Safety Certification Standards

What is RTCA DO-178?

RTCA DO-178 is a set of avionics standards described in the Radio Technical Commission for Aeronautics (RTCA). Document RTCA DO-178, titled “Software Considerations in Airborne Systems and Equipment Certification,” was developed by the avionics industry to establish software considerations for developers, installers, and users when aircraft equipment design is implemented using microcomputer techniques.

The first formal publication of this specification was published in 1982 by the Radio Technical Commission for Aeronautics (RTCA). This was also approved by EUROCAE as ED-12 shortly thereafter.

An update to DO-178 was published in 1985 and was called DO-178A. EUROCAE also published a matching update to ED-12, named ED-12A.

In 1992, various industry working groups published a comprehensive update to DO-178A, named DO-178B by RTCA and ED-12B by EUROCAE.

Since the release of DO-178B, FAA Designated Engineering Representatives (DERs) requested additional clarification/refinement of the definitions and boundaries between the key DO-178B concepts of high-level requirements, low-level requirements, and derived requirements, along with a better definition of the exit/entry criteria between systems requirements and system design and that of software requirements and software design (which is the domain of DO-178B). Other concerns included the meaning of verification in a model-based development paradigm and considerations for replacing some or all software testing activities with model simulation or formal methods.

These issues created the demand for a new revision of the standard, DO-178C. Companion documents that addressed these issues were also released – ground systems guidance (DO-278A), certification rationale for each DO-178C objective (DO-248C), software tool qualification (DO-330), modeling (DO-331), use of object-oriented technologies (DO-332), and use of formal methods (DO-333). DO-178C also created a specific alignment with ARP4754A.

RTCA DO-178C (and EUROCAE ED-12C) is now the current working version of this standard.

For more information see RTCA DO-178C, Software Considerations in Airborne Systems and Equipment Certification, December 2011, https://my.rtca.org/NC__Product?id=a1B36000001IcmrEAC.

What is a DO-178C Design Assurance Level (DAL)?

DO-178C Design Assurance Levels (DAL) based upon the potential of the software to cause safety-related failures identified in the system safety assessment. DO-178C has five DAL levels, also known as Criticality Levels:

Catastrophic – Failure may cause deaths, usually with the loss of the airplane.
Hazardous – Failure has a large negative impact on safety or performance or reduces the ability of the crew to operate the aircraft due to physical distress or a higher workload, or causes serious or fatal injuries among the passengers.
Major – Failure significantly reduces the safety margin or significantly increases crew workload. May result in passenger discomfort (or even minor injuries).
Minor – Failure slightly reduces the safety margin or slightly increases crew workload. Examples might include causing passenger inconvenience or a routine flight plan change.
No Effect – Failure has no impact on safety, aircraft operation, or crew workload.

Achieving a particular DAL level requires the completion of a number of specific objectives described in DO-178C, and some of these objectives require independent review outside of the software development team that wrote the software.
The number of DO-178C objectives for each DAL level is detailed in the table below:

DO-178C DAL	Failure Condition	Number Of Objectives	Objective with Independence
A	Catastrophic	71	30
B	Hazardous	69	18
C	Major	62	5
D	Minor	26	2
E	No Safety Effect	0	0

Who determines which DO-178C level is required?

The level to which a particular system must be certified is selected by a process of failure analysis and input from the device manufacturers and the certifying authority (FAA, EASA, Transport Canada, and more), with the final decision made by the certifying authority.

Note that software does not need to be certified specifically at each designated level. Software certified at DAL A can be used in any avionics application, but in most cases, it is not feasible to do this from a time, budget, and program risk standpoint. Therefore, most complex avionics environments use a robust partitioning avionics environment like ARINC 653 that enables the independent testing of avionics applications on a shared computer environment.

Which systems need to be certified under DO-178C?

Under the Global Aviation Traffic Management (GATM) agreement, all commercial airborne systems must comply with Federal Aviation Administration (FAA) regulations for avionics and require DO-178C certification. In addition, all airborne military and space systems must also comply with DO-178C. All retrofits, as well as new airborne system designs, also require DO-178C certification. Note that GATM has international validity and applicability.

For more information, see RTCA DO-178C, Software Considerations in Airborne Systems and Equipment Certification, December 2011, https://my.rtca.org/NC__Product?id=a1B36000001IcmrEAC

What is DO-248C?

RTCA DO-248C, “Supporting Information for DO-178C and DO-278A”, is a collection of Frequently Asked Questions (FAQs) and Discussion Papers addressing applications of DO-278C and DO-278Like DO-178C and DO-278A, it is a joint RTCA undertaking with EUROCAE, where the document is also published as ED-94C, “Supporting Information for ED-12C and ED-109A”. These publications do not provide any additional guidance for DO-178C or DO-278A; rather, they only provide clarification for the guidance established in those standards.

my.rtca.org/productdetails?id=a1B36000001IcjlEAC

What is DO-254?

RTCA DO-254 and EUROCAE ED-80, “Design Assurance Guidance for Airborne Electronic Hardware,” are documents providing guidance for the development of airborne electronic hardware. Items such as Line Replaceable Units (LRUs), circuit boards, commercial-off-the-shelf (COTS) hardware components, microcoded components like field programmable gate arrays (FPGA, programmable logic devices (PLDs), application-specific integrated circuits (ASICs), and multi-chip modules.

DO-254/ED-80 establishes objectives and activities for the systematic design assurance of complex electronic hardware and is the counterpart to RTCA DO-178C and EUROCAE ED-12C).

my.rtca.org/productdetails?id=a1B36000001IcjTEAS

What is DO-278?

RTCA DO-278A, “Software Integrity Assurance Considerations for Communication, Navigation, Surveillance, and Air Traffic Management (CNS/ATM) Systems,” is a document that provides guidelines for the assurance of software contained in non-airborne (ground) CNS/ATM systems and provides recommendations to produce that software commensurate with a level of confidence in safety. DO-278A defines a set of objectives recommended for establishing assurance that the developed CNS/ATM software has the integrity needed for use in a safety-related application.

my.rtca.org/productdetails?id=a1B36000001IciGEAS

What is DO-330?

RTCA DO-330 and EUROCAE ED-215, “Software Tool Qualification Considerations,” provide tool qualification guidance for building airborne and ground-based software that is achieving safety certification using RTCA DO-178C, DO-254 and DO-278A safety certification guidance. DO-330 describes five Tool Qualification Levels (TQL) categories, TQL-1 to TQL-5, and the required tool qualification objectives that must be satisfied. TQL-5 is the least rigorous, TQL-1 is the most rigorous, and accelerates and/or eliminates the highest number of DO-178C objectives. DO-330 tool qualification criteria may also be applied in other industry safety domains such as automotive/autonomous, space systems, electronic systems, and other environments requiring rigorous safety processes.
A sample of software companies that provide DO-330 qualified tools is:

AdaCore : www.adacore.com
Ansys : www.ansys.com
DDC-I: www.ddci.com
LDRA: www.ldra.com
MathWorks: www.mathworks.com
Presagis: www.presagis.com
QA Systems -- Cantata: www.qa-ystems.com/tools/cantata/
Rapita Systems: www.rapitasystems.com
Vector: www.vector.com
Verocel: www.verocel.com/tools/
Wind River Systems: www.windriver.com/

What is DO-331?

RTCA DO-331 and EUROCAE ED-218, “Model-Based Development and Verification Supplement to DO-178C and DO-278A,” are definitions of the set of objectives, activities, explanatory text, and software life cycle data that should be addressed when model-based development and verification tools are used as part of the software life cycle. This complements RTCA DO-178C and DO-278A safety certification guidance.
A sample of software companies that provide DO-331 tools is:

Ansys: www.ansys.com
MathWorks: www.mathworks.com
Presagis: www.presagis.com

What is DO-332?

What is DO-333?

What is SAE ARP 4654B?

SAE Aerospace Recommended Practice (ARP) 4754B, Guidelines for Development of Civil Aircraft and Systems, provides recommendations for the development of aircraft and systems, including aircraft functions and operating environment. It provides practices for ensuring the safety of the overall aircraft design, showing compliance with regulations, and assisting a company in developing and meeting its own internal standards. These practices include validation of requirements and verification of the design implementation for safety, certification, and product assurance.

www.sae.org/standards/content/arp4754b/

What is FDA 501(k)?

FDA Section 510(k), or Premarket Notification (or PMN), of the Food, Drug, and Cosmetic Act requires device manufacturers to register and/or notify the FDA at least 90 days in advance of their intent to market a medical device. Specifically, medical device manufacturers are required to submit 501(k) premarket notifications if they intend to introduce a device into commercial distribution for the first time or reintroduce a device that will be significantly changed or modified to the extent that its safety or effectiveness could be affected. The safety implications are like FAA requirements, where life-critical devices and/or safety-critical devices are required to have a prudent design, code, and test/QA strategy to produce a product that is safe to use.

What is IEC 61508?

IEC 61508 was developed to create a standard for the functional safety of electrical/electronic/programmable electronic safety-related systems. The documentation requirements of IEC 61508 are similar to DO-178C/ED-12C but tend to lean more heavily on design, usage, and manufacturing due to the standalone component capabilities available with this certification. One of the most critical documents is the Safety Manual, which contains the rules and guidelines on how to use the software component in a system that is certified.

The IEC has a great FAQ at: https://www.iec.ch/functional-safety/faq.