U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: Airborne Software Development Assurance Using EUROCAE ED-12( ) and RTCA DO-178( ) Date: 07/21/2017 Initiated by: AIR-134 AC No: 20-115D Change:
1. Purpose of this Advisory Circular (AC).
a. This AC describes an acceptable means, but not the only means, for showing compliance with the applicable airworthiness regulations for the software aspects of airborne systems and equipment in type certification or TSO authorization. This AC is not mandatory and does not constitute a regulation. However, if you use the means described in the AC, you must follow it in all applicable respects.
b. This AC recognizes the following current EUROCAE and RTCA, Inc. documents:
(1) EUROCAE ED-12C, Software Considerations in Airborne Systems and Equipment Certification, dated January 2012, and RTCA DO-178C, Software Considerations in Airborne Systems and Equipment Certification, dated December 13, 2011.
(2) EUROCAE ED-215, Software Tool Qualification Considerations, dated January 2012, and RTCA DO-330, Software Tool Qualification Considerations, dated December 13, 2011.
(3) EUROCAE ED-218, Model-Based Development and Verification Supplement to ED- 12C and ED-109A, dated January 2012, and RTCA DO-331, Model-Based Development and Verification Supplement to DO-178C and DO-278A, dated December 13, 2011.
(4) EUROCAE ED-217, Object-Oriented Technology and Related Techniques Supplement to ED-12C and ED-109A, dated January 2012, and RTCA DO-332, Object-Oriented Technology and Related Techniques Supplement to DO-178C and DO-278A, dated December 13, 2011.
(5) EUROCAE ED-216, Formal Methods Supplement to ED-12C and ED-109A, dated January 2012 and RTCA DO-333, Formal Methods Supplement to DO-178C and DO-278A, dated December 13, 2011.
Note: EUROCAE ED is hereafter referred to as ED; RTCA DO is hereafter referred to as DO. Where the notation ED-XXX/DO-XXX appears in this document, the referenced documents are recognized as being equivalent.
c. This AC identifies the following as supporting documents: ED-94C, Supporting Information for ED-12C and ED-109A and DO-248C, Supporting Information for DO-178C and DO-278A. ED-94C/DO-248C contains a collection of frequently asked questions (FAQs) and discussion papers (DPs) compiled and approved by the authors of ED-12C and DO-178C to provide clarification of the guidance contained in ED-12C/DO-178C.
d. References to use of ED-12C/DO-178C in this AC include use of ED-215/DO-330 and supplements ED-218/DO-331, ED-217/DO-332, and ED-216/DO-333, as applicable.
e. This AC establishes guidance for using existing ED-12B/DO-178B processes for new development.
f. This AC also establishes guidance for transitioning to ED-12C/DO-178C when making modifications to software previously approved using ED-12/DO-178, ED-12A/DO-178A, or ED- 12B/DO-178B.
2. Applicability. We wrote this AC for applicants, design approval holders, and developers of airborne systems and equipment containing software to be installed on type certificated aircraft, engines, and propellers, or to be used in TSO articles.
3. Cancellation. This AC cancels AC 20-115C, Airborne Software Assurance, dated July 19, 2013.
4. Background.
a. ED-12C/DO-178C, Appendix A, section 3, provides a summary of the differences between ED-12C/DO-178C and ED-12B/DO-178B. The EUROCAE and RTCA, Inc.
documents identified in subparagraph 1.b. of this AC provide guidance for establishing software life cycle planning, development, verification, configuration management, quality assurance and certification liaison processes to be used in development of software for airborne systems. The guidance provided in these documents is in the form of:
(1) Objectives for software life cycle processes;
(2) Activities that provide a means for satisfying the objectives; and
(3) Descriptions of the evidence that indicate that the objectives have been satisfied.
b. The technical content of this AC is as far as practicable harmonized with European Aviation Safety Agency (EASA) AMC 20-115D, equally based on ED-12C/DO-178C.
5. Using ED-12B/DO-178B Processes and Procedures for New Development.
a. Applicants who have established software development assurance processes using ED- 12B/DO-178B may continue to use those processes (including tool qualification processes) for new software development and certification projects, provided the following criteria are met:
(1) The software development assurance processes can be shown to have no known process deficiencies, such as those discovered during internal or external audits or reviews, or identified in open problem report(s) resulting in non-satisfaction to one or more ED-12B/DO- 178B objectives. Evidence of resolution and closure of all process-related open problem reports and of all process-related audit or review findings may be requested.
(2) The processes were previously used to develop software that was used in a certified product at a software level at least as high as the software level of the software to be developed.
(3) If model-based development, object-oriented technology, or formal methods will be used, existing processes incorporating these methods were evaluated and found to be acceptable by the FAA on a previous certified project. These processes should have been developed in accordance with FAA guidance specific to the technique, such as that contained in an associated issue paper or a published AC.
(4) If using configuration data, as defined under “Parameter Data Item” in ED-12C/DO- 178C, existing processes for such data have been evaluated and found to be acceptable by the FAA on a previous certified project. In the absence of processes for using configuration data, the applicant should establish new processes for using parameter data items in accordance with ED- 12C/DO-178C.
(5) There are no significant changes to the software processes described in the plans or to the software development environment. This should be supported through analysis of changes to the previously accepted software development processes and environment.
(6) You do not intend to declare the proposed software as having satisfied ED-12C/DO- 178C.
b. If the criteria of subparagraph 5.a. are not met, you should upgrade your processes and develop the new software using ED-12C/DO-178C; tool qualification processes should be addressed in accordance with section 12.2 of ED-12C/DO-178C and paragraph 10.c of this AC.
c. Applicants or developers who are establishing new software life cycle processes should do so in accordance with ED-12C/DO-178C.
6. Using EUROCAE ED-12C and RTCA DO-178C. ED-12C/DO-178C is an acceptable means of compliance for the software aspects of type certification or TSO authorization. When you use ED-12C/DO-178C:
a. You should satisfy all of the objectives associated with the software level assigned to the software and develop all of the associated life cycle data demonstrating satisfaction of the applicable objectives, as listed in the ED-12C/DO-178C Annex A tables and, where applicable, the ED-215/DO-330, ED-216/DO-333, ED-217/DO-332, and ED-218/DO-331 Annex A tables.
You should plan and execute activities that will satisfy each objective. If the FAA chooses not to be involved in the certification liaison process, you can consider the certification liaison process objectives and activities to be satisfied after you have produced the life cycle data specified in Table(s) A-10 of ED-12C/DO-178C, ED-215/DO-330, and supplements, as applicable.
b. You should submit the life cycle data specified in section 9.3 of ED-12C/DO-178C and section 9.0.a of ED-215/DO-330, as applicable for tool qualification, to the appropriate project certification office. It is your responsibility to perform the planned activities and produce the life cycle data necessary to satisfy all applicable objectives.
c. Section 9.4 of ED-12C/DO-178C specifies the software life cycle data related to the type design of the certified product. However, not all of the specified data applies to all software levels; specifically Design Description and Source Code are not part of the type design data for Level D.
d. You should make available to us, upon request, any of the data described in section 11 of ED-12C/DO-178C, applicable tool qualification data, data outputs from any applicable supplements, and any other data needed to substantiate satisfaction of all applicable objectives.
e. The FAA may publish an acceptable means of compliance for specific regulations, stating the required relationship between the criticality of the software-based systems and the software levels as defined in ED-12C/DO-178C. Such acceptable means of compliance will take precedence over the application of section 2.3 of ED-12C/DO-178C.
7. Reserved.
8. Guidance applicable to ED-12B/DO-178B or ED-12C/DO-178C.
a. Use of Supplements with ED-12C/DO-178C. You should apply the guidance of supplements ED-218/DO-331, ED-217/DO-332, and ED-216/DO-333 when incorporating the addressed software development techniques. If you intend to use multiple software development techniques together, more than one supplement applies. You cannot use supplements as standalone documents.
(1) When using one or more supplements, your Plan for Software Aspects of Certification (PSAC) should describe:
(a) How you will apply ED-12C/DO-178C and the supplement(s) together.
(b) How you will address the applicable ED-12C/DO-178C objectives and those added or modified by the supplement(s), which objectives from which documents apply to which software components, and how your planned activities will satisfy all the applicable objectives.
(2) If you intend to use any techniques addressed by the supplements to develop a qualified tool, (for tool qualification levels (TQLs) 1, 2, 3, and 4 only), then the Tool Qualification Plan should describe:
(a) Based on supplement analysis, which tool qualification objectives are impacted by the use of the technique(s).
(b) How the planned activities will satisfy the added or modified objectives.
(3) The intent of this subparagraph is to provide clarification of section MB.6.8.1 of ED- 218/DO-331. If you are using models as defined in section MB.1.0 of ED-218/DO-331 as the basis for developing software, you should apply the guidance in ED-218/DO-331. When applying section MB.6.8.1 of ED-218/DO-331, you should:
(a) Identify what reviews and analyses objectives are planned to be satisfied by simulation alone or in combination with reviews and analyses; all other objectives should be satisfied by reviews and analyses as described in section MB.6.3 of ED-218/DO-331.
(b) For each identified objective, justify in detail, how the simulation activity, alone or in combination with reviews and analyses, fully satisfies the specific reviews and analyses objective.
b. Guidance for Field Loadable Software (FLS). This section supplements ED-12C/DO- 178C and ED-12B/DO-178B. Use this guidance in addition to ED-12C/DO-178C and ED- 12B/DO-178B when using FLS in your project.
(1) As the developer, you should provide the necessary information to support the system-level guidance identified in items a, b, c and d of ED-12C/DO-178C section 2.5.5; and items a, b, c and d of ED-12B/DO-178B section 2.5.
(2) The FLS should be protected against corruption or partial loading to an integrity level appropriate for the software level of the FLS.
(3) The FLS part number, when loaded in the airborne equipment, should be verifiable by appropriate means.
(4) Protection mechanisms should be implemented to prevent inadvertent enabling of the field loading function during flight or any other safety-critical phase.
c. Guidance for User Modifiable Software (UMS). This section supplements ED- 12C/DO-178C and ED-12B/DO-178B. You should use this guidance in addition to ED-12C/DO- 178C and ED-12B/DO-178B when using UMS in your project.
(1) As the developer, you should provide the necessary information to support systemlevel guidance identified in items a, b, c and f of ED-12C/DO-178C section 2.5.2; and items a and b of ED-12B/DO-178B section 2.4.
(2) The modifiable part of the component should be developed to a software level at least as high as the software level assigned to that software.
9. Modifying and Re-using Software Approved using ED-12/DO-178, ED-12A/DO-178A, or ED-12B/DO-178B.
a. We previously approved the software for many airborne systems using ED-12/DO-178, ED-12A/DO-178A, or ED-12B/DO-178B as a means of compliance. In this AC, reference to legacy software includes the previously approved software or a component(s) that makes up the software used in legacy systems. In this subparagraph, we describe how to demonstrate
6 compliance with the software aspects of certification for an application that includes modifications to legacy software or use of unmodified legacy software.
b. Figure 1 presents a flow chart for using legacy software. Use the flow chart while following the procedures in this subparagraph if you are modifying or re-using legacy software.
Although these procedures will apply to the majority of projects, you should coordinate situations that do not follow this flow with the certification office.
7 Figure 1 - Legacy Software Process Flow Chart Is the legacy system software to be modified?
See 9.b.(3) Is the DO-178B software level acceptable?
See 9.b.(2) Yes No Is the software developed using DO-178B?
See 9.b.(2) Yes No Correct process deficiencies and document plan for resolving related software deficiencies.
See 9.b.(1) Evaluate software usage history, SDs, ADs, OPRs, etc.
See 9.b.(1) Is the software usage history acceptable?
See 9.b.(1) No Yes Yes No Yes No Have the software plans and environment been properly maintained?
See 9.b.(7)(b) Yes No Do you want to declare equivalence to DO-178C?
See 9.b.(7)(c) Is the DO-178 or DO-178A software level acceptable?
See 9.b.(2) No Yes Upgrade software baseline including all processes & procedures using DO-178B or use DO-178C and DO-330.
See 9.b.(2)(c) Conduct Change Impact Analysis See 9.b(4) If MBD, OOT, or FM will be used, do processes support the technique IAW applicable guidance?
See 9.b.(7)(a) Intent to use software previously shown to satisfy DO-178, DO-178A, or DO-178B Change software and associated life cycle data using the same DO-178( ) version as the original approval. For configuration data / PDI, use approved process or establish new process using DO-178C.
See 9.b.(8)(a) & (b) Change software and associated life cycle data using DO-178C, Section 12.1, and applicable supplements.
See 9.b.(6) & (9) Will there be new software tools or changes to tools?
See 9.b.(5) Determine tool qualification requirements.
See paragraph 10.
Yes No Upgrade software baseline including all processes & procedures using DO-178C and DO-330.
See 9.b.(2)(a) or (b) Did you upgrade the software baseline to DO-178C IAW paragraph
9.b.(2)(a),(b),or(c)?
See 9.b.(6) Yes No Acronyms ADs – Airworthiness Directives FM – Formal Methods IAW – In Accordance With MBD – Model-Based Development OOT – Object Oriented Technology OPRs – Open Problem Reports PDI – Parameter Data Item SDs – Service Difficulties Original approval basis or baseline upgrade to DO-178C acceptable as approval basis.
See 9.b.(3)(a) or (b) Upgrade software baseline including all processes & procedures using DO-178C and DO-330.
See 9.b.(9) Yes No Note: References to EUROCAE documents are intentionally omitted for formatting purposes.
(1) Assess the legacy software to be modified or re-used for its usage history from previous installations. If the software has safety-related service difficulties, airworthiness directives, or open problem reports with a potential safety impact on the proposed installation, establish plans to resolve all related software deficiencies. Prior to modifying or reusing the legacy software, correct any related development process deficiencies, such as those discovered during internal or external audits or reviews, or identified in open problem report(s) resulting in non-satisfaction to one or more ED-12B/DO-178B objectives. Evidence of resolution and closure of all process-related open problem reports and of all process-related audit or review findings may be requested.
(2) The system safety process assigns the minimum development assurance level based on the severity classifications of failure conditions for a given function. The ED-12B/DO-178B software levels are consistent with the ED-12C/DO-178C software levels. However, ED-12/DO- 178 and ED-12A/DO-178A were published prior to establishment of the levels addressed in ED- 12B/DO-178B and ED-12C/DO-178C. Use Table 1 to determine if your legacy software level satisfies the software level assigned by the system safety process for the proposed installation. A “” in the intersection of the row and column indicates that the legacy software level is acceptable. For example, legacy software with development assurance to ED-12A/DO-178A Level 2 can be considered to satisfy software Levels B, C, and D. A blank indicates that the software level is not acceptable. Therefore, the ED-12A/DO-178A software developed to Level 2 would not be acceptable where software Level A is required.
Table 1 – Software Level Relationships Assigned Software Level Legacy Software Level per ED-12B/ DO-178B Legacy Software Level per ED-12A/ DO-178A Legacy Software Level per ED-12/DO-178 A B C D 1 2 3 Critical Essential Non-Essential A B C D
(a) If your legacy software was developed to software Level Essential using ED- 12/DO-178 and was previously accepted by the certification authority as acceptable for software Level B, it remains acceptable for the new project. If the ED-12/DO-178 legacy software was not previously assessed, or the software level is not acceptable, upgrade the software development baseline, including all processes and procedures (including tool qualification processes), using section 12.1.4 of ED-12C/DO-178C, and ED-215/DO-330.
(b) If your legacy software was developed using ED-12A/DO-178A, and the software level is not acceptable, upgrade the software development baseline, including all
9 processes and procedures (including tool qualification processes), using section 12.1.4 of ED- 12C/DO-178C, and ED-215/DO-330.
(c) If your legacy software was developed using ED-12B/DO-178B, and the software level is not acceptable, upgrade the software development baseline, including all processes and procedures (including tool qualification processes), using section 12.1.4 of ED- 12B/DO-178B or ED-12C/DO-178C and ED-215/DO-330.
(3) If the criteria in subparagraphs 9(b)(1) and 9(b)(2) are satisfied and modifications to the software are not required, then:
(a) The original approval may serve as the basis for the software in the installation approval of the proposed system.
(b) If you upgraded the software development baseline using ED-12C/DO-178C and updated all processes and procedures, including tool qualification processes, to ED-12C/DO- 178C and ED-215/DO-330, then you may declare your software as equivalent to satisfying ED- 12C/DO-178C. However, you cannot declare your unmodified tools as equivalent to having satisfied ED-12C/DO-178C and ED-215/DO-330. All subsequent modifications to all your software and tools are to be made using your processes and procedures that satisfy ED-12C/DO- 178C and ED-215/DO-330.
(4) If modifications to the software are required, conduct a software change impact analysis (CIA) to determine the extent of the modifications, the impact of those modifications, and what verification is required to ensure that the modified software performs its intended function and continues to satisfy the identified means of compliance.
(a) Identify the software changes to be incorporated and perform a CIA consisting of one or more analyses associated with the software change as identified in section 12.1of ED- 12C/DO-178C;
(b) Conduct the verification as indicated by the CIA; and
(c) Summarize the results of the CIA in the Plan for Software Aspects of Certification (PSAC) or in the Software Accomplishment Summary (SAS).
(5) If new software tools or modifications to tools are needed, refer to paragraph 10 of this AC to determine tool qualification requirements.
(6) If you upgraded the software baseline to ED-12C/DO-178C in accordance with subparagraph 9.b.(2), make all modifications to the software using section 12.1.of ED-12C/DO- 178C. If you want to declare your software as equivalent to satisfying ED-12C/DO-178C, your equivalence declaration applies to both modified and unmodified software and is valid even if you use unmodified tools that have not been qualified using ED-12C/DO-178C. However, you cannot declare your unmodified tools as equivalent to having satisfied ED-12C/DO-178C and ED-215/DO-330. All subsequent modifications to all your software and tools are to be made using your processes and procedures that satisfy ED-12C/DO-178C and ED-215/DO-330.
(7) If you want to use your existing processes to make modifications to your legacy software using the version of ED-12( )/DO-178( ) (i.e., ED-12/DO-178, ED-12A/DO-178A, or ED-12B/DO-178B) that was used for the original software approval, you may do so provided all of the following conditions are met:
(a) If model-based development, object-oriented technology, or formal methods will be used, existing processes incorporating these methods were evaluated and found to be acceptable by the FAA on a previous certified project. These processes should have been developed in accordance with the FAA guidance specific to the technique, such as that contained in associated issue paper or published advisory circular.
(b) You have maintained, and can still use, the software plans, processes, and life cycle environment, including improvements to processes or to the life cycle environment as captured in revised plans.
(c) You do not intend to declare the proposed software as having satisfied ED- 12C/DO-178C.
(8) If the conditions in subparagraph 9.b.(7) are satisfied:
(a) You may accomplish all modifications to the software using the same ED-12()/ DO-178( ) version as the original approval. However, you may not declare your software as equivalent to satisfying ED-12C/DO-178C.
(b) If using configuration data, as defined under “Parameter Data Item” in ED- 12C/DO-178C, you may use existing processes for such data if the processes were evaluated and found to be acceptable by the FAA on a previous project. In the absence of processes for using configuration data, you should establish new processes for using parameter data items in accordance with ED-12C/DO-178C.
(9) If any of the conditions in subparagraph 9.b.(7) are not satisfied, update all your processes and procedures (including tool qualification processes), using ED-12C/DO-178C and ED-215/DO-330, and make all modifications to the software using section 12.1 of ED-12C/DO- 178C. If you want to declare your software as equivalent to satisfying ED-12C/DO-178C, your declaration applies to both modified and unmodified software and is valid even if you use unmodified tools that have not been qualified using ED-12C/DO-178C and ED-215/DO-330.
However, you cannot declare your unmodified tools as equivalent to having satisfied ED- 12C/DO-178C and ED-215/DO-330. All subsequent modifications to all your software and tools are to be made using your processes and procedures that satisfy ED-12C/DO-178C and ED- 215/DO-330.
10. Tool Qualification. Section 12.2 of ED-12C/DO-178C, and ED-215/DO-330 provide an acceptable method for tool qualification. ED-215/DO-330 contains its own complete set of objectives, activities, and life cycle data for tool qualification.
a. If your legacy software was previously approved using ED-12/DO-178 or ED-12A/DO- 178A, and you intend to use a new or modified tool for modifications to the legacy software, use the criteria of section 12.2 of ED-12C/DO-178C to determine if tool qualification is needed. If
11 you need to qualify the tool, use the software level assigned by the system safety assessment for determining the required Tool Qualification Level (TQL), and use ED-215/DO-330 for the applicable objectives, activities, and life cycle data. You may declare your qualified tool as having satisfied ED-215/DO-330 but not the legacy software as equivalent to having satisfied ED-12C/DO-178C.
b. If your legacy software was previously approved using ED-12B/DO-178B, and you do not intend to declare equivalence to satisfying ED-12C/DO-178C, you can either:
(1) Use your ED-12B/DO-178B tool qualification processes for qualifying new or modified tools in support of modifications to ED-12B/DO-178B legacy software, or
(2) Update your tool qualification processes and qualify the tool using ED 215/DO-330;
use Table 2 of this document for determining the required TQL. You may then declare your qualified tool as having satisfied ED-215/DO-330.
c. If your legacy software was previously approved using ED-12B/DO-178B, you intend to declare equivalence to satisfying ED-12C/DO-178C, and you have ED-12B/DO-178B legacy tools that need to be qualified, follow the guidance of this subparagraph.
(1) ED-12C/DO-178C establishes five levels of tool qualification based on the tool use and its potential impact in the software life cycle processes (see section 12.2.2 and Table 12-1 of ED-12C/DO-178C). However, ED-12C/DO-178C does not address the use of tools previously qualified to the ED-12B/DO-178B criteria. For a tool previously qualified as a ED-12B/DO- 178B development tool or verification tool, use Table 2 (below) to determine the correlation between the ED-12B/DO-178B tool qualification type and ED-12C/DO-178C tool criteria and tool qualification levels (TQLs).
Table 2 - Correlation Between ED-12B/DO-178B Tool Qualification Type and ED-12C/DO-178C Tool Criteria and TQL ED-12B/ DO-178B Tool Qualification Type Software Level ED-12C/ DO-178C Tool Criteria ED-12C/ED-215 DO-178C/DO-330 TQL Development A 1 TQL-1 Development B 1 TQL-2 Development C 1 TQL-3 Development D 1 TQL-4 Verification A, B 2 TQL-4 Verification C, D 2 TQL-5 Verification All 3 TQL-5
(2) Development Tools Previously Qualified Using ED-12B/DO-178B.
(a) If the ED-12B/DO-178B software level assigned to the tool correlates with or exceeds the required TQL established by ED-12C/DO-178C, you may continue to use your ED- 12B/DO-178B tool qualification processes. If there are changes to the tool’s operational environment or to the tool itself, then you should conduct a tool change impact analysis according to sections 11.2.2 or 11.2.3 of ED-215/DO-330, respectively, and perform changes using your ED-12B/DO-178B tool qualification processes.
(b) If the ED-12B/DO-178B software level assigned to the tool does not satisfy the required TQL, you should update your tool qualification processes and requalify the tool using ED-215/DO-330.
(c) You may declare your tool as equivalent to having satisfied ED-215/DO-330 if all changes to the tool and your tool qualification processes satisfy ED-215/DO-330.
(3) Verification Tools Previously Qualified Using ED-12B/DO-178B.
(a) If TQL-5 is the required tool qualification level, and your verification tool was previously qualified using ED-12B/DO-178B:
(i) You may continue to use your ED-12B/DO-178B tool qualification process.
(ii) If there are changes to the tool or the tool’s operational environment, you should conduct a tool change impact analysis and reverify the tool using your ED-12B/DO-178B tool qualification processes or requalify the tool using ED-215/DO-330.
(b) If TQL-4 is the required tool qualification level, then you should requalify your verification tool using ED-215/DO-330.
(c) You may declare your tool as equivalent to having satisfied ED-215/DO-330 if all changes to the tool (if applicable) and your tool qualification processes satisfy ED-215/DO-
330.
11. Related Regulatory, Advisory, and Industry Material.
a. 14 CFR Applicable Sections. 14 CFR parts 21, 23, 25, 27, 29, 33, and 35.
b. FAA Advisory Circulars (ACs).
(1) AC 20-170, Integrated Modular Avionics Development, Verification, Integration and Approval using RTCA DO-297 and Technical Standard Order C-153.
(2) AC 20-171, Alternatives to RTCA/DO-178B for Software in Airborne Systems and Equipment.
(3) AC 20-174, Development of Civil Aircraft and Systems.
(4) AC 21-50, Installation of TSOA Articles and LODA Appliances.