ASIL (Automotive Safety Integrity Level)
ASIL (Automotive Safety Integrity Level) is the risk classification of ISO 26262 for safety-related electrical and electronic systems in vehicles. The four levels ASIL A (lowest) to ASIL D (highest) define how rigorous the requirements for development, evidence and testing of a vehicle function are. Functions without safety relevance are classified as QM (Quality Management).
How is the ASIL determined?
The ASIL is determined in the concept phase through the hazard analysis and risk assessment (HARA) according to ISO 26262-3. Each identified hazard is rated using three parameters:
| Parameter | Meaning | Levels |
|---|---|---|
| S — Severity | Severity of possible injuries | S0 (none) to S3 (life-threatening/fatal) |
| E — Exposure | Probability of the driving situation | E0 (incredible) to E4 (high probability) |
| C — Controllability | Controllability by the driver or others | C0 (controllable in general) to C3 (difficult to control) |
The combination of the three values yields the classification: only the highest combination (S3, E4, C3) leads to ASIL D. Lower combinations lead to ASIL C, B, A — or to QM if there is no unreasonable risk.
What do the levels mean in practice?
The higher the ASIL, the stricter the requirements of ISO 26262 — for example regarding requirements traceability, architectural metrics, test coverage and the independence of verification instances:
- QM: no additional safety measures beyond normal quality management — e.g., comfort functions such as seat heating.
- ASIL A/B: moderate requirements — e.g., rear-view camera or electric window lifters with anti-trap protection.
- ASIL C: increased requirements — e.g., sub-functions of the powertrain.
- ASIL D: maximum requirements for evidence, redundancy and test depth — e.g., braking system, steering, airbag deployment.
ASIL decomposition
ISO 26262-9 allows a safety requirement with a high ASIL to be distributed across several redundant, sufficiently independent elements with a lower ASIL — for example ASIL D into two times ASIL B(D). The notation in brackets records the original level the requirement is derived from. Decomposition considerably reduces the effort per element, but requires solid evidence of independence (freedom from interference) — in practice one of the most common sources of findings in safety audits.
ASIL in practice: traceability is half the battle
The ASIL classification itself is only the beginning: auditors want to be able to trace without gaps how each safety requirement has been implemented from the HARA through the architecture to implementation and testing — with different rigour per ASIL level. Precisely this end-to-end traceability across tool boundaries is, in practice, the biggest hurdle in ISO 26262 projects.