Development Assurance Level (DAL) Allocation and Architectural Independence

Preventing common-cause failures by partitioning software and hardware into isolated assurance domains.

Top-Down DAL Decomposition Rules

An aircraft-level Catastrophic hazard does not automatically mean every component must be DAL A. Under ARP4754A Section 5.4, a Catastrophic function can be decomposed into two architecturally independent subsystems developed to DAL B, dramatically reducing development cost without compromising safety.

Proving Architectural Independence

Regulators require formal proof that redundant channels cannot fail simultaneously from a single root cause (e.g., shared power supply, identical compiler optimization bug, or co-located wiring harnesses). Common Cause Analysis (CCA) enforces physical and logical segregation.

Enforces physical separation of wiring harnesses and sensor lines
Prohibits shared clock domains between redundant fly-by-wire channels
Compliant with FAA Advisory Circular AC 20-174 for systems development assurance

Aerospace-Domains ansehen