Design Assurance Levels bridge the safety assessment domain (ARP 4761 failure condition classification) with the certification compliance domain (DO-178C for software, DO-254 for hardware). During FHA, failure conditions are classified by severity; the resulting classification automatically determines the required DAL and, consequently, the certification objectives that must be satisfied.
DAL
Certification Standard
Failure Condition Classification
Safety Impact
Certification Rigor
A
DO-178C / DO-254
Catastrophic
Potential for multiple fatalities or loss of aircraft
The Aerospace Safety Solution implements the standard ARP 4761 mapping from failure condition classification to DAL. When a failure condition is classified during FHA, the corresponding DAL is automatically assigned via formula, ensuring consistency across the project.Automatic DAL Assignment Formula:This formula is embedded in the FHA risksheet. Once a failure condition is classified, the DAL column automatically populates. No manual DAL selection is required; classification determines DAL.
The automatic formula mapping is implemented in the FHA risksheet template. Confirm the exact formula expression and any override mechanisms in your configured risksheet.json.
DAL is assigned at two levels in the Aerospace Safety Solution:
Failure Condition DAL — Assigned during FHA based on failure condition classification. This DAL drives the safety requirements allocation and verification strategy.
System Element DAL — Assigned to physical system components (subsystem, assembly, component) in the System Structure Navigator. System element DAL establishes the baseline certification rigor for all documents associated with that element (design requirements, design characteristics, DFMEA, compliance objectives).
System Element Type Hierarchy:
Element Type
Decomposition Level
Typical DAL Assignment
Example
System
Top-level product
Varies by subsystem
Aircraft flight control system
Subsystem
Major functional group
Typically DAL A–D
Flight control computer subsystem
Assembly
Physical grouping
Inherited from parent
Hydraulic valve assembly
Subassembly
Intermediate component
Inherited from parent
Servo actuator subassembly
Component
Lowest-level replaceable unit
Typically DAL C–E
Pressure sensor component
Each system element’s DAL constrains the certification activities required for requirements, design characteristics, and test cases associated with that element.
DO-178C and DO-254 define a set of certification objectives. Not all objectives apply to all DAL levels:
DAL A: All objectives must be satisfied. Represents the full certification compliance package.
DAL B: Most objectives apply. A few less-critical objectives may be waived by the DER.
DAL C: Subset of objectives apply. Standard development practices typically suffice.
DAL D: Minimal objectives. Basic verification and documentation.
DAL E: No certification objectives. Standard commercial development practices are acceptable.
The Aerospace Safety Solution tracks per-DAL compliance status for each certification objective. An objective can have different compliance states at different DAL levels (for example, “Satisfied” at DAL C but “In Progress” at DAL B).Per-DAL Compliance Status Values:
Status
Meaning
Not Applicable
This objective does not apply at this DAL level.
Not Started
Objective applies but work has not begun.
In Progress
Objective work is underway.
Satisfied
Objective is complete and evidence is available.
Waived
Objective is waived by the Design Engineering Representative (DER).
When a failure condition is allocated to a safety requirement, the safety requirement inherits the DAL from the failure condition. The safety requirement’s DAL determines:
Verification Level — Scope: Unit, Integration, System, Acceptance, or Qualification.
Traceability — Links to design requirements, design characteristics, and test cases at the corresponding DAL level.
Safety Requirement Custom Fields:
Field
Type
Purpose
dalLevel
Enumeration (DAL A–E)
Inherited from failure condition classification. Read-only.
allocatedSubsystem
String
Target subsystem where the safety requirement is implemented.
verificationMethod
Enumeration
How the requirement is verified: Test, Analysis, Inspection, Demonstration, or Review.
contributingFailureModes
Text
List of failure modes (from FMEA/SFMEA) that could violate this requirement.
The FHA risksheet automatically creates safety requirement work items from failure conditions. Each safety requirement is allocated to a subsystem and assigned its DAL. The allocation decision documents which subsystem is responsible for implementation and verification.
Design requirements are classified by engineering discipline (subType: Electrical, Software, Mechanical, Labeling, Useability) and inherit DAL from their parent safety requirements through the requirements decomposition chain:Customer Requirement → System Requirement → Subsystem Requirement → Design RequirementAt each level, DAL flows down through the decomposition, ensuring that design requirements at all levels maintain the safety classification rigor.Design Requirement Subtypes and DAL Allocation:
Design characteristics (measurable properties of design elements) are also classified and traced to environmental categories per DO-160G. Characteristics assessed in DFMEA inherit DAL from their parent design requirements.Characteristic Custom Fields:
Field
Type
Purpose
classification
Enumeration (SC / CC)
Safety-Critical or Control characteristic.
targetValue
String
Nominal or target value for the characteristic.
tolerance
String
Allowable deviation (e.g., ±0.5 mm, ±5%).
When a characteristic is allocated to a failure mode in DFMEA, the DAL context is carried through, ensuring that design FMEA analysis rigor matches the assigned DAL.
Fuel, hydraulic fluid, oil exposure and compatibility
11
Sand and Dust
Ingestion and deposit resistance
12
Fungus
Fungal growth prevention
13
Salt Spray
Corrosion resistance in salt environment
14
Magnetic Effects
Magnetic field interference
15
Power Input
Frequency and voltage variation tolerance
16
Voltage Spike
Transient over-voltage immunity
17
Conducted Susceptibility
RF conducted immunity
18
Signal Susceptibility
Low-level signal interference
19
RF Susceptibility
Radiated RF field immunity
20
RF Emission
Radiated emission limits
21
Lightning Transients
Indirect lightning effects
22
Lightning Direct
Direct lightning strike effects
23
Icing
Ice crystal ingestion and accretion
27
ESD
Electrostatic discharge immunity
26
Fire
Fire resistance and flammability
27
Smoke and Toxicity
Smoke emission and toxic fumes
Test cases and design requirements link to these environmental categories, enabling traceability from design specifications through environmental qualification test execution.
The complete list of DO-160G environmental categories and their application to your specific aircraft project is maintained in the Environmental Qualification PowerSheet. Verify which sections apply to your system in the project configuration.
In the Aerospace Safety Solution data model, DAL levels are represented using the following enumeration identifiers:
Copy
Ask AI
dalA # Design Assurance Level A (Catastrophic)dalB # Design Assurance Level B (Hazardous)dalC # Design Assurance Level C (Major)dalD # Design Assurance Level D (Minor)dalE # Design Assurance Level E (No Safety Effect)
These identifiers are used in:
Failure condition DAL allocation fields
System element DAL properties
Safety requirement DAL fields
Compliance objective tracking (per-DAL status columns)
Risksheet and PowerSheet cell formulas and filters
Sources: Extracted from Polarion configuration files (.polarion/tracker/fields/dal-enum.xml, safetyRequirement-custom-fields.xml, FHA risksheet template), DO-178C and DO-254 standards definitions, and ARP 4761 safety assessment guidance.
