DO-254 — Design Assurance Guidance for Airborne Electronic Hardware
Issuing body: RTCA, Inc. (U.S.; EUROCAE ED-80 is the technically equivalent European document). Enforcer / jurisdiction: FAA (U.S.) and EASA (Europe) via advisory circulars and certification policy — international in effect, since type certification and TSO/ETSO authorization require it worldwide.
1. What it is
DO-254 (first published 2000) is the design-assurance standard for complex airborne electronic hardware (AEH) — FPGAs, PLDs, ASICs, and circuit-board assemblies whose correctness cannot be established by testing alone. It is the hardware analogue of DO-178C (software): it does not tell you how to design logic, but demands a planned, documented, requirements-driven development and verification process whose rigor scales with the criticality of the function. FAA Advisory Circular AC 20-152A ("Development Assurance for Airborne Electronic Hardware") is the current FAA vehicle for invoking DO-254; FAA Order 8110.105B tells FAA personnel how to audit against it.
2. Scope, triggers, thresholds
- Applies to: complex custom micro-coded components — FPGAs, PLDs, structured ASICs, and (per AC 20-152A) circuit board assemblies that contribute to DAL A/B/C functions — in systems seeking FAA/EASA approval. Simple devices (fully verifiable by test) may be handled with reduced rigor, with certification-authority agreement.
- Design Assurance Levels (DAL A–E): derived from the system safety assessment (ARP4761/ED-135):
- DAL A — catastrophic failure condition (multiple fatalities likely): full objectives, independence in verification, requirements-based verification plus robustness/advanced methods.
- DAL B — hazardous; DAL C — major; DAL D — minor (reduced objectives; the FAA does not expect to examine DAL D life-cycle data if DO-254 is followed); DAL E — no safety effect (no objectives).
- COTS components: explicitly in scope of industry concern — using a COTS FPGA or IP core does not escape DO-254; the applicant must still establish assurance (service experience, additional verification, or architectural mitigation), and AC 20-152A specifically excludes simple COTS microcontrollers from its complex-device guidance while addressing complex COTS.
- Trigger: any type-certification, amended type-certification, or TSO/ETSO project whose hardware contributes to a safety-related function.
3. Key requirements and compliance obligations
- Planning: a Plan for Hardware Aspects of Certification (PHAC) plus design, verification, validation, and configuration-management plans — written before the work, not after.
- Requirements capture and traceability: hardware requirements traced bidirectionally to design and to verification cases; requirements-based verification is the floor.
- Design process: conceptual and detailed design with reviews; HDL coding standards; design-constraint management.
- Verification: reviews, analyses, and testing scaled by DAL — for DAL A/B, independence between designer and verifier, elemental analysis, and robustness testing beyond nominal requirements.
- Configuration management and process assurance: problem reporting, change control, and archival of life-cycle data.
- Tool qualification: design and verification tools assessed for their potential to inject or mask errors (the DO-330 analogue applies in spirit).
- Certification liaison: staged reviews with the authority (planning, design, verification reviews) per Order 8110.105B's level-of-involvement worksheets.
4. Penalties and consequences
No direct fines — DO-254 is invoked through airworthiness regulation. Consequences: denial or delay of type certification / TSO authorization, findings against the design-approval holder, and grounding exposure for fielded products. Fraudulent certification data can draw criminal exposure under 18 U.S.C. (false statements) and debarment. Commercially, failure at a certification audit typically costs quarters, not weeks.
5. Version status and live changes (verified 2026-09-30)
- Current standard: DO-254 (2000), unchanged. It is 25+ years old and widely acknowledged as straining under modern practice (COTS IP, high-level synthesis, AI-assisted design).
- FAA Order 8110.105B issued February 20, 2024 (replacing 8110.105A) — standardizes how FAA personnel audit AEH, adds level-of-involvement worksheets, and removes chapters 3–6 duplicated by the new ACs.
- AC 20-152A (expanded) plus companion AC 00-72 ("Best Practices for Airborne Electronic Hardware Design Assurance Using EUROCAE ED-80/DO-254") close known gaps in DO-254 — including explicit application to circuit-board assemblies at DAL A/B/C.
- DO-254A is in development (RTCA Special Committee work, harmonized with EUROCAE) to modernize the guidance for current technology — [Flag: not published as of 2026-09-30; do not cite requirements from it. Track RTCA SC-239/EUROCAE WG-52 outputs.]
- EASA's AMC 20-152A provides the European acceptance path — [Flag: confirm the current EASA AMC revision before a European program kickoff.]
6. Related certifications
The catalogue's Electronics/Embedded flagship credentials (IPC-A-610 CIS, IPC J-STD-001 CIS, IPC CID) address manufacturing and design quality, not design assurance — they do not cover DO-254. DO-254 competence is demonstrated through program experience and DER (Designated Engineering Representative) qualification; there is no individual "DO-254 certification" in the catalogue. Engineers moving from commercial FPGA work to avionics should expect the process-assurance culture shock to be the real barrier, not the HDL.
7. Practical notes
- Write the PHAC first and get certification-authority agreement on DAL assignments before RTL freeze — renegotiating DAL A verification strategy after place-and-route is how programs lose a year.
- COTS IP (soft cores, vendor primitives): budget for the assurance case (service history, supplemental verification, or dissimilar redundancy) as a line item, not an afterthought.
- Keep verification independence real for DAL A/B: the same engineer writing the RTL and the testbench will not survive an audit.
Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.