In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

technology and differing interpretations being applied to some areas of the previousversion.DO-178B revised the criticality and software levels used in DO178A. Instead ofcriticality categories, DO178B used failure condition categories consistent with theACJ to JAR 25.1309; that is, catastrophic, hazardous (or severe-major), major,minor, and no effect. The associated software levels were A, B, C, D and E. Therequired software level was based on the contribution of the software to thepotential failure condition (for example, Level A software was required for acatastrophic failure condition). 113 The use of five levels enabled the softwaredevelopment processes to be more finely tuned to the potential impact of the systemon safety.The new version also provided objectives for software life cycle processes (such assoftware planning, software development, and software verification), descriptionsof activities and design considerations for achieving the objectives, and descriptionsof the evidence that indicated that the objectives were satisfied. It also providedmore detailed guidance in some areas than DO-178A. For example, DO-178Bincluded a list of robustness test cases to demonstrate the ability of software torespond to abnormal inputs and conditions. The robustness test cases includedguidance that ‘the possible failure modes of the incoming data should bedetermined, especially complex, digital data strings from an external system’. Nofurther guidance was provided on the types of failure modes that should beconsidered.A third revision of DO-178, DO-178C, was scheduled to be issued during 2011. Itwas expected to provide further enhancement and clarification of the core processesin DO-178B, as well as to address topics dealing with advances in complex avionicssoftware development. These topics include the use of formal methods andmodel-based development (section 2.6.3), and the use of object-orientedsoftware. 114In 2000, the RTCA issued DO-254 (Design Assurance Guidance for AirborneElectronic Hardware) as a complementary document to DO-178 for hardwarecomponents. Its purpose was to provide ‘design assurance guidance for thedevelopment of airborne electronic hardware such that it safely performs itsintended function, in its specified environments.’ DO-254 defined five hardwaredesign assurance levels, analogous to those in DO-178B.Aerospace recommended practice 4754In November 1996, the Society of Automotive Engineers (SAE) 115 issued aerospacerecommended practice (ARP) 4754 (Certification considerations forhighly-integrated or complex aircraft systems). The ARP was ‘intended to providedesigners, manufacturers, installers, and certification authorities a commoninternational basis for demonstrating compliance with airworthiness requirements113114115Revisions of the FCPC software were developed as Level A software.Object-oriented programming is one of many software programming paradigms and isincreasingly used in the development of aircraft software. It groups information into objects withassociated properties and functions.The SAE developed standards for the design of road, marine and aircraft vehicles. These standardswere often adopted by regulatory agencies as design requirements.- 100 -