| Thermal | Operating junction temperature | Run the final PCB and enclosure at maximum rated ambient temperature, maximum clock frequency, and representative continuous workload for at least 4 hours. | Calculated junction temperature remains below the stated maximum, with at least 10°C design margin. | Peak estimated junction temperature: 91°C at 85°C ambient; 14°C margin to a 105°C limit. | Thermal report, thermocouple locations, workload definition, enclosure configuration, and junction-temperature calculation. | Pass |
| Thermal throttling | Repeat the maximum-load test while logging clock frequency, voltage, performance counters, and temperature at one-second intervals. | No unexpected throttling; any documented protection behavior must occur outside the product operating envelope. | No throttling during the 4-hour test; clock frequency remained within ±1% of the configured target. | Raw telemetry, firmware settings, test duration, and performance log. | Pass |
| Power consumption | Measure idle, typical, peak, and sleep-mode power on the production-intent board using calibrated equipment. | Peak power remains within the power-tree, regulator, connector, and enclosure budgets. | Typical: 1.8 W; peak: 3.9 W; sleep: 42 mW. Peak remained below the 5 W board budget. | Power analyzer export, supply voltage, workload script, and regulator temperature record. | Pass |
| Thermal cycling reliability | Cycle powered samples between -40°C and 85°C, using a controlled ramp and dwell profile appropriate to the product environment. | No functional loss, boot failure, package damage, or permanent parameter shift after the defined cycle count. | 10 pilot samples completed 100 cycles with no functional failures; visual inspection found no package cracking. | Chamber profile, sample traceability, electrical checks before and after cycling, and inspection record. | Pass |
| EMC and Signal Integrity | Radiated emissions | Perform pre-compliance scans in a semi-anechoic environment using the final clock plan, cable set, enclosure, and firmware workload. | At least 6 dB margin to the applicable emissions limit across the measured frequency range. | Worst-case margin: 7.4 dB at the dominant harmonic; no single narrowband peak exceeded the limit. | Detector settings, antenna factors, cable configuration, frequency plots, and calibration records. | Pass |
| Radiated immunity | Expose the powered product to the applicable field-strength levels while monitoring communications, watchdog events, resets, and data integrity. | No unsafe behavior, unrecoverable reset, corrupted persistent data, or loss of required function. | No reset or data corruption from 80 MHz to 1 GHz at 10 V/m; one recoverable communication retry occurred at 1.8 GHz. | Field-strength calibration, frequency sweep, error counters, application logs, and recovery analysis. | Conditional |
| Conducted emissions | Measure noise on power and communication cables with the intended filters, harness length, and external peripherals. | At least 6 dB margin to the applicable conducted-emissions limit over the specified frequency range. | Worst-case margin: 5.2 dB at 148 MHz; additional common-mode filtering is required before formal certification. | Line-impedance stabilization network data, filter bill of materials, cable layout, and corrected-design retest. | Conditional |
| High-speed interface integrity | Measure eye diagrams, setup and hold timing, insertion loss, and error rates on the fastest production interfaces at voltage and temperature corners. | Eye opening and timing meet the interface specification with at least 20% measured margin; no uncorrectable errors during stress testing. | Measured eye height: 286 mV against a 220 mV minimum; zero uncorrectable errors in a 24-hour traffic test. | Oscilloscope files, probe de-embedding data, traffic pattern, board stack-up, and temperature-corner results. | Pass |
| Security | Secure boot and firmware authentication | Attempt to boot unsigned, modified, downgraded, and incorrectly signed firmware images. | Only authenticated firmware executes; failed verification produces a controlled recovery path. | Unsigned and modified images were rejected; recovery image started only after signature verification. | Key hierarchy, signing procedure, boot-log captures, failed-image test records, and recovery instructions. | Pass |
| Debug-port protection | Probe production units through JTAG, SWD, UART, USB, and other exposed maintenance interfaces. | Debug access is disabled, authenticated, or physically controlled in the production configuration. | JTAG and SWD access disabled; authenticated service mode required for UART diagnostics. | Production fuse configuration, port-access test results, service authorization flow, and recovery policy. | Pass |
| Vulnerability and software inventory | Generate a software bill of materials and scan bootloader, operating system, drivers, libraries, and update tools. | Every shipped component has an owner, version, license, remediation process, and documented vulnerability disposition. | SBOM generated in SPDX format; two medium-severity findings assigned remediation dates before release. | Signed SBOM, scan report, patch policy, vulnerability-response SLA, and open-issue register. | Conditional |
| Secure update and key recovery | Test signed updates, interrupted updates, rollback prevention, key rotation, and recovery after power loss. | No bricking after interrupted update; rollback protection and key-revocation procedures operate as designed. | 20 interrupted-update tests completed without bricking; rollback blocked; key-rotation procedure requires final production approval. | Update logs, recovery images, anti-rollback counters, key-rotation runbook, and access-control review. | Conditional |
| 10-Year Availability | Product-life commitment | Obtain a written lifecycle statement covering production status, last-time-buy notice, and recommended successor path. | Supply commitment covers the required service period, with formal notification lead time defined in the purchasing agreement. | Written availability statement covers 10 years from planned production release; last-time-buy notice period: 12 months. | Signed lifecycle letter, notification terms, product-change-notification process, and approved successor mapping. | Conditional |
| Second-source and substitution risk | Review die, package, memory, power, and software dependencies; assess whether a substitute can be qualified without a PCB redesign. | Critical single-source risks have a mitigation plan, validated substitute, or sufficient strategic inventory. | Core processor remains single-source; compatible memory alternatives identified; processor substitution requires PCB and firmware requalification. | Dependency map, alternative-component assessment, qualification plan, and approved risk register. | Conditional |
| Supply continuity and allocation | Review capacity assumptions, standard lead time, minimum order quantity, NCNR terms, allocation policy, and historical delivery performance. | Lead time and order terms fit the production plan; supply interruption scenario has at least one practical mitigation. | Quoted lead time: 16 weeks; minimum order quantity: 2,000 units; buffer stock required for an 8-week demand spike. | Commercial quotation, capacity statement, delivery records, inventory model, and escalation contacts. | Conditional |
| Change control and qualification continuity | Examine the process for mask changes, package changes, process-node changes, firmware changes, and factory transfers. | Material or process changes require notification, impact assessment, sample approval, and regression testing before release. | Formal change-notification process available; notification lead time is 90 days; customer regression approval remains contract-dependent. | Change-control agreement, notification template, qualification matrix, sample requirements, and contract language. | Hold |
| Commercial and Final Gate | Pilot-to-PO readiness score | Combine thermal, EMC, security, reliability, lifecycle, and commercial evidence into a weighted review. | No unresolved safety or security blocker; all conditional items have owners and due dates; lifecycle terms are contractually controlled. | Weighted readiness score: 86/100. Technical pilot is acceptable, but change-control terms and security key-rotation approval remain open. | Signed design-review minutes, corrective-action register, final qualification plan, and purchase-order conditions. | Hold |