DO-333 Certification Case Studies

  • Darren Cofer
  • Steven Miller
Part of the Lecture Notes in Computer Science book series (LNCS, volume 8430)


RTCA DO-333, Formal Methods Supplement to DO-178C and DO-278A, provides guidance for software developers wishing to use formal methods in the certification of airborne systems and air traffic management systems. This paper presents three case studies describing the use of different classes of formal methods to satisfy DO-178C certification objectives. The case studies examine different aspects of a common avionics example, a dual-channel Flight Guidance System (FGS), which is representative of the issues encountered in actual developments. The three case studies illustrate the use of theorem proving, model checking, and abstract interpretation. Each of these techniques has strengths and weaknesses and each could be applied to different life cycle data items and different objectives than those described here. Our purpose is to illustrate a reasonable application of each of these techniques to produce the evidence needed to satisfy certification objectives in a realistic avionics application. We hope that these case studies will be useful to industry and government personnel in understanding formal methods and the benefits they can provide.


Formal methods certification model checking theorem proving abstract interpretation 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Dorobantu, A., Johnson, W., Lie, F.A.P., Murch, A., Paw, Y.C., Gebre-Egziabher, D., Balas, G.J.: An Airborne Experimental Test Platform: From Theory to Flight. In: Proceedings of the 2013 American Control Conference, Washington DC (June 2013)Google Scholar
  2. 2.
    Federal Aviation Administration, Joint Advisory Circular: Flight Guidance System Appraisal, AC/ACJ 25.1329 (2001)Google Scholar
  3. 3.
    Hagen, G., Tinelli, C.: Scaling up the formal verification of Lustre programs with SMT-based techniques. In: Proceedings of the 8th International Conference on Formal Methods in Computer-Aided Design (FMCAD 2008), Portland, Oregon. IEEE (2008)Google Scholar
  4. 4.
    Halbwachs, N., Caspi, P., Raymond, P., Pilaud, D.: The Synchronous Dataflow Programming Language LUSTRE. In: Proceedings of the IEEE (1991)Google Scholar
  5. 5.
    Hurd, J.: Composable packages for higher order logic theories. In: Aderhold, M., Autexier, S., Mantel, H. (eds.) Proceedings of the 6th International Verification Workshop, VERIFY 2010 (July 2010),
  6. 6.
    Miller, S.P., Whalen, M.W., Cofer, D.D.: Software Model Checking Takes Off. Communications of the ACM 33(2) (February 2010)Google Scholar
  7. 7.
    Norrish, M., Slind, K.: HOL-4 Manual (1998-2013),
  8. 8.
    Obua, S., Skalberg, S.: Importing HOL into isabelle/HOL. In: Furbach, U., Shankar, N. (eds.) IJCAR 2006. LNCS (LNAI), vol. 4130, pp. 298–302. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  9. 9.
    Owre, S., Shankar, N.: The Formal Semantics of PVS, NASA Technical Report CS-1999-209321 (May 1999)Google Scholar
  10. 10.
    RTCA DO-178C, Software Considerations in Airborne Software (December 2011)Google Scholar
  11. 11.
    RTCA DO-330, Software Tool Qualification Considerations (December 2011)Google Scholar
  12. 12.
    RTCA DO-333, Formal Methods Supplement to DO-178C and DO-278A (December 2011)Google Scholar

Copyright information

© Springer International Publishing Switzerland 2014

Authors and Affiliations

  • Darren Cofer
    • 1
  • Steven Miller
    • 1
  1. 1.Rockwell Collins Advanced Technology CenterUSA

Personalised recommendations