AC 20-145
GUIDANCE FOR INTEGRATED MODULAR AVIONICS (IMA) THAT IMPLEMENT TSO-C153 AUTHORIZED
HARDWARE ELEMENTS
Date: 2/25/03
TABLE OF CONTENTS
1. PURPOSE1
2. RELATED DOCUMENTS1
a. Code of Federal Regulations1
b. FAA Technical Standard Orders (TSO)1
c. FAA Policy Documents2
d. FAA Advisory Circulars (AC)2
e. RTCA, Inc. Documents3
f. SAE Documents3
3. DEFINITIONS3
4. ACRONYMS5
5. SCOPE6
6. BACKGROUND7
7. DOCUMENT OVERVIEW7
8. IMA SYSTEM APPROVALS AND AUTHORIZATIONS7
a. TSO-C153 Authorization8
b. Functional TSO Authorization8
c. I nstallation Approval9
9. SAFETY ASSESSMENT PROCESS GUIDANCE9
10. CONFIGURATION MANAGEMENT GUIDANCE13
11. ELECTRONIC IDENTIFICATION GUIDANCE16
12. SOFTWARE GUIDANCE17
a. Software Assurance17
b. Software Levels17
c. F ield-Loadable Software (FLS)17
d. Partitioning and Protection19
e. Software Reuse20
13. ELECTRONIC HARDWARE GUIDANCE21
14. IMA DESIGN GUIDANCE21
a. Electrical Power for IMA Systems21
b. Recovery Features21
c. Built-In Test (BIT)22
Page i
d. Maintenance Diagnostics22
e. F ailure Detection and Annunciation22
f. F unctional Partitioning22
g. F unctional Isolation22
h. Intentional Transmitters22
i. Visual and Aural Alerting22
15. ENVIRONMENTAL QUALIFICATION GUIDANCE23
Figure 15-1. RTCA/DO-160D Environmental Qualification Requirements25
16. HUMAN FACTORS AND FLIGHT CREW INTERFACE GUIDANCE25
a. Human Factors Background25
b. Potential Human Factors and Flight Crew Interface Issues with IMA Systems26
c. Testing Considerations for Human Factors and Flight Crew Interface Issues30
d. Methods of Compliance with Controls Regulations30
17. TESTING PRACTICES32
a. IMA Hardware Element Testing32
b. Individual System Testing32
c. IMA System Integration Testing33
d. Aircraft Ground Testing34
e. Aircraft Flight Testing34
f. Configuration Control During Flight Testing35
18. ROLES AND RESPONSIBILITIES OF IMA SYSTEM APPLICANTS36
a. TSO-C153 Applicant Roles and Responsibilities36
b. Functional TSO Applicant Roles and Responsibilities37
c. TC, STC, ATC, ASTC Applicant Roles and Responsibilities38
19. ADDITIONAL GUIDANCE FOR THIRD-PARTY MANUFACTURERS39
20. AIRWORTHINESS CONSIDERATIONS41
a. Initial Installation41
b. Follow-on Installations41
c. Change Impact Analysis42
d. Change Classification43
21. MAINTENANCE AND CONTINUED AIRWORTHINESS GUIDANCE43
a. Maintenance Instructions43
b. Maintenance Diagnostics43
c. Master Minimum Equipment List (MMEL)43
APPENDIX 1. PARTIAL LIST OF FUNCTIONAL TSOs Page ii
Subject: GUIDANCE FOR
INTEGRATED MODULAR
AVIONICS (IMA) THAT IMPLEMENT TSO-C153
AUTHORIZED HARDWARE
ELEMENTS Date: 2/25/03
Initiated By: AIR-100 AC No: 20-145
Change:
1. P URPOSE.
a. This advisory circular (AC) establishes an acceptable means, but not the only means, to obtain Federal Aviation Administration’s (FAA) airworthiness approval for the installation of an Integrated Modular Avionics (IMA) System that uses hardware elements authorized under Technical Standard Order (TSO)-C153, Integrated Modular Avionics Hardware Elements. The FAA’s TSO process is a means for obtaining FAA design and production approval for an appliance, system, or product; however, the TSO authorization does not provide installation approval. This AC provides guidance for applicants involved in the integration, installation, certification, and continued airworthiness of IMA systems into an aircraft or engine, when the IMA system utilizes hardware elements that comply with TSO-C153. The guidance applies to the entire IMA system, not just the hardware elements. The guidance is specific to installations of these systems on aircraft or engines approved under Title 14 of the Code of Federal Regulations (14 CFR) parts 23, 25, 27, 29, 33, and 35.
b. The means of compliance presented in this AC is not mandatory; therefore, the term “must” used in this AC only applies to an applicant who follows this particular means of compliance and TSO-C153.
2. RELATED DOCUMENTS. The latest amendments of the following publications are the primary reference tools when using this AC:
a. Code of Federal Regulations. Title 14 CFR parts 21, 23, 25, 27, 29, 33, 35, 91, 121, and 135.
b. FAA Technical Standard Order (TSO). Copies of TSOs may be obtained from the Department of Transportation, FAA, Aircraft Certification Service, Aircraft Engineering Page 1
Division, AIR-100, 800 Independence Avenue, SW, Washington, D.C. 20591, or from the FAA website at http://av-info.faa.gov/tso. The following TSO is relevant to this AC:
/g183 TSO-C153, Integrated Modular Avionics Hardware Elements.
c. FAA Policy Documents. The following policy documents are relevant to this AC:
(1) Order 8150.1, Technical Standard Order Program.
(2) Order 8110.4, Type Certification.
(3) Policy Statement PS-ANM100-2003-01-03, Factors to Consider When Reviewing an Applicant’s Proposed Human Factors Methods of Compliance for Flight Deck Certification.
(4) Policy Statement PS-ANM111-1999-99-2, Guidance for Reviewing Certification Plans to Address Human Factors for Certification of Transport Airplane Flight Decks.
(5) Policy Statement PS-ACE100-2001-004, Guidance for Reviewing Certification Plans to Address Human Factors for Certification of Part 23 Small Airplanes.
NOTE: Copies of FAA orders, advisory circulars, and policy statements are also available from the FAA website at http://www.airweb.faa.gov/rgl.
d. FAA Advisory Circulars (AC). Copies of ACs may be obtained from the Department of Transportation, Subsequent Distribution Office, SVC-121.23, Ardmore East Business Center, 3341 Q 75th Ave, Landover, MD 20785. The following ACs are relevant to this AC:
(1) AC 20-88, Guidelines on the Marking of Aircraft Powerplant Instruments (Displays);
(2) AC 20-115, Radio Technical Commission for Aeronautics, Inc. (RTCA) Document RTCA/DO-178B;
(3) AC 21-16, RTCA Document DO-160D;
(4) AC 21-40, Application Guide for Obtaining a Supplemental Type Certificate;
(5) AC 23.1309-1, Equipment, Systems, and Installations in Part 23 Airplanes;
(6) AC 23.1311-1, Installation of Electronic Displays in Part 23 Airplanes;
(7) AC 25-11, Transport Category Airplane Electronic Display Systems;
(8) AC 25.1309-1, System Design and Analysis;
(9) AC 27-1, Certification of Normal Category Rotorcraft;
(10) AC 29-2, Certification of Transport Category Rotorcraft;
(11) AC 33.28-1, Compliance Criteria for 14 CFR § 33.28, Aircraft Engines, Electrical and Electronic Engine Control Systems; and
(12) AC 120-64, Operational Use and Modification of Electronic Checklists.
NOTE: Other ACs may be applicable, depending on the functions being implemented in the IMA system.
e. RTCA, Inc. Documents. Copies of RTCA documents may be purchased from RTCA, Inc., 1828 L Street, NW, Suite 805, Washington, D.C. 20036. Alternatively, copies may be purchased on-line at http://www.rtca.org. RTCA documents referenced in this AC are:
(1) RTCA/DO-160D, Change 2, Environmental Conditions and Test Procedures for Airborne Equipment;
(2) RTCA/DO-178B , Software Considerations in Airborne Systems and Equipment Certification;
(3) RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware;
and
(4) RTCA/DO-257, Minimum Operational Performance Standards for the Depiction of Navigation Information on Electronic Maps.
f. SA E Documents. Copies of Society of Automotive Engineers (SAE) documents may be purchased from SAE, 400 Commonwealth Drive, Warrendale, PA 15096-0001. Or, copies may be purchased on-line at http://www.sae.org/. The following SAE documents are referenced in this AC:
(1) Aerospace Recommended Practice (ARP) 4754, Certification Considerations for Highly-Integrated or Complex Aircraft Systems; and
(2) ARP4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.
3. DE FINITIONS.
a. Cognizant Aircraft Certification Office (ACO). The ACO granting the certificate or TSO authorization for the specific product, system, or appliance.
b. Design Assurance. All planned and systematic actions and data that substantiate that hardware or software correctly performs its intended function(s) and that design errors have been identified and corrected such that the hardware or software satisfies the applicable certification basis.
c. Devel opment Assurance. All planned and systematic actions used to substantiate that development errors have been identified and corrected such that the system satisfies the applicable certification basis.
d. F unctional Software. Software applications that will be approved as part of a functional TSO authorization or as part of a type certification effort. This software is sometimes referred to as operational software, application software, or flight software.
e. F unctional TSO. A TSO with a defined functionality. Examples of functional TSOs are listed in appendix 1 of this AC. TSO-C153 is not considered a functional TSO, because hardware elements typically do not have system-level functionality.
f. Functional TSO Applicant. The applicant seeking functional TSO authorization.
g. H ardware Element. A hardware element (as defined in TSO-C153) is: (1) a hardware module, or (2) cabinets or racks that host hardware modules. TSO-C153 authorization of a hardware element is not considered a functional TSO authorization.
NOTE: This definition may differ from terminology in other documents (for example, RTCA/DO-254).
h. IM A System. For this AC, an IMA system encompasses all components (such as, hardware elements, software, displays, control devices, sensors, receivers, and transmitters) needed to make the aircraft or engine system functional and operational.
i. P artitioning. The process of separating, usually with the express purpose of isolating one or more attributes of a function, to prevent specific interactions and cross-coupling interference. The terms “partitioning” and “protection” are often used interchangeably; however, partitioning is typically considered a means of protection.
j. P rotection. A concept that ensures the separation of avionics functions so that a fault in one function cannot affect another. Protection is typically considered a superset of partitioning;
however, the two terms are often used interchangeably.
k. Red Label Unit. For this AC, a red label unit is one that contains hardware and/or software that does not yet have FAA approval.
l. S oftware Component. A functional software file that is loaded into the IMA system.
m. S takeholders. All the entities involved in the development, integration, and certification of the IMA system. Stakeholders mentioned in this AC are the hardware element manufacturer, the functional TSO applicant, the IMA system integrator, the type certification applicant, the certification authority, and any other manufacturer involved in the IMA system development or integration.
n. System Configuration File. A data file loaded into the IMA system. It typically defines the IMA system, rack, or cabinet configuration; provides means of checking that the system is correctly configured and that the correct software has been successfully loaded;
provides parameters for checking that system and hardware module resource management protection features are functioning properly; and performs other related functions.
o. Third-Party Manufacturer. For this AC, a third-party manufacturer is a developer of a hardware module to be installed into a rack or cabinet that has TSO-C153 authorization, and who is not the rack or cabinet manufacturer nor the IMA system integrator. The hardware module may or may not have an associated TSO authorization.
p. TSO-C153 Applicant. The applicant seeking TSO-C153 authorization.
q. Type Certificate (TC), Supplemental TC (STC), Amended TC (ATC), or Amended STC (ASTC) Applicant. The applicant seeking type certification approval using the TC, STC, ATC, or ASTC process. For purpose of this document, the TC, STC, ATC, or ASTC applicant is denoted as TC/STC/ATC/ASTC applicant.
4. ACRONYMS . The following acronyms are used in this AC:
14 CFR Title 14 of the Code of Federal Regulations AC Advisory Circular ACO Aircraft Certification Office AFM Aircraft Flight Manual AFMS Aircraft Flight Manual Supplement ARP Aerospace Recommended Practice ASTC Amended Supplemental Type Certificate ATC Amended Type Certificate BIT Built-In Test CCD Cursor Control Device CFR Code of Federal Regulations DOA Delegation Option Authorization DAS Designated Alteration Station EQT Environmental Qualification Test FAA Federal Aviation Administration FHA Functional Hazard Assessment FLS Field-Loadable Software GPS Global Positioning System HIRF High Intensity Radiated Fields Page 5
IMA Integrated Modular Avionics MCDU Multifunction Control and Display Unit MLS Microwave Landing System MMEL Master Minimum Equipment List MPS Minimum Performance Standard ODAR Organizational Designated Airworthiness Representative PSCP Project-Specific Certification Plan PSSA Preliminary System Safety Assessment RF Radio Frequency SAE Society of Automotive Engineers SSA System Safety Assessment STC Supplemental Type Certificate TC Type Certificate TCAS Traffic Alert and Collision Avoidance System TSO Technical Standard Order
5. SCOP E.
a. IMA systems using TSO-C153 require consideration by all stakeholders involved (for example, the hardware element manufacturer, the functional TSO applicant, the IMA system integrator, the type certification applicant, and the FAA). This AC provides guidance for applicants involved in the integration, installation, certification, and continued airworthiness of IMA systems that use TSO-C153 authorized hardware elements in aircraft or engines. The guidance of this AC is focused on applicants who implement or interface with TSO-C153 authorized hardware elements. It should be noted that TSO-C153 authorization does not provide functional approval nor installation approval. This AC applies to the installation, integration, certification, and continued airworthiness of the entire IMA system, including the hardware elements. This AC provides guidance for an IMA system installed on an aircraft to provide aircraft or engine system functions. It addresses the integration of hardware elements, software, displays, sensors, control devices, and any other components needed to ensure the aircraft or engine systems operate properly and safely.
b. The TC/STC/ATC/ASTC applicant is ultimately responsible for showing compliance to the applicable 14 CFR parts for their aircraft or engine. The IMA system may include subsystems that may or may not have TSO authorization. The applicability of TSO authorization to various portions of the IMA system should be handled like any other TSO application and authorized accordingly by the FAA. The IMA system must be approved as part of a TC/STC/ATC/ASTC project.
c. While this AC is focused on IMA systems that use TSO-C153 authorized hardware elements, much of the guidance may also be useful for IMA systems that do not use these hardware elements.
6. B ACKGROUND.
a. IMA systems, depending on the specific aircraft or engine application, can combine many functions that have historically been contained in functionally and physically separated systems. The integration of many functions and the implementation of hardware elements present several obstacles for compliance to the regulations. This AC provides a means of compliance to the regulations for applicants involved in the integration, installation, certification, and continued airworthiness of IMA systems for an aircraft or engine.
b. TSO-C153 identifies two types of hardware that are considered hardware elements:
(1) hardware modules and (2) cabinets/racks that host hardware modules. The hardware elements that do not have TSO-C153 authorization can also be integrated into IMA systems, if they meet the environmental, interoperability, and regulatory requirements of the installation (that is, they are approved as part of the TC/STC/ATC/ASTC).
c. Hardware elements authorized under TSO-C153 may contain software to enable electronic part marking and/or future loading of functional software. The hardware elements manufactured to comply with TSO-C153 may be used in support of functional TSOs (for example, a Global Positioning System, TSO-C129) or systems approved under 14 CFR parts 23, 25, 27, 29, 33, or 35 (for example, a braking system approved as part of a type certificate (TC)).
d. Field-loadable software (FLS) may be loaded into TSO-C153 authorized hardware elements to support functional TSO or aircraft-level functionality. The FLS must be approved via the functional TSO and/or the TC/STC/ATC/ASTC. Loading the TSO-C153 authorized hardware elements with approved software is not considered an alteration to the hardware element – instead, it is considered part of the installation process.
7. DOCUMENT OVERVIEW. The following sections are included in this AC:
a. Sections 8 through 17 provide guidance on specific technical areas to be addressed by integrators and installers of IMA systems.
b. Section 18 provides guidance on the roles and responsibilities of the multiple stakeholders in the certification, integration, and installation process.
c. Section 19 provides guidance to third-party manufacturers.
d. Section 20 provides guidance regarding the airworthiness considerations of IMA systems.
e. Section 21 provides guidance regarding the maintenance and continued airworthiness of IMA systems.
8. IMA SYSTEM APPROVALS AND AUTHORIZATIONS. Integration, installation, and certification of an IMA system on an aircraft may use hardware and software that has undergone Page 7
several levels of design and approval. Three types of authorization or approval will typically be applicable:
a. TSO-C153 Authorization. In order to receive TSO-C153 authorization, the applicant must demonstrate that the hardware element being authorized meets the minimum hardware performance standards and the defined subset of RTCA/DO-160D environmental qualification requirements in TSO-C153. TSO-C153 authorization does not provide functional approval nor installation approval.
b. Functional TSO Authorization.
(1) A functional TSO authorization is for a TSO with a defined functionality (for example, air data computer, TSO-106). Other examples of functional TSOs are listed in appendix 1 of this AC. TSO-C153 is not considered a functional TSO, because these hardware elements do not have system-level functionality. The TSO-C153 and functional TSO applicants may be different entities. The functional TSO applicant must demonstrate that the IMA system, when loaded with the functional software, meets all applicable requirements of the functional TSO. Additionally, all environmental qualification testing must be carried out for the functional TSO. The environmental qualification may include selected environmental qualification tests performed as part of the TSO-C153.
(2) The configuration of all software components and hardware modules installed in TSO-C153 authorized cabinets or racks must be identified in the type design defined for the particular aircraft or engine model. Additionally, the software and hardware must conform to that type design.
(3) Functional TSO authorization supported by hardware modules authorized under TSO-C153 is granted for the specific system configuration, not for individual hardware modules.
That is, a functional TSO may be comprised of multiple hardware elements with the appropriate loaded functional software.
(4) A functional TSO authorization (for example, a Global Positioning System (GPS) hardware module that includes the functional software) may be obtained on a hardware element to be installed in a TSO-C153 authorized rack or cabinet. In this case, a hardware element without TSO-C153 authorization must be identified with the functional TSO markings.
(5) TSO authorization is not an authorization to install either the TSO-C153 hardware element or a functional TSO authorized system in an aircraft.
(6) Some functional TSO applications may be aircraft-specific (that is, they only apply to one aircraft type). These aircraft-specific TSO applications must meet the minimum performance standards (MPS) of the applicable TSO(s).
(7) Order 8150.1 (see the most current edition) provides additional information on TSO procedures.