem
A sensor sits at the physical edge of the aircraft, so its case has to carry both measurement accuracy and the harsh exposure that comes with the mounting location. Accuracy is characterized at room conditions while the temperature, pressure, and icing extremes go lightly tested, the fault-detection that should catch a slowly drifting reading is weak, and the downstream systems consume the output as if it were always trustworthy. The exposure and drift gaps surface when a reviewer asks how a degrading sensor announces itself.
What gets reviewed
- The certification basis and the article authorization the sensor is pursued under
- The measurement-accuracy case across the sensor's full operating range
- The fault-detection case for drift, bias, and hard failure of the reading
- DO-160 environmental and exposure qualification for the mounting location
- Software lifecycle data for any embedded conditioning or compensation
- How downstream systems are told the reading is degraded or invalid
Scope this review
Tell us the asset, the event, and the evidence in scope, and we will outline a focused first engagement.
Identify what is missing against the means of compliance.
What gets validated
- Accuracy is shown across the full range and exposure, not at room conditions alone
- Fault detection catches drift and bias, not only a hard loss of signal
- DO-160 categories cover the exposure the mounting location actually sees
- Software lifecycle data matches the level an undetected-error hazard assigns
- The invalid-data signaling to downstream systems is specified and verified
Evidence normally required
- The draft or current certification basis for the sensor article
- The accuracy and fault-detection characterization to date
- DO-160 environmental and exposure test plans and reports so far
- Software lifecycle data for embedded conditioning at its current state
- Open findings or prior authority correspondence if a program is running
Common discrepancies
- Accuracy characterized at room conditions but not across temperature and exposure
- Fault detection that catches a hard failure but not a slow drift or bias
- Exposure qualification that does not match the harsh mounting the sensor sees
- Invalid-data signaling unspecified, so downstream systems trust a degraded reading
- Software level set for loss when the hazard is an undetected wrong measurement
What is at stake
A sensor whose fault-detection case is thin can feed a wrong reading into systems that trust it, so a finding here propagates outward. The rework touches both the hardware exposure case and the detection logic, the schedule slips, and the field-exposure testing is slow and costly to repeat.
How the work runs
Set the basis
Confirm the certification basis and the physical quantity the sensor is authorized to measure.
Span the exposure
Show accuracy across the full range and the temperature, pressure, and icing exposure the mounting imposes.
Catch the drift
Check the fault-detection covers slow drift and bias, not only a hard loss, and signals invalid data downstream.
Reconcile the case
Align the software level with the undetected-error hazard and deliver a prioritized closure list.
What the buyer receives
- A gap read against the applicable sensor-article authorization and standards
- A reconciled compliance matrix tied to the accuracy and fault-detection evidence
- A traceability view from sensor requirements through verification
- A prioritized list of the data needed to close the package
Who uses the output
- Certification leads building the sensor submittal
- Sensor engineers strengthening the drift and bias detection case
- Integration teams relying on the invalid-data signaling to downstream systems
How the work fits into the transaction or program
The work supports the supplier's sensor program and carries the exposure case the mounting location demands alongside the accuracy case. It feeds the systems that trust the reading with a defined invalid-data signal, and it sits upstream of a navigation read where the sensor supplies a position input.
Start with a single asset
Confirm requirements map to substantiating evidence.
Aircraft-specific considerations
An air-data probe on a fast jet meets very different temperature, pressure, and icing exposure than a cabin-pressure sensor in a conditioned bay, so the qualification profile follows the mounting on the specific airframe. The read keeps the exposure case tied to where the sensor actually lives rather than a generic category.
Regulatory limits
Endeavor Elements supports the applicant's sensor-article data. It does not grant an authorization, make accuracy or integrity findings for the authority, or warrant acceptance. The applicant submits and the authority decides.
What this review does not cover
- Granting an article authorization or design approval
- Making compliance findings on the authority's behalf
- Running the environmental and exposure testing itself
Specific to this review
- A sensor at the airframe edge has to carry an exposure case as demanding as its accuracy case, since temperature, pressure, and icing extremes come with the mounting.
- Slow drift is harder to detect than a hard failure, and weak drift-detection is a recurring gap because the reading still looks plausible.
- Downstream systems trust a sensor's output unless told otherwise, so the invalid-data signaling is part of the certification case rather than an integration detail.
Sources
U.S. Government (eCFR). Type certificates, STCs (Subpart E), TSO authorizations (Subpart O), PMA (Subpart K), and export airworthiness approvals (Subpart L).
RTCA. Environmental qualification test categories and procedures referenced by TSO and equipment qualification.
RTCA. Objectives and lifecycle data for airborne software assurance, by design assurance level (DAL A-E).
SAE International. Safety assessment methods (FHA, PSSA, SSA, FTA, FMEA) supporting development assurance level assignment.
Frequently asked questions
Why does drift detection matter more than detecting a hard failure?
A hard failure usually announces itself; a slow drift keeps producing a plausible reading the downstream systems trust. The read checks that the fault-detection catches drift and bias and that an invalid reading is signaled out.
Relevant glossary terms
Related pages
Where this fits
Talk to an engineer who has done this work
We will walk through your current state, the records or evidence involved, and a scoped first engagement.
Walk through your situation with an engineer who has done this work.