DO-178C

Software Considerations in Airborne Systems and Equipment Certification
Latest version January 5, 2012 (2012-01-05)
Organization
Domain Aviation
Abbreviation
  • DO-178C
  • ED-12C

DO-178C, Software Considerations in Airborne Systems and Equipment Certification is the primary document by which the certification authorities such as FAA, EASA and Transport Canada approve all commercial software-based aerospace systems. The document is published by RTCA, Incorporated, in a joint effort with EUROCAE, and replaces DO-178B. The new document is called DO-178C/ED-12C and was completed in November 2011 and approved by the RTCA in December 2011. It became available for sale and use in January 2012.[1][2][3]

The FAA approved AC 20-115C[4] on 19 Jul 2013, making DO-178C a recognized "acceptable means, but not the only means, for showing compliance with the applicable airworthiness regulations for the software aspects of airborne systems and equipment certification."

Background

Since the release of DO-178B, there have been strong calls by DERs (FAA Designated Engineering Representatives) for clarification/refinement of the definitions and boundaries between the key DO-178B concepts of high-level requirements, low-level requirements, and derived requirements and a better definition of the exit/entry criteria between systems requirements and system design (see ARP4754) and that of software requirements and software design (which is the domain of DO-178B). Other topics such as what does verification mean in a model-based development paradigm and can model simulation or formal methods replace some or all software testing activities. The release of DO-178C and the companion documents DO-278A (Ground Systems), DO-248C (Additional information with rationale for each DO-178C objective), DO-330 (Tool Qualification), DO-331 (Modeling), DO-332 (Object Oriented), and DO-333 (Formal Methods) were created to address the issues noted. The SC-205 members worked with the SAE S-18 committee to ensure that APR4754A and the above noted DO-xxx documents provide a unified and linked process with complementary criteria.

Overall, DO-178C keeps most of the DO-178B text, which has raised concerns that issues with DO-178B, such as the ambiguity about the concept of low-level requirements, may not be fully resolved.[5]

Committee organization

The RTCA/EUROCAE joint committee work was divided into seven Subgroups:

The Model Based Development and Verification subgroup (SG4), was the largest of the working groups. All work is collected and coordinated via a web-site that is a collaborative work management mechanism.[6] Working artifacts and draft documents were held in a restricted area available to group members only.

The work was focused on bringing DO-178B/ED-12B up to date with respect to current software development practices, tools, and technologies.[7][8]

Software level

The Software Level, also known as the Design Assurance Level (DAL) or Item Development Assurance Level (IDAL),[9] is determined from the safety assessment process and hazard analysis by examining the effects of a failure condition in the system. The failure conditions are categorized by their effects on the aircraft, crew, and passengers.

DO-178C alone is not intended to guarantee software safety aspects. Safety attributes in the design and as implemented as functionality must receive additional mandatory system safety tasks to drive and show objective evidence of meeting explicit safety requirements. The certification authorities require and DO-178C specifies the correct DAL be established using these comprehensive analyses methods to establish the software level A-E. "The software level establishes the rigor necessary to demonstrate compliance" with DO-178C.[9] Any software that commands, controls, and monitors safety-critical functions should receive the highest DAL - Level A.

The number of objectives to be satisfied (some with independence) is determined by the software level A-E. The phrase "with independence" refers to a separation of responsibilities where the objectivity of the verification and validation processes is ensured by virtue of their "independence" from the software development team. For objectives that must be satisfied with independence, the person verifying the item (such as a requirement or source code) may not be the person who authored the item and this separation must be clearly documented.[10]

Level Failure condition Objectives[11] With independence
A Catastrophic 71 33
B Hazardous 69 21
C Major 62 8
D Minor 26 5
E No Safety Effect 0 0

Traceability

Diagram illustrating the required tracing between certification artifacts, as required by the RTCA DO-178C standard. Red-colored traces are required only for Level A. Purple-colored traces are required for Levels A, B, and C. Green-colored traces are for Levels A, B, C, and D. Level E does not require any tracing. The references on each trace arrow represent references to the standard for the objective, the activity, and the review/verification, respectively.

DO-178 requires a documented connection (called a trace) between the certification artifacts. For example, a Low Level Requirement (LLR) traces up to a High Level Requirement (HLR). A traceability analysis is then used to ensure that each requirement is fulfilled by the source code, that each requirement is tested, that each line of source code has a purpose (is connected to a requirement), and so forth. Traceability ensures the system is complete. The rigor and detail of the certification artifacts is related to the software level.

Differences with DO-178B

SC-205 was responsible for revising DO-178B/ED-12B to bring it up to date with respect to current software development and verification technologies. The structure of the document remains largely the same from B to C. Example changes include:[12]

Guidelines vs. Guidance

DO-178B was not completely consistent in the use of the terms Guidelines and Guidance within the text. "Guidance" conveys a slightly stronger sense of obligation than "guidelines". As such, with the DO-178C, the SCWG has settled on the use of “guidance” for all the statements that are considered as "recommendations", replacing the remaining instances of "guidelines" with “supporting information” and using that phrase wherever the text is more "information" oriented than "recommendation" oriented.

The entire DO-248C/ED-94C document, "Supporting Information for DO-178C and DO-278A", falls into the “supporting information” category, not guidance.[16]

Sample difference between DO-178B and DO-178C

Chapter 6.1 defines the purpose for the software verification process. DO-178C adds the following statement about the Executable Object Code:

As a comparison, DO-178B states the following with regard to the Executable Object Code:

The additional clarification fills a gap that a software developer may encounter when interpreting the document.[17]

See also

References

  1. Timberlake Membership Software, 703-591-4232. "Rtca, Inc". Rtca.org. Retrieved 2016-08-07.
  2. Charlotte Adams (2010-09-01). "DO-178C nears finish line, with credit for modern tools and technologies". Avionics Intelligence. Retrieved 2010-10-23. The industry expects the final package DO-178C to be released in the first quarter of 2011 and be mandated six to nine months after ratification.
  3. "Summary of Difference Between DO-178B and DO-178C". FAA Consultants.com. Qualtech Consulting, Inc. Retrieved 2010-10-23. The release of these long anticipated standards will occur in mid 2011 and be recognized by the Certification Authorities in 2012.
  4. "Archived copy" (PDF). Archived from the original (PDF) on 3 September 2014. Retrieved 2013-08-08.
  5. Dale, Chris; Anderson, Tom, eds. (2010). Advances in systems safety : proceedings of the Nineteenth Safety-Critical Systems Symposium, Southampton, UK, 8-10th February 2011. London: Springer. pp. 298–299. ISBN 9780857291325.
  6. "Archived copy". Archived from the original on 19 July 2011. Retrieved 2010-09-18.
  7. Bill StClair & Tim King (2012-03-07). "DO-178C brings modern technology to safety-critical software development". Military Embedded Systems. Retrieved 2012-04-17.
  8. "DO-178C Enhances Safety-Critical Avionics Software Development". Electronic Design. Electronic Design. Retrieved 2012-04-17.
  9. 1 2 RTCA/DO-178C "Software Considerations in Airborne Systems and Equipment Certification", p. 116
  10. RTCA/DO-178C "Software Considerations in Airborne Systems and Equipment Certification", p. 41
  11. RTCA/DO-178C "Software Considerations in Airborne Systems and Equipment Certification", Annex A
  12. "HighRely Synopsis of National FAA Software and Hardware Meeting Includes DO-178C Status". 2006. Retrieved 30 September 2009. DO-178C will contain more details on software modeling and the potential ability to use modeling to supplant some of the verification techniques normally required in DO-178B. DO-178C will also more fully address OO (Object Oriented) software and the conditions under which it can be used and the certification ramifications of OO in DO-178C.
  13. RTCA/DO-178C Software Considerations in Airborne Systems and Equipment Certification. RTCA, Inc. 2011.
  14. Pothon, Frédéric, et al, (2012). DO-178C/ED-12C versus DO-178B/ED-12B Changes and Improvements (PDF). p. 49. Retrieved 2015-01-05.
  15. Pothon, pp. 43-46
  16. Pothon, p. 14
  17. "Archived copy". Archived from the original on 11 September 2014. Retrieved 2013-03-07.

External links

This article is issued from Wikipedia - version of the 12/4/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.