DO-178C flight software certification process

Roughly fifteen nations hold the ability to independently certify safety-critical airborne software. India is not among them. For DO-178C certification of aero-engine software, India's dependence is total.

DO-178C is the international standard by which certification authorities such as the FAA, EASA and Transport Canada assess commercial software-based aerospace systems. Completed and approved in 2011, available for use from January 2012, it is jointly maintained by RTCA in the United States and EUROCAE in Europe. It is not a product one buys but a discipline one proves. The standard is objectives-based: it does not prescribe how software is written, but demands documented entry and exit criteria, bidirectional traceability from system requirement through code to test, and genuine independence in verification. Its five assurance levels run from A to E; Level A, the highest, applies to software that commands, controls and monitors safety-critical functions — precisely the domain of engine control.

That is what makes the climb steep. The difficulty is not writing the code but assembling the evidence chain and the accredited human infrastructure that certifies it, at a cost the industry puts at 25 to 40 per cent above ordinary avionics software development.

India today certifies its military airborne systems through a domestic route, under CEMILAC using standards such as DDPMAS-2002, rather than DO-178C. The wider engine ambition is real and long. The Kaveri programme, authorised in 1986 under GTRE and DRDO, first ran in 1996 and remains in testing; certification for manned flight has not been achieved. Test infrastructure is being built out — a National Aero Engine Test Complex, for which a Request for Information was issued in March 2026, is intended to end dependence on foreign testing facilities, but does not yet exist.

The gap persists because DO-178C sits atop foundations India is still laying. A safety-critical software development lifecycle and the traceability and configuration-management infrastructure beneath it are emerging, not mature. There is no domestic Designated Engineering Representative capacity, the accredited third-party role certification demands. The development tools themselves must be qualified under DO-330, and model-based and formal-methods approaches carry their own supplements, DO-331 and DO-333. Aero-engine control architecture — FADEC, the most safety-critical domain — remains an unheld expertise.

What it would take is the deliberate build-out of each layer: qualified toolchains, traceability infrastructure, DER capacity, and control-system expertise. Certification capability is the visible summit; the routes to it run through a stack of quieter engineering disciplines.