U.S. Department Advisory of Transportation Federal Aviation Circular Administration Subject: Integrated Modular Avionics Date: 11/21/2013 AC No: 20-170 Approval Using RTCA/DO-297 and Technical Development, Verification, Integration, and Initiated by: AIR-120 Change: 1 Standard Order-C153 Purpose. This advisory circular (AC) sets forth an acceptable means of compliance for aircraft and engines that utilize Integrated Modular Avionics (IMA) systems. This AC calls out and supplements the guidance material of RTCA/DO-297, Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations, dated November 8, 2005. This AC incorporates pertinent guidance material and information from AC 20-145, Guidance for Integrated Modular Avionics (IMA) that Implement TSO-C153 Authorized Hardware Elements.
AC 20-145 is now cancelled.
Principal Changes. This change incorporates minor changes and updates, and a new appendix to AC 20-170. These changes are necessary in order to address incorrect references in RTCA/DO-297 when using SAF ARP 4754, Rev. A, which is recognized by AC 20-174.
Information regarding whom you may contact with questions regarding the information in this AC, and where you may obtain a copy, are also included.
PAGE CONTROL CHART Remove Pages Dated Insert Pages Dated Table of Contents. page 10/28/10 Table of Contents, page iv.
IV (12/28/10) Pages 3 through 4 10/28/10 Pages 3 through 4 Page 26 10/28/10 Page 26 Pages D-1 through D-3 10/20/10 Appendix D. pages D-1 through D-3 Appendix H. page I1-1 SusangH Calle For David W. Hempe Manager, Aircraft Engineering Division Aircraft Certification Division
U.S. Department Advisory of Transportation Federal Aviation Circular Administration Subject: Integrated Modular Avionics Date: 10/28/10 AC No: 20-170 Development, Verification, Integration, and Initiated by: AIR-120 Approval Using RTCA/DO-297 and Technical Standard Order-C153 This advisory circular (AC) sets forth an acceptable means of compliance for aircraft and engines that utilize Integrated Modular Avionics (IMA) systems. This AC calls out and supplements the guidance material of RTCA/DO-297, Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations, dated November 8, 2005. This AC incorporates pertinent guidance material and information from AC 20-145, Guidance for Integrated Modular Avionics (IMA) that Implement TSO-C153 Authorized Hardware Elements. AC 20-145 is now Susann Caller Pe David W. Hempe Manager, Aircraft Engineering Division Aircraft Certification Division
Table of Contents Chapter 1 RTCA-DO-297 as an Acceptable Means of Compliance.
1-1. Purpose of this AC...
1-2. Whom this AC Affects..
1-3. Cancellation... 2
1-4. Using this AC and RTCA/DO-297.
1-5. Applying RTCA/DO-297 as an Acceptable Means of Compliance.
1-6. What This AC Covers.. 4 Chapter 2 Acceptance And Incremental Acceptance. . 5
2-1. Comparison of RTCA/DO 297 Acceptance and FAA Approval.
2-2. Major Benefits of Incremental Acceptance.
2-3. IMA Module, Application, System, and Installation Acceptance. 6
2-4. Documentation And Data Packaging. 7 Chapter 3 Obtaining an IMA Component Acceptance Letter. .8
3-1. General Guidance Regarding IMA Component Acceptance Letters
3-2. Parts of the IMA Component Acceptance Letter. .. 9
3-3. Essential Elements of the IMA Component Acceptance Cover Letter. 10
3-4. Essential Elements of the IMA Component Acceptance Letter Data Sheet. 12
3-5. Acceptance Letter... 13
3-6. IMA Component Acceptance Letters For Revised IMA Components. 13
3-7. Cancelling an IMA Component Acceptance Letter. 14 Chapter 4 Reuse Of IMA Components. .. 15
4-1. Reuse of an Accepted IMA Component. 15
4-2. What Can Be Reused... 15
4-3. Reuse of Other Types of Compliance Data. . 16
4-4. Reuse of Previously Accepted Software-Only or Hardware Component Containing Airborne Software. .. . 17
4-5. Reuse of CEH or Hardware Component Containing CEH. .. 17
4-6. Reuse Of SEH or Hardware Component Containing SEH 18
4-7. Reuse of EQT Data. . - 18
4-8. Data the Component Developer Owes to the IMA Developer/System Integrator or Applicant. 19
4-9. Reuse of a Previously Accepted IMA Component That Was Revised.. .. 19
4-10. Reuse of an IMA Component with a Previous TSO Authorization ... 20 Chapter 5 Configuration Management of an IMA System. ..21
5-1. IMA Configuration Management.. .. 21
5-2. Automated, Robust Configuration Management. .. 21
5-3. Non-Automated, Robust Configuration Management. .. 22
5-4. Software Loading Procedures... 22
5-5. Assurance Level of IMA Components Used in Configuration Management. 22 Chapter 6 IMA Recovery Features.. 23
6-1. Restarting Safety Critical IMA Functions 23
6-2. Restart Mechanism Implementation 23 Chapter 7 Topics Not Covered by RTCA/DO-297 ..24
7-1. Electrical Power For IMA Systems 24
7-2. Field Loadable Software. . 24
7-3. Electronic Identification Guidance 26
7-4. Aircraft System Lightning and HIRF Protection 27 Chapter 8 Use Of TSO Authorized Components In IMA Systems. .. 29
8-1. IMA Systems and TSOs.. 29
8-2. TSO-C153 Authorization for IMA Hardware Components. 29
8-3. Functional TSO Authorization30
8-4. EQT of IMA Components with TSO Authorization. 30
8-5. IMA Component TSO Part Marking.. 31
8-6. Integration of TSO Authorized Components in IMA Systems. 32
8-7. Aircraft Installation Approval of IMA Systems Including TSO Authorized Components.
8-8. Roles and Responsibilities When TSO Authorized Components Are Used in IMA Systems.. 32 ¡ii
Appendix A Environmental Qualification Guidance for TSO-C153. A-1 Appendix B Sample IMA Component Acceptance Cover Letter. .B-1 Appendix C Sample Acceptance Letter. .C-1 Appendix D Related Documents And How To Get Them. ..D-1 Appendix E Glossary... .E-1 Appendix F Acronyms....... ..F-1
Appendix G Partial List of Functional TSOs...........G-1
Appendix H SAE ARP 4754 to ARP 4754A Cross-Reference MatrixH-1
iv
Chapter 1 RTCA-DO-297 as an Acceptable Means of Compliance.
1-1. Purpose of this AC.
a. This advisory circular (AC) shows you how to obtain Federal Aviation Administration (FAA) airworthiness approval for the development, verification, and integration of an integrated modular avionics (IMA) system for installation into an aircraft or engine. We cite RTCA, Inc.
document RTCA/DO-297, Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations, dated November 8, 2005 and supplement it with this text. This AC also provides guidance on how to show compliance with Technical Standard Order (TSO)-C153, Integrated Modular Avionics Hardware Elements.
b. This AC is not mandatory and does not constitute a regulation. In it, we describe an acceptable means, though it is not the only means, to obtain FAA approval of IMA systems.
c. This AC uses the terminology "should" when discussing compliance to the AC itself, as the AC represents one, but not the only, method of complying with the regulations. This AC uses the term "must" when discussing compliance to the regulations, as compliance to a regulation is not optional. In these cases, the AC text supplies a reference to the specific rule(s) being discussed.
1-2. Whom this AC Affects.
a. We wrote this AC for:
(1) Applicants for type certificates (TC), amended TC (ATC), supplemental TC (STC), or amended STC (ASTC) of aircraft and aircraft engines implementing IMA systems and equipment,
(2) Developers of IMA systems, applications, and components,
(3) Applicants for TSO-C153, Integrated Modular Avionics Hardware Elements, and for functional TSOs as they apply to IMA systems,
(4) Integrators of IMA systems,
(5) Installers of the IMA system into the aircraft, and
(6) Those involved in the approval and continued airworthiness of IMA systems.
b. When the term "applicant" is used in this AC, we are referring to the applicant for an aircraft or engine TC, STC, ATC, or ASTC. When this AC is referring to an applicant for a TSO authorization (TSOA), the phrase "applicant for TSO authorization" or other similar phrase is
used. When this AC is referring to an applicant for an IMA Component Acceptance Letter, the phrase "applicant for IMA Component Acceptance Letter" or other similar phrase is used.
1-3. Cancellation. This AC cancels AC 20-145, Guidance for Integrated Modular Avionics (IMA) that Implement TSO-C153 Authorized Hardware Elements, and incorporates all pertinent information from it that is not covered by RTCA/DO-297.
1-4. Using this AC and RTCA/DO-297.
a. The means in this AC are a complete method to show compliance and obtain approval of IMA components and systems for installation into an aircraft or engine. We intend that this AC be applied at the aircraft or engine level by the applicant for a TC, STC, ATC, or ASTC. That is, this AC is not intended as guidance solely for an IMA developer, IMA system integrator, or IMA application/component supplier.
b. It you are an applicant for an authorization for TSO-C153, Integrated Modular Avionics Hardware Elements, you may use the guidance in this AC as one acceptable means of compliance to requirements defined in TSO-C153. See paragraph 8-7 and appendix A of this AC for more information.
c. We find that the objectives, processes, and activities in RTCA/DO-297, plus the additional guidance material contained in this AC, constitute an acceptable means of compliance for the development, integration, verification, and installation approval of IMA systems. If the applicant wants to propose an alternative means, including those from other industry documents referenced by RTCA/DO-297, document those alternative means and secure FAA approval during your project's planning stage. Prepare to use Issue Papers to document agreements reached.
d. According to the definition of an IMA in Appendix E. Glossary, an IMA is a "shared set of flexible, reusable, and interoperable hardware and software resources that, when integrated, form a platform that provides services." You should keep in mind that an IMA system is defined by the system architecture, not by the functionality the system provides. IMA systems may not always implement functions historically regarded as "avionics", such as flight deck displays, navigation, communication, etc. IMA systems may also be used to implement other aircraft functionality, such as fly-by-wire flight controls, inertial reference/air data systems, or electrical power control systems. There may be more than one IMA system on an aircraft. An IMA system could feasibly be mounted within an engine assembly.
1-5. Applying RTCA/DO-297 as an Acceptable Means of Compliance.
a. RTCA/DO-297 describes objectives, processes, and activities to incrementally accumulate design assurance and acceptance of IMA systems and components. RTCA/DO-297 refers to industry standards such as SAE International's Aerospace Recommended Practice (ARP) 4754, Certification Considerations for Highly Integrated or Complex Aircraft Systems, and SAE ARP 4761, Guidelines and Methods of Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment. When RTCA/DO-297 invokes the processes and methods in specific 2
sections of those industry standards as part of the IMA development, integration, verification, or approval process, you should consider those sections of the referenced industry standard (or other acceptable alternative means) to be part of the overall acceptable means of compliance as outlined in RTCA/DO-297.
Note: SAE International updated their ARP 4754 1o ARP 4754A, "Guidelines for Development of Civil Aircraft and Systems" in December 2010. AC 20-174. Development of Civil Aircraft and Systems, dated September 30. 2011, recognizes ARP 4754A as an acceptable means of compliance for development of aircraft systems. This revision A reflects a significant change to that document, including section and paragraph numbering from that used in the original release. As a result, several references to ARP 4754 by RTCA/DO-297 are incorrect when using SAE ARP 4754A. Please see appendix H of this AC in order to cross reference ARP 4754 with ARP 4754A sections and paragraphs referenced by the original release of RTCA/DO-297.
b. You may use this AC as an acceptable means of compliance for a IMA systems that include TSO authorized articles. Although RTCA/DO-297 does not address TSOs, you should apply the intent of its objectives in Annex A to IMA systems that include TSO authorization(s) in order to obtain IMA system approval. See chapter 8 of this AC for more information.
c. If you choose to follow this AC to show compliance, apply the AC to your IMA development and approval process regardless of the complexity of the IMA system or business model under which it is developed and approved. RTCA/DO-297 is written primarily from the perspective of a complex IMA system developed and integrated by multiple organizations and companies (see RTCA/DO-297. subsection 2.4). Although the development, integration, verification. and approval of an IMA system developed by a single company are likely to be less complex than for multiple companies. RTCA/DO-297 applies equally. This AC should be used as an acceptable means of compliance for IMA systems that:
(1) Are developed by a single company as well as those developed by multiple companies.
If a single company devclops a complete IMA system, many of the separate roles defined in RTCA/DO-297 - such as IMA developer, application developer, and IMA integrator -- will be taken by this single company.
(2) Are simple IMA systems as well as complex IMA systems. These terms are purposely left undefined, because it is difficult to make a clear distinction betwen them. The purpose of this item is to illustrate that this AC should be applied to IMA systems of all levels of complexity.
(3) Are closed architecture as well as open architecture. (See Appendix F.. Glossary.)
(4) Use TSO authorized components (that is, TSO-C153) and functional TSOs (such as TSO-C113, Electronic Flight Displays and TSO-C9, Automatic Pilots) as well as IMA systems that do not use TSO authorized components.
Note: Becausc of the variations described in c. above, not all aspects of RTCA/DO-297 or the additional guidance contained in this AC may apply to every IMA development program.
We strongly recommend that any question regarding the application of this AC be discussed with us at the beginning of the certification program and the agreements reached during those discussions be documented. The FAA may require an Issue Paper on these questions.
d. Appendix A of this AC, Environmental Qualification Guidance for TSO-C153, Integrated Modular Avionics Hardware Elements, shows applicants for TSO-C153 authorization how to conduct environmental qualification testing (EQT) that cnsures compliance to the minimum performance standard (MPS) of TSO-C153. We do not require compliance to appendix A if you are not using TSO-C153 authorized hardware components.
1-6. What This AC Covers. This AC describes an acceptable means by which to apply RTCA/DO-297, along with the additional guidance material included in this AC, to an aircraft or engine certification program which uses an IMA system. We cover the following subjects in detail:
- Acceptance and Incremental Acceptancc (in chapter 2).
- Getting An IMA Component Acceptance Letter (in chapter 3).
- Reuse Of IMA Components (in chapter 4).
- Configuration Management of an IMA System (in chapter 5).
- IMA Recovery Features (in chapter 6).
- Additional Topics Not Covered by RTCA/DO-297 (in chapter 7).
- Use of ISO Authorized Components in IMA Systems (in chapter 8).
Chapter 2 Acceptance And Incremental Acceptance.
2-1. Comparison of RTCA/DO 297 Acceptance and FAA Approval.
a. RTCA/DO-297, paragraph 2.1.2, gives the following definitions:
(1) Acceptance - Acknowledgement by the FAA that the module, application, or system complies with its defined requirements. Acceptance is recognition by the FAA (typically in the form of a letter or stamped data sheet) signifying that the submission of data, justification, or claim of equivalence satisfies applicable guidance or requirements.
The goal of acceptance is to achieve credit for future use in a certification project.
(2) Incremental Acceptance - A process for obtaining credit toward approval and certification by accepting or finding that an IMA module, application, and/or off-aircraft IMA system complies with specific requirements. This incremental acceptance is divided into tasks. Credit granted for individual tasks contributes to the overall certification goal.
Incremental acceptance provides the ability to integrate and accept new applications and/or modules, in an IMA system, and maintain existing applications and/or modules, without the need for re-acceptance.
b. We view acceptance, as defined above, as part of the processes documented by Title 14 of the Code of Federal Regulations (14 CFR) and published FAA policy used to approve airborne systems during an aircraft or engine certification program. To obtain approval for installation on a certified aircraft or engine, applicants must show that the aircraft or engine system/function meets with the applicable regulatory requirements. See §§ 21.17, 21.20, and
21.115. Some of the regulatory requirements are accompanied by an AC (such as this one) that describes one, but not the only, possible means of complying with those regulations.
c. The main differences between RTCA/DO-297 "acceptance" and our current formal process of showing compliance in an aircraft certification program are 1) each stage of RTCA/DO-297 acceptance is accompanied by some form of recognition, such as a "signed letter or stamped data sheet" or "accepted or approved compliance data package." and 2) a goal of acceptance, as defined by RTCA/DO-297, is to "achieve credit for future use in a certification process." Otherwise, the two concepts are very similar: data submissions and statements of compliance are used to show that an airborne system or component complies with all applicable requirements and therefore can be approved for installation onto an aircraft or engine.
d. "Acceptance" is a term often used during the approval of aircraft or engine systems, but its meaning may not be consistent throughout the certification process. The meaning of this word can depend on the context. For example, the RTCA/DO-297's "acceptance" is very similar, but not identical, to AC 20-148, Reusable Software Components. That AC states:
"Acceptance is credit the FAA grants for fully or partially meeting RTCA/DO-178B objectives for an (Reusable Software Component) RSC. The FAA shows acceptance by issuing a RSC acceptance letter." Although the concept is similar between RTCA/DO-297 and AC 20-148, the specific definitions of "acceptance" are not identical. This example illustrates that the meaning 5
of "acceptance" may vary, given its context. Make sure you understand the context and meaning of this term when you encounter it.
e. "Incremental acceptance", as defined in RTCA/DO-297, takes the concept of acceptance further. It divides acceptance into "certification tasks" accomplished during different points, or increments, in the certification program. Each task builds upon previous tasks. Incremental acceptance of IMA components is normally associated with the IMA Component Acceptance Letter process described by RTCA/DO-297. See RTCA/DO-297, Section 4 for more information.
f. An applicant may use acceptance of components within the IMA to accumulate certification credit toward installation approval of an IMA system on an aircraft or engine. The concept of acceptance does not alter or replace FAA certification processes. Instead, acceptance is a means to recognize that a specific IMA component complies with all documented requirements and objectives, and that an accepted component can be used without detailed examination of the compliance data for that component - that is, is the component acceptable for use in an approved airborne system? IMA Component Acceptance Letters described in Chapter 3 of this AC are not required to accumulate certification credit toward installation approval.
2-2. Major Benefits of Incremental Acceptance.
a. The major benefit of using the incremental acceptance process, as defined in RTCA/DO- 297, is that incremental acceptance provides the ability to integrate and accept new components in an IMA system and maintain existing components without the need for re-acceptance. This allows you to:
(1) Reuse accepted IMA components in multiple applications in the same certification program by submitting certification data packages that have an established pedigree. This reduces certification effort of the current aircraft or engine program without compromising system safety.
(2) Reuse accepted IMA components in future certification programs by submitting certification data packages that have an established pedigree. This reduces follow-on certification effort without compromising system safety.
b. The incremental acceptance process defined in RTCA/DO-297 shows how to package and document the data and artifacts of a specific IMA component, so the previously accepted data and artifacts may easily be used in multiple concurrent or future programs.
2-3. IMA Module, Application, System, and Installation Acceptance.
a. Acceptance at each stage of IMA development and verification, as described RTCA/DO- 297, subsection 4.2 (Task 1 - Module Acceptance), subsection 4.3 (Task 2 - Application Acceptance), subsection 4.4 (Task 3 - IMA System Acceptance), and subsection 4.5 (Task 4 - Aircraft Integration of IMA System), is required for IMA system installation approval. We intend that all important aspects in RTCA/DO-297 regarding IMA development, integration, 6
verification, and approval (Tasks 1 through 4) be followed and you show that the IMA system complies with all objectives of RTCA/DO-297, Annex A, regardless of whether you request IMA Component Acceptance Letters. The IMA Component Acceptance Letter process covered in RTCA/DO-297, Section 4, and chapter 3 of this AC is optional. As an applicant, IMA developer/system integrator, or IMA component supplier, you may decide whether or not to request an IMA Component Acceptance Letter.
Note: RTCA/DO-297, subsection 4.6 (Task 5) deals with changes to accepted modules and subsection 4.7 (Task 6) deals with reuse of modules or applications. These subsections are important and should be followed. However, for the purposes of the initial acceptance of the IMA system and approval for installation on an aircraft or engine, only subsections 4.2 through
4.5 (Tasks 1 though 4) are relevant. If previously accepted components are being reused, subsection 4.7 (Task 6) should also be considered.
b. The documentation required to obtain acceptance when you are planning to reuse IMA components may be more than that required if you seeking approval for a component to be only used on a single TC/STC/ATC/ASTC program. Although it is not mandatory, we strongly suggest that in your initial certification plans for the IMA system and/or components, you state which components for which you desire IMA Component Acceptance Letters at the end of the certification program, along with the name of the company or companies that will be asking for those letters.
c. The FAA will not grant acceptance at the higher task levels - that is, Tasks 2, 3, and 4 - until all acceptances at the subordinate levels on which those higher tasks depend have been completed. For example, to obtain acceptance for an IMA application, you should first obtain acceptance of all modules which comprise that application. Likewise, all applications that make up an IMA system should be accepted before we accept the system.
d. If you are going to deviate from certification planning documents already accepted by the FAA, you should request a deviation to those plans. The request should include a justification for the deviation and the mitigating actions (if any) that you plan to take.
2-4. Documentation And Data Packaging. RTCA/DO-297, Section 4 addresses the artifacts required for acceptance at the various task levels. Examples include the module acceptance plan, the module requirements specification, the module configuration index, the IMA system certification plan, and the IMA system validation and verification plan. This AC does not require that you use those specific document titles or methods of data packaging. They represent one particular acceptable means to comply with RTCA/DO-297. We accept alternative document titles and data packaging. However, if you use alternative documentation naming convention and data packaging, you should address all significant aspects in RTCA/DO-297, Section 4 and Annex A to claim compliance to this AC. See RTCA/DO-297, subsection 4.1 for more information.