An inflight entertainment (IFE) system has software for the computers and for the seatback displays. What DAL level is the software classified at?
$\begingroup$
$\endgroup$
2
-
2$\begingroup$ Welcome to aviation.stackexchange! You are asking many questions at a time. Could you please rephrase your question to only ask for one thing. You can then create more follow up questions and link them to this one. $\endgroup$– BianfableCommented Apr 21, 2019 at 9:14
-
$\begingroup$ Done. Thank you. $\endgroup$– testuserCommented Apr 21, 2019 at 16:22
Add a comment
|
3 Answers
$\begingroup$
$\endgroup$
DAL is specific to a design and installation. It's a flow down from the aircraft system requirements and design and the safety assessment process.
These processes are defined in SAE ARP4754A Guidelines for Development of Civil Aircraft and Systems and ARP4761 Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.
ARP4754A is the more relevant to this question. A summary of the process is to start with a Functional Hazard Assessment which identifies hazards associated with failure modes of specific functions. Based on the severity of the failure condition a Functional DAL (FDAL) assignment is made.
The next step is to assess the architecture for functional and item independence. This allows for setting Item FDAL for each of the components of the system.
It can get complicated, but for a simple example: If you have an FDAL B and FDAL E function combined into a single item with no independence, the IDAL of both becomes Level B. If they are functionally independent and also independent items, the IDAL would match the FDAL for each.
Back to the question: An old colleague of mine worked much of the certification effort for the B777 IFE when he was at Boeing. As he explained, the highest criticality function in the IFE is the PA override function which is FDAL C. The rest of the IFE system was set at Level D. (you could argue for Level E based on the argument that losing it has no safety effect, but the Level D is based on the requirement that you show non-interference with any other system.)
The question as posed, is about the software which means we're asking about IDAL. If the IFE SW architecture is a single application or multiple applications that lack independence from the PA override code, the IDAL for the IFE SW will be Level C.
It may be possible to architect the SW with proper hardware or software partitioning to provide independence of the functions and items. In that case, the independent items could be developed at the lower IDAL level.
$\begingroup$
$\endgroup$
2
While I haven't worked directly with IFE software, I would expect it to be either DAL D or E, depending on the integration with the rest of the cabin systems.
Most likely it would be DAL E, as the failure of the IFE system should have no bearing on the safety of the flight systems themselves.
answered Apr 22, 2019 at 13:17
-
$\begingroup$ ...unless you're on Swissair 111, but that wasn't software (I think). $\endgroup$– userCommented Apr 23, 2019 at 12:39
-
$\begingroup$ From the reports, Swissair 111 was likely cause by the IFE wiring, definitely not the software. $\endgroup$ Commented Apr 23, 2019 at 13:44
$\begingroup$
$\endgroup$
3
I can answer with certainty on several products I am familiar with that they are certified to DAL C. This seems a bit much in my personal opinion, but it is a fact.
answered Apr 22, 2019 at 16:53
-
$\begingroup$ Is that DAL then driven by the specific OEM/installer? I don't recall a TSO geared towards IFE systems to help guide their criticality level, which leaves either PMA or TC/STC. $\endgroup$ Commented Apr 22, 2019 at 17:53
-
$\begingroup$ I am not certain what drives this, it is a different division that handles these particular products. And for clarification, the hardware is various power supplies for the IFE systems, and not the displays themselves. $\endgroup$ Commented Apr 22, 2019 at 18:21
-
$\begingroup$ Please note that we are talking ONLY about IFE software and not the IFE system. I am having a hard time visualizing why it would be at DAL C - there is nothing in there to be at a failure condition of "major" $\endgroup$– testuserCommented Apr 23, 2019 at 0:20