Volume 6 Surveillance

chapter 11 other surveillance

Section 19 Monitor Approved Avionics Software Changes

6-2616 PROGRAM TRACKING AND REPORTING SUBSYSTEM (PTRS) ACTIVITY CODES. Avionics: 5414/5416

6-2617 OBJECTIVE. This task provides guidance for the control and monitoring of avionics air carrier software changes to line replaceable units (LRUs).

6-2618 GENERAL.

A. Definition. Partitioned System: A hardware/software system that is designed to separate safety related functions from other functions. This ensures that no action in a non‑safety related function can cause a failure in a safety related function.

B. Postcertification Software Changes. Postcertification software changes can be required when the following occurs:

· System functional capability changes.

· Design errors are discovered during service.

1) When making a postcertification software change, care must be taken as even the smallest change can lead to “secondary errors” in the software. Secondary errors are errors that were not present or whose effects were not detected when the system was first certificated.

2) Because only changes to safety related software will be treated as a major alteration, it is necessary to predetermine what software will be affected by the change.

3) Most current system designs use a software program which is not partitioned. Use of a non‑partitioned system makes it necessary to determine if the proposed changes affect safe aircraft operation by evaluating the functions performed by the system. Public address systems, passenger entertainment, and galleys are examples of systems which do not affect safety.

4) Care must be taken to ensure that partitioning actually exists, especially when implemented in software. When partitioning does exist, changes may be made to non‑safety related software without Federal Aviation Administration (FAA) approval of the methods used for verification and validation.

C. Design Changes. If an air carrier wishes to design changes to the object code (software) of a line replaceable unit, it must establish and comply with a software verification and validation program equivalent to that described by RTCA/DO‑178A, Software Considerations in Airborne Systems and Equipment Certification.

1) A software verification and validation program is not necessary if the air carrier only wishes to modify line replaceable units by incorporating software which has been previously approved by the FAA.

2) The level of sophistication and effort needed for original design changes made to the resident software differs from that needed for the incorporation of a pre‑approved software change. A pre‑approved software change can be accomplished by:

· Installing a new memory device which contains the approved object code, or

· Loading the approved object code into a programmable device contained within the line replaceable unit.

D. Maintenance Program. The principal avionics inspector has responsibility for the approval of the operator’s avionics maintenance program. The maintenance program must provide for the proper maintenance/inspection of all avionics equipment and components, including complete systems.

1) Changes to the software which performs functions affecting the safe operation of the aircraft should be treated as major alterations. All other software changes should be treated as minor alterations.

2) The operator must establish that partitioning exists prior to making changes to software which does not affect safety when such software is contained in a system which does affect safety.

3) When a software change has been previously approved, an operator may modify equipment by incorporating the software change, even when the software change is related to aircraft safety.

6-2619 COORDINATION REQUIREMENTS. This task requires coordination with the operator, Aircraft Certification Office (ACO), and the manufacturer.

6-2620 REFERENCES, FORMS, AND JOB AIDS.

A. References.

· Title 14 CFR parts 21, 43, 91, and 121/135.

· Volume 4 (this order), Chapter 9, Section 1, Perform Field Approval of Major Repairs and Major Alterations.

· Advisory Circular 20‑121, Airworthiness Approval of Airborne Loran‑C Navigation Systems for Use in the U.S. National Airspace System (NAS), as amended.

· RTCA DO‑178A, Software Considerations in Airborne Systems and Equipment Certification.

B. Forms. FAA Form 337, Major Repairs and Alterations

C. Job Aids. None.

6-2621 PROCEDURES.

A. Review the Operator’s Manual. Review applicable manuals, including the operator’s maintenance manual, to ensure the following:

1) The manufacturer’s service bulletin describing the change is FAA approved.

2) The manufacturer’s recommended Automatic Test Equipment (ATE)/approved equivalent/manual test equipment and test data are current and capable of performing the required tests.

3) Procedures are described for transferring the software from the medium provided by the manufacturer to the line replaceable unit memory devices.

4) Procedures are described for checks ensuring that no errors are introduced by the transfer when memory devices are reprogrammed.

5) The manual clearly states that avionics software changes performing functions that affect the safe operation of the aircraft will be limited to the following:

· Those described in the avionics manufacturer’s FAA‑approved service bulletins

· Those for which the operator has obtained FAA approval

6) Controls exist to prevent unauthorized software changes and that changes are performed in accordance with the procedures described therein.

7) Any change to software is reflected in an appropriate revision to the identification of the line replaceable unit in accordance with the criteria of RTCA Document No. DO‑178A.

B. Review the Training Records. Ensure that the operator’s training records list those persons:

· Trained in the procedures, tools, and testing necessary to incorporate the new software

· Qualified to make the inspections when the work is completed and the units are returned to service

NOTE: Factory training may be necessary before using new procedures and tools to incorporate software, depending on the complexity of the tasks involved.

C. Approve Operator Designed Software Changes Requiring FAA Engineering Assistance.

1) For changes that affect aircraft safety, contact the appropriate Aircraft Certification Office (ACO) and request engineering review and approval of the verification and validation methods to be used by the operator during the design and test of the new software.

2) For changes that do not affect aircraft safety in a system which has been partitioned, accomplish the following:

· Contact the appropriate aircraft certification office and request verification to confirm that partitioning exists.

· Ensure that the software changes will not affect the functions which affect aircraft safety.

6-2622 TASK OUTCOMES.

A. PTRS. Close the PTRS.

B. Task Completion. Completion of this task will result in coordinating the approval or the denial of the proposed change with FAA Engineering.

6-2623 FUTURE ACTIVITIES. None.

RESERVED. Paragraphs 6‑2624 through 6‑2640.