DO-178C introduces the concept of a Tool Qualification Level (TQL) that defines the rigor of the qualification process. Five (5) TQLs are defined on the basis of three (3) criteria:

a. Criteria 1: A tool whose output is part of the airborne software and thus could insert an error.

b. Criteria 2: A tool that automates verification process(es) and thus could fail to detect an error, and whose output is used to justify the elimination or reduction of: 1. Verification process(es) other than that automated by the tool, or 2. Development process(es) that could have an impact on the airborne software.

c. Criteria 3: A tool that, within the scope of its intended use, could fail to detect an error.

Criteria 1 is identical to the definition of a “development tool” under DO-178B. These are tools whose output is used (directly or after downstream activities) as part of the airborne system in its approved configuration.

Criteria 3 is practically identical to the definition of “verification tool” in DO-178B. The change is the addition of the phrase “within the scope of its intended use”. This phrase is used to set Criteria 3 apart from Criteria 2, which is discussed below. The output of the tool is not used as part of the airborne application, so the tool cannot introduce errors into the software. The tool may fail to detect existing errors. Code coverage measurement and static analysers are two very common examples of such tools. LDRA has several TQSPs for Criteria 3 tools within the LDRA tool suite.

Criteria 2 is new in DO-178C. The certification authorities were concerned because they were seeing projects that were using DO-178B “verification tools” in order to justify not performing activities that are not directly performed by the tool. For example, a stack usage monitor is used during development and verification of the application to justify not including a stack overflow detection routine in the airborne software. The decision to use the tool in such an extended manner is a project-level decision. LDRA does not generically support any Criteria 2 tool qualifications through TQSPs.

If a customer wishes to qualify an LDRA tool as a Criteria 2 tool, it is advisable that they do so in consultation with LDRA Certification Service (LCS).

Once the need to qualify is established and the applicable criterion is identified for the tool qualification, Table 12-1 in DO-178C §12.2.2 is used to determine the appropriate TQL. This table is reproduced below.

As LDRA’s TQSPs are designed for Criteria 3 tools, the remainder of this paper will focus exclusively on TQL-5 tool qualification.

Tool Qualification Level

Get in touch