How to qualify an ML tool under DO-330

This is the buyer-side sequence for an ML tool (trainer, data-prep pipeline, test generator, robustness analyzer). The trained model that executes on the aircraft is usually a DO-178C software item, not a qualified tool. That distinction is in How to map an AI model to DO-178C / DO-330. The longer 12.2 walkthrough is DO-330 tool qualification for ML toolchains.

1. Confirm it is a tool

RTCA’s DO-330 product page defines a tool as a computer program used to help develop, transform, test, analyze, produce or modify another program, its data or its documentation, for example code generators, compilers and test tools. FAA Order 8110.49A says tool qualification is the process necessary to obtain certification credit for a software tool within the context of a specific airborne system (citing DO-178B/C Section 12.2). Credit is project-specific, not a vendor certificate you reuse unchanged.

2. Apply the 12.2 decision

RTCA FTP1055 is the public page that states the 12.2 test without reproducing DO-178C. If the tool outputs are verified independently of the tool, then no qualification is necessary. For a tool that cannot introduce an error in the software but could fail to detect an error, independent verification of the output, including confirmation of the activity the tool is eliminating, reducing or automating, likewise means no qualification is necessary. In all other cases qualification is necessary. DO-330 provides the guidance.

Analysis, labeled as such: an ML trainer whose weights you accept as the airborne design without reviewing them against data-set requirements is in the “all other cases” bucket. A robustness analyzer whose every finding you independently confirm is not. FTP1055 does not name neural-network trainers.

3. Ask for the TQL and the objective count

FTP1055 says most tools are TQL-5, and only need to meet 14 DO-330/ED-215 objectives (versus TQL-1 must meet 76 objectives). TQL-5 tools are those that are used in a verification manner and cannot directly modify the software product itself. Qualifying at TQL-5 does not require any artifact on how the tool has been developed: it is a full black box approach. TQL-1 applies when some development objectives of airborne software at level A are automated by the software tool.

We did not find an FAA or RTCA table that assigns TQL-1 through TQL-5 to training frameworks, data-labeling services or neural-network verifiers. AC 20-115D still treats DO-178C as an acceptable means, but not the only means and does not constitute a regulation.

4. Ask what the vendor actually ships

MathWorks’ DO Qualification Kit provides documentation, test cases, and procedures that let you qualify Simulink and Polyspace software verification tools based on DO-330. The same page says the kit does not “prequalify” tools: tool qualification must be performed in the context of each specific project and operational environment. Ansys SCADE Suite names KCG as qualified … for DO-178C/DO-330 at TQL-1. Rapita RVS names qualification kits for DO-178C. Those pages describe conventional code-generation and verification tools, not an ML-toolchain TQL table. See the AI Verification Library listing for the airborne deep-learning worked example.

5. Do not treat the FAA roadmap as a TQL table

The FAA roadmap supports the application, and possible extension, of existing standards including DO-178C/ED-12 and DO-330/ED-215. “Possible extension” is not a published assignment of TQLs to ML products. Treat TQL as a 12.2 question for the certification authority on that project. Broader ML-versus-DO-178C gaps are in DO-178C and machine learning.

Questions

Can I reuse another program’s DO-330 kit as my qualification?

Order 8110.49A says qualification is within the context of a specific airborne system. MathWorks says the kit does not “prequalify” tools. Reuse of artifacts is a project-level authority decision, not a directory claim.

Does qualifying the trainer replace DO-178C for the airborne model?

No source we cite says that. FTP1055 is about certification credit for a software tool. The model that executes is still in the DO-178C conversation.