Automotive Safety Integrity Level

ASIL D, an abbreviation of Automotive Safety Integrity Level D, refers to the highest classification of initial hazard (injury risk) defined within ISO 26262 and to that standard's most stringent level of safety measures to apply for avoiding an unreasonable residual risk.[2] In particular, ASIL D represents likely potential for severely life-threatening or fatal injury in the event of a malfunction and requires the highest level of assurance that the dependent safety goals are sufficient and have been achieved.[2] An example of dangerous hazard that warrants the ASIL D level is loss of braking on all wheels.[9]

ASIL D is noteworthy, not only because of the elevated risk it represents and the exceptional rigor required in development, but because automotive electrical, electronic, and software suppliers make claims that their products have been certified or otherwise accredited to ASIL D,[10][11][12][13] ease development to ASIL D,[14] or are otherwise suitable to or supportive of development of items to ASIL D.[15][16][17] Any product able to comply with ASIL D requirements would also comply with any lower level.

ISO 26262 "highly recommends" the use of semi-formal modeling languages for ASIL D designs (Stateflow and SysML provide examples of such languages).[18] Executable validation using either prototyping or simulation is mandatory.[19]

Loss of braking for rear wheels only is less dangerous, this hazard is associated with ASIL C.[20] Another example of a less critical function that warrants the ASIL C rating is cruise control.[21]

For ASIL C designs the use of semi-formal modeling languages is highly recommended.[18] Executable validation using either prototyping or simulation is mandatory.[19]

ASIL B examples are headlights and brake lights.[21]

Modeling of the ASIL B design can rely on an informal languages.[18] This and other differences requirements make the cost difference between C and B to be the largest step across all the ASILs.[22]

ASIL A is the lowest rating of the functional safety. A typical example are tail lights (non-braking).[21] Less strict design walkthroughs can be used during the development (higher levels require more formal design inspections).[19]

Referring to "Quality Management", the QM level means that all assessed risks are tolerable from a safety perspective (even if the manufacturer might want to address them from a customer satisfaction perspective, for example make sure the vehicle starts). So, safety assurance controls are unnecessary and standard quality management processes are sufficient for development.[23][2]

ISO 26262 is an extension of IEC 61508.[2] IEC 61508 defines a widely referenced Safety Integrity Level (SIL) classification. Unlike other functional safety standards, ISO 26262 does not provide normative nor informative mapping of ASIL to SIL; while the two standards have similar processes for hazard assessment, ASIL and SIL are computed from different perspectives.[25]

• An ISO 26262 ASIL is a qualitative statement of assessed risk, assessed in terms of three risk parameters in a qualitative way that leaves room for interpretation.[26][27][28][29][30][31]

• On the other hand, the IEC 61508 SIL employ quantitative target probability or frequency measures[27] of dangerous failures depending on the type of safety function.[32]

In the context of IEC 61508, higher risk applications require greater robustness to dangerous failures:

${\displaystyle {\text{probability of failure}}<{{\text{Tolerable Risk}} \over {\text{Risk}}}}$

That is, for a given Tolerable Risk, greater Risk requires more risk reduction, i.e., a smaller design target value for greater probability of dangerous failure. For a safety function operating in high demand or continuous mode of operation, SIL 1 is associated with a probability of dangerous failure limit of 10⁻⁵ per hour while SIL 4 is associated with a probability of dangerous failure rate limit of 10⁻⁹ per hour.

In commercial publications, ASIL D has been illustrated to align with SIL 3 and ASIL A is compared to SIL 1.[33]

While it is more common to compare the ISO 26262 Levels D through QM to the Design Assurance Levels (DAL) A through E and ascribe those levels to DO-178C; these DAL are actually defined and applied through the definitions of SAE ARP4761 and SAE ARP4754. Especially in terms of the management of vehicular hazards through a Safety Life Cycle, the scope of ISO 26262 is more comparable to the combined scope of SAE ARP4761 and SAE ARP4754. Functional Hazard Assessment (FHA) is defined in ARP4761 and the DAL are defined in ARP4754. DO-178C and DO-254 define the design assurance objectives that must be accomplished for given DAL.

Unlike SIL, it is the case that both ASIL and DAL are statements measuring degree of hazard. DAL E is the ARP4754 equivalent of QM; in both classifications hazards are negligible and safety management is not required. At the other end, DAL A and ASIL D represent the highest levels of risk addressed by the respective standards, but they do not address the same level of hazard. While ASIL D encompasses at most the hazards of a loaded passenger van, DAL A includes the greater hazards of large aircraft loaded with fuel and passengers. Publications might illustrate ASIL D as equivalent to either DAL B, to DAL A, or as an intermediate level.