RTCA DO-178C / EUROCAE ED-12C — Software Considerations in Airborne Systems and Equipment Certification
Issuing body: RTCA, Inc. (jointly with EUROCAE as ED-12C — technically identical documents). Recognised by: FAA via Advisory Circular AC 20-115D; EASA via AMC 20-115D. The standard itself is not law; it becomes binding when an applicant's certification plan invokes it as the means of compliance with airworthiness regulations (14 CFR Part 25 §25.1309 lineage, EASA CS-25.1309). Jurisdiction: International — accepted by FAA, EASA, Transport Canada, ANAC Brazil, and most other authorities.
What it is
DO-178C is the global standard for assuring that airborne software does what it is supposed to do — and only what it is supposed to do — at a level of rigour matched to how badly things go wrong if it fails. It does not tell you how to write software; it defines objectives (71 of them) for the software life-cycle processes — planning, requirements, design, coding, integration, verification, configuration management, and quality assurance — and the evidence you must produce to show each objective is satisfied. Certification authorities audit the evidence, not the code.
The central mechanism is the Design Assurance Level (DAL), inherited from the system safety assessment (ARP4761):
| DAL | Failure condition | Example |
|---|---|---|
| A | Catastrophic | Fly-by-wire primary flight controls |
| B | Hazardous | Autopilot |
| C | Major | Flight management display |
| D | Minor | Cabin lighting control |
| E | No safety effect | In-flight entertainment |
Higher DAL = more objectives (Level A requires all 71; Level D a subset). The objectives scale verification independence (Level A/B require independent verification — a different person or tool than the developer), structural coverage (Level A: MC/DC — modified condition/decision coverage; Level B: decision coverage; Level C: statement coverage), and traceability depth.
Scope: who it applies to
Any organisation developing software that runs on a certified aircraft or engine where the system safety assessment assigns DAL A–D. Triggers: new avionics (flight controls, FADEC, fly-by-wire, TCAS/ACAS, weather radar), software changes to certified systems, and increasingly software in eVTOL and advanced air mobility programs. Applies to airborne software — ground tools that can introduce errors into airborne software are covered by the DO-330 supplement (tool qualification).
Key requirements and compliance obligations
- Planning. Five plans anchor the program: PSAC (Plan for Software Aspects of Certification — the contract with the authority), SDP (development plan), SVP (verification plan), SCMP (configuration management), and SQAP (quality assurance). Deviations from the plans require authority agreement.
- Requirements-based process. High-level requirements derive from system requirements; low-level requirements and architecture derive from high-level requirements; source code implements low-level requirements. Bidirectional traceability across every layer is mandatory and is the backbone of every audit.
- Verification. Requirements-based test cases and procedures; reviews and analyses of requirements, design, and code; and structural coverage analysis measured on the target (or representative) hardware. Level A adds MC/DC coverage of all code and data/control coupling analysis.
- Configuration management. Baselines, change control, problem reporting, and controlled loading of field-loadable software (with the DO-178C/DO-254 joint guidance for electronic distribution).
- Supplements (each with its own additional objectives, invoked as needed):
- DO-331 — model-based development and verification.
- DO-332 — object-oriented technology.
- DO-333 — formal methods (mathematically rigorous verification, increasingly used at Level A).
- DO-330 — software tool qualification (tools whose output can inject errors, or tools used to verify, must themselves be qualified at a tool qualification level tied to the DAL).
- Parameter data items (configuration tables, databases — e.g., navigation databases) are handled under DO-178C/DO-200B jointly.
- Software accomplishment summary (SAS) and software configuration index (SCI) close the program for the authority.
Penalties and consequences of non-compliance
DO-178C is not directly enforced with fines — it is enforced through the certification gate. Failure to satisfy the objectives means no finding of compliance, which means no type certificate, no STC, and no return to service for the software change. In service, software non-conformances discovered post-certification drive airworthiness directives and fleet-wide software updates. Deliberate falsification of verification evidence (coverage results, traceability) is treated as certification fraud with the same criminal exposure as falsified airworthiness data. Commercially, DO-178C Level A programs are among the most expensive engineering activities in industry (verification routinely exceeds development cost), and schedule slips in software certification are the leading cause of avionics program delays.
Version / edition status and live changes (verified 2026-09-30)
- Current edition: DO-178C / ED-12C (2011/2012). No revision D exists; the standard is stable. AC 20-115D (2017) remains the FAA's recognition vehicle — verified as still current.
- Active evolution is in guidance, not the base document: increasing authority acceptance of formal methods (DO-333) for Level A, model-based workflows (DO-331) as standard practice, and ongoing policy work on machine-learning / AI components, which DO-178C does not address — EASA has published AI concept papers and learning-assurance guidance (EASA AI Roadmap 2.0) precisely because DO-178C's requirements-based paradigm does not cover trained neural networks. Practitioners proposing ML in DAL A–C functions should expect special conditions and issue papers, not a straight DO-178C path.
- Flag (thin-sourced): fine-grained FAA/EASA policy positions on AI/ML assurance are evolving rapidly; verify current issue-paper practice before planning a program around it.
Related certifications (from the engineering catalogue)
Flagship/license Aerospace certifications: FAA A&P Mechanic Certificate and CEng via RAeS. Neither tests DO-178C — A&P is maintenance-focused; CEng is professional registration. DO-178C competence is demonstrated through employer qualification and designated-engineering roles, not through catalogue credentials. Flagged honestly: there is no flagship certification in this catalogue that examines DO-178C.
Honest flags
- Objective counts and coverage criteria above reflect the published standard; exact tailoring is negotiated per program in the PSAC.
- The AI/ML note reflects published EASA concept material and industry practice, not a settled certification path.
Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.