Advisory 

Circular

 

Subject: AVIATION DATABUS 

ASSURANCE 

Date: 08/04/06

Initiated by: AIR-100 

AC No: 20-156 

1. PURPOSE. 

a. This advisory circular (AC) is for aircraft and aircraft engine manufacturers and 

designers. We provide a means to gain Federal Aviation Administration (FAA) approval of your 

aviation databus by showing the databus design performs its intended function and satisfies the 

applicable airworthiness requirements when installed on an aircraft or aircraft engine. 

b. This AC is not mandatory and does not constitute a regulation. This AC describes an 

acceptable means, but is not the only means, to gain databus certification. However, if you use 

the means described, you must follow it in all important respects. 

2. MOTIVATION FOR GUIDANCE.

a. Aircraft, engine and avionics manufacturers want to take advantage of commercially 

available databus technology that would reduce aircraft weight and development/manufacturing 

time, and increase airborne system performance. This desire motivates manufacturers to 

consider replacing point-to-point wiring and uni-directional databuses (for example, ARINC 429 

databus) with faster and lighter bi-directional databuses. The guidance in this AC is intended for 

new type certificate or major changes of aircraft installations with highly-integrated and complex 

databus technology. It is not intended for systems with previously approved or legacy databus 

technology unless the databus is used in a significant different way. You can use alternate 

methods to ensure that the databus performs its intended function and meets airworthiness 

requirements when installed on an aircraft or aircraft engine. Coordinate your plans for alternate 

methods with us early in the certification project. 

b. Databuses transfer information between line replaceable units (LRU) and line 

replaceable modules or avionics modules installed in an aircraft. Aircraft and avionics 

manufacturers propose to use different types of databuses on aircraft. These databuses are 

becoming more complex as aircraft, aircraft engine, and avionics manufacturers integrate more 

avionics components into the aircraft and aircraft engine data sources, requiring accommodations 

for larger data transfers. System engineers have considerable flexibility when designing a 

databus because there are many physical and logical configurations for airborne systems 

architecture, data units or packets, protocols, message traffic, and so on, allowing avionics 

manufacturers, databus vendors, and system integrators more latitude when configuring 
08/04/06 AC 20-156 

2 

databuses. Without extensive configuration control across the many manufacturers, vendors, and 

integrators, this flexibility can make it difficult to establish the type design of an aircraft or 

engine, to determine compliance to the regulations, and to maintain continued airworthiness. 

c. Aircraft and aircraft engine certification applicants must address this AC guidance when 

developing, selecting, integrating, or seeking approval of a databus technology that complies 

with the appropriate airworthiness requirements for an aircraft or aircraft engine. To help you 

obtain this approval, we divided the guidance in eight categories. Each category contains 

guidelines you must address. You will have to determine whether a particular guideline applies 

to your databus. However, depending on your project, you may need other project-specific 

criteria not specifically identified in this AC. The eight categories are: 

∞ Safety (paragraph 3). 

∞ Data integrity (paragraph 4). 

∞ Databus performance (paragraph 5). 

∞ Software and hardware assurance (paragraph 6). 

∞ Electromagnetic compatibility (paragraph 7). 

∞ Verification and validation (paragraph 8). 

∞ Configuration management (paragraph 9). 

∞ Security assurance (paragraph 10). 

3. SAFETY REQUIREMENTS. As an aircraft or aircraft engine applicant, you must 

determine how the databus design will affect the safe operation of the aircraft or aircraft engine. 

To accomplish this task, you must comply with the requirements of Title 14 of the Code of 

Federal Regulations (14 CFR) §§ xx.1301 and xx.1309 (where xx connotes the applicable part 

23, 25, 27, 29), §§ 33.28 and §§ 33.75 and the associated advisory material for the design and 

function of your databus. Your safety assessment of the databus when installed on an aircraft or 

aircraft engine must address the following: 

a. The databus architecture and implementation, using for example, SAE International’s 

Aerospace Recommended Practice (ARP) 4754, Certification Considerations for HighlyIntegrated or Complex Aircraft Systems, dated November 1996, and ARP 4761, Guidelines and 

Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and 

Equipment, dated December 1996. 

b. Databus availability and reliability requirements meet the safety requirements. Your 

safety assessment will help determine the safety requirements. 

c. Partitioning and protection requirements for the databus’ architecture and 

implementation. 

d. Failure detection, reporting, and management features such as the use of redundancy 

features, detecting the loss of nodes, the support of transparent shadow nodes, and the support of 
08/04/06 AC 20-156 

3 

parallel nodes. A node is a databus component capable of processing, sending, receiving, or 

sending and receiving information over the databus. 

e. Fault containment, fault tolerance, and monitoring of the databus to protect against 

hardware and software faults in the host system. 

f. Common cause (including common mode) and cascading failures. For each aircraft, you 

must perform a common cause analysis to address faults that go beyond your databus fault 

analysis. This common cause analysis includes a zonal safety analysis, particular risk analysis, 

and a common mode analysis. The location of each LRU and the routing of wiring between 

those components are critical in the achievement of acceptable zonal safety and determining the 

particular risks analyses. For critical aircraft functions supported by the databus, do not route 

redundant channels of the databus through zones where a probable risk may cause loss of all 

channels. To protect databus applications, use electrical and mechanical means to isolate 

databus channels. 

g. Methods or ways to reconfigure node(s) and the network to ensure safe operation of 

possible configurations and states, as appropriate. 

4. DATA INTEGRITY REQUIREMENTS. Data that passes between LRUs, nodes, 

switches, modules, or other entities must remain accurate and meet the data integrity of the 

aircraft functions supported by the databus. To ensure data integrity through error detection and 

corrections resulting from databus architectures, evaluate databus systems for the following: 

a. The maximum error rate per byte expected for data transmission. 

b. Where applicable, databus-provided means to detect and recover from failures and errors 

to meet the required safety, availability and integrity requirements. Examples are cyclic 

redundancy checks, built-in detection, hardware mechanisms, and architecture provisions. 

c. A databus loading analysis (for example, maximum traffic load, databus throughput, 

worse-case loading, and so forth) to ensure data integrity requirements are met. 

d. The buffer overflow and underflow limits to ensure data integrity requirements are met. 

e. Issues related to the databus integrity such as nodes that transmit at random instants for 

an arbitrary duration (babbling idiots), nodes that send an endless stream of bits (jabbering 

devices), packet collisions, broadcast storms, and incomplete data packages. 

f. If applicable, the ability of the databus to reconfigure the node, databus architecture and 

network (both software and hardware) to support data integrity requirements. 

g. The bi-directional error detection implementations to address data integrity issues. 

h. If applicable, the switch saturation limits of the system. 

i. If applicable, the allowable levels of degradation for the databus operation and 

performance, and their affect on data integrity. 
08/04/06 AC 20-156 

4 

j. Security issues that may affect data integrity (see paragraph 10 of this AC). 

5. DATABUS PERFORMANCE REQUIREMENTS. You must evaluate the following 

databus performance items: 

a. The databus operating speed and scheduling of messages (timing and prioritization) that 

support the operational safety and integrity requirements. 

b. Loss of the databus through shorting or opening of the databus connections. 

c. The system interoperability to include the databus or network topology, the 

communication protocol between components, and any other aspects. 

d. Each databus length, stub length, and cable coupling specification and limitations. 

e. Degraded databus operation and performance abilities, where applicable. 

f. Retry algorithms, where applicable. 

g. Bandwidth capability of the databus. 

h. The actual specification of the databus capacity. 

i. Data latency and efficiency. 

j. Per-transmission overhead and other overhead effects. 

k. The system’s failure management (including failure/malfunction reporting) and the 

failure effects within the databus. 

l. The system start-up configuration and reintegration (recovery when a node that has gone 

off line rejoins the bus) durations. You must determine and use the worst-case times for bus 

start-up and node reintegration for all systems using the bus. 

6. SOFTWARE AND HARDWARE ASSURANCE REQUIREMENTS. The aircraft’s 

systems, equipment, or engine must meet the applicable software and hardware design and 

development assurance guidelines, regardless of the bus architecture you propose (synchronous 

or asynchronous; uni-directional or bi-directional). 

a. Each complex electronic device must meet the appropriate hardware design assurance 

requirements. The hardware design assurance of those complex electronic devices must meet the 

failure condition category and hardware design assurance level as determined by the safety 

assessment. To ensure the hardware design assurance, follow AC 20-152, RTCA, Inc., Document 

RTCA/DO-254, and RTCA, Inc. document RTCA/DO-254, Design Assurance Guidance for 

Airborne Electronic Hardware, dated April 19, 2000, or other acceptable means of compliance.

b. To ensure the design and development assurance of software that will function within 

the databus architecture, you must develop the software to the appropriate software design 

assurance level, per AC 20-115, RTCA, Inc., Document RTCA/DO-178B, and RTCA/DO-178B, 
08/04/06 AC 20-156 

5 

Software Considerations in Airborne Systems and Equipment Certification, dated December 1, 

1992, or other acceptable means of compliance. 

c. When using tools to develop or verify the databus software or hardware, you may need 

to qualify the tools. Guidance for qualifying tools to develop software and hardware may be 

found in RTCA/DO-178B and RTCA/DO-254 respectively. 

7. ELECTROMAGNETIC COMPATIBILITY REQUIREMENTS. To ensure proper 

operations of the databus, you must address the electromagnetic compatibility of the proposed 

databus: 

a. There is a potentially large variation in electromagnetic emissions and electromagnetic 

susceptibility in databuses and databus components. Consider the effects of electromagnetic 

emissions and susceptibility when you design, select, or specify the databus you will use in the 

aircraft. An electromagnetically noisy databus installed throughout an aircraft is difficult to fix 

after installation. 

b. When evaluating the databus for electromagnetic compatibility, consider the entire 

databus system, including the terminals, hardware, and installation. To address issues with 

electromagnetic emissions and susceptibility, you should not limit your evaluation to only 

RTCA/DO-160E, Environmental Conditions and Test Procedures for Airborne Equipment, dated 

December 9, 2004, tests for individual equipment. Individual pieces of equipment tested in 

isolation may meet the RTCA/DO-160E emission requirements but create interference problems 

when integrated on the aircraft. To address the overall electromagnetic compatibility of the 

integrated databus system, you may need to define and evaluate databus system requirements to 

supplement the RTCA/DO-160E tests performed for individual equipment. 

 NOTE: RTCA/DO-160E emission tests performed on technical 

 standard order (TSO) equipment during the TSO authorization process 

 may be used to support the electromagnetic compatibility requirements 

 of this AC. 

c. The electromagnetic emissions will depend on the databus design specifications for 

pulse rise times and settling times, databus speed, and databus topology. Databus topology may 

include the use of balanced differential-mode signaling and transformer-coupled connections, 

making the shape of the data pulse (both leading and trailing pulse edges) very important. 

Proposed interconnection of the databus will significantly affect the electromagnetic emissions 

and susceptibility. However, shielded, twisted pairs of wires with high-quality connectors for 

shield termination will have better electromagnetic performance than buses using unshielded 

wires. You should address and mitigate the effects of electromagnetic susceptibility that can 

cause common mode failures for redundant implementations. 

d. To address the electromagnetic compatibility guidelines presented in paragraphs 7a

through 7c above, evaluate each databus using the following electromagnetic compatibility 

criteria: 
08/04/06 AC 20-156 

6 

(1) Databus data rate, switching speed, and pulse rise and fall times. Evaluating these 

criteria will help minimize spectral components interference with aircraft equipment such as 

sensitive aircraft radio receivers. 

(2) Databus interconnect hardware and wiring requirements for radio frequency 

emissions and susceptibility. An example of a hardware and wiring requirement is minimum 

shielding effectiveness for the databus conductors and connectors. 

(3) Electromagnetic compatibility of databus components such as individual databus 

transceivers. Also, evaluate the overall performance of the databus as installed in the aircraft. 

(4) Lightning and high-intensity radiated field (HIRF) immunity commensurate with 

the safety classification of the functions that the databus supports. Guidance for system lightning 

protection is found in AC 20-136, Protection of Aircraft Electrical/Electronic Systems against 

the Indirect Effects of Lightning. FAA special conditions are issued with HIRF protection 

requirements for individual certification projects. 

8. VERIFICATION AND VALIDATION REQUIREMENTS. As an applicant, you must: 

a. Validate the databus requirements for the aircraft or aircraft engine project. 

b. Evaluate whether the databus meets RTCA/DO-160E environmental standards, at the 

levels appropriate for each of the criticality functions supported by the databus. The 

electromagnetic compatibility and lightning qualification is of particular concern for databus 

technology because verification is typically done during aircraft installation. Electromagnetic 

testing and validation may vary depending on the databus architecture. 

c. Perform appropriate verification of the databus in accordance with AC 20-115 

(RTCA/DO-178B) and AC 20-152 (RTCA/DO-254), as discussed in paragraph 6 above. 

 NOTE: RTCA/DO-178B and RTCA/DO-254 verification tests 

 performed on technical standard order (TSO) equipment during 

 the TSO authorization process may be used to support the verification 

 and validation requirements of this AC. 

d. Perform a functional test of the integrated databus to ensure it meets its intended 

functions. 

e. Verify and validate the databus operation, architecture, and performance claims. One 

acceptable method is to use an aircraft or databus simulator that uses the maximum throughput 

rate allowed for the system being tested. 

f. If applicable, test the databus failure and recovery procedures by reconfiguration of 

nodes and networks, loss of nodes, number of recovery attempts, shorted nodes, fault coverage, 

etc. 

g. If applicable, verify all built-in-tests to ensure they function correctly. 
08/04/06 AC 20-156 

7 

h. If applicable, test the databus failure management features at the bench and installation 

levels. 

i. If degraded mode capability is supported, test the databus in a degraded mode to ensure 

acceptable performance. 

j. When you use test benches to verify the performance of the databus, you must also 

perform the wiring acceptance tests by documenting the test methods or procedures used to 

determine the wiring harness is correct. You must use these procedures for initial installation 

and subsequent maintenance actions. Modifications after installation approval will require a 

change impact analysis to determine if the wiring acceptance tests or procedures need to be 

performed again. 

9. CONFIGURATION MANAGEMENT REQUIREMENTS. Because there are many 

new databus technologies, each individual aircraft’s databus configuration could potentially be 

unique, and because of this uniqueness, changes to the databus configuration may result in an 

adverse effect on the databus’ message traffic, data collision rates, and reliability. For databus 

installations, manufacturers must establish a configuration management program for the databus. 

These installations will also require maintenance personnel and installers to use manufacturer’s 

approved configuration databases and tools when maintaining or re-establishing the 

airworthiness of the databus configuration. Address the following system configuration 

management items when developing your databus: 

a. When you integrate the databus into the aircraft or aircraft engine design, consider the 

total system by ensuring there are mechanisms of configuration control for continued operational 

safety and configuration control of the modifications. The additions of nodes and applications 

on the databus must be assured both in certification requirements and in-service maintenance 

activities. 

b. You must establish and maintain configuration control of the databus during 

certification, from design through production and maintenance by following your established 

standards and documented procedures. Configuration control should address the databus and the 

selected options for each installation, being mindful that you may need additional FAA 

certification for changes to previously approved configuration. 

c. Document applicable specification standards. At a minimum, you need to document 

physical and logical rules used by the databus. Examples of physical rules are requirements for 

transmission media, connectors, terminations, maximum number nodes, and run lengths. 

Message packet definitions are an example of logical rules. 

d. Provide documentation to support development and operation of the databus such as the 

interface definitions document, user’s guide, and installer’s guide. 

e. If the databus uses multi-layered architecture, provide documentation to support and to 

configure layers. An example of multi-layered architecture is the open systems interconnection 

(OSI) networking model, also known as the seven-layer model. 
08/04/06 AC 20-156 

8 

f. You must document databus wiring and installation procedures. These procedures 

should include definitions of appropriate wire and shield types, electrical bonding requirements, 

and any specific wire bundle routing and separation requirements. 

g. Strategy, plan, or process for future bus expansion and how potential changes will affect 

system integrity and safety. 

10. SECURITY ASSURANCE REQUIREMENTS. Many modern databuses introduce 

potential security risks that are not common in traditional networked systems. Access security 

and data protection are two areas you should address: 

a. Access Security. When airborne systems interact with the outside world through a 

databus or network, they may become vulnerable to potential malicious attacks such as software 

viruses. Each databus should be evaluated for this potential risk. Depending on the risk, adopt 

appropriate security techniques and controls to protect access to the airborne software. Some 

sample techniques are: 

∞ Encryption techniques (such as public and private key encryption, digital 

signatures, hash functions) to protect data transmission. 

∞ Authentication and access control policies (such as Discretionary Access 

Control protocol and the Mandatory Access Control protocol). 

∞ Intrusion detection (such as signature-based approach, anomaly-based 

detector, specification-based intrusion detection, bottleneck verification, hostbased intrusion detection, and network-based intrusion detection). 

b. Information and Data Protection. When using networks or modern databuses, you 

must protect critical information used and stored in airborne systems. Sample approaches are: 

∞ Information verification methods to ensure that the data have not been 

corrupted during loading and storage (for example, cyclic redundancy check 

and checksum). 

∞ Use of audit trails that account for data accessed (for example, a log of when 

and which critical flight data are accessed). 

11. PROCEDURES FOR MEETING REQUIREMENTS. Perform the following activities 

to ensure you address the guidance in paragraphs 3 through 10 of this AC: 

a. Develop a databus certification plan to address the guidelines in paragraphs 3 through 10

of this AC, and other requirements in on the specific project. The databus certification plan may 

be part of the system certification plan or other certification planning document. 

b. Submit the plan to the responsible aircraft certification office for approval. 

c. After developing the databus, submit a compliance report to show how you satisfied the 

guidelines of this AC. This compliance report may be part of the system, aircraft, or aircraft 

engine compliance report. If certain guidelines do not apply, describe why they do not apply. 
08/04/06 AC 20-156 

9 

d. Address continued airworthiness requirements in the instructions for continued 

airworthiness section of the maintenance manual, user’s guide, or other appropriate documents. 

At a minimum, you must address the following continued airworthiness issues: 

∞ Performance of the databus over the life of the aircraft. 

∞ Physical degradation of the databus components. This could include databus 

wire and connector corrosion, damage, and wear out. 

∞ In-service modifications and repairs to the databus. 

∞ Use of different configurations and functional components for obsolete 

databus components, due to the rapidly changing state-of-the-art databus 

components. Future maintenance of the databus may require the use of 

different configurations and functional components. 

∞ Scheduling information for any databus components that require specific 

maintenance intervals. 

∞ Information on how to remove/install databus components to support 

maintenance. 

∞ Information on how to evaluate and test databus operation (system checks). 

e. Perform a system-level change impact analysis to determine how modifications to the 

databus affect the system. The impact analysis will also determine appropriate activities needed 

to re-perform and re-assess the databus and affected systems. Follow your defined process when 

performing a change impact analysis to determine how the change may affect the continued 

operational safety of the aircraft. 

f. When using a previously approved or modified databus for a different project, you may 

use the guidelines in this AC to evaluate the suitability of the databus for the new project. 

12. RELATED DOCUMENTS AND HOW TO GET THEM. 

a. Code of Federal Regulations. You can get copies of 14 CFR parts 21, 23, 25, 27, 29, 

and 33 from the FAA website at http://www.airweb.faa.gov/rgl. 

b. FAA Advisory Circulars (AC) and Orders. The following ACs and orders are 

available from the FAA website at http://www.airweb.faa.gov/rgl. 

(1) AC 20-115, RTCA, Inc. Document RTCA/DO-178B; 

(2) AC 20-152, RTCA, Inc. Document RTCA/DO-254, Design Assurance Guidance for 

Airborne Electronic Hardware; 

(3) AC 21-16, RTCA, Inc. Document RTCA/DO-160E; and 

(4) AC 20-136, Protection of Aircraft Electrical/Electronic Systems against the 

Indirect Effects of Lightning. 
08/04/06 AC 20-156 

10 

(5) AC 23.1309-1, Equipment, Systems, and Installations in Part 23 Airplanes. 

(6) AC 25.1309-1, System Design and Analysis.

(7) AC 27-1, Certification of Normal Category Rotorcraft. 

(8) AC 29-2, Certification of Transport Category Rotorcraft. 

(9) AC 33.28-1, Compliance Criteria For 14 CFR§33.28, Aircraft Engines, Electrical 

And Electronic Engine Control Systems

(10) AC 33.28-2, Guidance Material For14 CFR §33.28, Reciprocating Engines, 

Electrical And Electronic Engine Control Systems. 

(11) AC 33.75-1, Guidance Material for 14 CFR 33.75, Safety Analysis. 

c. RTCA, Inc. Documents. Order RTCA documents from RTCA, Inc., 1828 L Street 

NW, Suite 805, Washington, D.C. 20036-4008. You can also order copies online at 

www.rtca.org. RTCA documents referenced in this AC are: 

(1) RTCA/DO-160E, Environmental Conditions and Test Procedures for Airborne 

Equipment; 

(2) RTCA/DO-178B, Software Considerations in Airborne Systems and Equipment 

Certification; and 

(3) RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware. 

d. SAE Documents. Order SAE documents from SAE International, 400 Commonwealth 

Drive, Warrendale, PA 15096-0001. You can also order copies on-line at www.sae.org. We 

reference the following SAE documents in this AC: 

(1) ARP4754, Certification Considerations for Highly-Integrated or Complex Aircraft 

Systems; and 

(2) ARP4761, Guidelines and Methods for Conducting the Safety Assessment Process 

on Civil Airborne Systems and Equipment. 

David W. Hempe 

Manager, Aircraft Engineering Division 

Aircraft Certification Service