0 Advisory U.S. Department of Transportation Federal Aviation Administration Circular Subject: Integrated Modular Avionics Date: 11/21/2013 AC No: 20-170 Development, Verification, Integration, and Initiated by: AlR-120 Change: 1Approval Using RTCA/OO-297 and Technical Standard Order-Cl53 Purpose. This advisory circular (AC) sets forth an acceptable means ofcompliance for aircraft and engines that utilize Integrated Modular Avionics (IMA) systems. This AC calls out and supplements the guidance material ofRTCAID0-297, Integrated Modular Avionics (IMA) Development Guidance and Certificatitm Considerations, dated November 8, 2005. This AC incorporates pertinent guidance material and information from AC 20-145, Guidance.far Integrated Modular Ai·ionics (IMA) that Implement TSO-CJ53 Authorized Hardware Elements.
AC 20-145 is now cancelled.
Principal Changes. This change incorporates minor changes and updates, and a new appendix to AC 20-170. These changes are necessary in order to address incorrect references in RTCNDO-297 when using SAE ARP 4754, Rev. A, which is recognized by AC 20-174.
Information regarding whom you may contact with questions regarding the information in this AC, and where you may obtain a copy, are also included.
PAGE CONTROL Cl lART Remove Pa es Dated Insert P cs Dated Table of Contents. page 10/28/IO Table ofContents. page iv. iv (12/28/I 0) Pages 3 through 4 10/28/10 Pages 3 through 4 Page 26 10/28/10 Page 26 Pages D-1 through D-3 10/20/10 Appendix D. pages 0-1 through D-3 Appendix H. page Il-1 ~ ~~ ~ f',;,J.. David W. I lempe Manager, Aircraft Engineering Division Aircraft Certification Division
AdvisoryU.S. Department of Transportation Federal viation Admini tration Circular Subject: Integrated M dular A ionics Date: I 0/28/ J o: 20-170 Development, Verificali n. Integration an Approval Using RTCA/OO -297 and Tecluucal Initiated by: AIR-120 Standard Order-Cl 53 Thi advi ory circular cts forth an acceptable mean f compliance for aircraft and engine s that utiliz [ntegrated Modular Avjonics (I.MA) ·ystems. This AC calls out and supplements the guidance materia] of RT A/DO-297 , Integrated Modular Avionics (IMA) Development Guidan e and Certification Consideration , dated November 2005. This A incorporates pertinent guidance material and infom1ati n from AC 20- l 45~ 01,idance for /11tegrated Modular Avio nics (JMA) that Implement TSO-CI 53 Authoriz.ed Hard ware Elements. AC 20-145 i now cancelled .
h~ David W. Hempe Manager, Aircraft Engine ring Di isi n Aircraft Certifica tion Divi. i n
10/28/10 AC20- 170 Table of Contents
Chapter 1 RTCA-0O-297 as an Acceptable Means of Compliance1
1-1. Purpose of this AC1
1-2. Whom this AC A ff~ctsl
1-3. Cancellation2
1-4. Using this AC and RTCA/ D O-2972
1-5. App lying RTCAIDO-297 as an Acceptable Means of Comp liance2
1-6. What This AC Cove rs4
Chapter 2 Acceptance And Incremental Acceptance5
2-1. Compari son ofRTCAIDO 297 Acceptance and FAA Approval5
2-2. Major Benefits of Incremental Accepta nce6
2-3. IMA Module, Appli cation, S ystem, and Installation Acce ptan ce6
2-4. Documentation And Data Packaging7
Chapter 3 Obtaining an IMA Component Acceptance Letter8
3- 1. General Guidance Regar din g LM A Component Accep tance Letters8
3-2. Parts of the IMA Component Acceptance Letter9
3-3. Essen tial Elements of the IMA Compo nent Acceptance Cover Letter................... .......... I 0
3-4. Esse ntial Elements of the IMA Compone nt Accep tance Letter Data Sheet12
3-5. Acceptanc e Letter13
3-6. lMA Compon ent Accept anc e Letters For Revised IMA Component s13
3-7 . Cance lling an IMA Component Acceptance Letter14
Chapter 4 Reuse Of IMA Components15
4-1 . Reuse of an Accepted lMA Component. ...................... ...... ............................. ................. l 5
4-2. What Can Be Reused15
4-3. Reuse of Other Types of Comp liance Data ................................................. ,16
4-4. Reuse of Previous ly Acce pted Software-O nl y or Hardware Componen t Contain ing
Airborne Software17
4-5. Reuse of CEH or Hardware Component Containin g CEH17
4-6. Reuse OfSEH or Hardware Compo nent Containing SEHJ8
II
4-7. Reuse of EQT Data18
4-8. Data the Componen t Developer Owes to Lhe IMA Developer /System Integrator or
Applicant19
4-9. Reuse of a Previous ly Accepted IMA Component That Wa.,., Revised19
4-10. Reuse of an fMA Component with a Previous TSO Authorization20
Chapter 5 Configuration Management of an IMA System21
5-1. IMA Configuration Management21
5-2. Automated, Robust Configuration Management ............... .......... ................. .................. .. 2 1
5-3. Non-Automated, Robust Configuration Management22
5-4. Software Loading Procedures22
5-5. Assurance Level of lMA Components Used in Configuration Management22
Chapter 6 IMA Recovery Features23
6-L Restarting Safety Critica l IMA Functions23
6-2. Restart Mechanism Implementation23
Chapter 7 Topics Not Covered by RTCA/DO-29724
7-1. Electrical Power For IMA Systems24
7-2. Field Loadable Software24
7-3. Electronic Identification Guidance26
7-4. Aircraft System Lightning and HCRF Protection27
Chapter 8 Use Of TSO Authorized Components In IMA Systems29
8-1. IMA Syste.ms and TS Os29
8-2. TSO-C 153 Authorization for IMA Hardware Components29
8-3. FunctionaJ TSO Authorization30
8-4. EQT of IMA Components with TSO Authoriza tion30
8-5. lMA Compone nt TSO Part Marking31
8-6. Integration ofTSO Authorized Components in [MA Systems32
8-7. Aircraft Installation Approval of IM A Systems includin g TSO Autl1orized Components .
.32
8-8. Roles and Responsibilities When TSO Authorized Components Are Used in IMA
Systems32
Ill
Appendix A Environmental Qualification Guidance forTSO-C153A-1
Appendix B Sample IMA Component Acceptance Cover LetterB-1
Appendix C Sample Acceptance LetterC-1
Appendix D Related Documents And How To Get Them .•....•••...•...••...••.••• D-1
Appendix E GlossaryE-1
Appendix F Acronyms .............•..••..•••..••.......•..•....•..•......•.................•... F-1
Appendix G Partial List of Functional TSOsG-1
Appendix H SAE ARP 4754 to ARP 4754A Cross-Reference Matrix ..•H-1
iv
Chapter 1 RTCA-OQ ..297 as an Acceptable Means of Compliance.
1-l. Purpose of this AC.
a. This advisory circular (AC) shows you 110w to obtain Federal Aviation Administration (FAA) airworthiness approva l for the devel opment. verification , and integration of an integrated modular avionics (IMA) system for installation into an aircraft or engine. We cite RTCA, Inc.
document RTCA/DO-297 , Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations , dated November 8, 2005 and supplement it with this text. This AC also provides guidance on how to show compliance with Technical Standard Order (TSO)-C15 3, integrated Modular Avionics Hardware Ele ments.
b. This AC is not mandatory and does not constitute a regulation. In it, we describe an acceptable means , though it is not the only means, to obtain FAA approval of rMA systems.
c. This AC uses the terminology "should'' when discussing compliance to the AC itself , as the AC represents one, but not the only, method of complying wiU1 the regulations. This AC uses the term ''must " when discussing compliance to the re_brtilations, as com pliance to a regulation is not optional ln these cases, the AC text supplies a reference to the specific rule(s) being discussed.
1-2. Whom this AC Affects.
a. We wrote this AC for:
(I) Applicants for type certificates (fC), amended TC (ATC), suppleme ntal TC (STC) , or amended STC (ASTC) of aircraft and aircraft engines implementing IMA systems and equipment ,
(2) Developer s of IMA systems, applications, and compo nents,
(3) Applican ts for TSO-C153 , Integrated Modular Avionics Hardwar e Elements , and for functiona l TSOs as they apply to IMA systems,
(4) Integrators of lMA systems,
(5) Installer s of the lMA syste m into the aircraft, and
(6) Those involved in the approval and continued airworthines s of IMA systems.
b. When the term ..applicant'' is used in this AC, we are refening to the applicant for an aircraft or engine TC. STC , A TC. or ASTC . When this AC is referrin g to an applicant for a TSO authorizat ion (TSOA), the phrase "applicant for TSO authorization " or other similar phrase is
used. When this AC is referring to an applicant for an IMA Component Acceptance Letter, the phrase "applicant for fMA Component Acccptanc ,e Letter • or othe r similar phrase is used .
1-3. Cancellation. This AC cancels AC 20-145, Guidance/or Integrated Modular Avionics (IMAJ that Jmpleme11t TSO-C153 Authori=ed Hardware Elements. and incorpornte s all pertin ent information from it that is not covered by RTCA/DO-297.
1-4. Using this AC and RTCA/0O-297.
a. The means in this AC are a complete method to sJ10w compliance and obtain approval of IMA components and systems for installatiou into an aircraft or engine. We intend that this AC be applied at the aircraft or engine level by the applicant for o TC, STC, A TC, or ASTC. That is, this AC is not intended as gujdance solely for an IMA developer, IMA system integrator , or lMA application/component supplier .
b. If you are an appl icant for an authorizution for TSO-C 153, Integrated Modular Avionics Hardware Elements, you may use the guidance in this AC as one acceptable means of compliance to requirements defined in TSO-C153. See paragraph 8-7 and appendix A ofthi s AC for more information.
c. We find that the objectives, processes, and activittes in RTCA/DO-297, plus the additional guidance material contained in this AC, constitute an acceptable means of compliance for the developm ent, integration, verification, and installation approval of1MA syste ms. If the applicant wants to propose an alternativ e means. including those from other industry documents refer enced by RTCA /DO-2 971 document those altemative means and secure FAA approval during yoUI project's planning stage. Prepare to use Issue Papers to document agreements reached.
d. According to the definition of an lMA in Appendix E. Glossary , an [MA is a "shared set of flexible, reusable , and interoperable hardware and software resources that, when integrated, fonn a platform that provide s services.'' You should keep in mind that an IMA system is defined by the system architecture, not by the functionality the syst em provides . lMA systems may not always imp lement functions historically regarded as "avio nics", such as flight deck displays, navigation, communication, etc. IMA syste ms may also be used to implement other aircraft functionality, such as fly-by-wire flight controls, inertial reference/air data systems, or electrical power control systems. The re may be more than one IMA sys tem on an aircraft. An IMA system could feasibly be mounted within an engine assembly.
1-5. App lying RTCA/DO -297 as an Acceptable Means of Compliance.
a. RTCNDO-297 des(..Tibes objectives. proce sses, and activities to incrementally accumulate design ass urance and accepta nce of IMA syste ms and components. RTCA/DO-297 refers to indu stry standar ds such as SAE Intemational' s Aerospace Recommended Practice (ARP) 4754, Certification Consideralio11sfor Highly Integrated or Complex Aircraft, Syste,ns, and SAE ARP 4761, Guidelines and Methods ofConducti11g the Safety Assessment Process 0 11 Civil Airborne Systems and Equipment. When RTCA/0O-297 invokes the processes and methods in specific 2
sections of those industry standards as part of the IMA development. integration, verification, or approval process, you should consider those sections of the referenced industry standard (or other acceptable alternative means) to be part of the overall acceptable means of compliance as outlined in RTCA/DO-297.
Note: SAE International updated their ARP 4754 to ARP 4754A, ··Guidelines.for Development ofCivil Aircraft and Systems"' in December 2010. AC 20-174. Development of Civil Aircrc!ff and Systems, dated September 30,2011, recognizes ARP 4754A as an acceptable means of compliance for development of aircraft systems. This revision A reflects a significant change to that document, including section and paragraph numbering from that used in the original release. As a result, several references to ARP 4754 by RTCA/DO-297 are incorrect when using SAE ARP 4754A. Please see appendix Hof this AC in order to cross reference ARP 4754 with ARP 4754A sections and paragraphs referenced by the original release ofRTCA/DO-297.
b. You may use this AC as an acceptable means of compliance for a IMA systems that include TSO authorized articles. Although RTCA/DO-297 docs not address TSOs, you should apply the intent of its objectives in Annex A to IMA systems that include TSO authorization(s) in order to obtain IMA system approval. See chapter 8 of this AC for more information.
c. If you choose to follow this AC to show compliance, apply the AC to your !MA development and approval process regardless of the complexity of the IMA system or business model under which it is developed and approved. RTCA/DO-297 is written primarily from the perspective of a complex IMA system developed and integrated by multiple organizations and companies (see RTCA/DO-297, subsection 2.4). Although the development, integration, verification. and approval of an IMA system developed by a single company are likely lo be less complex than for multiple companies. RTCA/DO-297 applies equally. This AC should be used as an acceptable means of compliance for IMA systems that:
(I) Arc developed by a single company as well as those developed by multiple companies.
lfa single company develops a complete IMA system, many of the separate roles defined in RTCA/DO-297 - such as !MA developer, application developer, and !MA integrator -- will be taken by this single company.
(2) Are simple IMA systems as well as complex IMA systems. These terms are purposely left undefined. because it is difficult to make a clear distinction between them. The purpose of this item is to illustrate that this AC should be applied to IMA systems of all levels of complexity.
(3) Are closed architecture as well as open architecture. (See Appendix E. Glossary.)
(4) Use TSO authorized components (that is, TSO-Cl53) and functional TSOs (such as TSO-C 113, Electronic Flight Displays and TSO-C9, Automatic Pilots) as well as IMA systems that do not use TSO authorized components.
Note: Because of the variations described inc. above, not all aspects of RTCND0-297 or the additional guidance contained in this AC may apply to every IMA development program.
We strongly recommend that any question regarding the application of this AC be discussed with us at the beginning of the certification program and the a!,>reements reached during those discussions be documented. The FAA may require an Issue Paper on these questions.
d. Appendix A of this AC, Environmental Qualification Guidance for TSO-Cl 53, Integrated Modular Avionics Hardware Elements. shows applicants for TSO-C 153 authorization how to conduct environmental qualification testing (EQT) that ensures compliance to the minimum performance standard (MPS) ofTSO-Cl53. We do not require compliance to appendix A if you are not using TSO-C 153 authori,:cd hardware components.
1-6. What This AC Covers. This AC describes an acceptable means by which to apply RTCND0-297, along with the additional guidance material included in this AC, to an aircraft or engine certification program which uses an IMA system. We cover the following subjects in detail:
-Acceptance and Incremental Acceptance (in chapter 2).
- Getting An IMA Component Acceptance Letter (in chapter 3 ).
- Reuse Of IMA Components (in chapter 4 ).
- Configuration Management of an !MA System (in chapter 5).
- IMA Recovery Features (in chapter 6).
- Additional Topics Not Covered by RTCA/D0-297 (in chapter 7).
- Use of TSO Authorized Components in !MA Systems (in chapter 8).
10/28/ lO AC 20-170 Chapter 2 Acceptance And Incremental Acceptance.
2-1. Comparison of RTCA/DO 297 Acceptance and FAA Approval.
a. RTCA /DO-297 , paragraph 2.1.2, gjves the following definitions:
(I) Acceptance -Acknowledgement by the FAA thal the moduJe1 application, or system comp lies with its defined requirem ents. Ac;ceptance is recognition by the FAA (typically in the form of a letter or stamped data sheet) signifying that the submission of data, justification, or claim of equivalence satisfies applicable guidance or requirements.
The goal of acceptance is to achieve credit for future use in a certification project.
(2) Incremental Acceptance - A process for obtaining credit toward approval and certification by accepting or finding that an IMA module. applicalion, and/or off-aircraft lMA syste m complies with specific requirement s. This incremental acceptance is divided into tasks. Credit granted for individual tasks contributes to the overall certification goal.
Increm ental acceptance provides tbe ability to integrate and accept new applications and/or module s, in an IMA system, and maintain existing applications and/or modules , without the need for re-acceptance.
b. We view acceptance, as defined above, as part of the processes documented by Title 14 of the Code of Federal Regulations ( l 4 CFR.) and published FAA policy used to approve airborne systems during an aircraft or engine certification program. To obtain approval for installation on a certified aircraft or engine, applicants must show that the aircraft or engine system/ fwiction meets with the applicable regulatory requfrements. See§§ 2 l. l 7, 21.20, and 2Ll 15. Some of the regulatory requirem ents are accompanied by an AC (such as this one) that describes one, but not the only, possible means of complying with those regulations.
c. The main differences between RTCA/DO-297 .. acceptance" and our current formal process of showing compliance in an aircraft certification program are 1) each stage of RTCA /OO-297 acceptance is accompanied by some fom1 of recogni tion, such as a "signed letter or stampe d data sheet" or <(accepted or approved comp liance data package,' ' and 2) a goal of acceptance, as defined by RTCA/DO-297 , is to "achieve credit for futur e use in a certification pro cess." Otherwise, the two concepts are very similar: data submission s and statements of compliance are used to show that an airborne system or component complies with all applicable requir ements and therefore can be approved for installation onto an aircraft or engine.
d. "Acceptance" is a term often used during the approval of aircraft or engine systems, but its meaning may not be consistent throughout the certification process. The meaning of this word can depend on the conte xt. For example, the RTCA/OO-297's "acceptance" is very similar, but not identical , lo AC 20-148, Reusable Software Components. That AC states:
"Acceptance is credit the FAA grants for fully or pruiially meeting RTCA/OO-178B objective s for an (Reusable Software Component) RSC. The FAA shows acceptance by issuing a RSC acceptance letter.'' Although the concept is similar between RTCA/DO-297 and AC 20-148, the specific definitions of "acceptance" are not identical. This examp le illu strates that the meaning 5
of ''acce ptance" may vary, given 1ts context. Make sure you understand the context and meaning of this term when you encounter it.
e. "Incremental acceptance", as defined in RTCA/ 00-297, takes the concept of acceptance further. lt divides acceptance into «certification tasks" accomplished during different points, or increments, in the certification program. Each task builds upon previous tasks. Incremental acceptance of IMA components is no1mally associated with the (MA Component Acceptance Letter process described by RTCA/00-297. See RTCA/ 00-297, Section 4 for more infom1ation.
f. An applicant may use acceptance of components within the IMA to accumulate certification credit towa rd instaJlation approval of an I.MA system on an aircraft or engine. The concept of acceptance does not alter or replace FAA certificatio n processes. [nstead, acceptance is a means to recognize that a specific lMA component complies with all docwnented requirements and objectives. and that an accepted component can be used without detailed examination of the compliance data for that component - that is, is the component acceptable for use in an approved airborne system? IMA Component Acceptance Letters described in Chapter 3 of this AC are not required to accumulate cettification credit toward installation approval.
2-2. Major Benefits of Incremental Acceptance.
a. The major bendit of using the incremental acceptance process, as defined in RTCA/D0 297, is that incrementa l acceptance provides the ability to integrate and accept new components in an IMA system and maintain existing components without the need for re-acceptance. This allows you to:
(I) Reuse accepted lMA components in multiple applications in the same certification program by submitting certification data packages that have an established pedigree. This reduces certification effort of the current aircraft or engine program without compromising system safety.
(2) Reuse accepted [MA components in future certification programs by submittin g certification data packages that have an established pedigree. This reduces follow-on certification effort without compromising system safety.
b. The incremental acceptance -process defined in RTCA/00-297 shows how to package and docwnent the data and artifacts of a specific IMA component, so the previously accepted data and artifacts may easily be used in multiple concurrent or future programs.
2-3. IMA Mod ule, App lication , System, and Installation Acceptance.
a. Acceptance at each stage of IMA development and verification, as described RTCA/00 297, subsection 4.2 (Task I - Module Acceptance), subsection 4.3 (Task 2 - Application Acceptance), subsection 4.4 (Task J - IMA System Acceptance), and subsection 4.5 (Task 4 Aircraft integration oflMA System), is required for IMA system installation approval. We intend that a11 important aspects in RTCA/00-297 regarding IMA development, integration.
verification, and approval (Tasks 1 t11rougb 4) be fo11owed and you show that the IMA system complies with all object ives ofRTCA/00-297, Annex A, regardless of whether you request IMA Component Acceptance Letters. The IMA Component Acceptance Letter process covered in RTCA/D0-297, Section 4, and chapter 3 of this AC is optional. As an appl icant, IMA developer /system integrator. or IMA component supplier, you may decide whether or not to request an fMA Component Acceptance Letter.
Note: RTCA/D0-297 , subsection 4.6 (Task 5) deals with change s to acce pted modules and subsection 4. 7 (Task 6) <leals with reuse of modules or applications. These subsections are important and should be foJlowed. However , for the purposes ofthe initial accepta nce ofthe IMA system and approval for installation on an aircraft or engine, only subsections 4.2 through
4.5 (Tasks l though 4) are relevant. If previously accepted componen ts are being reused , subsection 4. 7 (Task 6) should a1so be consi<lered.
b. The documentation required to obtain acceptance when you are planning to reuse IMA components may be more than that required ifyou seeking approval for a component to be only used on a single TC/STC / ATC/ ASTC program. Although it is not mandatory, we strongly suggest that in your initial certification plans for the IMA system and/or compo nents, you state which compone nts for which you desire [MA Compone nt Acceptance Letters at the end of the certification program, aJong with the name of the company or companies that will be asking for those letters.
c. The FAA will not grant acceptance at the higher task levels- that is, Tasks 2, 3, and 4 unti l aJJ acceptances at the subordinate leve ls on which those higher tasks depe nd have been completed. For example , to obtain acceptance for an IMA application, you should first obtain acceptance of all module s which comprise that applica tion. Likewise, all applications that make up an lMA system should be accepted before we accept the system.
d. If you are going to deviate from ccrti fication planning documents already accepted by the FAA, you should request a deviation to those plans. The request should include a justification for the deviation and the mitigating actions (if any) that you plan to take.
2-4. Documentation And Data Packaging . RTCA/D0-297 , Section 4 addresses the artifacts required for acceptance al the various task levels. Exa mples include the module acceptance plan , the module requirements specification, the module configuralion index, the fMA system certification plan, and the IMA system vaJidation and verification plan. This AC does not requir e that you use those spec ific document titles or methods of data packaging. They represent one particular acceptable means to comply with RTCND0-297. We accept alternative document titles and data packaging. However , if you use alternative documentation naming convention and data packagi ng, you should address all significant aspects in RTCA/D0-297 , Section 4 and Annex A to claim complianc e to this AC. See RTCA/D0-297 , subsection 4.1 for more infonnation.