(d) Functions and features testing (for example, “functions” include things like GPS navigation, while “features” are parts of the system, such as a zoom-in button).
(e) BIT versus external test equipment (for example, an Instrument Landing System test set or a Traffic Alert and Collision Avoidance System test set) to assure correct interfacing.
(4) Environmental qualification tests requiring functional software should typically be performed as part of the system-level environmental qualification testing.
(5) Robustness testing to verify that the system responds correctly to abnormal conditions, such as corrupted or invalid data inputs, and to ensure that assumptions made during the safety assessment and system design are valid.
c. IMA System Integration Testing.
(1) This testing addresses the integration of all hardware elements, functional software, displays, controls, sensors, power sources, and other IMA system components representing the configuration intended for aircraft certification.
(2) Typically, the same issues are addressed as in the individual system testing, plus the addition of functional compatibility and interoperability among systems.
(3) Worst-case system testing or analysis should be performed to verify the performance of the functionality of the overall system (for example, data communication, throughput, design margins, cooling, and power consumption).
(4) HIRF testing should be performed as part of the system integration tests for systems whose failures may contribute to catastrophic or hazardous failure conditions for the aircraft or engine.
(5) Lightning testing should be performed as part of the system integration tests for systems whose failures may contribute to major, hazardous, or catastrophic failure conditions for the aircraft or engine.
(6) System integration testing provides another opportunity for human factors and flight crew interface evaluations. This enables timely identification of human factors and flight crew interface issues so that changes can be made with acceptable technical, schedule, and economic impacts. It allows for FAA evaluation of the design to instill confidence in the applicant’s design decisions and to potentially reduce certification risks.
(7) Integration testing should include evaluation of built-in-test functionality, fault isolation, detection and annunciation, and maintenance diagnostics. Integration testing should also be used to validate assumptions made in the aircraft level and IMA safety assessment, where possible.
(8) System testing should verify independence assumptions between or among functions supported by the IMA system, as documented in the SSA. Verification includes assurance that functions are not affected during malfunction and/or loss of other independent systems and hardware elements, including short-circuited power. Analysis to identify worst-case conditions may be used to minimize the testing effort. It is recommended that this testing be performed in the laboratory but may be performed as part of the aircraft ground test.
d. Aircraft Ground Testing.
(1) The applicant should submit a ground test plan. Hardware elements must be installed and software components loaded in the conformed configuration that represents the intended type design. Ground tests should evaluate the high temperature extremes and may evaluate the low temperature operating conditions.
(2) If system integration testing is not performed in a laboratory, then it must be performed on the aircraft.
(3) Typically, Electro-Magnetic Compatibility testing is performed during the aircraft ground tests.
(4) Some human factors and flight crew evaluations may be performed on the ground (for example, night lighting, equipment location, and hazardous system malfunctions).
(5) Ground testing should also include IMA system testing with simulated malfunctions or losses, where possible. This testing should verify that functions are not affected during malfunction and/or loss of other independent systems and hardware elements, including loss of power (for example, that none of the non-GPS IMA systems are affected by a GPS hardware module failure). These tests should be a subset of the integration testing addressed in paragraph 17c(8) above.
(6) Compliance of colors of advisories, cautions, and warnings with the regulations (such as 14 CFR § XX.1322) and applicable guidance of advisory materials (for example, AC 25-11). Portions of alerting system evaluation may be performed during flight-testing.
(7) Equipment cooling testing.
e. Aircraft Flight Testing. Hardware elements must be installed and software components loaded in the conformed configuration that represents the intended type design.
Situational awareness, human factors, and flight crew workload must be considered with respect to the certification requirements of the type design for both normal and abnormal operational requirements. Certain tests may not be able to be conducted during flight due to safety reasons and may be accomplished during ground testing or simulator testing, as agreed with the cognizant ACO. The fidelity of simulator testing must be commensurate with the complexity of the task and the degree of system integration at the aircraft level. The following areas of each Page 34
installation should be evaluated by flight testing for compliance with the applicable airworthiness regulations (for example, 14 CFR parts 23, 25, 27, or 29) and impact on crew workload:
(1) Evaluation of functions, features, and abnormal modes of the IMA system.
(2) Evaluation of flight crew situational awareness of selected/deselected systems/modes during normal and degraded system scenarios.
(3) Evaluation of the crew alerting system(s).
(4) Evaluation of pilot visibility of each required instrument from each pilot station, to include normal and reversionary modes.
(5) Human factors aspects of control system (for example, cursor-based control or other control devices, location and accessibility of controls).
(6) Any tests unique to the new equipment or new/novel functions. This should include simulated IMA system failures and the capability of the backup systems to take over without interruption.
(7) Electrical bus switching. This testing should include monitoring the response of the different IMA systems with bus interruptions and transients.
NOTE: Flight test personnel should also evaluate the AFM or AFMS procedures and limitations to ensure that they are accurate and support the safety assessment.
f. Configuration Control During Flight Testing. Because of the dynamic and complex nature of IMA system configuration, “red label” units are often used during the certification flight-testing. The hardware elements and software configurations may change several times during the flight test program. Therefore, the applicant should define an IMA system configuration control process to use during the certification flight test program. This process should include “flight test conformity,” as well as a means of ensuring that the final product conforms to what was tested, and that the test results for configurations tested that were different than the final IMA system configuration are valid. Examples of items to be addressed in the process are:
(1) Inclusion of the aircraft-level safety assessment and a summary of each function’s criticality and worst-case failure conditions.
(2) A process to identify and control the configuration of each hardware element and software component of the IMA system during the certification flight test program.
(3) A process for analyzing the interoperability effects of all changes during the flight test program. For example, a process to determine how changes to some software components may affect other software components or functions in the IMA system.
(4) A change impact analysis process for analyzing the effect of changes during the test program on the aircraft-level safety assessment and other systems, and the validity of previously conducted tests.
(5) A process for analyzing the effect of every change on the overall functionality of the final IMA system and the validity of previous test results.
18. ROLES AND RESPONSIBILITIES OF IMA SYSTEM APPLICANTS. There are a number of different levels of roles and responsibilities that should be addressed in order for the overall IMA system certification to occur. This section identifies the major roles and responsibilities for the TSO-C153 applicant, the functional TSO applicant, and the TC/STC/ATC/ASTC applicant. Please note that these lists are not all-inclusive. All applicants are strongly encouraged to coordinate with the certification authorities throughout the entire IMA system development.
a. TSO-C153 Applicant Roles and Responsibilities:
(1) Apply for TSO-C153.
NOTE: Due to the complexity of IMA projects, it is recommended that the TSO manufacturer coordinate with the FAA early in the program.
(2) Build MPS in accordance with TSO-C153. Ensure that all the appropriate items in TSO-C153 Appendix 1 have been documented and approved by the FAA.
(3) Develop and implement part identification and configuration management functionality into hardware elements. The configuration management and part identification approach should follow the guidance of sections 10 and 11 of this AC.
(4) Coordinate with TC/STC/ATC/ASTC applicants who will be integrating and installing the hardware elements on the aircraft to ensure that the relevant issues are identified and addressed as early as possible.
(5) Design and build hardware elements per TSO-C153 and the MPS.
(6) Perform the tests necessary to demonstrate compliance with TSO-C153 and the MPS. If special purpose test software is used for environmental qualification testing, the manufacturer must verify, validate, and control the configuration of the hardware elements and software components to ensure the validity of the testing
(7) Submit the data package (that is, information in Section 5 of TSO-C153, including the MPS) to the cognizant FAA ACO for review and issuance of TSO authorization.
(8) Apply for changes to TSO-C153 elements, as design changes occur. Notify TC, STC, ATC, ASTC holder and/or functional TSO holder of the design change.
NOTE: During the manufacturing airworthiness determination of the hardware elements identified with TSO-C153 authorization, functional software must not be installed on the hardware element in order to comply with 14 CFR § 21.603.
b. Functional TSO Applicant Roles and Responsibilities.
(1) Apply for functional TSO.
(2) Design the system in accordance with the appropriate TSO standards.
(3) Identify and address all integration and installation issues with the TSO-C153 and TC/STC/ATC/ASTC applicants.
(4) Develop a mapping between the TSO requirements and the system implementation (for example, a mapping matrix). The mapping should identify TSO requirements that are fully met, partially met, or not met at all.
(5) Reference Order 8150.1 (see the most current edition), as needed.
(6) Identify functions in the IMA system that are not addressed by the TSO. These functions may require deviations and must be addressed by the TC/STC/ATC/ASTC applicant.
(7) Perform tests to demonstrate compliance to the functional TSO or functional performance standards. Some EQTs may not have been accomplished for TSO-C153 authorization. The functional TSO applicant must demonstrate that all testing, including EQTs, required for the functional TSO has been accomplished. If special purpose test software is used for environmental qualification testing, the applicant must verify, validate, and control the configuration of the software to ensure the validity of the testing. Credit may be applied for EQTs that were conducted for the TSO-C153 authorization, if appropriate.
(8) Submit the data package required by the functional TSO to the cognizant FAA ACO for review and issuance of TSO authorization. The installation data are included as part of the data package and should include the configuration of the functional TSO submitted for authorization.
(9) Apply for changes to functional TSOs, as design changes occur. Notify TC, STC, ATC, and ASTC holder of the design change.
NOTE: Due to the high integration, functional TSO data packages for IMA systems are typically developed in parallel with the TC/STC/ATC/ASTC effort. In these cases, TSO data should not be submitted to the ACO for authorization until the TC/STC/ATC/ASTC testing is completed.
c. TC, STC, ATC, ASTC Applicant Roles and Responsibilities.
(1) Develop and submit a Project-Specific Certification Plan (PSCP) for the IMA system to the cognizant ACO for approval.
(a) It is recommended the PSCP include a detailed conformity plan that addresses all hardware elements and software components’ conformity and installation conformity inspections (including the plan for addressing any “red label” units).
(b) The PSCP should clearly identify what functions will and will not be approved through the TSO authorization process. This is necessary in order to clarify the approval process (that is, to identify what will be TSO authorized and what will be TC/ATC/STC/ASTC approved).
(c) The PSCP should address integration and installation of all components of the IMA system (including all hardware elements and software components).
(2) Define aircraft system and performance requirements.
(3) Perform aircraft-level safety assessment per section 9 of this AC and submit to ACO.
(4) Integrate the IMA system into the aircraft or engine.
NOTE: The TC/STC/ATC/ASTC applicant is responsible for system integration in the aircraft or engine, IMA system-level testing, ground testing, and flight-testing.
(5) Ensure that all TSO assumptions are not violated in the installation (for example, relocation of a GPS hardware module does not invalidate environmental qualification credit for the GPS TSO).
(6) Integrate all hardware elements and software components.
(7) Develop field-loading procedures to ensure that proper software is loaded on the aircraft (see section 10g of this AC).
(8) Verify that software and complex electronic hardware issues were properly addressed for the installation per sections 12 and 13 of this AC.
(9) Determine appropriate aircraft environmental conditions and ensure that EQTs were performed (see section 15 of this AC).
(10) Develop test plans and perform necessary tests, including those addressed in section 17 of this AC.
(11) Develop a plan for addressing human factors issues and perform human factors and flight crew evaluations of the IMA system, as described in section 16 of this AC.
(12) Ensure that the IMA system meets all airworthiness requirements (see section 20 of this AC).
(13) Submit all appropriate certification data (for example, safety assessments, hardware design assurance data, software data, test plans, test results, compliance reports) to ACO for approval.
(14) Maintain aircraft system configuration management per sections 10 and 11 of this AC.
(15) Evaluate and document changes to IMA system and elements per 14 CFR § 21.93.
(16) Ensure that aircraft design features address safety and comply with the regulations (see section 14 of this AC).
(17) Evaluate third-party hardware modules and/or any software installed in the IMA system and demonstrate compliance to regulations (see section 19 of this AC).
NOTE: If a manufacturer desires production authority, the quality assurance, inspection, and test procedures data must be submitted for issuance of production approval.
19. ADDITIONAL GUIDANCE FOR THIRD-PARTY MANUFACTURERS. For purposes of this section, a third-party manufacturer is a developer of a hardware module to be installed into a TSO-C153 authorized rack or cabinet. However, this hardware module developer is not the developer of the rack or cabinet and is not the primary IMA system integrator. A thirdparty manufacturer may have many approaches to integrating their hardware module into an IMA system. This section provides additional guidance to be considered by third-party manufacturers and applicants of IMA systems using third-party hardware modules.
a. Third-party hardware modules may or may not obtain TSO-C153 authorization. In order to not violate the TSO-C153 authorization granted for the rack or cabinet, the third-party manufacturer’s hardware module must be shown to meet the environmental, interoperability, configuration management, and regulatory requirements of the installation. The third-party hardware module must also participate in the robust automated configuration management Page 39
system by providing configuration identification information to the system. This requires close cooperation between all stakeholders involved.
b. Some third-party manufacturers may seek functional TSO authorization on their hardware module as part of a TSO authorized system (for example, GPS or Terrain Awareness Warning System TSO authorization). Hardware modules seeking functional TSO authorization should be designed and tested to operate in an environment that is valid for the actual environmental. During the functional TSO authorization, the configuration of all components needed for system operation should be specified. The expected installation approach and limitations should be documented when the TSO package is submitted to the FAA. During the actual installation of such hardware modules into IMA systems, TC/STC/ATC/ASTC applicants should ensure that the assumptions of the TSO authorization are not violated (for example, ensure that the actual environment is not harsher than the environment authorized by the TSO authorization).
c. Some third-party hardware module manufacturers will not apply for any TSO authorization (neither TSO-C153 authorization nor a functional TSO authorization). This might happen because a functional TSO authorization doesn’t exist (for example, braking system or power distribution system) or because a TSO authorization isn’t desirable. Such hardware modules will be approved as part of the TC/STC/ATC/ASTC. The environmental, interoperability, configuration, and regulatory requirements must be demonstrated as part of the TC/STC/ATC/ASTC process. Regardless of the approach taken by the third-party manufacturer, third-party hardware modules should be evaluated at the installation level to verify that all requirements are met. Third-party manufacturers are suppliers to the TC/STC/ATC/ASTC applicant and must be controlled during production by the applicant’s quality assurance organization.
d. Some third-party hardware modules may be designed to install field-loadable software (FLS). The FLS should meet the criteria of sections 10, 11, and 12 of this AC and the requirements of any functional TSOs involved. Additionally, the FLS should be carefully controlled. Loading software into third-party hardware modules may or may not be through the same port as other hardware modules in the IMA system. The loading approach must be carefully controlled to address configuration management, security, and verification of correct loads. There must be a robust loading process to ensure that incorrect software cannot be loaded and that other software cannot be inadvertently changed, when the third-party hardware module is loaded.
e. All hardware modules installed into a TSO-C153 authorized rack or cabinet should have a data sheet, similar to the one shown in Appendix 2 of TSO-C153. A manufacturer can submit data in a different format, but it must contain all of the information listed in Appendix 2 of the TSO-C153. If a particular portion of the data sheet does not apply, mark it “Not Applicable.”
NOTE: Third-party software has not been addressed in this AC. It may be utilized in some IMA systems. Third-party software Page 40
component manufacturers should consider the FAA’s AC on software components (see http://av-info.faa.gov/software).
20. AIRWORTHINESS CONSIDERATIONS.
a. Init ial Installation. For initial approval of a particular equipment installation, the scope of the applicant’s program should be directed toward airworthiness approval through the TC or STC process. This AC is also appropriate for applicants who exercise their Delegation Option Authorization (DOA), Organizational Designated Airworthiness Representative (ODAR), or Designated Alteration Station (DAS) authorization for STC approval. As part of the ATC or ASTC program, the applicant should determine if the changes to the type certificated aircraft constitute a significant change, but not one so extensive as to require a new TC in accordance with 14 CFR § 21.19. If the design change is considered significant, the certification program should be coordinated with the responsible FAA Directorate and cognizant ACO, as described in FAA Order 8110.4 (see the most current edition).
b. F ollow-on Installations. For equipment that has already obtained initial installation approval by the TC or STC process, approval may be obtained using either the STC, ATC, ASTC, or FAA Form 337, Major Repair and Alteration, process subject to the restrictions of paragraph (1) below.
(1) For installations on aircraft operated under 14 CFR part 91 and with the applicant providing acceptable IMA system installation or alteration instructions, approval for return to service can be accomplished using FAA Form 337. Because of the complexity of IMA systems, the FAA Form 337 should be limited to return to service. Installation variations acceptable for approval by FAA Form 337 must not impact system or aircraft operation (for example, slight location changes, minor fastener changes, and so forth, could use the FAA Form 337 process).
Therefore, it is recommended that the FAA Form 337 process be limited to minor aircraft installation variations from a TC/STC/ATC/ASTC that approves an IMA system for that particular aircraft model. Any operational variation in installation should only be accomplished by STC or amended TC.
NOTE: Part 121 operators and Part 145 repair stations may not require FAA Form 337 for return to service, because their return to service method is specified in their FAA-approved manuals.
(2) When using the STC or ATC process, all required data pertaining to the installation should be submitted to the ACO. These data should include the manufacturer’s operating and installation or alteration instructions, safety analysis for the installation or alteration, installation or alteration details, structural substantiation, system wiring diagrams, ground test plans, flight test plans, and test results, as a minimum.
(3) Because of the complexity of IMA system installations and alterations, it is highly recommended that initial DAS and DOA/ODAR IMA projects have significant ACO participation.
c. Change Impact Analysis. When a change is made to the IMA system, a change impact analysis should be performed. The change impact analysis should determine whether the change could adversely affect safe operation of the system or product. The following are examples of areas that could have an adverse impact on safety or operation:
(1) Safety-related information is changed. For example:
(a) Previous hazards, as identified by the SSA, are changed.
(b) Failure condition categories, as identified by the SSA, are changed.
(c) Software levels or electronic hardware device design assurance levels are changed.
(d) Safety-related requirements, as identified by the SSA, are changed.
(e) Safety margins are reduced.
(f) Validity of the environmental qualification testing is affected.
(2) Operational or procedural characteristics of the aircraft are changed in a manner that could adversely affect flight safety as a result of the software change. For example:
(a) Aircraft operational or airworthiness characteristics are changed.
(b) Flight crew procedures are changed.
(c) Pilot workload is increased.
(d) Situational awareness, warnings, and alerts are changed.
(e) Displayed information to make flight decisions is changed.
(f) Assembly and installation requirements are changed.
(g) Changes that affect equipment interchangeability and/or interoperability with other equipment.
(h) Certification Maintenance Requirements are changed or added.
(3) New functions or features are added to the existing system functions that could adversely impact flight safety.
(4) Processors, interfaces, and other hardware components or the environment are changed in such a way that safety could be adversely affected. See RTCA/DO-178B, Section 12.1.3, and RTCA/DO-254, Sections 11.1 and 11.2.
(5) Life cycle data (for example, requirements, code, and architecture) are significantly changed in such a way that it could adversely affect safety.
d. Change Classification. The change impact analysis should be used to justify minor or major classification of the change. The major and minor change classification procedures should also evaluate the interoperability of the changed components. The TC/STC/ATC/ASTC holder must control all changes, regardless of the classification.