Acronym · Safety & Security
ASIL (Automotive Safety Integrity Level)
The risk classification assigned to a hazardous event in ISO 26262, ranging from A (lowest) to D (highest). The level is derived from severity, exposure and controllability, and determines how rigorous the development, analysis and metric targets must be.
- Also known as
- ASIL A, ASIL B, ASIL C, ASIL D
- Type
- Acronym
- Domain
- Safety & Security, Safety lifecycle
- Also relevant to
- Automotive
Notes
ASIL D typically applies to steering, braking and airbag functions; most infotainment silicon is QM or ASIL B.
Overview
An ASIL (Automotive Safety Integrity Level) is the risk class that ISO 26262 assigns to a hazardous event and the safety goal that addresses it, from A for the lowest risk to D for the highest; risks too low to need an ASIL are marked QM, for ordinary quality management. The ASIL then travels down to every requirement, hardware block and software unit serving that goal and decides how rigorous their development, verification and analysis must be. For chip suppliers, the ASIL a part can support is often the first question a customer asks.
How it works
The ASIL comes out of the hazard analysis and risk assessment done in the concept phase. Each hazardous event is rated for severity of harm (S0 to S3), exposure to the driving situation (E0 to E4) and controllability by the driver (C0 to C3), and the combination gives the level: the worst case, S3 with E4 and C3, gives ASIL D. Typical results are ASIL D for airbags and anti-lock braking, and lower levels for functions such as lighting. ASIL is a qualitative scale, unlike the probability-based SIL of IEC 61508.
For hardware, the ASIL sets targets for the architectural metrics. The single point fault metric is commonly cited at about 90 per cent for ASIL B, 97 per cent for C and 99 per cent for D, and the latent fault metric at about 60, 80 and 90 per cent; there is also a budget for the probability of random hardware failures. These targets drive how much error correction, redundancy and self-test a chip needs.
A requirement can be decomposed across redundant, sufficiently independent elements, each developed to a lower ASIL, written for example as ASIL B(D) for an element at B serving an ASIL D goal. Decomposition only holds if the elements cannot fail together from a common cause.
Examples
- An airbag control system rated ASIL D, while rear lights are typically rated ASIL A.
- A braking function decomposed into two independent channels, each developed to ASIL B(D).
- Texas Instruments describing sensing products that support functional safety levels as high as ASIL D, with safety manuals and FMEDA reports.
- Synopsys offering 'ASIL B and D ready' IP blocks with the documentation customers need for their safety case.
Why it matters
Functional safety managers and architects set ASIL targets, safety analysis engineers prove the metrics, and design and verification teams carry the extra work, which grows with each level. Chip suppliers publish safety manuals and FMEDA results so that customers can use a part in an item with a given ASIL, and state the highest ASIL a part is designed to support.
Related terms
Part of the Safety & Security glossary, with every term in the topic and the lifecycles, tools and standards that use them.
Where it appears on the Hub
Used on 17 pages of the Hub. In each group, the pages that mention it most come first.
Lifecycle stages and gates
Roles
Suggest an improvement
Suggest an improvement to this entry
A clearer definition, an example, a correction or a source an editor can check. Editors review every suggestion before the entry changes.
Last reviewed . Written by The Semiconductor Hub editorial team. The full glossary