DO-178C compliance

The unique challenges in developing safety-critical software for aviation

Companies designing and building safety-critical systems need robust methods and collaborative platforms. This white paper introduces best practices for software development and DO-178C compliance. It also looks at IBM Engineering Requirements Management DOORS Next solutions and approaches that can help organizations deliver safety-critical products, improve collaboration, and increase efficiency and profitability.

In the aerospace and defense (A&D) industry, costs associated with product functionality are increasing over time¹ — putting significant pressure on A&D companies to do more with less or to sacrifice functionality to meet cost pressures. Software development and testing alone may be a significant factor in these rising costs, and the DO-178C standard and its related technology supplements have the potential to drive costs up even further.

Projects that need to comply with DO-178C standards could see cost increases anywhere from 25 percent to 40 percent compared to projects that don’t require compliance.²

The sources of additional costs may include the following:

Reduced developer productivity due to increases in process complexity

Manual reporting and documentation processes that are not suited to the level of detail required to comply with DO-178C

Qualification activities involved in compliance

The purpose of DO-178C is to provide guidance for developing airborne software systems to ensure that it performs its intended function with a level of confidence commiserate with its airworthiness requirement. DO-178C is objective driven and companies may use a variety of means to achieve compliance as long as they meet the objective(s) in question. To comply with DO-178C, companies must provide multiple supporting documents and records surrounding their development processes.

Different airworthiness levels within DO-178C — A, B, C, D and E — directly correspond to the consequences of a potential software failure: catastrophic, hazardous/severe-major, major, minor or no effect, respectively. Each software level has a defined number of objectives that need to be satisfied (some with independence). Objectives requiring independence need documentary evidence that the person verifying the item is not be the person who developed the item.

Table 1. Objectives for each software level

These different software level certifications also determine the rigor required in testing and other aspects of development.

DO-178C compliance involves six key processes: planning, development, verification, configuration management, quality assurance (QA) and certification liaison. Because the certification liaison process is not a development activity, this white paper only focuses on the first five areas.

One of the significant changes in DO-178C from DO-178B is that there are four additional supplements that may be used in conjunction with the DO-178C.

These supplements cover model-based development and verification supplement (DO-331.); object-oriented technology and related techniques supplement (DO-332); formal methods supplement (DO-333); and software tool qualification considerations (DO-330). These supplements have been used to avoiding the need to update or expand the text inside the main DO-178 document. For example, the qualification criteria for software development and verification tools has been deleted in version C and has been replaced with a section that details the criteria for determining if tool qualification is needed. The objectives, activities, guidance, and life cycle data required for each Tool Qualification Level are described in DO-330, “Software Tool Qualification Considerations”.

As with the other processes involved in proving compliance with DO-178C, planning requires associated output documentation, including the following:

Plan for software aspects of certification (PSAC)

Software development plan (SDP)

Software verification plan (SVP)

Software configuration management plan (SCMP)

Software quality assurance plan (SQAP)

System requirements

Software requirements standard (SRS)

Software design standard (SDS)

Software code standard (SCS)

Output documents associated with meeting DO-178C standards in the development process include software requirements data, software design descriptions, source code and executable object code.

According to DO-178C stipulations, without verifiable, unambiguous, consistent and well-defined requirements, you must create a problem report and submit the issue back to the input source to be clarified and corrected. You must also be able to trace those system requirements that will be realized by high level software requirements to one or more low-level software requirements, and a low-level requirement to one or more high-level software requirements. Plus, you need to provide all of your derived requirements to the system safety assessment process. In a nutshell, this means that all of the source code you develop needs to be traceable, verifiable and consistent, and it needs to correctly fulfill the low-level software requirements.

DO-178C requires effective capabilities for measuring and reporting project status deliverables. Automated measurement and reporting tools can fulfill DO-178C requirements by enabling you to do the following:

Gain access to data in multiple tools across the development workflow to avoid slow, costly and error-prone manual data collection

Automatically generate reports and dashboards to help ensure that you generate consistent evidence of compliance and provide stakeholders with the correct information in a timely manner

To help ensure that your software fulfills DO-178C requirements, you must submit a verification report that shows the absence of errors — not just that you have tested for and detected errors.

You need to prove that all lower-level artifacts satisfy higher-level artifacts, that you have accomplished traceability between requirements and test cases via requirements-based coverage analysis, and that you can show traceability between code structure and test cases through a structural coverage analysis. Each requirement in your software development process must be traceable not only to the code that implements it, but also to the review, test or analysis through which it has been verified. You must also ensure that you can trace implemented functionality back to requirements and that testing can prove this. In other words, you need to eliminate any dead code or code that is not traceable to requirements.

Output documentation associated with DO-178C includes the following:

Software verification cases and procedures (SVCP)

Software verification results (SVR)

Review of all requirements, design and code

Testing of executable object code

Code coverage analysis

Line, decision and condition coverage requirements are determined by the compliance level (A-E).

Figure 1. DO-178C stipulates coverage testing requirements by compliance level.

As shown in figure 1, DO-178C defines specific verification objectives, including requirements-based testing, robustness testing and coverage testing, depending on the software level for which you are complying. At Level E, DO-178C requirements don’t apply. Level D requires 100 percent requirements coverage. Level C stipulates that companies meet Level D requirements plus 100 percent statement or line coverage. To gain Level B compliance status, companies must meet Level C requirements plus 100 percent decision coverage. Level A requires that companies meet all Level B requirements plus 100 percent modified condition decision coverage. Each type of coverage is defined in the standard — for example, statement coverage means that every statement in the program has been invoked at least once, while decision coverage means that every point of entry and exit in the program has been invoked at least once and every decision in the program has reached all possible outcomes at least once.

Configuration management

To support compliance with DO-178C elements surrounding configuration management, companies are required to do the following:

Uniquely identify each configuration item

Protect baselines of configuration items from change

Trace a configuration item to the configuration item from which it was derived (lineage and history)

Trace baselines to the baselines from which they were derived

Reproduce builds (replicate executable object code)

Provide evidence of change approvals

Produce output documentation for a software configuration index (SCI) and a software lifecycle environment configuration index (SECI)

The QA process in DO-178C requires reviews and audits to demonstrate compliance. Key output documents in this process include software quality assurance records (SQARs), a software conformity review (SCR) and a software accomplishment summary (SAS).

Showing compliance to DO-178C can be a challenge in terms of the rigor, traceability and reporting required. An effective platform and process can reduce both the burden and the costs of compliance. IBM Engineering Requirements Management DOORS Next solutions for systems and software development provide cross-team and cross-lifecycle collaboration, automation and reporting capabilities to address the needs of DO-178C projects.

IBM Engineering Lifecycle Management tools provide the de facto standard software solution for requirements management. In coordination with IBM Engineering Workflow Management, IBM Engineering Systems Design Rhapsody, and IBM Engineering Test Management, when integrated, it provides extensive traceability capabilities to help you meet DO-178C requirements.

IBM Engineering Requirements Management DOORS Next is the leading requirements management application that can help you reduce costs, increase efficiency and improve quality by enabling you to optimize requirements communication, collaboration and verification throughout your organization and across your supply chain. Requirements Management software integrates with Test Management software to enable you to demonstrate requirements-based test coverage.

IBM Engineering Requirements Management DOORS Next is a web-based collaborative requirements management application that allows teams to work more effectively across disciplines, time zones and supply chains.

IBM Engineering Lifecycle Optimization - Publishing software is an automated document generation solution with the capability to connect a variety of data sources, including Engineering Lifecycle Management solutions and select third-party tools. Using IBM Engineering Lifecycle Optimization - Publishing software to automate document generation for ad hoc use, formal reviews, contractual obligations and regulatory compliance can help you improve productivity and reduce risk and cost.

IBM Engineering Systems Design Rhapsody is a collaborative design, development and test environment for systems engineers and software engineers. It provides:

Rapid prototyping and execution to address errors earlier when they are least costly to fix.

Automatic consistency checking to enhance agility and improve reuse with collaboration to reduce both recurring and non-recurring costs.

The ability to share, collaborate, and review your engineering lifecycle artifacts created with IBM Engineering Systems Design Rhapsody or other design tools, such as Mathworks Simulink, with the extended engineering team.

IBM Engineering Test Management software is a collaborative and customizable solution for test planning, execution management, workflow control, tracking and metrics reporting that provides a central hub through which to manage the verification process. By providing open interfaces, this offering allows you to connect IBM and third-party testing solutions to manage testing, results and defects.

When implemented across teams, the IBM Engineering Lifecycle Management tools provide a cross-platform solution for software component testing, runtime profiling and coverage analysis that can help code writers debug and correct errors before they get into production code. When integrated, these software solutions help you effectively manage test coverage related to the DO-178C verification process.

By adopting best-practice processes designed around a development lifecycle tool platform, you can offset compliance overhead costs by improving efficiency and lower rework costs by reducing late-discovered errors and defects. Specifically, you can make improvements through the following:

The IBM Engineering Lifecycle Management (ELM) software platform for systems and software engineering is designed to help engineering teams find new, collaborative ways to develop and deliver the right demands on time, on budget, with the right quality and in compliance with DO-178C requirements — across the systems delivery lifecycle. IBM solutions for safety-critical software development are extensible, through both IBM and third-party offerings, to help you in other areas such as architecture management and specialized testing and analysis capabilities.

By deploying IBM ELM solutions, you can reuse software assets and skills to improve development productivity and accelerate time to market and innovation. Comprehensive traceability functionality allows you to enhance collaboration and communication and enables teams from multiple disciplines to coordinate system and software architecture activities. Standards-based development capabilities provide an open and extensible technology platform as well as support for industry standards throughout the development lifecycle — from requirements to implementation. Leveraging IBM ELM solutions, you can enable global development and delivery by supporting communication among original equipment manufacturers, suppliers, agencies and contractors.

Additionally, IBM Global Financing can help you acquire the software capabilities that your business needs in the most cost-effective and strategic way possible. We’ll partner with credit-qualified clients to customize a financing solution to suit your business and development goals, enable effective cash management, and improve your total cost of ownership. Fund your critical IT investment and propel your business forward with IBM Global Financing. For more information, visit: ibm.com/financing