Topic · DO-278

What is DO-278, and how do I keep CNS/ATM software true in CI?

Gist

DO-278 is RTCA guidance for ground communication, navigation, surveillance, and air-traffic software. High assurance levels still want MC/DC. Proof measures that on the Go you ship with proof mcdc measure ./... --engine go, then fails the merge when the graph is stale.

proof mcdc measure ./... --engine go

Keep VectorCAST or LDRA if you need a DO-330 qualified C toolchain and a DER stamp. Proof is not that qualification. Airborne software is DO-178C, a different H1.

Request demo Last pack vs this graph

01 · Ground, not airborne

DO-178C is the aircraft. DO-278 is the ground system that talks to it.

A radar tracker, a flight-data processor, an ATM display. Same integrity idea. Different document. Last year's coverage pack does not reopen on this push.

The four jobs that are not this standard (checkable shalls, re-derived links, MC/DC as a discipline, a named reviewer) live on the DO-178C-style page when you are not certifying. The formal-methods supplement that names both DO-178C and DO-278A lives on DO-333. This page is the ground document: measure the conditions the shall actually named, on the code that shipped, every merge.

DO-278A is the current revision. EUROCAE publishes the same text as ED-109A. The typed query is DO-278. One URL. Assurance levels AL1 through AL6 are the ground scale. Proof does not assign an AL. You do. MC/DC is still the criterion the high ALs ask for. VectorCAST and LDRA still measure C. They were not built for Go.

proof mcdc measure ./... --engine go
proof audit --fail-level warn

The first command is condition independence on the Go in this tree. The second is the standing gate. A line-coverage report is not this check. Statement coverage can be 100% while a condition never independently affected the decision.

02 · The exhibit

Same tracker. A PDF from last PSAC, or this graph.

The pack still has last year's MC/DC table. The decision changed. Click the tabs.

LDRA / VectorCAST PDF

Target C object code, last build
fresh && (hit || !stale) still 100% on that binary

Pack present

This push

The Go tracker changed. The PDF did not.

No re-measure

LDRA / VectorCAST PDF

Still last build. Still C.

Keep the qualified kit

Proof

Ask does each condition independently affect the decision
Gate audit --fail-level warn

Merge blocked if MC/DC on this tree is stale

Same tracker. A PDF from last PSAC, or this graph. Click the tabs.

Who	What they notice	What they lose
DO-278 / RTCA	Ground CNS/ATM software integrity. AL1 through AL6. MC/DC at the high ALs.	They write the requirement. Keep them. Proof does not replace the standard and is not a qualified tool.
DO-178C	Airborne software. Design Assurance Levels, not ALs.	Different H1. The steal-the-four-jobs page lives on DO-178C-style.
VectorCAST / LDRA	A qualified C toolchain and structural coverage of object code	They still win when a DER stamps the kit. Proof measures the Go you ship. C stays with them.
Proof	MC/DC on this tree, then the same audit on every push	No AL assignment. No DO-330. FLIP MC/DC is specification-level. Tests are not executed.

The generate path is a view of the same graph, not a second source of shalls:

proof doc generate verification-report --format html --output docs/verification.html
proof audit --fail-level warn

Unknown template names fail before render. The report shows current verification states from loaded project data. Treat it as a print of the graph. If the graph is thin, the report is thin. We have not run MC/DC against a frozen DO-278 corpus, and we have not scored it against VectorCAST on the same pack. The loss is named, not scored.

03 · The honest loss

A green Proof audit is not DO-278 credit.

Credit under the standard requires a qualified tool and a human who can sign. Proof is not qualified under DO-330. A named reviewer is not a DER.

Proof does not pick an assurance level. AL1 through AL6 are your classification. We measure the Go in the tree you pointed at. We do not map that measurement onto an AL table and call it done. Object-code coverage on C still wants the qualified toolchain. That H1 lives on MC/DC for Go and on Proof vs LDRA. Proof generates inputs. It does not run them. Keep go test.

DO-333 is the formal-methods supplement to both DO-178C and DO-278A. Kind2 on the shalls lives on that URL, not here. ARP 4754 sits above airborne software. Ground ATM has its own system safety assessment. Proof does not run FHA or PSSA. IEC 61508 is the parent industrial standard; that H1 lives on IEC 61508. Jama still authors.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What is DO-278A? The current revision. Same cluster. This URL. EUROCAE ED-109A is the European publication of the same text.

I need DO-178C style verification but I'm not in aerospace. What can I use? The four jobs, not the Type Certificate. DO-178C-style.

What is DO-333, and how do I keep formal analysis true in CI? The formal-methods supplement to DO-178C and DO-278A. DO-333.

What is DO-330? Tool qualification. Proof is not qualified. Keep VectorCAST or LDRA if a DER has to stamp the kit.

How do I measure MC/DC coverage for my Go code? The instrument, not the standard. MC/DC for Go.

What is IEC 61508? Parent industrial functional safety. Different H1. IEC 61508.

What is a requirements traceability matrix, and how do I keep it true? DO-278 still wants the links re-derived, not pasted. RTM.