4-7. Reuse of EQT Data. . - 18
4-8. Data the Component Developer Owes to the IMA Developer/System Integrator or Applicant. 19
4-9. Reuse of a Previously Accepted IMA Component That Was Revised.. .. 19
4-10. Reuse of an IMA Component with a Previous TSO Authorization ... 20 Chapter 5 Configuration Management of an IMA System. ..21
5-1. IMA Configuration Management.. .. 21
5-2. Automated, Robust Configuration Management. .. 21
5-3. Non-Automated, Robust Configuration Management. .. 22
5-4. Software Loading Procedures... 22
5-5. Assurance Level of IMA Components Used in Configuration Management. 22 Chapter 6 IMA Recovery Features.. 23
6-1. Restarting Safety Critical IMA Functions 23
6-2. Restart Mechanism Implementation 23 Chapter 7 Topics Not Covered by RTCA/DO-297 ..24
7-1. Electrical Power For IMA Systems 24
7-2. Field Loadable Software. . 24
7-3. Electronic Identification Guidance 26
7-4. Aircraft System Lightning and HIRF Protection 27 Chapter 8 Use Of TSO Authorized Components In IMA Systems. .. 29
8-1. IMA Systems and TSOs.. 29
8-2. TSO-C153 Authorization for IMA Hardware Components. 29
8-3. Functional TSO Authorization30
8-4. EQT of IMA Components with TSO Authorization. 30
8-5. IMA Component TSO Part Marking.. 31
8-6. Integration of TSO Authorized Components in IMA Systems. 32
8-7. Aircraft Installation Approval of IMA Systems Including TSO Authorized Components.
8-8. Roles and Responsibilities When TSO Authorized Components Are Used in IMA Systems.. 32 ¡ii
Appendix A Environmental Qualification Guidance for TSO-C153. A-1 Appendix B Sample IMA Component Acceptance Cover Letter. .B-1 Appendix C Sample Acceptance Letter. .C-1 Appendix D Related Documents And How To Get Them. ..D-1 Appendix E Glossary... .E-1 Appendix F Acronyms....... ..F-1
Appendix G Partial List of Functional TSOs...........G-1
Appendix H SAE ARP 4754 to ARP 4754A Cross-Reference MatrixH-1
iv
Chapter 1 RTCA-DO-297 as an Acceptable Means of Compliance.
1-1. Purpose of this AC.
a. This advisory circular (AC) shows you how to obtain Federal Aviation Administration (FAA) airworthiness approval for the development, verification, and integration of an integrated modular avionics (IMA) system for installation into an aircraft or engine. We cite RTCA, Inc.
document RTCA/DO-297, Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations, dated November 8, 2005 and supplement it with this text. This AC also provides guidance on how to show compliance with Technical Standard Order (TSO)-C153, Integrated Modular Avionics Hardware Elements.
b. This AC is not mandatory and does not constitute a regulation. In it, we describe an acceptable means, though it is not the only means, to obtain FAA approval of IMA systems.
c. This AC uses the terminology "should" when discussing compliance to the AC itself, as the AC represents one, but not the only, method of complying with the regulations. This AC uses the term "must" when discussing compliance to the regulations, as compliance to a regulation is not optional. In these cases, the AC text supplies a reference to the specific rule(s) being discussed.
1-2. Whom this AC Affects.
a. We wrote this AC for:
(1) Applicants for type certificates (TC), amended TC (ATC), supplemental TC (STC), or amended STC (ASTC) of aircraft and aircraft engines implementing IMA systems and equipment,
(2) Developers of IMA systems, applications, and components,
(3) Applicants for TSO-C153, Integrated Modular Avionics Hardware Elements, and for functional TSOs as they apply to IMA systems,
(4) Integrators of IMA systems,
(5) Installers of the IMA system into the aircraft, and
(6) Those involved in the approval and continued airworthiness of IMA systems.
b. When the term "applicant" is used in this AC, we are referring to the applicant for an aircraft or engine TC, STC, ATC, or ASTC. When this AC is referring to an applicant for a TSO authorization (TSOA), the phrase "applicant for TSO authorization" or other similar phrase is
used. When this AC is referring to an applicant for an IMA Component Acceptance Letter, the phrase "applicant for IMA Component Acceptance Letter" or other similar phrase is used.
1-3. Cancellation. This AC cancels AC 20-145, Guidance for Integrated Modular Avionics (IMA) that Implement TSO-C153 Authorized Hardware Elements, and incorporates all pertinent information from it that is not covered by RTCA/DO-297.
1-4. Using this AC and RTCA/DO-297.
a. The means in this AC are a complete method to show compliance and obtain approval of IMA components and systems for installation into an aircraft or engine. We intend that this AC be applied at the aircraft or engine level by the applicant for a TC, STC, ATC, or ASTC. That is, this AC is not intended as guidance solely for an IMA developer, IMA system integrator, or IMA application/component supplier.
b. It you are an applicant for an authorization for TSO-C153, Integrated Modular Avionics Hardware Elements, you may use the guidance in this AC as one acceptable means of compliance to requirements defined in TSO-C153. See paragraph 8-7 and appendix A of this AC for more information.
c. We find that the objectives, processes, and activities in RTCA/DO-297, plus the additional guidance material contained in this AC, constitute an acceptable means of compliance for the development, integration, verification, and installation approval of IMA systems. If the applicant wants to propose an alternative means, including those from other industry documents referenced by RTCA/DO-297, document those alternative means and secure FAA approval during your project's planning stage. Prepare to use Issue Papers to document agreements reached.
d. According to the definition of an IMA in Appendix E. Glossary, an IMA is a "shared set of flexible, reusable, and interoperable hardware and software resources that, when integrated, form a platform that provides services." You should keep in mind that an IMA system is defined by the system architecture, not by the functionality the system provides. IMA systems may not always implement functions historically regarded as "avionics", such as flight deck displays, navigation, communication, etc. IMA systems may also be used to implement other aircraft functionality, such as fly-by-wire flight controls, inertial reference/air data systems, or electrical power control systems. There may be more than one IMA system on an aircraft. An IMA system could feasibly be mounted within an engine assembly.
1-5. Applying RTCA/DO-297 as an Acceptable Means of Compliance.
a. RTCA/DO-297 describes objectives, processes, and activities to incrementally accumulate design assurance and acceptance of IMA systems and components. RTCA/DO-297 refers to industry standards such as SAE International's Aerospace Recommended Practice (ARP) 4754, Certification Considerations for Highly Integrated or Complex Aircraft Systems, and SAE ARP 4761, Guidelines and Methods of Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment. When RTCA/DO-297 invokes the processes and methods in specific 2
sections of those industry standards as part of the IMA development, integration, verification, or approval process, you should consider those sections of the referenced industry standard (or other acceptable alternative means) to be part of the overall acceptable means of compliance as outlined in RTCA/DO-297.
Note: SAE International updated their ARP 4754 1o ARP 4754A, "Guidelines for Development of Civil Aircraft and Systems" in December 2010. AC 20-174. Development of Civil Aircraft and Systems, dated September 30. 2011, recognizes ARP 4754A as an acceptable means of compliance for development of aircraft systems. This revision A reflects a significant change to that document, including section and paragraph numbering from that used in the original release. As a result, several references to ARP 4754 by RTCA/DO-297 are incorrect when using SAE ARP 4754A. Please see appendix H of this AC in order to cross reference ARP 4754 with ARP 4754A sections and paragraphs referenced by the original release of RTCA/DO-297.
b. You may use this AC as an acceptable means of compliance for a IMA systems that include TSO authorized articles. Although RTCA/DO-297 does not address TSOs, you should apply the intent of its objectives in Annex A to IMA systems that include TSO authorization(s) in order to obtain IMA system approval. See chapter 8 of this AC for more information.
c. If you choose to follow this AC to show compliance, apply the AC to your IMA development and approval process regardless of the complexity of the IMA system or business model under which it is developed and approved. RTCA/DO-297 is written primarily from the perspective of a complex IMA system developed and integrated by multiple organizations and companies (see RTCA/DO-297. subsection 2.4). Although the development, integration, verification. and approval of an IMA system developed by a single company are likely to be less complex than for multiple companies. RTCA/DO-297 applies equally. This AC should be used as an acceptable means of compliance for IMA systems that:
(1) Are developed by a single company as well as those developed by multiple companies.
If a single company devclops a complete IMA system, many of the separate roles defined in RTCA/DO-297 - such as IMA developer, application developer, and IMA integrator -- will be taken by this single company.
(2) Are simple IMA systems as well as complex IMA systems. These terms are purposely left undefined, because it is difficult to make a clear distinction betwen them. The purpose of this item is to illustrate that this AC should be applied to IMA systems of all levels of complexity.
(3) Are closed architecture as well as open architecture. (See Appendix F.. Glossary.)
(4) Use TSO authorized components (that is, TSO-C153) and functional TSOs (such as TSO-C113, Electronic Flight Displays and TSO-C9, Automatic Pilots) as well as IMA systems that do not use TSO authorized components.
Note: Becausc of the variations described in c. above, not all aspects of RTCA/DO-297 or the additional guidance contained in this AC may apply to every IMA development program.
We strongly recommend that any question regarding the application of this AC be discussed with us at the beginning of the certification program and the agreements reached during those discussions be documented. The FAA may require an Issue Paper on these questions.
d. Appendix A of this AC, Environmental Qualification Guidance for TSO-C153, Integrated Modular Avionics Hardware Elements, shows applicants for TSO-C153 authorization how to conduct environmental qualification testing (EQT) that cnsures compliance to the minimum performance standard (MPS) of TSO-C153. We do not require compliance to appendix A if you are not using TSO-C153 authorized hardware components.
1-6. What This AC Covers. This AC describes an acceptable means by which to apply RTCA/DO-297, along with the additional guidance material included in this AC, to an aircraft or engine certification program which uses an IMA system. We cover the following subjects in detail:
- Acceptance and Incremental Acceptancc (in chapter 2).
- Getting An IMA Component Acceptance Letter (in chapter 3).
- Reuse Of IMA Components (in chapter 4).
- Configuration Management of an IMA System (in chapter 5).
- IMA Recovery Features (in chapter 6).
- Additional Topics Not Covered by RTCA/DO-297 (in chapter 7).
- Use of ISO Authorized Components in IMA Systems (in chapter 8).
Chapter 2 Acceptance And Incremental Acceptance.
2-1. Comparison of RTCA/DO 297 Acceptance and FAA Approval.
a. RTCA/DO-297, paragraph 2.1.2, gives the following definitions:
(1) Acceptance - Acknowledgement by the FAA that the module, application, or system complies with its defined requirements. Acceptance is recognition by the FAA (typically in the form of a letter or stamped data sheet) signifying that the submission of data, justification, or claim of equivalence satisfies applicable guidance or requirements.
The goal of acceptance is to achieve credit for future use in a certification project.
(2) Incremental Acceptance - A process for obtaining credit toward approval and certification by accepting or finding that an IMA module, application, and/or off-aircraft IMA system complies with specific requirements. This incremental acceptance is divided into tasks. Credit granted for individual tasks contributes to the overall certification goal.
Incremental acceptance provides the ability to integrate and accept new applications and/or modules, in an IMA system, and maintain existing applications and/or modules, without the need for re-acceptance.
b. We view acceptance, as defined above, as part of the processes documented by Title 14 of the Code of Federal Regulations (14 CFR) and published FAA policy used to approve airborne systems during an aircraft or engine certification program. To obtain approval for installation on a certified aircraft or engine, applicants must show that the aircraft or engine system/function meets with the applicable regulatory requirements. See §§ 21.17, 21.20, and
21.115. Some of the regulatory requirements are accompanied by an AC (such as this one) that describes one, but not the only, possible means of complying with those regulations.
c. The main differences between RTCA/DO-297 "acceptance" and our current formal process of showing compliance in an aircraft certification program are 1) each stage of RTCA/DO-297 acceptance is accompanied by some form of recognition, such as a "signed letter or stamped data sheet" or "accepted or approved compliance data package." and 2) a goal of acceptance, as defined by RTCA/DO-297, is to "achieve credit for future use in a certification process." Otherwise, the two concepts are very similar: data submissions and statements of compliance are used to show that an airborne system or component complies with all applicable requirements and therefore can be approved for installation onto an aircraft or engine.
d. "Acceptance" is a term often used during the approval of aircraft or engine systems, but its meaning may not be consistent throughout the certification process. The meaning of this word can depend on the context. For example, the RTCA/DO-297's "acceptance" is very similar, but not identical, to AC 20-148, Reusable Software Components. That AC states:
"Acceptance is credit the FAA grants for fully or partially meeting RTCA/DO-178B objectives for an (Reusable Software Component) RSC. The FAA shows acceptance by issuing a RSC acceptance letter." Although the concept is similar between RTCA/DO-297 and AC 20-148, the specific definitions of "acceptance" are not identical. This example illustrates that the meaning 5
of "acceptance" may vary, given its context. Make sure you understand the context and meaning of this term when you encounter it.
e. "Incremental acceptance", as defined in RTCA/DO-297, takes the concept of acceptance further. It divides acceptance into "certification tasks" accomplished during different points, or increments, in the certification program. Each task builds upon previous tasks. Incremental acceptance of IMA components is normally associated with the IMA Component Acceptance Letter process described by RTCA/DO-297. See RTCA/DO-297, Section 4 for more information.
f. An applicant may use acceptance of components within the IMA to accumulate certification credit toward installation approval of an IMA system on an aircraft or engine. The concept of acceptance does not alter or replace FAA certification processes. Instead, acceptance is a means to recognize that a specific IMA component complies with all documented requirements and objectives, and that an accepted component can be used without detailed examination of the compliance data for that component - that is, is the component acceptable for use in an approved airborne system? IMA Component Acceptance Letters described in Chapter 3 of this AC are not required to accumulate certification credit toward installation approval.
2-2. Major Benefits of Incremental Acceptance.
a. The major benefit of using the incremental acceptance process, as defined in RTCA/DO- 297, is that incremental acceptance provides the ability to integrate and accept new components in an IMA system and maintain existing components without the need for re-acceptance. This allows you to:
(1) Reuse accepted IMA components in multiple applications in the same certification program by submitting certification data packages that have an established pedigree. This reduces certification effort of the current aircraft or engine program without compromising system safety.
(2) Reuse accepted IMA components in future certification programs by submitting certification data packages that have an established pedigree. This reduces follow-on certification effort without compromising system safety.
b. The incremental acceptance process defined in RTCA/DO-297 shows how to package and document the data and artifacts of a specific IMA component, so the previously accepted data and artifacts may easily be used in multiple concurrent or future programs.
2-3. IMA Module, Application, System, and Installation Acceptance.
a. Acceptance at each stage of IMA development and verification, as described RTCA/DO- 297, subsection 4.2 (Task 1 - Module Acceptance), subsection 4.3 (Task 2 - Application Acceptance), subsection 4.4 (Task 3 - IMA System Acceptance), and subsection 4.5 (Task 4 - Aircraft Integration of IMA System), is required for IMA system installation approval. We intend that all important aspects in RTCA/DO-297 regarding IMA development, integration, 6
verification, and approval (Tasks 1 through 4) be followed and you show that the IMA system complies with all objectives of RTCA/DO-297, Annex A, regardless of whether you request IMA Component Acceptance Letters. The IMA Component Acceptance Letter process covered in RTCA/DO-297, Section 4, and chapter 3 of this AC is optional. As an applicant, IMA developer/system integrator, or IMA component supplier, you may decide whether or not to request an IMA Component Acceptance Letter.
Note: RTCA/DO-297, subsection 4.6 (Task 5) deals with changes to accepted modules and subsection 4.7 (Task 6) deals with reuse of modules or applications. These subsections are important and should be followed. However, for the purposes of the initial acceptance of the IMA system and approval for installation on an aircraft or engine, only subsections 4.2 through
4.5 (Tasks 1 though 4) are relevant. If previously accepted components are being reused, subsection 4.7 (Task 6) should also be considered.
b. The documentation required to obtain acceptance when you are planning to reuse IMA components may be more than that required if you seeking approval for a component to be only used on a single TC/STC/ATC/ASTC program. Although it is not mandatory, we strongly suggest that in your initial certification plans for the IMA system and/or components, you state which components for which you desire IMA Component Acceptance Letters at the end of the certification program, along with the name of the company or companies that will be asking for those letters.
c. The FAA will not grant acceptance at the higher task levels - that is, Tasks 2, 3, and 4 - until all acceptances at the subordinate levels on which those higher tasks depend have been completed. For example, to obtain acceptance for an IMA application, you should first obtain acceptance of all modules which comprise that application. Likewise, all applications that make up an IMA system should be accepted before we accept the system.
d. If you are going to deviate from certification planning documents already accepted by the FAA, you should request a deviation to those plans. The request should include a justification for the deviation and the mitigating actions (if any) that you plan to take.
2-4. Documentation And Data Packaging. RTCA/DO-297, Section 4 addresses the artifacts required for acceptance at the various task levels. Examples include the module acceptance plan, the module requirements specification, the module configuration index, the IMA system certification plan, and the IMA system validation and verification plan. This AC does not require that you use those specific document titles or methods of data packaging. They represent one particular acceptable means to comply with RTCA/DO-297. We accept alternative document titles and data packaging. However, if you use alternative documentation naming convention and data packaging, you should address all significant aspects in RTCA/DO-297, Section 4 and Annex A to claim compliance to this AC. See RTCA/DO-297, subsection 4.1 for more information.
Chapter 3 Obtaining an IMA Component Acceptance Letter.
3-1. General Guidance Regarding IMA Component Acceptance Letters.
a. Obtaining an IMA Component Acceptance Letter is optional for applicants, IMA developers/system integrators, and IMA component developers. The decision to apply or not apply for an IMA Component Acceptance Letter has no bearing on the final approval of the IMA system and its installation onto an aircraft or engine. The main reason to obtain an IMA Component Acceptance Letter is to formally document acceptance of the compliance data for future or concurrent reuse of that accepted IMA component. If you do not request an IMA Component Acceptance Letter, we will not issue one.
b. We typically issue the IMA Component Acceptance Letter after:
(1) The applicant has completed and submitted all applicable documentation and shown that the objectives of RTCA/DO-297, Annex A, Table A-1 and/or A-2 (depending on if the IMA component is a module or an application), Table A-3, and Table A-4 have been achieved, and
(2) We find no installation, safety, operational, functional, or performance concerns.
c. If there are software operating systems, generic hardware computing/power supply modules, or other IMA components not dependent on IMA system integration or aircraft installation, we may issue an IMA Component Acceptance Letter before completion of those later stages of IMA development and integration. However, you should work with the FAA during the planning process if you desire an IMA Component Acceptance Letter prior to the certification of the aircraft or engine. Otherwise, this request for an IMA Component Acceptance Letter may not be prioritized according to your needs, as the FAA will normally issue IMA Component Acceptance Letters after the completion of the certification program.
d. According to RTCA/DO-297, subsection 4.7, future reuse of compliance data for a previously accepted IMA component is limited to IMA modules and applications. Therefore, we will only issue IMA Component Acceptance Letters for IMA modules and applications. We will not issue IMA Component Acceptance Letters for an IMA system or its installation onto an aircraft or engine.
e. RTCA/DO-297, subsection 4.1, states: "IMA acceptance can only be proposed in the context of an actual certification project." That means we issue IMA Component Acceptance Letters only for IMA components being developed and approved for a specific aircraft/engine certification program. We do not issue IMA Component Acceptance Letters for TSO authorized articles that are not for an identified aircraft/engine certification program.
f. A request for an IMA Component Acceptance Letter is not limited to the developer of an IMA component. The applicant, IMA developer/system integrator, or IMA component developer may apply for an IMA Component Acceptance Letter. The intent to request an IMA 8
Component Acceptance Letter should be included in the appropriate certification planning documentation.
g. Because IMA component acceptance is relevant only within the context of an aircraft/engine certification program, you may ask if a specific compliance data package belongs to the applicant, or to the company supplying the IMA component or system. The answer depends upon the agreements reached between the various companies. Consequently, we strongly suggest that all parties document their plan for IMA Component Acceptance Letters, including the intent for concurrent or future reuse, at the start of the aircraft or engine certification program. This way, all parties will understand and agree on how data for the current program may be used in the future - possibly for a different applicant than the current aircraft/engine program.
h. Use the following guidance to determine which FAA office you should apply to for an IMA Component Acceptance Letter:
(1) If there is a valid IMA Component Acceptance Letter for an IMA component and that component is being updated, then you should apply for a new IMA Component Acceptance Letter to the Aircraft Certification Office (ACO) that issued the existing IMA Component Acceptance Letter. Otherwise, use the guidance in items (2) through (5).
(2) If the IMA component in question will not also be getting a TSO authorization (either TSO-C153 or functional TSO), you should apply for an IMA Component Acceptance Letter to the ACO that is responsible for the certification of the aircraft or engine that will be using that IMA component.
(3) If the IMA component is question will also be getting a TSO authorization (either TSO-C153 or functional TSO), you should apply for a new IMA Component Acceptance Letter to the ACO that is responsible for issuing the TSO authorization for that IMA component.
(4) If the aircraft or engine in which the IMA component is to be installed is of non-U.S.
design and manufacture, you should apply for an IMA Component Acceptance Letter to the ACO that you would normally apply to for a TSO authorization. The manufacturer of that aircraft or engine should be in the process of obtaining, or has already obtained, an FAA certification. We will not issue an IMA Component Acceptance Letter for an IMA component that is used on an aircraft or engine that is not seeking an FAA certification. In this case, the ACO to which the application for an IMA Component Acceptance Letter is made will coordinate with the FAA office that is acting as the Validating Authority for that aircraft or engine program.
(5) We will not issue an IMA Component Acceptance Letter to a company that is not based within the United States. There is not an ACO that has geographic responsibility and oversight of that company.
3-2. Parts of the IMA Component Acceptance Letter.
a. An IMA Component Acceptance Letter is composed of three parts:
(1) The IMA Component Acceptance Cover Letter, prepared and signed by the applicant for the IMA Component Acceptance Letter. See paragraph 3-3.
(2) The IMA Component Acceptance Letter data sheet, prepared by the applicant for the IMA Component Acceptance Letter. See paragraph 3-4.
(3) The Acceptance Letter, prepared and signed by the FAA. See paragraph 3-5.
b. If you are an applicant for an IMA Component Acceptance Letter, assemble your request package (both the completed IMA Component Acceptance Cover Letter and the IMA Component Acceptance Letter data sheet) and submit it to the appropriate FAA office. If we approve your request, we will prepare and sign a Acceptance Letter for that IMA component.
We will send the applicant for the IMA Component Acceptance Letter a copy of the IMA Component Acceptance Cover Letter and the signed Acceptance Letter. We will retain and archive the original of all three parts of the IMA Component Acceptance Letter.
c. At your request, we will provide extra copies of the signed Acceptance Letter and IMA Component Acceptance Cover Letter to you or to another company.
d. You should maintain your own files of the IMA Component Acceptance Cover Letter and IMA Component Acceptance Letter data sheet. We will not provide copies of the IMA Component Acceptance Letter data sheet.
e. We do not allow modifications to previously accepted IMA components under an existing IMA Component Acceptance Letter. If you change a previously accepted IMA component and still want an IMA Component Acceptance Letter, you will have to apply for another one. See paragraph 4-9 of this AC for more information on changes to an accepted IMA component.
3-3. Essential Elements of the IMA Component Acceptance Cover Letter.
a. The IMA Component Acceptance Cover Letter specifies what compliance data is being accepted by the FAA. The applicant for an IMA Component Acceptance Letter should include the following information in the IMA Component Acceptance Cover Letter:
(1) Date of application for the IMA Component Acceptance Letter.
(2) The FAA office to which the request for an IMA Component Acceptance Letter is being made.
(3) Unique identifier for the IMA Component Acceptance Cover Letter. The specific format of this identifier is left to the discretion of the applicant for the IMA Component Acceptance Letter. It could be a company correspondence number or a unique identifier used solely for the purpose of application for IMA Component Acceptance Letters. However, once a particular identification is used, it should not be re-used.