U.S. Department Advisory of Transportation Circular Federal Aviation Administration Subject: Altematives to RTCA/DO-178B for Date: 01/19/11 AC No: 20-171 Software in Airborne Systems and Equipment Initiated by: AIR-120 Change:
1. Purpose of this Advisory Circular (AC).
a. On January 11, 1993, we, the Federal Aviation Administration (FAA), published Advisory Circular (AC) 20-115B recognizing RTCA/DO-178B, Software Considerations in Airborne Systems and Equipment Certification, dated December 1, 1992, as a means, but not the only means, to seek FAA approval of airborne software. RTCA/DO-178B is recognized by industry and certification authorities as an accepted approach for assuring that software in airborne systems and equipment has been developed to meet the safety objectives of the regulations.
This AC identifies what you, as an applicant, will have to address and document when you propose an alterative approach to that defined in RTCA/DO-178B. This AC is intended to provide you, the applicant, with guidance on how to establish that your proposed alternative provides the same level of assurance as that provided in RTCA/DO-178B for airborne software.
Your proposed alternative should be evaluated in conjunction with the certification process and applied to airborne systems and equipment (containing software) for which you are seeking FAA approval in order to obtain a Type Certificate, Supplemental Type Certificate, Amended Type Certificate, or Amended Supplemental Type Certificate.
b. The FAA also provides other applicable guidance for software approval that is not included in RTCA/DO-178B. You should identify how this guidance may apply to your proposed alternative.
c. The Technical Standard Order process is outside the scope of this AC. There are separate processes and guidelines for deviations to their standards (See Title 14 of the Code of Federal Regulations (14 CFR) § 21.609).
d. We use the term alternative to define an approach that is different than the approach described in RTCA/DO-178B. An alternative may include one that replaces RTCA/DO-178B in its entirety, or only in part. Your proposed approach should demonstrate how compliance to the appropriate 14 CFR regulations is established.
e. This AC is not mandatory and does not constitute a regulation. In it, we describe an acceptable means for you to seek our approval of an alternative, but it is not the only acceptable means. If you use the means described in this AC, you must follow it in all respects.
2. To Whom this AC Applies. We wrote this AC for manufacturers and developers of airborne systems and equipment (containing software) that are installed on all Type Certified aircraft, engines, and propellers.
3. Communication and Continued Coordination with the FAA.
a. When you propose a compliance approach to 14 CFR regulations that is an alternative to the RTCA/DO-178B software assurance process, you should establish early commumication with us in the certification project, and if applicable, with other certification authorities. Before you proceed with the implementation of an alternative you should establish agreement with the FAA that your alternative is acceptable. This can be done through familiarization meetings and a preliminary project-specific certification plan prior to application. This will allow us an opportunity to identify the scope of your proposed alternative and determine our level of involvement in the project. Our team may include FAA chief scientist and technical advisors, technical specialists, and appropriate standards and policy staffs to assist in the evaluation and acceptance of your proposed alternative.
b. Once you have formalized your plans and submitted your project to us, we should respond with an FAA-prepared issue paper (IP). IPs provide a vehicle for the negotiation and resolution of certification issues while maintaining a standardized position within the FAA and a consensus with the applicant. They describe and track the resolution of significant technical, regulatory, and administrative issues that occur during a project. The IP should:
(1) Provide an overview and description of your proposed alternative to RTCA/DO-178B and how the alternative supports the demonstration of compliance to the applicable 14 CFR regulations;
(2) Identify a means of determining the status of our acceptance of your proposed alternative;
(3) Identify the level of FAA involvement in your project; and
(4) Summarize how any issues with the alternative were resolved.
c. By following this process, we will establish expectations and document our agreements early in the project Alternatives should be identified in the software plans for certification projects. If alternatives are proposed late in a program or you deviate from the agreed approach, you should provide a gap analysis that includes any differences between what was originally planned and the implemented approach, the current project status, and, if applicable, any operational limitations or other mitigating factors to ensure the airworthiness of the product.
Alternative proposals submitted late in a project may result in an extended project schedule depending on the complexity of the issue, level of FAA coordination, and your ability to follow the guidance provided in this AC.
Note: Although we may accept your proposed alternative, other certification authorities may not.
4. Equivalent Level of Safety Assurance.
a. The commercial aviation industry and international aircraft certification authorities have accepted RTCA/DO-178B as an assurance process that:
(1) Demonstrates that the airborne software performs its intended function;
(2) Minimizes the possibility of software errors;
(3) Verifies the software correctly implements its specified requirements;
(4) Demonstrates traceability to higher level systems-level and aircraft-level specified requirements and processes, and
(5) Demonstrates that the software, as installed in target systems and equipment, supports the complete systems and equipment compliance to the regulations.
b. This assurance process includes objectives and activities for planning, development, verification, quality assurance, configuration management, and certification authority coordination. It includes rigorous, iterative, and structured objectives and activities by which airborne software should be developed. Each objective is supported by a recommended set of activities. Each software level identifies applicable objectives, level of independence, and configuration control criteria. The process also identifies a defined set of inter-relationships, sequencing, independence, configuration control, feedback mechanisms and transition criteria.
Throughout the assurance process, the software requirements are traced and verified to assure system and software functionality, and compliance to safety objectives and requirements.
c. RTCA/DO-178B establishes a level of safety assurance for software that supports the demonstration of compliance to the regulations. Your proposed alternative must demonstrate an equivalent level of safety assurance to the regulations.
5. Identifying the Intent and the Alternative.
a. When you seek approval of your airborne systems and equipment software by an alternative that replaces RTCA/DO-178B in its entirety, or only in part, for compliance to 14 CFR, you should:
(1) Address the principles achieved by the RTCA/DO-178B process described in Section 4 of this document in your certification planning;
(2) Describe the intent of each of the objectives and/or activities for which you are proposing an alternative.
b. Before you proceed with implementation of your alternative, you should identify:
(1) A compliance approach under 14 CFR that addresses the principles found in Section 4 of this AC;
(2) How your alternative approach meets the intent of the objectives and/or activities defined in RTCA/DO-178B process as described in Section 5 of this AC; and
(3) How your approach demonstrates compliance to the regulations.
c. Then, you should discuss your proposed alternative with us to establish an agreement on the relationship between your proposal and the original intention of the objective(s) and/or associated activities. Where applicable, you should also address verification independence, software quality assurance, configuration data control categories, and applicability of guidance by software level in your proposed alternative.
d. These activities should be addressed in your software planning documents. Depending on the scope and complexity of your proposed alternative, your alternative may be approved at the discretion of the responsible FAA office, without the use of an IP as described in section 3 (b) of this AC.
6. Proposing an Alternative.
a. For your proposed alternative, identify all inter-relationships between the software development processes, including how errors are detected, captured, documented and fed back into the overall systems assurance process, and resolved. Establish transition criteria between the system requirements, software requirements, design, code, integration, verification, configuration management, and quality assurance activities. Specify how the software development processes will be accomplished in a disciplined manner that ensures the software functions as intended, limuts software development errors that could impact safety, and complies with the applicable regulations.
b. Provide an unambiguous description of the intended functions(s) of the airborne system, its safety objectives, and intended operational environment. Document how your proposed alternative will assure that the specified requirements allocated to software will be properly verified and the software integrated into the overall system. This will facilitate the proper assessments of its impact on aircraft safety and your proposed alternative's part in demonstrating compliance to the regulations. You can use SAE, International Aerospace Recommended Practice (ARP) 4754, Certification Considerations for Highly-Integrated or Complex Aircraft Systems, dated November 1, 1996 and published by SAE, International to assist in understanding and documenting the system development processes, including the system safety assessment process.
c. Conduct a safety assessment for the systems and equipment and identify how the software supports the safety objectives and requirements at the sub-system, system and aircraft levels. You may use SAE, International ARP 4761, Guidelines and Methods for Conducting the 4
Safety Assessment Process in Civil Airborne Systems and Equipment, dated December 1, 1996 to assist in understanding the system safety assessment process. Document your results using the applicable methods, such as functional hazard assessments, fault trees, failure modes and effect analyses, common cause analysis, etc. This will be used to assure the intended safety and functional requirements allocated to the software are fully met and support your demonstration of compliance with the regulations. FAA ACs for 14 CFR parts 23/25/27/29/33/35 contain guidance for acceptable means for the development of a system safety assessment.
d. Your proposed alternative should support the level of assurance identified by the aircraftlevel and systems-level safety assessment processes. Document how your alternative provides the same level of assurance as that provided by DO-178B by using industry best practices, research findings, scientific evidence, and other means, as applicable.
e. Having a good understanding of the software function(s), target installation, operational environment, and safety objectives will allow us to apply the proper risk assessment principles and determine the acceptability of your proposed alternative and compliance with the regulations.
The level of effort required to obtain our approval of your proposed alternative will depend on the software level, the impact of the alternative on the software development processes, and our ability to determine compliance to the regulations.
7. Documenting the Alternative.
a. Document your rationale (including any supporting data, logic, analysis, best practices, scientific or research evidence, etc.) and the means that is being considered as an alternative to RTCA/DO-178B guidance in your software plan and other planning documents. Include plans for software development, verification, standards, configuration management, quality assurance, tool use, and other applicable project-specific plans. Also, document traceability to the safety objectives of the regulations. This rationale should demonstrate that your alternative provides the same level of assurance as that provided by RTCA/DO-178B and the regulations from both engineering and safety perspectives.
b. When documenting the alternative:
(1) Identify which regulations from 14 CFR apply to the airborne system and equipment installation and operational use. Include a systems overview and any relevant history, such as previously developed software;
(2) Provide a project and software life cycle diagram which shows the various processes of the project, for example, planning, design, implementation, etc.;
(3) Document how all requirements allocated to software are satisfied by providing reference to overall system requirements with traceability to supporting software requirements;
(4) Document how your proposed alternative is related to the system-level and aircraftlevel safety assessment processes;
(5) Document how your proposed alternative is equivalent to the level of rigor required by the regulations; and
(6) Work with the FAA to obtain agreement on the software life cycle data related to the type design.
c. The software plans, processes, expected results, and evidence of the means and methods proposed should substantiate the rationale of your alternative.
8. Software Life Cycle Data. In your planning documents, identify the software life cycle data you will produce as evidence of compliance to your proposed alternative, including what data you will submit or make available to the FAA for review. Also identify any designees you plan to use and their roles in assessing the proposed alternative's compliance to the applicable regulations.
9. Substantiation of Results.
a. Provide substantiating evidence that you followed your plans. Substantiating evidence includes, at a minimum:
(1) A plan for software aspects of certification or other acceptable planning document;
(2) A software accomplishment summary or other acceptable summary document that identifies deviations from plans, open problem reports, and justification that safety is not affected;
(3) A software configuration index or other acceptable configuration indices to include software environment configuration;
(4) Impact of the alternative on post-certification modifications. For example, how software change impact analysis will be performed, and regression testing conducted;
(5) Software life cycle data related to the type design, and;
(6) Additional documents that are relevant to the project.
b. Depending on the alternative proposed, other substantiating evidence may include:
(1) System certification plan;
(2) Software development plan;
(3) Software verification plan;
(4) Software/hardware integration verification plans and reports, and system verification
and validation plan and report;
(5) Software development standards;
(6) Software requirements;
(7) Software design;
(8) Source code;
(9) Executable object code;
(10) Description of review and analysis procedures;
(11) Test cases and procedures;
(12) Results of each review, analysis, and test;
(13) Acceptable safety report documents, and applicable assessment artifacts, i.e., preliminary systems safety assessment, systems safety assessment, aircraft/engine level safety assessment;
(14) Software configuration management plan, procedures, and records;
(15) Software quality assurance plan and records; and
(16) System summary documents.
Susan CaLle David W. Hempe Manager, Aircraft Engineering Division Aircraft Certification Service