Appendix 1 A1-5
d. Performance Section.
(1) The computerized AFM may be used to generate all of the FAA-approved performance information required to be in the AFM.
(2) The operating rules (§§ 91.9(b)(1), 121.141(b), and 125.75(b)) require operators to carry, in each transport category airplane, either the AFM or an operator-prepared manual that contains all of the information required to be in the AFM. The computerized AFM is not intended for use on board the airplane. Thus, any portions of the AFM that are provided only in computerized (i.e., electronic) form may not be used to satisfy these operating requirements.
This does not preclude printing out information calculated by the FAA-approved computerized AFM and subsequently using the paper printout on board the airplane.
(3) Configuration Deviation List (C DL) and Master Minimum Equipment List (MMEL) effects on performance may be included if they are FAA-approved and applications are clearly identified on the generated output.
(4) Although the output from the computerized AFM should be usable without adjustment, applying corrective factors that are provided in the paper AFM may be acceptable in the following cases:
(a) CDL or MMEL information.
(b) Urgent temporary FAA-approved revisions made mandatory for safety reasons.
(c) Any case in which the appropriate data are unavailable from the computerized AFM and it is clear to the user that corrective factors are to be applied.
(d) Supplements produced by STC applicants.
(5) Supplementary performance information may be included in accordance with paragraph 4b of this appendix (e.g., for operation on runways contaminated with standing water, slush, snow, or ice).
(6) The applicant may request FAA appr oval of supplementary computerized AFM applications (e.g., optimized runway performance). This supplementary software application will not be required by the FAA for type certification.
6. Software integrity, development, and documentation requirements. The computerized AFM consists of the AFM software application used in conjunction with the hardware and software environment in which it is installed. This section provides guidelines that address the integrity, development process, and documentation requirements of the software.
Appendix 1 A1-6
a. Software Integrity.
(1) The computation of hazardously misl eading primary information, such as takeoff speeds, landing approach speeds, engine power or thrust , engine limit data, or other related airplane performance data, should be improbable (as defined in § 25.1309). The AFM software application should, as far as practicable, be protected from inadvertent, deliberate, or unauthorized alterations. For example, self-check features could be used to provide software verification and protection against deliberate or inadvertent alteration.
(2) The level of integrity established for the computerized AFM is the basis for the software development process and should be addressed in the plan for software aspects of certification (see paragraph 6b of this appendix).
(3) Each part of the FAA-approved AF M software application (e.g., program, data) should bear a unique notation, a unique date, or a revision number.
(4) A means to check the programs and da ta to avoid undetected failures should be provided (e.g., a checksum routine, tabular data to verify a check case, or provisions for a lineby-line file comparison).
(5) Commercially available software, su ch as operating systems (e.g., MS-DOS), word processors, and spreadsheets, will not be approved by the FAA. However, this software can be used to run the computerized AFM software application or process (i.e., edit, format, manipulate, etc.) AFM data to produce approved AFM information if:
(a) The applicant demonstrates that the unapproved software does not interfere with the correct functioning of the FAA-approved computerized AFM software application;
(b) The applicant demonstrates that the unapproved software produces reliable results when used with the specified hardware environment and the computerized AFM software application.
b. Software Development. The integrity of the software components of the computerized AFM is achieved through the software development processes used.
(1) The applicant should propose the softwa re development process in the plan for software aspects of certification. Per AC 20-115B, RTCA/DO-178B provides an acceptable
Appendix 1 A1-7
means of compliance for the software components of the AFM. The applicant should document the methods, parameters, and allowable range of conditions contained in the computerized AFM.
The results obtained from the computerized AFM should be shown to meet all applicable part 25 requirements. This compliance may be shown using substantiation documentation, demonstrations, or other means mutually agreed to by the FAA and the applicant.
(2) The applicant should submit a description of the computerized AFM and the plan for software aspects of certification to the FAA for review early in the certification process. This plan proposes the schedule and means by which compliance with the requirements will be achieved and the means by which certification data and supporting records will be made available to the FAA for review.
c. Hardware and Software Environment. The computerized AFM software application may be FAA-approved independent of the hardware and software environment in which it is installed. A common example of this would be the development of a computerized AFM software application to be run in a commercial-off-the-shelf (COTS) hardware and software environment. The applicant should provide for item (1) as follows, plus either item (2) or (3), as appropriate:
(1) A mechanism, such as an installation u tility function or test set, that verifies the proper functioning of the computerized AFM software application in the target software and hardware environment. The verification check should include, but not be limited to, proper functioning with hardware specified in the AFM, including input and output devices, and with resident software, including terminate-and-stay-resident or other control programs such as Microsoft Windows, and with any operating system calls made by the AFM software.
(2) If the computerized AFM is inte nded for a COTS hardware and software environment, installation information that describes the minimum requirements, including limitations and constraints, for the software and hardware environment.
(3) If the computerized AFM is intende d for a specific hardware/software system, installation information that describes the specific hardware and software environment in which the computerized AFM software application need to be installed. Additionally, the applicant should provide a configuration management scheme that ensures the hardware and software environment that will be used in service is identical to the environment specified in the FAA- approved installation data.
d. Revisions to a Computerized AFM Software Application.
(1) Revisions to an FAA-approved computerized AFM should be submitted for evaluation and FAA-approval in accordance with software development methodology
Appendix 1
A1-8 established in paragraph 6b of this appendix. A log of FAA-approved AFM software application parts should be furnished by the applicant. For historical purposes, the applicant should maintain records from which the information from any approved revision level of the computerized AFM can be reproduced, unless none of the affected airplanes remain in operational service.
(2) The applicant should submit a description of the proposed changes and an updated plan for software aspects of certification. In addition, the applicant should:
(a) Re-assess the software integrity le vel (paragraph 6a of this appendix) of the revised computerized AFM;
(b) Demonstrate that the revisions do not affect any of the unrev ised portions of the computerized AFM; and
(c) Demonstrate that the revisions are compatible with the hardware and software environment intended for the computerized AFM software application.
(3) The computerized AFM software applic ation is not intended to be user-modifiable software (under the definition of user-modifiable software provided in DO-178B). Revisions to a computerized AFM can be made only by the TC or STC holder of that computerized AFM.
STC applicants may supplement but not revise a TC holder’s computerized AFM.
(4) When revisions are in corporated, a means (e.g., document) of indicating those parts of the software that have been changed should be provided.
(5) Each revised software element should be identified in th e same manner as the original, with the exception of the new date or revision notation (see paragraph 6a(3) of this appendix).
e. Submittal and FAA-Approval of Software.
(1) The applicant will be considered the re sponsible party for all matters pertaining to the computerized AFM software application, including submittal to the FAA and obtaining FAA-approval.
(2) The applicant and the FAA should disc uss and agree on the data structures and calculation models.
(3) The applicant should provide any part of the hardware environment necessary for operating the computerized AFM that is not readily available to the FAA.
Appendix 1
A1-9
f. Documentation Requirements. Documentation containing the following information should be provided by the applicant to the FAA:
(1) Approval plan that describes the soft ware aspects of certification, including time schedules, an outline of the desired applications, and design objectives for software and data integrity.
(2) Software development plan, including the methods used to accomplish the design objectives.
(3) Software descriptions, including jus tifications that program structures and calculation models are appropriate to their intended function.
(4) Data verification document, including a description of the scope and depth of the review, analysis, and tests used to determine that the developed software and generated output accurately reflect the airplane performance characteristics. This description should include the purpose of each test case and the set of inputs, expected results, test environment, and calculated results.
(5) Operating instructions, including all in formation for proper use of the computerized AFM, installation instructions, and identification of the suitable hardware and software environment.
(6) Software configuration reference, including a log of the approved software elements and a statement that design objectives of the approval plan and compliance with the guidelines of this appendix have been demonstrated.
7. Provisions for FAA post certification access to computerized AFM. In the plan for software aspects of certification, the applicant should propose which components of the computerized AFM will be submitted to the FAA. In cases where the AFM software application can be installed on FAA equipment, the applicant need only provide the computerized AFM software application, which includes the installation data and operating guide. However, if the computerized AFM software application requires a hardware and software environment that is not available to the FAA, the applicant should also provide the appropriate FAA certification offices with the necessary components to access the AFM software application.
8. Provisions for public access to computerized AFM. The AFM is necessary for the safe operation of an airplane and is considered public information. Public disclosure of AFM information is necessary. Recognizing that the computerized AFM software application may also contain data, analysis methods, and operating systems that are proprietary to the applicant, the FAA will not provide direct public access to the software, unless the applicant states that
Appendix 1
A1-10 public access is authorized. To satisfy the need for public disclosure when public access to the software application is not authorized, the FAA will use the computerized AFM to generate a limited number of discrete computer results or other AFM information requested by the public.