1. Purpose of the gate
This gate accepts the architecture the rest of the program builds on. After it, detailed design starts against a fixed set of devices, partitions and interfaces, and changing the device technology or partitioning approach becomes a redesign.
Reviewers focus on whether the architecture keeps the promises the safety assessment made. If an item's assurance level was lowered because two channels are independent, the architecture must show separate devices, power, clocks and software, and the common cause analysis must find no shared cause. If software of different levels shares a processor, robust partitioning must be demonstrated by design. If a multicore or commercial device is used, its assurance approach, including interference analysis for multicore processors under AMC 20-193 and AC 20-193, must be agreed.
The gate also fixes the component selection list and the environmental test categories, because supply life, grades, shielding and cooling all follow from them.
The device choice deserves particular care. A programmable device or custom ASIC gives full visibility of the design but brings the full DO-254 effort at its level; a commercial processor or complex device brings performance without design visibility, so its assurance rests on documentation, service experience, usage domain analysis and architectural mitigation, as the airborne electronic hardware guidance describes. Reviewers want to see that this trade was made deliberately, with the authority's expected position in mind.
10 more sections for registered members.