Standards & Compliance

DAL C

Q: How many DO-178C objectives apply at DAL C versus DAL B and DAL A?

DO-178C defines 71 software objectives across its annex tables. DAL A requires all 71 with 30 of them satisfied with independence. DAL B requires 69 objectives with 18 independent. DAL C drops to 62 objectives with only 5 requiring independence. The objectives shed when moving from B to C are concentrated in structural coverage: DAL C does not require decision coverage or MC/DC, only statement coverage of the source code. This is the single largest cost driver that separates the levels, because MC/DC analysis on complex Boolean logic is the most expensive verification activity in the standard.

Q: What structural code coverage does DAL C require?

DAL C requires statement coverage only, meaning every executable statement in the source code must be exercised at least once by a requirements-based test. It does not require decision coverage (every branch taken both ways) which is added at DAL B, nor modified condition/decision coverage (MC/DC) which is added at DAL A. In practice teams still measure decision coverage at DAL C because reaching full statement coverage usually exposes the same dead or deactivated code, but only statement coverage is a certification objective at Level C. Coverage gaps must be analyzed and justified, not simply waived.

Q: What failure condition and probability target maps to DAL C?

DAL C corresponds to a Major failure condition under the ARP4754A and AC 25.1309 safety taxonomy. A Major condition significantly reduces safety margins or functional capability, increases crew workload, or causes discomfort or minor injuries to occupants. The quantitative reliability budget for a Major condition is a probability of occurrence less than or equal to 1e-5 per flight hour, often described as Remote. By comparison DAL B (Hazardous) targets 1e-7 per hour and DAL A (Catastrophic) targets 1e-9 per hour. For an RF line replaceable unit, a function such as a non-essential datalink modem typically lands at DAL C.

/dee-ay-el see/

Short for Design Assurance Level C, the third-highest of the five assurance tiers used to scope avionics development. The level is allocated by the system safety assessment under ARP4754A, after which the corresponding objectives are defined by DO-178C for software and by RTCA DO-254 for airborne electronic hardware. A function is allocated to DAL C when its failure would produce a Major failure condition: a significant reduction in safety margin or a meaningful increase in crew workload, but not a hazardous or catastrophic outcome. The associated reliability budget is a probability on the order of 1e-5 per flight hour. At the software level, DAL C demands 62 of the 71 DO-178C objectives and statement-level structural coverage, a substantial reduction from the decision coverage and EMI-qualification rigor stacked onto higher levels. For RF line replaceable units, DAL C commonly applies to non-essential communication and datalink functions.

Failure Condition: Major

Probability Target: ≤ 1e-5 / hour

DO-178C Objectives: 62 (5 independent)

How DAL C Shapes a Certification Program

Design assurance levels exist because the certification effort for airborne equipment must scale with the consequence of failure, not with the size of the codebase. The system safety assessment, driven by ARP4754A and the failure-condition categories of AC 25.1309, allocates each function a level from A (Catastrophic) down to E (No Effect). DAL C sits in the middle: failures classified as Major are serious enough to warrant disciplined development and verification, but not so severe that the most expensive analysis activities are justified. For a manufacturer integrating an RF transceiver into an aircraft, this allocation determines how many objectives the supplier must satisfy and how much independent review the work requires.

The practical signature of DAL C is the relaxation of structural coverage. DAL A and B require decision coverage, and DAL A additionally requires modified condition/decision coverage (MC/DC), the analysis that proves each Boolean condition independently affects an outcome. DAL C requires only statement coverage, so every line of source executes at least once under a requirements-based test. Removing MC/DC and decision coverage is what makes Level C development roughly half the verification cost of Level B for equivalent functional content, since those analyses dominate the test-generation budget on logic-heavy code.

On the hardware side, DO-254 mirrors this gradient for complex devices such as FPGAs and ASICs used in RF beamformers, frequency synthesizers, and digital receivers. A DAL C FPGA requires requirements capture, conceptual and detailed design data, and functional verification, but the elemental analysis and additional design assurance techniques reserved for Levels A and B are not mandated. Both standards share the same underlying philosophy: the objective set, the degree of independence, and the configuration-management rigor all step up as the level climbs from C toward A.

Probability Budget and the Major Classification

Failure-condition to DAL mapping (AC 25.1309):
Catastrophic → DAL A → P ≤ 1×10⁻⁹ / hr
Hazardous → DAL B → P ≤ 1×10⁻⁷ / hr
Major → DAL C → P ≤ 1×10⁻⁵ / hr
Minor → DAL D → P ≤ 1×10⁻³ / hr
No Effect → DAL E → no quantitative target

Allowable failure budget over a mission:
P_mission ≈ λ × t_flight
Example: a DAL C function at λ = 1×10⁻⁵/hr over a 3 hr flight gives P ≈ 3×10⁻⁵ per flight, which the system safety assessment must show is covered by the architecture and any monitoring or redundancy.

Objective and Coverage Differences Across Levels

Level	Failure Condition	Prob. Target (/hr)	DO-178C Objectives	Independent	Structural Coverage
DAL A	Catastrophic	≤ 1e-9	71	30	Statement + Decision + MC/DC
DAL B	Hazardous	≤ 1e-7	69	18	Statement + Decision
DAL C	Major	≤ 1e-5	62	5	Statement
DAL D	Minor	≤ 1e-3	26	2	None required
DAL E	No Effect	None	0	0	None

Common Questions

Frequently Asked Questions

How many DO-178C objectives apply at DAL C versus DAL B and DAL A?

DO-178C defines 71 software objectives. DAL A requires all 71 with 30 satisfied with independence, DAL B requires 69 with 18 independent, and DAL C requires 62 with only 5 independent. The objectives shed from B to C are concentrated in structural coverage: DAL C does not require decision coverage or MC/DC, only statement coverage. That single change is the largest cost driver separating the levels, since MC/DC on complex Boolean logic is the most expensive verification activity in the standard.

What structural code coverage does DAL C require?

Statement coverage only: every executable statement must be exercised at least once by a requirements-based test. Decision coverage (every branch taken both ways) is added at DAL B, and MC/DC is added at DAL A. Teams often still measure decision coverage at Level C because closing statement coverage exposes the same dead or deactivated code, but only statement coverage is a certification objective here. Any gaps must be analyzed and justified, not simply waived.

What failure condition and probability target maps to DAL C?

DAL C corresponds to a Major failure condition under ARP4754A and AC 25.1309: a significant reduction in safety margin, increased crew workload, or minor occupant injury. The quantitative budget is P ≤ 1e-5 per flight hour (Remote). For comparison, DAL B (Hazardous) targets 1e-7 per hour and DAL A (Catastrophic) targets 1e-9 per hour. An RF function such as a non-essential datalink modem typically lands at DAL C.

Related Terms

← DAL B DAL D →