DAL D (Design Assurance Level D)
Where DAL D Sits in the Avionics Assurance Hierarchy
Design assurance levels exist so that the engineering effort spent proving correctness scales with the consequence of getting it wrong. The aircraft-level functional hazard assessment classifies each function by the severity of its worst credible failure, and that severity maps directly to one of five levels: Catastrophic to A, Hazardous to B, Major to C, Minor to D, and No Safety Effect to E. DAL D is the home of functions that are real but undemanding, a maintenance data logger, a passenger-information annunciator, or a non-essential RF status monitor whose loss merely annoys the crew or trims a safety margin without endangering the flight.
Because the consequence is Minor, DO-178C relaxes the verification burden dramatically. The standard keeps the spine of any disciplined process, namely planning, high-level requirements, software architecture, requirements-based testing, configuration management, and quality assurance, but it removes the expensive parts. There is no statement, decision, or Modified Condition/Decision Coverage requirement at Level D, no obligation to develop and verify low-level requirements, and no source-to-object-code traceability. The 26 applicable objectives, only 2 of which demand verification independence, represent roughly a third of the full DO-178C set.
For RF and millimeter-wave hardware destined for an aircraft, the level applies through DO-254 to the complex electronic hardware, an FPGA managing a frequency converter, an ASIC sequencing a transmit chain, or programmable monitoring logic. The analog signal path itself is usually addressed through the safety assessment and DO-160 environmental qualification, while only the custom digital logic that warrants a design assurance level carries the DAL D obligations.
Objective Count and Verification Independence
Level A: 71 objectives, 30 with independence
Level B: 69 objectives, 18 with independence
Level C: 62 objectives, 5 with independence
Level D: 26 objectives, 2 with independence
Level E: 0 objectives required
Relative verification effort (Level C = 1.0):
ED ≈ 0.35 × EC (no MC/DC, no low-level requirements)
Failure-rate budget for a Minor condition:
Pfail > 1×10-5 per flight hour (classified Probable)
Where E denotes verification labor. The probability target flows down from the aircraft functional hazard assessment per ARP4754A and AC 25.1309; the developer does not choose it.
Design Assurance Levels Compared
| Level | Failure Condition | Effect on Aircraft | Probability (per fh) | DO-178C Objectives | Structural Coverage |
|---|---|---|---|---|---|
| DAL A | Catastrophic | Loss of aircraft / hull loss | < 1×10-9 | 71 (30 indep.) | MC/DC |
| DAL B | Hazardous | Serious injury, large margin loss | 1×10-7 to 1×10-9 | 69 (18 indep.) | Decision |
| DAL C | Major | Significant workload, discomfort | 1×10-5 to 1×10-7 | 62 (5 indep.) | Statement |
| DAL D | Minor | Slight margin or workload change | > 1×10-5 | 26 (2 indep.) | None required |
| DAL E | No Safety Effect | No operational impact | No requirement | 0 | None |
Frequently Asked Questions
How many DO-178C objectives apply at DAL D compared with DAL C?
DO-178C Annex A defines 71 objectives. At DAL D only 26 apply, with just 2 requiring independence, versus 62 (5 independent) at DAL C. Level D drops all structural coverage analysis (statement, decision, MC/DC), most low-level requirements verification, and source-to-object-code traceability, while keeping high-level requirements, architecture, requirements-based testing, configuration management, and QA. The result is roughly a third to a half of the DAL C verification labor.
What failure-condition probability is associated with DAL D?
DAL D maps to a Minor failure condition: one that slightly reduces safety margins or modestly increases crew workload without affecting safe flight. The quantitative target is greater than 1×10-5 per flight hour, classified Probable. For context, DAL C (Major) targets 1×10-5 to 1×10-7, DAL B (Hazardous) 1×10-7 to 1×10-9, and DAL A (Catastrophic) below 1×10-9. The level is assigned by the functional hazard assessment, not chosen by the developer.
Can a DAL D RF or microwave component be developed under DO-254 instead of DO-178C?
Yes. DO-178C covers airborne software and DO-254 covers complex airborne electronic hardware such as FPGAs, ASICs, and programmable RF control logic, sharing the same five levels and failure-condition definitions. At DAL D, DO-254 needs the basic design lifecycle plus validation and verification, without the elemental analysis or exhaustive functional coverage of DAL A and B. For a millimeter-wave subsystem, the analog chain is handled by DO-160 and the safety assessment, while only complex custom digital logic carries the assigned DAL.