Feedback on IMA certification and on-going regulatory work in Europe

Transcription

1 Thales Avionics 30th october Feedback on IMA certification and on-going regulatory work in Europe Cédric Chevrel System & IMA Referent Certification Expert Airworthiness Certification Directorate THALES Avionics International IMA Conference Moscou 2012

2 2 / IMA System Certification Manager Life of a System Certification Manager before IMA... Life of a System Certification Manager with IMA...

3 3 / Content IMA perimeter in Avionics System Certification Process Incremental Certification Lessons Learned On-going Regulatory work in Europe

4 Thales Avionics 30th october Avionics System IMA perimeter International IMA Conference Moscou 2012

5 5 / Avionics System Perimeter Cockpit Localisation Navigation Surveillance Flight Management Flight Guidance & Envelope Avionics System Integrated Modular Avionics Recording Display and Warning Communication Utilities / Cabin Maintenance A trend : from Equipment, to Subsystem and Open Avionics System Package

6 6 / Integrated Modular Avionics (IMA) Before Now with IMA Platform composed by a set of non system specific and highly configurable computers 1 function = 1 computer Multiple systems applications are executed on the same platform and network ARINC 429 Allowing highly integrated architecture, IMA permits recurrent, development and maintenance cost savings optimizing industrial business model

7 7 / IMA business model Platform / Module supplier : Production, Supply chain, component obsolescence management and capacity to F3 design in the future In Service Experience on COTS hardware component (Certification constraint) RT Operating System (such as A653) skills Robust Partitioning demonstration (Partitioning) skills Sub-System Designers / Application Suppliers Functional domain (Flight Management, Fuel, Cabin...) skills Functional oriented Software engineering skills IMA system integrator Complex integration (mixing software and functional aspects) skills Incremental Integration & Acceptance IMA objective : Select the best supplier for each task taking into each specificity

8 Thales Avionics 30th october Integrated Modular Avionics Certification Process THALES Avionics International IMA Conference Moscou 2012

9 9 / Certification Actors Aircraft Manufacturer Type Certification TSO installation Airworthiness Authority Country A (IAC-AR) Contract System Development & Type Certification Contribution TSO Equipment Avionics System Supplier (Thales) TC Validation Airworthiness Authority Country C (ex:faa) Agreements Arrangements between AAs Suppliers Sub-contractors Technical Standard Order (TSO) Authorization Airworthiness Authority Country B (EASA)

10 Equipment System Aircraft 10 / Certification basis flow-down CRI F-xx/IP S-xx System Supplier A/C Manufacturer Determination of Certification Basis Aircraft Certification Basis: - CS 25/AP25/FAR 25 - Special Conditions, Exemptions, ESF AMC (generic) IM (specific CRI / IP) System ARP4761 ARP4754 IMA DO-297 AUTHORITY Aircraft Certification Basis System Qualification Basis Equipment Supplier Standards HW DO-254 SW DO-178B Environmental DO-160 Equipment Qualification Basis

11 11 / IMA FAA/EASA Regulatory materials FAA : 2002 : TSO C153 «IMA hardware elements» 2003 : AC about TSO C153 (obsolete with AC20-170) 2004 : AC about «reusable software component (RSC)» 2010 : AC making the link between TSO C153, AC "reusable software component" and DO : PS-ANM provides criteria to determine if the guidance in AC is applicable (Am I an IMA?) EASA : CRI-Fxx : Interpretative Materials for Integrated Modular Avionics System CRI-Fxx : Interpretative Materials for Incremental Certification These regulatory materials are calling on industrial standards as means of compliance

12 12 / System/Hardware/Software Industrial Standards Aircraft & System Development Process (ARP-4754 / ED-79) Guidelines for Integrated Modular Avionics (DO-297/ED-124) ARP4754A Electronic Hardware Development Process (DO254 / ED-80) Software Development Process (DO178 / ED-12) DO297 ARP4754 (+ARP4761) and more recently DO297 are structuring IMA system development and certification processes

13 13 / IMA definitions According to DO-297 : Aircraft functions Generic Perimeter = Platform independent from Avionics functions DO297 shall be used to structure IMA definitions in order to avoir misleading interpretation at the beginning of the certification program

14 14 / Authority Involvement Manufacturer requirements Certification basis PLAN PHASE Certification Plan, Syst. FHA, EQTP, PSAC, PHAC, PCAC SOI1 Plan Review REQUIREMENT PHASE SYSTEM / SUB-SYSTEM / EQUIPMENT Development cycle ARCHITECTURE PHASE Accomplishment Status to the Plan Certification summary, SSA, EQTR, SAS, HAS, CAS, PAS (IMA) Which kind of authority involvement VERIFICATION PHASE and audit reviews with IMA? SOI4 Certification Review SOI3 Verification Audit Flight/Lab Test procedures and results DESIGN PHASE Specifications and Design data SOI : Airworthiness Authority Stage of Involvement SOI 2 Development/ Design Audit

15 Thales Avionics 30th october Integrated Modular Avionics Incremental Certification International IMA Conference Moscou 2012

16 16 / Integrated Modular Avionics (IMA) certification Before One function with DAL A / DAL D Highly Integrated Architecture Now with IMA DO178B partitioning definition Multi-system Integration Open Industrial Workshare Robust Partitioning(*) (*) DO297/ED124 definition IMA system Incremental Certification In the frame of each TC, specific CRI/IP (IM) are published considering IMA architecture as a system. But a system whose certification shall be handled via an incremental process (see DO297)

17 17 / What was at stake? 2 ways are identified to manage resources sharing issues at system level: IMA conventional way (API ARINC 653): Multi system integration on platform V&V activities Sub-System 1 Sub-System n Platform Sub-System 1 Platform Sub-System n Platform Sub-System 1 Sub-System n Platform Sub-System 1 Sub-System n Platform Simu/Aircraft + other systems IMA Incremental way (API ARINC Incremental process): Replacement of multi-system integration by qualification credit based on Usage Domain qualified at platform level! Sub-System 1 Sub- System 1 Sub- System n Platform Sub- System 1 Usage Domain & IMA Process CREDITS Sub- System n Platform Sub- System n Simu/Aircraft + other systems Platform Platform «AA warned about potential difficulties during the compliance demonstration in case of Incremental approch is not followed. This is derived from the complexity of IMA systems»

18 18 / What is at stake regarding IMA certification? What is at stake : Performance and safety of integrated module in any operational situation. The IMA architecture (including networks) is considered as a complex system of the aircraft. Independent qualification of some components and credit from some components pre-qualification is needed to simplify final approval. Qualification credits : Credit n 1: Bare Module & Tools pre-qualification : Modules & tool chain properties (partitionning, configurability, performances) is demonstrated and guaranteed in a frame of a Usage Domain. Credit n 2 : A qualified tool chain guarantes that Modules are well configurated compliantly to Usage Domain Credit n 3: Standalone qualification of Avionic applications are expected to be granted in the context of an integrated module with several functions Keys Points : Incremental qualification process shall be defined to master the interactions between the industrial players Incremental qualification taking benefit from Module & Tool properties (partitionning, configurability & usage domain)

19 19 / Certification program breakdown Module Audit Domain Module Integrator Audit Domain Avionic Application (Function) Audit Domain(s) Bare module and Tools development Tools 1 Configuration development Application development Software 1 development 3 2 Function 3 Function 2 Function 1 Credit n 2 Credit n 3 qualification qualification qualification functional performances Module acceptation IMA system Domain Application acceptation Functional Vs Qualification 3 Full incremental Certification Approach x Usage Domain & Partionning DO297 task Credit n 1 3 IMA PROCESS SYNTHESIS Qualified Integrated Module Credit n 1 + n 2 + n 3 Aircraft Certification 4

20 Thales Avionics 30th october Lesson learnt from recent IMA certification International IMA Conference Moscou 2012

21 21 / Lessons Learned (1) A/C Certification Basis understanding and good anticipation (Special Conditions, Issue Papers, etc) Including additional requirements from Importing Authorities. Including Interpretative Materials about Integration & Incremental Processes (which credit in which context?). Good sharing of the Certification Basis by A/C manufacturer with the IMA System Integrator, Application Suppliers and IMA Platform supplier Joint Certification Strategy TSOs / ETSOs Incremental Certification Approach in line with business workshare. Management of the Sub-contractors with correct cascading of certification requirements

22 22 / Lessons Learned (2) Bilateral Agreements or Arrangements between Authorities facilitate and optimize the Certification Early agreement on a Certification Program structured in several audit domains IMA System & Integration domain Application software qualification Platform qualification (hardware, Operating system and Tools) Early validation by AA of the HW, SW, SYS Certification Plans (SOI 1) reduce the risk Simple and Complex Hardware Components classification Clear roadmap for COTS components (In Service Experience, Errata...) Keep AA in the loop along the development process SOI audits in good phasing along with development reviews Relationship and confidence between Offices of Airworthiness is essential

23 Thales Avionics 30th october IMA Rulemaking in Europe What else? International IMA Conference Moscou 2012

24 24 / Reuse Vs Certification credit The IMA platforms are composed of elements/modules which are both generic and configurable. The IMA elements/modules are designed to be reusable in order to reduce cost development and facilitate certification programs. Nevertheless, «reuse» does not mean «certification credit» from an aircraft to another. The certification credit from the Incremental Acceptance is only granted for a dedicated Type Certificate (TC). This credit should be granted independently of the aircraft thanks to a [European] Technical Standard Order (TSO - Equipement Certificate) and their certification data package recognised as certification credit when reused for a new aircraft.

25 25 / Regulatory materials FAA system AC IMA System Installation TC IMA system Approval EASA system Certification Review Item CRI-Fxx : Integrated Modular Avionics System CRI-Fxx : Incremental Certification IMA System Installation (domain#6) Functional TSO Cxxx (Complete TSO) Complement Qualification DO160 Component Qualification Software Qualification Domain# 2, 5, 3, 4, 7 Hardware Qualification Domain#1 Functional TSO Cxxx (Incomplete TSO) Ex : C9c, C52b, C54, C92c, C101, C106, C115b, C151b IMA Hardware TSO C153 (E)TSO Authorization Functional ETSO Cxxx ETSO 2C153 Thales promotes an European System (ETSO, AMC) facilitating reuse and certification credit in IMA systems via an ETSO IMA platform (2C153) and Software Functional ETSO approach (AMC)

26 26 / Rulemaking Task (RMT) 0456 ETSO IMA and AMC will be created in EASA regulatory corpus ETSO 2C153 shall be developed and published enabling authorizations at IMA platform/module level, independent from aircraft. FAA TSO C153 cannot simply be transposed into an ETSO, because it does not contain sufficient Mimimum Performance Specifications (MPS) and do not cover Core Software. ETSO 2C153 to be complemented by AMC (based on ED124/DO297) to provide more guidance for integration at function and aircraft level without needing dedicated Certification Review Item (CRI) RMT.0456 included in EASA Rulemaking Programme

27 27 / ETSO 2C153 key concepts This ETSO refers to IMA platform modules which are appliances composed of Hardware and Core Software or any embedded software module contributing to the intended function of resources sharing. Seven basic types of IMA platform modules are identified : TYPE A : Rack Module (only relevant for Cabinet architecture) TYPE B : Processing Module. TYPE C : Graphical Processing Module. TYPE D : Mass Data Storage Module. TYPE E : Interface module. (Input/Output Module and/or network module) TYPE F : Power Supply Module (only relevant for Cabinet architecture) TYPE G : Display Head Module En equipment can combine several types (e.g B+D)

28 28 / Thank you for your attention Any questions? cedric.chevrel@fr.thalesgroup.com