Advisory Circular
Subject: AVIATION DATABUS Date: 08/04/06 AC No: 20-156 ASSURANCE Initiated by: AIR-100
1. PURPOSE.
a. This advisory circu lar (AC) is for aircraft and aircraft engine manufacturers and designers. We provide a means to gain Federal Aviation Administration (FAA) approval of your aviation databus by showing the databus design performs its intended function and satisfies the applicable airworthiness requirements when installed on an aircraft or aircraft engine.
b. This AC is not mandatory and does not constitute a regulation. This AC describes an acceptable means, but is not the only means, to gain databus certification. However, if you use the means described, you must follow it in all important respects.
2. MOTIVATION FOR GUIDANCE.
a. Aircraft, engine and avionics manufacturers want to take advantage of commercially available databus technology that would reduce aircraft weight and development/manufacturing time, and increase airborne system performance. This desire motivates manufacturers to consider replacing point-to-point wiring and uni-directional databuses (for example, ARINC 429 databus) with faster and lighter bi-directional databuses. The guidance in this AC is intended for new type certificate or major changes of aircraft installations with highly-integrated and complex databus technology. It is not inte nded for systems with previously approved or legacy databus technology unless the databus is used in a significant different way. You can use alternate methods to ensure that the databus performs its intended function and meets airworthiness requirements when installed on an aircraft or aircraft engine. Coordinate your plans for alternate methods with us early in the certification project.
b. Databuses transfer information between line replaceable units (LRU) and line replaceable modules or avionics modules installed in an aircraft. Aircraft and avionics manufacturers propose to use different types of databuses on aircraft. These databuses are becoming more complex as aircraft, aircraft engine, and avionics manufacturers integrate more avionics components into the aircraft and aircraft engine data sources, requiring accommodations for larger data transfers. System engineers have considerable flexibility when designing a databus because there are many physical and logical configurations for airborne systems architecture, data units or packets, protocols, message traffic, and so on, allowing avionics manufacturers, databus vendors, and system integrators more latitude when configuring
databuses. Without extensive configuration co ntrol across the many manufacturers, vendors, and integrators, this flexibility can make it difficult to establish the type design of an aircraft or engine, to determine compliance to the regulations, and to maintain continued airworthiness.
c. Aircraft and aircraft engine certification applicants must address this AC guidance when developing, selecting, integrating, or seeking approval of a databus technology that complies with the appropriate airworthiness requirements for an aircraft or aircraft engine. To help you obtain this approval, we divided the guidance in eight categories. Each category contains guidelines you must address. You will have to determine whether a particular guideline applies to your databus. However, depending on your project, you may need other project-specific criteria not specifically identified in this AC. The eight categories are:
∞ Safety (paragraph 3).
∞ Data integrity (paragraph 4).
∞ Databus performance (paragraph 5).
∞ Software and hardware assurance (paragraph 6).
∞ Electromagnetic compatibility (paragraph 7).
∞ Verification and validation (paragraph 8).
∞ Configuration management (paragraph 9).
∞ Security assurance (paragraph 10).
3. SAFETY REQUIREMENTS. As an aircraft or aircraft engine applicant, you must determine how the databus design will affect the safe operation of the aircraft or aircraft engine.
To accomplish this task, you must comply with the requirements of Title 14 of the Code of Federal Regulations (14 CFR) §§ xx.1301 and xx.1309 (where xx connotes the applicable part 23, 25, 27, 29), §§ 33.28 and §§ 33.75 and the associated advisory material for the design and function of your databus. Your safety assessment of the databus when installed on an aircraft or aircraft engine must address the following:
a. The databus architecture and implementation, using for example, SAE International’s Aerospace Recommended Practice (ARP) 4754, Certification Considerations for Highly- Integrated or Complex Aircraft Systems, dated November 1996, and ARP 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment, dated December 1996.
b. Databus availability and reliability requirements meet the safety requirements. Your safety assessment will help determine the safety requirements.
c. Partitioning and protection requirements for the databus’ architecture and implementation.
d. Failure detection, reporting, and management features such as the use of redundancy features, detecting the loss of nodes, the support of transparent shadow nodes, and the support of 2
parallel nodes. A node is a databus component capable of processing, sending, receiving, or sending and receiving information over the databus.
e. Fault containment, fault tolerance, and monitoring of the databus to protect against hardware and software faults in the host system.
f. Common cause (including common mode) and cascading failures. For each aircraft, you must perform a common cause analysis to address faults that go beyond your databus fault analysis. This common cause analysis includes a zonal safety analysis, particular risk analysis, and a common mode analysis. The location of each LRU and the routing of wiring between those components are critical in the achievement of acceptable zonal safety and determining the particular risks analyses. For critical aircraft functions supported by the databus, do not route redundant channels of the databus through zones where a probable risk may cause loss of all channels. To protect databus applications, us e electrical and mechanical means to isolate databus channels.
g. Methods or ways to reconfigure node(s) and the network to ensure safe operation of possible configurations and states, as appropriate.
4. DATA INTEGRITY REQUIREMENTS. Data that passes between LRUs, nodes, switches, modules, or other entities must remain accurate and meet the data integrity of the aircraft functions supported by the databus. To ensure data integrity thro ugh error detection and corrections resulting from databus architectures, evaluate databus systems for the following:
a. The maximum error rate per byte expected for data transmission.
b. Where applicable, databus-provided means to detect and recover from failures and errors to meet the required safety, availability and integrity requirements. Examples are cyclic redundancy checks, built-in detection, hardware mechanisms, and architecture provisions.
c. A databus loading analysis (for example, maximum traffic load, databus throughput, worse-case loading, and so forth) to ensure data integrity requirements are met.
d. The buffer overflow and underflow limits to ensure data integrity requirements are met.
e. Issues related to the databus integrity such as nodes that transmit at random instants for an arbitrary duration (babbling idiots), nodes that send an endless stream of bits (jabbering devices), packet collisions, broadcast storms, and incomplete data packages.
f. If applicable, the ability of the databus to reconfigure the node, databus architecture and network (both software and hardware) to support data integrity requirements.
g. The bi-directional error detection implementations to address data integrity issues.
h. If applicable, the switch saturation limits of the system.
i. If applicable, the allowable levels of degradation for the databus operation and performance, and their affect on data integrity.
j. Security issues that may affect data integrity (see paragraph 10 of this AC).
5. DATABUS PERFORMANCE REQUIREMENTS. You must evaluate the following databus performance items:
a. The databus operating speed and scheduling of messages (timing and prioritization) that support the operational safety and integrity requirements.
b. Loss of the databus through shorting or opening of the databus connections.
c. The system interoperability to include the databus or network topology, the communication protocol between components, and any other aspects.
d. Each databus length, stub length, and cable coupling specification and limitations.
e. Degraded databus operation and performance abilities, where applicable.
f. Retry algorithms, where applicable.
g. Bandwidth capability of the databus.
h. The actual specification of the databus capacity.
i. Data latency and efficiency.
j. Per-transmission overhead and other overhead effects.
k. The system’s failure management (including failure/malfunction reporting) and the failure effects within the databus.
l. The system start-up configuration and reintegration (recovery when a node that has gone off line rejoins the bus) durations. You must determine and use the worst-case times for bus start-up and node reintegration for all systems using the bus.
6. SOFTWARE AND HARDWARE ASSURANCE REQUIREMENTS. The aircraft’s systems, equipment, or engine must meet the applicable software and hardware design and development assurance guidelines, regardless of the bus architecture you propose (synchronous or asynchronous; uni-directional or bi-directional).
a. Each complex electronic device must meet the appropriate hardware design assurance requirements. The hardware design assurance of those complex electronic devices must meet the failure condition category and hardware design assurance level as determined by the safety assessment. To ensure the hardware design assurance, follow AC 20-152, RTCA, Inc., Document RTCA/DO-254, and RTCA, Inc. document RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware, dated April 19, 2000, or other acceptable means of compliance.
b. To ensure the design and development assurance of software that will function within the databus architecture, you must develop the software to the appropriate software design assurance level, per AC 20-115, RTCA, Inc., Document RTCA/DO-178B, and RTCA/DO-178B, 4
Software Considerations in Airborne Systems and Equipment Certification, dated December 1, 1992, or other acceptable means of compliance.
c. When using tools to develop or verify the databus software or hardware, you may need to qualify the tools. Guidance for qualifying to ols to develop software and hardware may be found in RTCA/DO-178B and RTCA/DO-254 respectively.
7. ELECTROMAGNETIC COMPATIBILITY REQUIREMENTS. To ensure proper operations of the databus, you must address the electromagnetic compatibility of the proposed databus:
a. There is a potentially large variation in electromagnetic emissions and electromagnetic susceptibility in databuses and databus components. Consider the effects of electromagnetic emissions and susceptibility when you design, select, or specify the databus you will use in the aircraft. An electromagnetically noisy databus installed throughout an aircraft is difficult to fix after installation.
b. When evaluating the databus for electromagnetic compatibility, consider the entire databus system, including the terminals, hardware, and installation. To address issues with electromagnetic emissions and susceptibility, you should not limit your evaluation to only RTCA/DO-160E, Environmental Conditions and Test Procedures for Airborne Equipment, dated December 9, 2004, tests for individual equipment. Individual pieces of equipment tested in isolation may meet the RTCA/DO-160E emission requirements but create interference problems when integrated on the aircraft. To address the overall electromagnetic compatibility of the integrated databus system, you may need to define and evaluate databus system requirements to supplement the RTCA/DO-160E tests performed for individual equipment.
NOTE: RTCA/DO-160E emission tests performed on technical standard order (TSO) equipment during the TSO authorization process may be used to support the electromagnetic compatibility requirements of this AC.
c. The electromagnetic emissions will depend on the databus design specifications for pulse rise times and settling times, databus speed, and databus topology. Databus topology may include the use of balanced differential-mode signaling and transformer-coupled connections, making the shape of the data pulse (both leading and trailing pulse edges) very important.
Proposed interconnection of the databus will significantly affect the electromagnetic emissions and susceptibility. However, shielded, twisted pairs of wires with high-quality connectors for shield termination will have better electromagnetic performance than buses using unshielded wires. You should address and mitigate the eff ects of electromagnetic susceptibility that can cause common mode failures for redundant implementations.
d. To address the electromagnetic compatibility guidelines presented in paragraphs 7a through 7c above, evaluate each databus using the following electromagnetic compatibility criteria:
(1) Databus data rate, switching speed, and pulse rise and fall times. Evaluating these criteria will help minimize spectral components interference with aircraft equipment such as sensitive aircraft radio receivers.
(2) Databus interconnect hardware and wiring requirements for radio frequency emissions and susceptibility. An example of a hardware and wiring requirement is minimum shielding effectiveness for the databus conductors and connectors.
(3) Electromagnetic compatibility of databus components such as individual databus transceivers. Also, evaluate the overall performance of the databus as installed in the aircraft.
(4) Lightning and high-intensity radiated field (HIRF) immunity commensurate with the safety classification of the functions that the databus supports. Guidance for system lightning protection is found in AC 20-136, Protection of Aircraft Electrical/Electronic Systems against the Indirect Effects of Lightning. FAA special conditions are issued with HIRF protection requirements for individual certification projects.
8. VERIFICATION AND VALIDATION REQUIREMENTS. As an applicant, you must:
a. Validate the databus requirements for the aircraft or aircraft engine project.
b. Evaluate whether the databus meets RTCA/DO-160E environmental standards, at the levels appropriate for each of the criticality functions supported by the databus. The electromagnetic compatibility and lightning qualification is of particular concern for databus technology because verification is typically done during aircraft installation. Electromagnetic testing and validation may vary depending on the databus architecture.
c. Perform appropriate verification of the databus in accordance with AC 20-115 (RTCA/DO-178B) and AC 20-152 (RTCA/DO-254), as discussed in paragraph 6 above.
NOTE: RTCA/DO-178B and RTCA/DO-254 verification tests performed on technical standard order (TSO) equipment during the TSO authorization process may be used to support the verification and validation requirements of this AC.
d. Perform a functional test of the integrated databus to ensure it meets its intended functions.
e. Verify and validate the databus operation, architecture, and performance claims. One acceptable method is to use an aircraft or databus simulator that uses the maximum throughput rate allowed for the system being tested.
f. If applicable, test the databus failure and recovery procedures by reconfiguration of nodes and networks, loss of nodes, number of recovery attempts, shorted nodes, fault coverage, etc.
g. If applicable, verify all built-in-tests to ensure they function correctly.
h. If applicable, test the databus failure management features at the bench and installation levels.
i. If degraded mode capability is supported, test the databus in a degraded mode to ensure acceptable performance.
j. When you use test benches to verify the performance of the databus, you must also perform the wiring acceptance tests by documenting the test methods or procedures used to determine the wiring harness is correct. You must use these procedures for initial installation and subsequent maintenance actions. Modifications after installation approval will require a change impact analysis to determine if the wiring acceptance tests or procedures need to be performed again.
9. CONFIGURATION MANAGEMENT REQUIREMENTS. Because there are many new databus technologies, each individual aircraft’s databus configuration could potentially be unique, and because of this uniqueness, changes to the databus configuration may result in an adverse effect on the databus’ message traffic, data collision rates, and reliability. For databus installations, manufacturers must establish a configuration management program for the databus.
These installations will also require maintenance personnel and installers to use manufacturer’s approved configuration databases and tools when maintaining or re-establishing the airworthiness of the databus configuration. Address the following system configuration management items when developing your databus:
a. When you integrate the databus into the aircraft or aircraft engine design, consider the total system by ensuring there are mechanisms of configuration control for continued operational safety and configuration control of the modifications. The additions of nodes and applications on the databus must be assured both in certification requirements and in-service maintenance activities.
b. You must establish and maintain configuration control of the databus during certification, from design through production and maintenance by following your established standards and documented procedures. Configuration control should address the databus and the selected options for each installation, being mindful that you may need additional FAA certification for changes to previously approved configuration.
c. Document applicable specification standards. At a minimum, you need to document physical and logical rules used by the databus. Examples of physical rules are requirements for transmission media, connectors, terminations, maximum number nodes, and run lengths.
Message packet definitions are an example of logical rules.
d. Provide documentation to support development and operation of the databus such as the interface definitions document, user’s guide, and installer’s guide.
e. If the databus uses multi-layered architecture, provide documentation to support and to configure layers. An example of multi-layered architecture is the open systems interconnection (OSI) networking model, also known as the seven-layer model.
f. You must document databus wiring and installation procedures. These procedures should include definitions of appropriate wire and shield types, electrical bonding requirements, and any specific wire bundle routing and separation requirements.
g. Strategy, plan, or process for future bus expansion and how potential changes will affect system integrity and safety.
10. SECURITY ASSURANCE REQUIREMENTS. Many modern databuses introduce potential security risks that are not common in traditional networked systems. Access security and data protection are two areas you should address:
a. Access Security. When airborne systems interact with the outside world through a databus or network, they may become vulnerable to potential malicious attacks such as software viruses. Each databus should be evaluated for this potential risk. Depending on the risk, adopt appropriate security techniques and controls to protect access to the airborne software. Some sample techniques are:
∞ Encryption techniques (such as public and private key encryption, digital signatures, hash functions) to protect data transmission.
∞ Authentication and access control policies (such as Discretionary Access Control protocol and the Mandatory Access Control protocol).
∞ Intrusion detection (such as signature-based approach, anomaly-based detector, specification-based intrusion detection, bottleneck verification, hostbased intrusion detection, and network-based intrusion detection).
b. Information and Data Protection. When using networks or modern databuses, you must protect critical information used and stored in airborne systems. Sample approaches are:
∞ Information verification methods to ensure that the data have not been corrupted during loading and storage (for example, cyclic redundancy check and checksum).
∞ Use of audit trails that account for data accessed (for example, a log of when and which critical flight data are accessed).
11. PROCEDURES FOR MEETING REQUIREMENTS. Perform the following activities to ensure you address the guidance in paragraphs 3 through 10 of this AC:
a. Develop a databus certification plan to address the guidelines in paragraphs 3 through 10 of this AC, and other requirements in on the specific project. The databus certification plan may be part of the system certification plan or other certification planning document.
b. Submit the plan to the responsible aircraft certification office for approval.
c. After developing the databus, submit a compliance report to show how you satisfied the guidelines of this AC. This compliance report ma y be part of the system, aircraft, or aircraft engine compliance report. If certain guidelines do not apply, describe why they do not apply.
d. Address continued airworthiness requirements in the instructions for continued airworthiness section of the maintenance manual, user’s guide, or other appropriate documents.
At a minimum, you must address the following continued airworthiness issues:
∞ Performance of the databus over the life of the aircraft.
∞ Physical degradation of the databus components. This could include databus wire and connector corrosion, damage, and wear out.
∞ In-service modifications and repairs to the databus.
∞ Use of different configurations and functional components for obsolete databus components, due to the rapidly changing state-of-the-art databus components. Future maintenance of the databus may require the use of different configurations and functional components.
∞ Scheduling information for any databus components that require specific maintenance intervals.
∞ Information on how to remove/install databus components to support maintenance.
∞ Information on how to evaluate and test databus operation (system checks).
e. Perform a system-level change impact analysis to determine how modifications to the databus affect the system. The impact analysis will also determine appropriate activities needed to re-perform and re-assess the databus and affected systems. Follow your defined process when performing a change impact analysis to determine how the change may affect the continued operational safety of the aircraft.
f. When using a previously approved or modified databus for a different project, you may use the guidelines in this AC to evaluate the suitability of the databus for the new project.
12. REL ATED DOCUMENTS AND HOW TO GET THEM.
a. Code of Federal Regulations. You can get copies of 14 CFR parts 21, 23, 25, 27, 29, and 33 from the FAA website at http://www.airw eb.faa.gov/rgl.
b. FAA Advisory Circulars (AC) and Orders. The following ACs and orders are available from the FAA website at http://www.airweb.faa.gov/rgl.
(1) AC 20-115, RTCA, Inc. Document RTCA/DO-178B;
(2) AC 20-152, RTCA, Inc. Document RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware;
(3) AC 21-16, RTCA, Inc. Document RTCA/DO-160E; and
(4) AC 20-136, Protection of Aircraft Electrical/Electronic Systems against the Indirect Effects of Lightning.
(5) AC 23.1309-1, Equipment, Systems, and Installations in Part 23 Airplanes.
(6) AC 25.1309-1, System Design and Analysis.
(7) AC 27-1, Certification of Normal Category Rotorcraft.
(8) AC 29-2, Certification of Transport Category Rotorcraft.
(9) AC 33.28-1, Compliance Criteria For 14 CFR§33.28, Aircraft Engines, Electrical And Electronic Engine Control Systems
(10) AC 33.28-2, Guidance Material For14 CFR §33.28, Reciprocating Engines, Electrical And Electronic Engine Control Systems.
(11) AC 33.75-1, Guidance Material for 14 CFR 33.75, Safety Analysis.
c. RTCA, Inc. Documents. Order RTCA documents from RTCA, Inc., 1828 L Street NW, Suite 805, Washington, D.C. 20036-4008. You can also order copies online at www.rtca.org. RTCA documents referenced in this AC are:
(1) RTCA/DO-160E, Environmental Conditions and Test Procedures for Airborne Equipment;
(2) RTCA/DO-178B, Software Considerations in Airborne Systems and Equipment Certification; and
(3) RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware.
d. SAE Documents. Order SAE documents from SAE International, 400 Commonwealth Drive, Warrendale, PA 15096-0001. You can also order copies on-line at www.sae.org. We reference the following SAE documents in this AC:
(1) ARP4754, Certification Considerations for Highly-Integrated or Complex Aircraft Systems; and
(2) ARP4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.
David W. Hempe Manager, Aircraft Engineering Division Aircraft Certification Service 10