Learn whether DO-178C remains a valid certification standard for FPGA development in aerospace and defense systems in 2026, and how it relates to DO-254.
1) Introduction: Why FPGA Certification Matters in 2026
Field-Programmable Gate Arrays (FPGAs) are now a pillar of modern aerospace and defense architectures. From flight-control augmentation to radar signal chains and mission computers, safety-critical functions increasingly lean on FPGA-based designs. The drivers are clear: high determinism, low latency, parallel processing, long life-cycle support, and the flexibility to evolve designs without respinning silicon. In parallel, the ecosystem has changed—AI accelerators, adaptive logic, high-level synthesis (HLS) flows, and richer HDL verification stacks are mainstream in 2026.
As these technologies advance, engineering teams often ask a practical question: Is DO-178C still applicable? Or should FPGA programs focus only on DO-254? The short answer is that both standards remain central—each with a distinct scope. This article clarifies what DO-178C covers (software) and what DO-254 governs (airborne electronic hardware), how they interact inside FPGA-centric systems, and what a certification-ready approach looks like in 2026.
2) Understanding the Role of DO-178C and DO-254
DO-178C (RTCA/EUROCAE) provides Software Considerations in Airborne Systems and Equipment Certification. It defines objectives for planning, development, verification, configuration management, and quality assurance so that airborne software is shown to meet its intended safety objectives (DAL A–E). DO-178C is process-centric: it does not prescribe specific languages, operating systems, or tools, but it demands evidence of correctness proportional to the Design Assurance Level.
DO-254 (RTCA/EUROCAE) provides Design Assurance Guidance for Airborne Electronic Hardware. It covers electronic hardware such as FPGAs, PLDs, ASICs, and circuit cards. DO-254’s objectives target requirements-based design, robust verification, configuration control, and rigorous life-cycle data for airborne hardware whose failure could affect safety.
- Scope boundary: DO-178C → software executing on processors (e.g., C/C++/Ada tasks running on a CPU or soft-core). DO-254 → hardware logic (e.g., HDL in an FPGA, ASIC logic, board-level design).
- Overlap: When an FPGA integrates a soft-core processor (e.g., MicroBlaze, Nios II, RISC-V soft core) or a hard CPU subsystem (SoC FPGAs), software components within that processor fall under DO-178C, while the surrounding programmable logic remains under DO-254.
3) The Relationship Between DO-178C and FPGA Development
In a typical avionics design, the FPGA implements time-critical signal processing, I/O bridging, sensor fusion primitives, bus guardians, or voting logic. These blocks are HDL-based and therefore governed by DO-254. However, if your FPGA also hosts an embedded operating environment—whether a soft-core RTOS or a bare-metal firmware service—then the software artifacts (source code, binaries, configuration) inside that environment are governed by DO-178C at the appropriate DAL.
Modern programs often deploy hybrid architectures where both standards apply:
- Example: A signal-processing chain (filters, FFTs, decimation) is HDL and verified under DO-254. A higher-level control loop (mode management, parameter scheduling) runs as C code on a MicroBlaze soft-core; that portion is developed and verified under DO-178C.
- Example: A SoC FPGA (e.g., with hard ARM cores) runs safety-relevant software on the CPU (DO-178C) while the programmable fabric implements safety-critical bridges and monitors (DO-254).
The key is to partition responsibilities and maintain end-to-end requirements traceability across both domains so the certification package demonstrates a coherent safety story.
4) Is DO-178C Still Relevant in 2026?
Yes. DO-178C remains the primary certification reference for airborne software. It is still recognized by FAA, EASA, and national military airworthiness authorities. No successor has replaced it. Its continued relevance stems from its technology-agnostic approach and from the ecosystem of supplements that keep it current:
- DO-330 — Tool Qualification: applied when you rely on development/verification tools whose outputs you do not fully verify by other means (e.g., model code generators, test tools, coverage tools).
- DO-331 — Model-Based Development and Verification: guidance for using models (e.g., Simulink/Stateflow) as development baselines and for verifying model/code consistency.
- DO-333 — Formal Methods: guidance for applying theorem provers, model checkers, and formal proofs to meet or augment verification objectives.
Emerging topics—AI-assisted verification, adaptive computing features, higher-level synthesis—do not invalidate DO-178C. Because the standard is process-based rather than technology-specific, it remains valid while allowing programs to justify new techniques through plans, standards, and compliance evidence.
5) When to Use DO-178C vs DO-254 for FPGA Projects
| Scenario | Applicable Standard |
|---|---|
| FPGA used as fixed hardware logic (pure HDL signal chain, interfaces) | DO-254 |
| FPGA with embedded processor / soft-core running software | DO-178C for the software portion; DO-254 for the surrounding logic |
| Mixed-function systems (hardware + firmware, SoC FPGA) | Both DO-254 and DO-178C |
| Development, verification, and test tools (synthesis, simulation, coverage, code generation) | DO-330 Tool Qualification (as applicable) |
6) Certification Challenges and Best Practices
- Bidirectional requirements traceability: Maintain links from system hazards to safety requirements, to hardware/software requirements, to HDL/software design, to tests and results. Use a single source of truth (e.g., requirements repository) so both DO-254 and DO-178C artifacts trace to the same safety case.
- Timing closure & coverage evidence: For DO-254, ensure timing closure and functional coverage on HDL (including CDC, metastability analysis, and corner cases). For DO-178C, provide structural coverage (up to MC/DC for DAL A/B) and robust test evidence.
- Tool qualification (DO-330): Identify which tools have outputs not fully re-verified—e.g., logic synthesis, place-and-route, test automation, model code generators. Classify and qualify those tools or add independent checks.
- Configuration Management & Problem Reporting: Treat HDL, constraint files, IP cores, test benches, firmware, and build scripts as controlled items. Use change review boards that span both hardware and software disciplines.
- Security and exportability: Many defense programs now expect alignment with MIL/NATO cyber requirements. Integrate secure-boot, bitstream protection, and anti-tamper measures early, and document them consistently across the DO-254/DO-178C data set.
7) Industry Trends (2024–2026)
- Mixed-criticality FPGA systems: Partitioned designs hosting both DAL A/B and lower-DAL functions on the same device using spatial/temporal isolation and monitored interfaces.
- AI accelerators & adaptive compute: Use of DSP slices, AI engines, and reconfigurable partitions for perception and sensor fusion—verified under DO-254 with supplementary evidence (e.g., scenario-based testing).
- Model-based verification (DO-331) and formal methods (DO-333): Wider adoption to raise confidence where brute-force simulation is insufficient.
- Traceability automation: Toolchains that connect requirements to HDL/software artifacts and tests (e.g., Aldec, Siemens/Questa, Mentor/Siemens Polarion), easing audit readiness.
- Certification synergy: Programs deliberately structure work packages so the software safety story (DO-178C) and the hardware safety story (DO-254) converge into a single, auditable argument.
8) Conclusion: The Certification Landscape Ahead
DO-178C is still valid in 2026—not obsolete, but evolving through its supplements and proven practice. For FPGA-centric avionics, DO-254 is the primary standard for the programmable logic, while DO-178C complements it when embedded software runs on soft or hard processor cores within, or alongside, the FPGA. The programs that succeed treat hardware and software assurance as one integrated effort—plans, standards, requirements, verification, and configuration management that line up to a single safety case.
In 2026, compliance isn’t about choosing between DO-178C or DO-254 — it’s about integrating both intelligently.
Further Reading & Useful Links
- Internal comparison article: DO-254 vs DO-178C
- RTCA official information: RTCA (DO-178C/DO-254/DO-330/DO-331/DO-333)
- FAA policy/orders relevant to airborne software and hardware (e.g., 8110 series)
FAQ
What is DO-178C used for?
It defines objectives and evidence for airborne software certification—planning, development, verification, configuration management, and quality assurance—scaled by Design Assurance Level.
Is DO-178C still valid in 2026?
Yes. It remains the industry baseline for safety-critical airborne software and is recognized by regulators. Supplements (DO-330/331/333) keep it current.
What’s the difference between DO-178C and DO-254?
DO-178C covers software running on processors; DO-254 covers electronic hardware such as FPGAs and ASICs. SoC or soft-core cases may require both.
