ABC’s of DO-178C for Military Aviation

For obvious reasons, worldwide militaries are quiet about their aircraft avionics and software. But the secret is out: DO-178C has stealthily taken over the world of military aviation!

Since “ancient times” (50 years ago for aviation technology), worldwide militaries had developed their aircraft avionics using dedicated defense-oriented standards such as MIL STD 882E, 2167A, and 498, the alphabet soup of aerospace standards. Admittedly, military aircraft designers were very motivated to aerospace software and hardware standards which differed from commercial aircraft since it was thought that military applications were too specialized and different. Now, think about that: navigation, communications, flight controls, landing gear, displays … are they “really” that different between military and commercial aircraft? Simply put, they may differ in functionality of course but not in the process of “development” which is where the standards come in.

Today, fighter jets (F-35, T-50, etc.), cargo/refueling planes (A400M, C-130, C-17, KC-46,.), Future Long-Range Attack Aircraft (FLRAA) and UAV/UAS’s (formally called RPAS: Remotely Piloted Aircraft Systems) are mandating compliance to DO-178C; increasingly, to DO-254 and the latest versions of Aircraft/Systems development safety ARP4754B/ARP4761A. Today, the world’s largest operator of aircraft is the U.S. Army; both Army and Air Force are diverging from MIL STD 882E military standards and instead mandating SAE ARP4754B and ARP4761A – the very latest versions of aircraft safety/systems standards. Why this sudden transformation? Simple: it has not been sudden; decades of lessons-learned regarding improved level of detail, reusability, visibility, preventing defects instead of testing and correcting defects, and significantly lower costs with improved mission effectiveness are behind this shift.

DO-178C (software) and DO-254/AC 20-152A (hardware) presume that software and hardware must operate in harmonic unison, each with proven reliability. Previously, hardware was considered “visible” and tested at the system level with integrated software; hence hardware was exempt from DO-178C quality attributes. But that exemption resulted in functionality being moved from software to hardware for the purpose of avoiding hardware certification. Additionally, hardware complexity has evolved such that hardware is often as complex, or more so, than software due to the embedded logic within the PLDs, ASICs and FPGAs. Now, everyone recognizes that hardware and software comprise an inextricable chain with the quality equal to that of the weakest link, thus today’s DO-178C related mandate to also apply DO-254 and A(M)C 20-152A to avionics hardware.

DO-178, DO-254, ARP4754A, and ARP4761 utilize five different levels of criticality, ranging from Level A (most critical) to Level E (least critical); these are officially termed “Development Assurance Levels (DALS)”. Each avionics system is assigned one or more levels of criticality based upon a system safety assessment which analyzes each system’s potential contribution to aircraft safety; each hardware and software component within that system must meet or exceed its assigned criticality level. As the criticality level increases, so does the degree of rigor associated with documentation, design, reviews, implementation, and verification.

DO-178C and its successor DO-178D in five years will continue to penetrate the development programs of everything that flies including missiles, spacecraft, helicopters, and someday perhaps even experimental aircraft. Like gravity on Earth, DO-178 and its successors will be around for a very long time.