DAL E
Where DAL E Sits in the Avionics Assurance Hierarchy
Design assurance levels are the backbone of civil avionics certification. The system safety process described in ARP4754A and ARP4761 assigns each aircraft function a failure condition severity, ranging from Catastrophic down to No Safety Effect. That severity then drives the development assurance level allocated to the hardware (per DO-254) and software (per DO-178C) that implement the function. The five levels run from A, where a failure is catastrophic and could cause loss of the aircraft, through B (hazardous), C (major), and D (minor), down to E, where a failure has no effect on safety at all. The lower the assurance level, the fewer process objectives the developer must satisfy and verify with evidence.
Level E is unique because it sits at the floor of the scale. A correctly justified No Safety Effect classification means the regulator expects no design assurance objectives, no structural coverage analysis, no requirements-based test campaign, and no independent verification of the implementation. The cost and schedule burden collapses almost entirely onto the up-front safety analysis that proves the function cannot affect the aircraft. For this reason, engineers and certification authorities scrutinize the Level E justification carefully: a function wrongly downgraded to Level E is a far more serious finding than a function conservatively over-classified to a higher level.
What a Level E Justification Must Demonstrate
To stand behind a Level E claim, the safety assessment must show that no failure mode of the item, including its most adverse combination with other failures, can propagate into a higher-severity condition. The classic pitfall is shared resources: if a passenger entertainment processor also writes to a data bus, power rail, or cooling loop shared with a flight-essential system, a failure could no longer be contained. Robust partitioning, isolated power, and segregated wiring are what allow an RF or digital module to remain credibly Level E rather than being pulled up to Level C or higher by association.
DO-178C Objective Count by Software Level
Level A ≈ 71 objectives (30 with independence)
Level B ≈ 69 objectives (18 with independence)
Level C ≈ 62 objectives
Level D ≈ 26 objectives
Level E = 0 objectives
Failure rate budget vs. level (per flight hour, typical):
Catastrophic / A ≈ < 1 × 10−9
Hazardous / B ≈ < 1 × 10−7
Major / C ≈ < 1 × 10−5
Minor / D ≈ < 1 × 10−3
No Safety Effect / E ≈ no quantitative budget required
Objective counts follow the DO-178C Annex A tables; quantitative rates follow AC 25.1309 guidance and vary by aircraft class.
Design Assurance Level Comparison
| Level | Failure Condition | Aircraft Effect | DO-178C Objectives | Typical RF Example |
|---|---|---|---|---|
| DAL A | Catastrophic | Loss of aircraft | 71 (30 independent) | Fly-by-wire RF telemetry |
| DAL B | Hazardous | Serious injury, large workload | 69 (18 independent) | Primary nav radio front end |
| DAL C | Major | Discomfort, higher workload | 62 | Weather radar receiver |
| DAL D | Minor | Slight workload increase | 26 | Maintenance datalink RF |
| DAL E | No Safety Effect | None | 0 | Passenger Wi-Fi / IFE converter |
Frequently Asked Questions
What failure condition classification corresponds to DAL E?
DAL E maps to the No Safety Effect category in ARP4761 and AC 25.1309: a failure does not reduce safety, increase crew workload, or affect operational capability. Examples include in-flight entertainment, cabin reading lights, and non-essential maintenance loggers. Because the worst case is benign, Level E items are exempt from the certification objectives that apply to DAL A through DAL D, so the key engineering effort is the safety assessment that justifies the level, not the development process.
How many DO-178C objectives apply at DAL E versus DAL A?
DO-178C defines 71 software objectives. Level A invokes all 71 with 30 requiring independence; Level B uses 69 (18 independent); Level C uses 62; Level D drops to 26, mostly high-level requirements and integration checks. Level E invokes zero objectives, since the software has no safety effect. DO-254 follows the same descending pattern for hardware, which is why a correctly justified Level E designation can remove the largest single block of certification cost.
Can an RF component in an avionics system be classified as DAL E?
Yes, if the safety assessment shows its failure produces no safety effect. A down-converter or low-noise amplifier feeding passenger Wi-Fi or satellite TV is a common candidate. The same converter feeding a radar altimeter, GPS, or a required nav radio would be DAL B or DAL C instead, because the classification follows the function supported, not the hardware type. Even DAL E hardware must still meet DO-160 environmental qualification, since survivability is separate from design assurance.