In aerospace, the safety and reliability of airborne systems is paramount. DO-254 (published in Europe as EUROCAE ED-80) establishes design assurance for airborne electronic hardware such as FPGAs, ASICs and complex circuit boards, and it is the basis on which certification authorities including the FAA and EASA accept that hardware is safe to fly. Used alongside related standards such as DO-178C, ARP 4754B and AMC 20-152A, it provides a complete framework for hardware reliability and system safety.

This article explains what DO-254 is, how Design Assurance Levels work, how the standard fits with the wider aerospace certification framework, and what it takes to comply in practice.

What is DO-254?

DO-254, Design Assurance Guidance for Airborne Electronic Hardware, governs the design and development of electronic hardware used in aircraft systems. It applies across the whole hardware lifecycle: planning, requirements capture, design, implementation, verification, validation and certification.

Its purpose is to make sure hardware goes through a design assurance process rigorous enough to identify and mitigate the risks that could lead to a malfunction affecting the safety of the aircraft. The deeper the potential safety impact, the more rigour the process demands.

Why design assurance matters in aerospace

In aerospace, the failure of a single electronic component can have catastrophic consequences, and modern aircraft rely on increasingly complex electronics for mission-critical functions. Design assurance is the discipline of demonstrating, with evidence, that hardware meets its safety, reliability and regulatory requirements.

DO-254 achieves this by requiring extensive verification, validation and documentation throughout the lifecycle. The goal is confidence: confidence that the hardware will perform as intended under all foreseeable operating conditions, including failure scenarios.

Design Assurance Levels (DAL A to DAL E)

DO-254 classifies hardware into five Design Assurance Levels. The level is set by the system safety assessment according to the worst-case effect a hardware failure could have on the aircraft:

  • DAL A: failure could cause a catastrophic condition. The highest level of assurance is required.
  • DAL B: failure could cause a hazardous or severe-major condition.
  • DAL C: failure could cause a major condition.
  • DAL D: failure could cause a minor condition.
  • DAL E: failure has no effect on safety. The lowest level of assurance is required.

The practical difference between levels is significant. DAL A and DAL B hardware requires additional activities such as elemental analysis, independence in verification and more extensive configuration and process assurance, which is why getting the DAL right early has a direct impact on programme cost and schedule.

Key requirements of DO-254

A structured design process

DO-254 requires a defined development process covering planning, requirements definition, conceptual design, detailed design, implementation and production transition. Each stage follows documented procedures, and every requirement must be traceable through design and verification so that nothing is missed and nothing is added without control.

Validation and verification

A large part of DO-254 is concerned with validation and verification. Validation confirms that the hardware requirements are correct and complete. Verification confirms that the design has been implemented correctly and that it meets those requirements. Both must be planned, evidenced and reviewed.

Supporting processes

Configuration management, process assurance and certification liaison run alongside development throughout the lifecycle. They are what turn good engineering into evidence a certification authority can accept.

The role of certification authorities

Working with certification authorities such as the FAA or EASA is an integral part of the DO-254 process. Manufacturers engage with them throughout development, typically through the Plan for Hardware Aspects of Certification (PHAC) and a series of stage-of-involvement reviews, so that the authority is confident the agreed processes have been followed and the safety and compliance requirements have been met.

How DO-254 fits with other aerospace standards

DO-254 does not operate in isolation. It sits within a wider framework of standards and methods that together ensure the safety and reliability of airborne systems.

DO-178C: software design assurance

DO-178C is the software counterpart to DO-254. Together they form the backbone of system-level design assurance, making sure that both the hardware and the software that controls it are developed and verified to equally stringent requirements.

AMC 20-152A: airborne electronic hardware

EASA’s Acceptable Means of Compliance AMC 20-152A provides specific guidance on demonstrating compliance for airborne electronic hardware, building on DO-254 and clarifying EASA’s expectations, including for commercial off-the-shelf devices and complex hardware. It is essential reading for anyone certifying hardware under EASA or UK CAA oversight.

ARP 4754B: development of civil aircraft and systems

ARP 4754B (which superseded ARP 4754A in 2023) sets out guidelines for aircraft and system development. It establishes how system-level development assurance flows down into the hardware and software processes defined in DO-254 and DO-178C, including how Design Assurance Levels are assigned.

ARP 4761: safety assessment

ARP 4761 describes the safety assessment process for aircraft and systems, using methods such as Fault Tree Analysis (FTA), Failure Mode and Effects Analysis (FMEA) and Common Cause Analysis (CCA). It complements DO-254 by identifying, at system level, the failure conditions that hardware design must protect against.

AMC 25.1309: system safety assessment for large aeroplanes

AMC 25.1309 provides guidance on demonstrating compliance with CS 25.1309, which requires a safety assessment of aircraft systems. It aligns closely with ARP 4761 and ARP 4754B and ensures that DO-254 hardware is considered as part of the overall aircraft safety case.

APQP for aerospace

Advanced Product Quality Planning (APQP), defined for aerospace in AS9145, gives organisations a systematic approach to product development and production control. It is not specific to DO-254, but it supports the same objective of robust design processes that minimise defects and build reliability in from the outset.

Common challenges in implementing DO-254

Achieving compliance can be demanding because of the complexity of modern hardware and the depth of evidence required. The challenges organisations most often face are:

  • Meeting the demands for detailed documentation and end-to-end requirements traceability.
  • Establishing verification and validation processes that are comprehensive without being unworkable.
  • Managing communication and alignment with certification authorities across a long programme.
  • Controlling the use of COTS devices and IP cores whose internal design is not fully visible.

Best practices for compliance

Plan early. Build design assurance into the project from the beginning. Retrofitting evidence after the design is complete is one of the most expensive mistakes a programme can make.

Use tools wisely. Automated verification and requirements management tools streamline testing and traceability, but any tool whose output is relied on without independent checking may itself need to be qualified.

Engage the authority early and often. Agreeing plans and DAL assignments with the certification authority at the start avoids costly surprises at later stages of involvement.

Integrate with your quality system. DO-254 evidence is far easier to produce and sustain when configuration management, supplier control and process assurance are already embedded in an AS9100 quality management system.

Conclusion

DO-254 is a cornerstone of safety and reliability in aerospace electronics. By establishing rigorous design assurance processes, it gives operators, manufacturers and regulators confidence that hardware will perform safely in mission-critical environments. Organisations that understand their Design Assurance Levels, plan early and integrate DO-254 with the wider standards framework achieve compliance more efficiently and with far less rework.

How Hillscom can help

Hillscom supports aerospace and defence organisations with design assurance, quality and certification, drawing on more than 30 years of quality leadership including senior quality and mission assurance roles in aerospace and defence. We help teams build the processes and evidence that DO-254, DO-178C and AS9100 demand, from gap analysis through to audit support.

If you are planning a hardware certification programme or strengthening your design assurance processes, get in touch to discuss how we can help.