DAL B
How DAL B Fits the Avionics Safety Hierarchy
The development assurance level scheme arises from the safety process described in SAE ARP4754A and ARP4761. A system Functional Hazard Assessment classifies the worst-case effect of each function's failure as Catastrophic, Hazardous, Major, Minor, or No Safety Effect. Those five severities map onto Design Assurance Levels A through E. DAL B corresponds to the Hazardous classification, meaning a failure would significantly reduce the aircraft's capability or the crew's ability to cope with adverse operating conditions, potentially causing serious or fatal injuries to a relatively small number of occupants. This is one notch less severe than the Catastrophic effect that drives DAL A, where loss of the aircraft is assumed.
Both DO-178C (software) and DO-254 (hardware) translate the assigned level into a defined set of process objectives. As the level moves from E up to A, the number of objectives grows and more of them must be performed with independence. DAL B sits near the demanding end of that scale: it requires nearly the full objective set, but with two notable relaxations relative to DAL A in the verification activities. Engineers refer to the hardware variant as IDAL B (Item Development Assurance Level) when emphasizing that the same severity scheme applies to electronic hardware components, not just software.
The practical consequence for an RF hardware supplier is that the embedded firmware controlling a synthesizer, gain stage, or built-in test routine must be verified to the DAL B objective set, and the complex programmable logic (FPGA or ASIC) inside the transceiver must follow the DO-254 DAL B life cycle. Requirements traceability, configuration management, and a documented verification record become deliverables rather than internal artifacts.
Structural Coverage and Independence at DAL B
The single most-cited distinction between DAL A and DAL B in DO-178C is the structural coverage requirement. DAL A demands Modified Condition/Decision Coverage (MC/DC), which proves each Boolean condition independently affects the decision outcome. DAL B steps down to Decision Coverage (DC), which only requires that every decision has taken both true and false outcomes and every entry point has been exercised. This relaxation, together with fewer objectives needing independence, is what makes DAL B development meaningfully less costly than DAL A for the same functionality.
Quantitative and Process Objectives
PHAZ < 1×10-7 per flight hour
Top-down DAL allocation:
FHA severity → DAL · (Catastrophic→A, Hazardous→B, Major→C, Minor→D, None→E)
DO-178C objective counts (with independence):
DAL A = 71 (30 indep.) · DAL B ≈ 69 (≈18 indep.) · DAL C ≈ 62
Where FHA = Functional Hazard Assessment and FH = flight hour. The hazardous budget of 1×10-7/FH is apportioned across redundant items so each contributing failure mode stays well under the system target.
Design Assurance Level Comparison
| Level | Failure Condition | Probability Target (/FH) | DO-178C Objectives | Structural Coverage | Example RF Item |
|---|---|---|---|---|---|
| DAL A | Catastrophic | < 1×10-9 | 71 | MC/DC | Fly-by-wire RF actuator link |
| DAL B | Hazardous | < 1×10-7 | ≈ 69 | Decision Coverage | Weather radar transceiver |
| DAL C | Major | < 1×10-5 | ≈ 62 | Statement Coverage | Mode-S transponder option |
| DAL D | Minor | < 1×10-3 | ≈ 26 | None required | Cabin connectivity radio |
| DAL E | No safety effect | No requirement | 0 | None required | In-flight entertainment RF |
Frequently Asked Questions
What is the difference between DAL A and DAL B?
DAL A covers catastrophic failures with a target below 1×10-9/FH; DAL B covers hazardous failures with a target below 1×10-7/FH. The headline DO-178C distinction is structural coverage: DAL A needs MC/DC, while DAL B needs only Decision Coverage. DAL B also drops 2 objectives and relaxes several independence requirements, which lowers development cost.
How many DO-178C objectives must be satisfied at DAL B?
Approximately 69 of the 71 objectives apply, with roughly 18 requiring independence between author and verifier. The two objectives removed relative to DAL A concern MC/DC structural coverage and the source-to-object code coverage mapping. Relaxed independence plus the move from MC/DC to Decision Coverage typically cut firmware effort 20 to 35 percent versus DAL A.
When is an RF or microwave line replaceable unit assigned DAL B?
When the system safety assessment shows its failure causes a hazardous, not catastrophic, aircraft-level condition. Common examples are primary weather radar transceivers, certain transponder and TCAS RF chains, and required SATCOM or datalink units. The level flows from the ARP4761 Functional Hazard Assessment to hardware via DO-254 and firmware via DO-178C; redundancy can keep a single channel at DAL B.