7 Keys to Successful DO-178C Audits PDF Print E-mail
Article Index
7 Keys to Successful DO-178C Audits
7 Keys to Successful DO-178B Audits
All Pages

By Rafael Montero, Quality Manager, Avionyx.

If your company develops or verifies software for the avionics industry, you are probably familiar with DO-178C Software Considerations in Airborne Systems and Equipment Certification.

In brief, DO-178C is a document published by RTCA and used by the Federal Aviation Agency (FAA) as the main guidance to determine if the software will perform safely and reliably in an airborne environment. DO-178C lists a series of objectives that need to be accomplished in order to produce reliable software according to the impact in safety caused by a failure condition of that software.

The FAA has established a software audit process that ensures compliance to the DO-178C objectives and other applicable software policy, guidance, and issue papers. This audit process includes four Stages of Involvement (SOI) throughout the software life cycle of a project:

  1. Planning Review
  2. Development Review
  3. Verification Review
  4. Final Review

The intent of this article is not to explain each SOI, but to assist you in being successful when the FAA’s Designated Engineering Representative (DER) or delegate performs an audit of your software project. For more information on the software audit process you may read the FAA Order 8110.49, Software Approval Guidelines available on the FAA website.

Companies are oftentimes exposed to audits which may be stressful, but they do not have to be that way. The following guidelines will help you handle FAA auditors, avoid common mistakes and reduce or even eliminate stress.

1. Plan the Audit

Preparation is the key to having a successful audit.

It is important to schedule a meeting with the DER well before the audit to discuss the topics that will be addressed during the visit. Ask the DER questions like:

  • What is the scope of the audit?
  • What documentation and materials will be needed and how soon? 
  • When will the audit occur?
  • How long will it take to complete the audit?
  • What support and considerations will be required (e.g., workspace, Internet access, and projector)?

What to do if you are not ready: It is extremely important that you are ready before the DER’s visit. If you are not ready, consider postponing the visit for a date when you will be ready. Why? Because neither you nor the DER will be very happy afterward when you both conclude that the audit has to be rescheduled, wasting the DER’s time and your company’s money. If you haven’t worked with the DER before, you may want to provide documentation in advance to confirm that you are ready, just to be safe.

Before you start, you should know what Level of Involvement (LOFI) the DER or designee will maintain with your facility. You can estimate/calculate their LOFI using a checklist that is available in the FAA 8110.49 Software Approval Guidelines.

The checklist provides a result that basically tells the DER what degree of thoroughness should be maintained during the software audit. There are three types of Involvement: Low, Medium and High. For example, for a Low level, the DER may want to check artifacts via e-mail or through a web based system. In the other extreme, for a High level, the DER will do on-site audits for every step of the project. This checklist is normally completed in advance by the DER but it is important that you are familiar with it and prepared to provide the information that the DER may request to complete it. Your initiative may help to build up the level of comfort of the DER by showing that you have been through the process before.

2. Build Your Team

Having the right people available to support the software audit is critical. A team that includes representatives from Project Management, Development, Verification and Quality Assurance will be more than adequate. People who either have the answers at hand or can quickly investigate issues and report back to the DER can help move a software audit along faster.

Before the software audit, it is important to designate a main speaker for the meeting so that he/she can decide who should answer which questions from the DER. Typically the Project Manager should be the main speaker of the meeting; but it could be anyone with sufficient knowledge of the project, process and team members’ capabilities. Not all the team members have to be present at all times, however the Quality Assurance and Project Management team members should be present.

3. Conduct a Self Assessment

Ask your Quality Assurance team member to lead a company self-assessment well in advance of the actual audit. The checklists that the DER will most likely use to perform the audit are contained in the Conducting Software Reviews Job Aid document available for download at the FAA website. Your team should select the checklists and checklist items that are most appropriate depending of the software level and the SOI that is being reviewed.

Evidence should be provided for each response of a checklist item. Do not resort to just giving “Yes” or “No” statements. Answers should be justified with objective evidence (e.g., document references, record references, justifications).

Some DERs will request more than one piece of evidence for each checklist item, so be sure to discuss this with the DER before you start the self-assessment. If you are not sure how to address a specific checklist item, don’t hesitate to ask the DER; you do not want to be at the audit without knowing what is expected from you.

4. Conduct a Team Meeting

A team meeting is strongly recommended prior to the actual audit so that any findings identified during the self assessment can be discussed and agreed upon before the actual audit.

Also, use this team meeting to discuss and reach a consensus on what is going to be presented to the DER. This avoids having team members answer questions differently during the real audit, and it helps to demonstrate clarity and process.

The DER may want to receive all the findings that you have discovered. This creates a better trust relationship with the DER, therefore he/she will likely focus on the findings that you submitted. Be honest! If they cannot be fixed quickly, then document them as findings. It is always better that you find an issue than letting the DER find it.

5. Prepare Audit Documentation

As mentioned before, preparation is the key to success during an audit. Bring to the meeting hard copies of major documents under audit ready. Looking at a computer monitor or a projector during a software audit can be a tedious task for the DER.

Good documentation is a must. Make sure that all the relevant released documents and records are up to date. Surviving an interrogation during an audit requires that the team answers questions referencing actual documentation.  If your records clearly substantiate the answers, the DER will not waste time conducting a more in-depth review.

If you do not know the answer to a question, that’s ok. Simply state that you will research it and provide the information later. And then provide the information as soon as you can, following the audit. But don’t lose your credibility by not following through.

Since the process required by DO-178C involves tracing between documents, a sample group of traceability threads — both upwards and downwards — will be needed by the DER so that he/she can verify how the process has been followed. Providing these threads in advance will also expedite the audit.

6. Provide a Professional Setting

Your DER may have to travel far to see you. An offer to assist in making travel arrangements may be appreciated. The audit may take a considerable amount of time, so try to ensure that sufficient accommodations are made to provide a comfortable and private setting. The mood should be professional and courteous.  Make sure your team shows up on time.

A DER will discuss the findings with you before the report is prepared. If you provide objective evidence that contradicts the finding, then he/she will most likely acknowledge it and remove the finding.

Common mistakes are normally attributed to not being prepared, such as being resistant or defensive to suggestions, being dishonest and offering explanations or information that are not supported by objective evidence.

Although you may be proud of your process and documentation, try to respond only to the questions being asked by a DER. Diverting the conversation or talking about unrelated topics will require the DER to scrutinize the additional information you provide and may extend the audit unnecessarily.

7. Close the Audit

Before closing your meeting, make sure that you close with a clear understanding of what the next steps are to completing the audit so you and your team know where you stand. You are allowed and encouraged to make specific requests to help your team meets its goals, for example:

  • Request a wrap-up meeting from the DER at the end of the site visit.
  • Request a draft copy of the final report that will be issued, and review it for accuracy. Most DERs are willing to provide a report with the findings and comments before leaving the premises.
  • Once you receive the draft report or final report at the end of the visit, make sure to ask what the result was: Pass or Fail. The audit process may uncover findings but the DER may feel that the project is in good shape and determine that the findings can be fixed along the way.

Finally, celebrate the successes and carefully review the problems found. Remember, don’t point fingers! Usually the problems lie within the process and procedures used to accomplish a task rather than your team’s shortcomings. Throwing money at a problem rarely solves it – however, finding a solution by following a thorough investigation is rewarding and beneficial to your team and your company.

If you need detailed information about the SOI process you may download a copy of the documents listed by clicking in the links provided here:

Software Approval Guidelines (8110.49)              FAA Website
Conducting Software Reviews Prior to Certification (Job Aid)         FAA Website

If you have questions on how to prepare for your SOI audit, feel free to contact Avionyx

AddThis Social Bookmark Button