Certification Authorities Software Team (CAST)

Position Paper

CAST-16

Databus Evaluation Criteria

Completed February 2003

Databus Evaluation Criteria

**Abstract:**

A number of new and existing databuses are being proposed for use by
aircraft manufacturers. This paper documents criteria that should be
considered by databus manufacturers, aircraft applicants, and
certification authorities when developing, selecting, integrating, or
approving a databus technology in the context of an aircraft project.

**Key words:**

> databus, bus, error rate, error detection, error recovery, error
> correction, controller, buffer, queue

# **1.0 Purpose**

A number of new and existing databuses are being proposed for use by
aircraft manufacturers. A databus provides numerous physical and logical
configurations for avionics architecture, data units/packets, protocols,
message traffic, etc. This allows considerable design flexibility for
system/sub-system engineers. Without extensive configuration management
(CM) control across many manufacturers, vendors, and integrators, this
flexibility can make the establishment of a type design, eventual
determinations of compliance, and maintaining continued airworthiness
extremely difficult. This paper documents criteria that should be
considered by databus manufacturers, aircraft applicants, and
certification authorities when developing, selecting, integrating, or
approving a databus technology in the context of an aircraft project.

##### 2.0 Background

Aircraft manufacturers desire to take advantage of the advances in
computing technology to reduce aircraft weight and time for design,
assembly, and integration, while also increasing airborne system
performance. This motivates them to consider replacing point-to-point
wiring and uni-directional databuses (e.g., ARINC 429) with faster and
lighter bi-directional databuses. The most widely used aviation
databuses (i.e., ARINC 429 and 629) are not considered adequate for
expanding future airborne system applications. Therefore, several
databuses are being considered for use in aircraft. For large transport
aircraft, switched Ethernet seems to be the major contender. For general
aviation aircraft (business jets and smaller aircraft), a number of
different communication technologies are being considered. Some of the
major contenders include: CAN (controller area network), ByteFlight, TTP
(time-triggered protocol), SAFEbus, and others.

Note: ARINC 429 and 629 have been evaluated and approved on many
applications. This paper is based upon knowledge to date on previous and
active databus project approvals.

##### 3.0 Databus Evaluation Criteria

There are a number of different areas to consider when evaluating
specific databus technology. The major categories to consider are:
safety, data integrity, performance, design/development assurance,
electromagnetic compatibility, verification and validation, system
configuration management, and continued airworthiness. Some of these
categories overlap; hence some evaluation criteria may be specified in
multiple locations.

This section contains general criteria for analyzing databuses. The
criteria are intentionally kept at a high and general level, since the
details will vary depending on the databus architecture. The criteria
are intended to be as complete as possible, without targeting a specific
databus application. Some criteria may not be applicable to every
databus; likewise, additional criteria may be needed for some databuses.
If a specific criterion is justifiably not applicable, it may simply be
considered "not applicable." For example, fiber optic databuses are not
specifically addressed in this paper; however, much of the criteria is
applicable to them and should be applied; likewise, there would likely
be some additional criteria to consider for fiber optic databuses.

The eight criteria categories are considered below.

***3.1 Safety***

The safety considerations of the bus technology and implementation must
be considered. The potential for ease of mix and match of different
suppliers' hardware and software when connectors and messages are
standardized also creates the potential for system incompatibility
errors. Therefore, the following criteria should be assessed and
addressed by the aircraft applicant:

1.  The aircraft-level and system-level safety assessments, as addressed
    by the pertinent regulations and advisory material (e.g., FAR/JAR
    xx.1301, FAR/JAR xx.1309, AC/AMJ xx-1309), should be performed
    considering the databus.

2.  A system safety assessment should address the bus architecture,
    implementation, and failure detection and reporting features (e.g.,
    using the SAE ARP 4754 and 4761 approach).

3.  Bus availability and reliability must meet the safety requirements,
    determined by the safety assessment.

4.  Partitioning/protection of the bus architecture, implementation, and
    failure detection and management features should be demonstrated.

5.  Failures should be detected and managed (e.g., using redundancy,
    detecting loss of nodes, supporting transparent shadow nodes, and
    supporting replica determinism or parallel nodes).

6.  Common cause (including common mode) failures should be addressed.

7.  Reconfiguration of node/network should be addressed (i.e., address
    safety aspects of possible configurations and states), as
    appropriate.

8.  A strategy for future bus expansion and associated effects on system
    integrity/safety should be developed.

9.  Redundancy management (loss reporting and automation) should be
    addressed.

***3.2 Data Integrity***

The data passed between line replaceable units (LRU), nodes, or other
entities must remain accurate. Some architectures implement error
detection and correction. In order to ensure data integrity, the
following items should be considered:

1.  The maximum error rate per byte expected for data transmission
    should be defined.

2.  A means to detect and recover from the errors should be implemented
    to meet the required safety assessment criteria (e.g., cyclic
    redundancy codes, built-in detection, hardware mechanisms,
    architecture provisions).

3.  A data load analysis should be performed to specify limitations of
    the databus.

4.  Bus capacity should be defined.

5.  Buffer overflow and underflow should be addressed.

6.  Bus integrity issues such as, babbling/jabbering devices, packet
    collisions, broadcast storms, and incomplete packages, should be
    considered.

7.  Reconfiguration of node/network should be addressed and shown to
    support data integrity requirements, if reconfiguration is enabled.

8.  Bi-directional implementation should be carefully evaluated to
    address all data integrity issues.

9.  Switch saturation should be addressed, if switches are used.

10. Mechanisms to implement reconfiguration (both software and hardware)
    should be evaluated and addressed for data integrity assurance, if
    such mechanisms are used.

11. The level of allowable degraded functionality must be considered.

12. Any security issues that may affect data integrity should be
    addressed.

***3.3 Performance***

In addition to some of the items listed in sections 3.1 and 3.2 above,
the applicant should consider the following performance items:

1.  The bus operating speed and scheduling of messages (timing and
    prioritization) should be evaluated and shown to support the safety
    and integrity requirements.

2.  Loss of bus, shorting of bus, or opening of bus situations should be
    evaluated.

3.  The system interoperability (including bus topology, communication
    protocol, and any other aspects) should be evaluated by the
    applicant.

4.  Bus length, stub length, and number of participant limitations
    should be established and followed.

5.  Degraded operation/performance should be defined and validated.

6.  Retry algorithms should be evaluated.

7.  Bus bandwidth capabilities and limitations should be documented and
    adhered to.

8.  Data latency and efficiency should be documented.

9.  Per-transmission overhead and other overhead effects should be
    established.

10. Failure management should be evaluated for adequacy and effects of
    failures within.

***3.4 Design/Development Assurance***

Regardless of the bus architecture proposed (e.g., synchronous vs.
asynchronous or uni-directional vs. bi-directional), the appropriate
design/development assurance criteria must be met:

1.  The hardware components that make up the bus architecture must have
    a level of design assurance (e.g., DO-254/ED-80) for hardware
    components that cannot be exhaustively tested. The design assurance
    should be appropriate to meet the criticality category determined by
    the associated safety assessment.

2.  The software implemented to carry out the databus architecture must
    be developed to the appropriate software level, per DO-178B/ED-12B.

    5.  ***Electromagnetic Compatibility***

The applicant should consider the electromagnetic compatibility aspects
associated with the proposed databus concept. There is a large variation
in databus electromagnetic emissions and potential electromagnetic
susceptibility. The electromagnetic emissions and susceptibility must be
considered during databus selection and specification development. An
electromagnetically noisy bus that is installed throughout an aircraft
is difficult to fix using shielding after installation. (Note that these
issues should not be relegated to simply satisfying RTCA/DO-160D
(EUROCAE/ED-14D) tests. Databuses that are installed and routed
throughout an aircraft can have emissions that meet RTCA/DO-160D
(EUROCAE/ED-14D) for individual pieces of equipment, but still create
interference problems when integrated in an aircraft.) The databus
evaluation should consider the entire databus system, which includes the
terminals, hardware, and installation.

The electromagnetic emissions will be highly dependent on the databus
specifications for pulse rise-times, bus speed, and bus topology. Bus
topology includes balanced differential-mode signaling and
transformer-coupled connections. Data pulse leading and trailing edge
shaping specifications are also important. The proposed databus
interconnection scheme will significantly affect the electromagnetic
emissions and susceptibility. Shielded, twisted pair wires with
high-quality connectors for shield termination will have better
electromagnetic performance than buses that use unshielded wires.
Effects of electromagnetic susceptibility should be considered as a
source of common mode failures for redundant implementations.

Based on these issues, the following electromagnetic compatibility
criteria should be considered by the applicant.

1.  Bus data rate, switching speed, and pulse rise and fall times should
    be assessed to minimize spectral components in sensitive aircraft
    radio receiver frequency bands.

2.  Databus interconnect hardware and wiring requirements should be
    specified with regard to radio frequency (RF) emissions and
    susceptibility. Minimum shielding effectiveness for the bus
    conductors and connectors should be defined.

3.  Electromagnetic compatibility performance should be specified for
    databus components, such as individual databus transceivers, and the
    overall databus performance as installed in the aircraft.

4.  Lightning and high intensity radiated field (HIRF) immunity should
    be specified, taking into account the safety classification for the
    functions that the databus supports.

***3.6 Verification and Validation***

The following verification and validation criteria should be considered
by the applicant:

1.  Evaluation to RTCA/DO-160D (EUROCAE/ED-14D) environmental standards,
    at levels that are appropriate for the determined criticality
    categories should be performed. The electromagnetic compatibility
    (EMC) and lightning qualification is of particular concern for
    databus technology.

2.  Appropriate verification per DO-178B/ED-12B and DO-254/ED-80 should
    be performed, as discussed in section 3.4 above.

3.  Testing of the integrated bus functionality should be performed.

4.  Integrated system testing should be performed.

5.  The bus operation, architecture, and claims should be verified and
    validated. One possible method would be via an aircraft/bus
    simulator with robustness testing to the maximum throughput rate
    possible.

6.  Failure and recovery situations should be tested (e.g.,
    reconfiguration of nodes/networks, loss of nodes, number of
    tries/retries, shorted nodes, fault coverage, etc.).

7.  Built-in-test (BIT) should be included in the databus implementation
    and should be verified for proper functionality.

8.  Failure management aspects should be tested by seeded faults at the
    bench and installation level.

9.  Degraded mode operation adequacy should be tested to assure
    acceptable performance.

> **Note:** Electromagnetic testing/validation may vary with the
> software implemented to carry out the databus architecture.

***3.7 System Configuration Management (CM)***

With many of the new databus technologies, each individual aircraft's
databus configuration could potentially be unique -- this impacts the
message traffic, collision rates, and reliability of the databus.
Databus installations require manufacturers to institute a formal CM
program, which may be stricter than was required for past technologies
(where configuration was easier to control). These installations will
also require maintenance shops and/or installers to have the
ability/access to utilize approved configuration databases and tools for
re-establishing the airworthiness of each new databus configuration. The
following system CM items should be considered:

1.  The integration of the databus into the aircraft design must be
    viewed from a total systems perspective. Therefore, mechanisms of
    configuration control, both from the fleet and the individual
    aircraft basis must be assured. Controllability of the
    modifications/additions of nodes and/or applications on the bus is
    an absolute necessity, both in certification and field maintenance
    activities, in order to assure continued operational safety.

2.  Configuration control is required in all phases, from design through
    production and maintenance, and is accomplished via use of standards
    and documentation procedures. Configuration control should address
    the overall databus and any options. Any changes of configuration
    would require an additional certification effort.

3.  Specification standards should be documented. The following is a
    minimal list of appropriate specification standards needed: physical
    rules (e.g., transmission media, connectors, terminations, maximum
    number nodes/run lengths, etc.), and logical rules (e.g., message
    packet definitions).

4.  The following documents should be provided and adhered to, as a
    minimum: Interface Control Documents, Designer's guide, and
    Installer's guide.

5.  If the databus uses a multi-layered architecture (e.g., the Open
    Systems International (OSI) standard Physical (OSI Level 1),
    Datalink (OSI Level 2), Network (OSI Level 3), Transport (OSI Level
    4), Session (OSI Level 5), Presentation (OSI Level 6), Application
    (OSI Level 7)), documentation to support all layers should be
    provided.

***3.8 Continued Airworthiness***

The performance of the databus over the life of the aircraft should be
considered. Issues related to physical degradation of the databus
components should be addressed. Physical degradation could include
databus wire and connector corrosion, damage, and wear. Issues related
to in-service modifications and repairs should be considered. In
addition, consideration should be given to the fact that the
state-of-the-art is changing rapidly for the typical components that
comprise the databus and future maintenance may require use of different
configuration/functional components.

Modifications to the databus will require a system-level change impact
analysis by the applicant to determine appropriate activities needed to
be re-performed/reassessed on the bus and affected system(s). The change
impact analysis should follow a defined process to accomplish its
purpose of determining the potential impact of the change on continued
operational safety of the aircraft on which the product is installed.

If a previously approved or modified databus is to be used in a
different project, the suitability of the bus to the new project should
be evaluated using the criteria of this paper.

##### 4.0 Certification Authorities Software Team (CAST) Position

The applicant and certification authority should make sure that the
evaluation criteria discussed in this paper are addressed, when
databuses are being considered. Applicants typically find that a databus
certification plan that demonstrates how they are addressing the above
criteria greatly assists the certification effort.

The criteria in this paper are by no means an exhaustive list of things
to consider in evaluation of a databus -- it is merely a list of the
minimum items to be considered. Each specific databus architecture will
have details that cannot be addressed by general criteria. These details
should be discussed, addressed, and agreed upon between the applicant
and the appropriate certification authority.