Can car software fly?

With the increased interest and development of eVTOL, companies experienced in the automotive sector often wonder if the same methodology used to develop automotive software can be used to develop aerospace software. Several analyses have shown that, while avionics software methodologies in guideline DO-178 and generated artefacts map well to, and satisfy, ISO 26262 requirements, this is not true in reverse. These analyses lead us to conclude that using automotive software methodologies in avionics development is not directly possible and would lead to issues later, during the certification stage.

A cursory evaluation may lead one to assume that these methodologies are replaceable and just applications in two different domains. Both ISO 26262 and DO-178C/ED-12C follow similar V-cycle development models, and both suggest similar software development and verification methodologies. However, there is a fundamental difference between the two which can be summarized in requirements traceability and certification of the final product. Avionics software standards are process-based compliance guidelines and are oriented towards demonstrating compliance in certification of one specific aircraft, which requires both downstream and upstream traceability from/to the high-level requirements, enabling certification of the complete process by an independent authority.

All functionality, software and its testing must be traced back to high-level requirements from the aircraft assigned to the software. On the other hand, automotive software development focuses on improving safety to acceptable levels for a given risk through demonstrating that recommended practices have been applied internally by the development teams as a self-check measure, or with compliance analysis of processes employed but with no need for independent certification.

Another common misconception is to equate software quality with certification compliance for software and to think that software of a high standard can be used without further consideration. ISO 26262 part 6, the standard for development of automotive software, has guided the improvements in software quality in modern cars but it has also led to extensive use of independent common software libraries. An average modern car contains over 100 million software lines of code. By contrast, a Boeing 787, a large modern aircraft, features only 6.5 million lines of code. Intrinsically verified and validated software does not exist in the avionics context independently of upstream system or downstream hardware considerations. All code must be traceable to a high-level system requirement allocated to this software component or, if not, must be removed.

The planning, documentation and traceability objectives for avionics software make it intractable to convert an existing piece of code to compliant code after the fact. As such, any safety-critical eVTOL flight software that will need to be certified would benefit from using DO-178C/ED-12C-compliant software development methodologies and software verification tools from the start to avoid major problems and surprises later.