ASIL
Measure
Topic overview
Quick facts
ASIL D represents the most stringent automotive integrity requirements, typical for functions whose failure can cause fatal, uncontrollable outcomes such as unintended steering or braking loss at speed. ASIL A is the least stringent level that still carries safety requirements, and QM (Quality Managed) denotes no safety requirement beyond normal automotive quality processes.
Unlike , ASIL derivation explicitly includes controllability: the ability of the driver or other road users to act to avoid harm, which is why driver-supervised features can carry lower ASILs than fully automated ones performing the same physical action.
ASIL decomposition allows a requirement to be split across sufficiently independent redundant elements, for example decomposing an ASIL D requirement into an ASIL B(D) element plus an ASIL B(D) element.
The notation preserves the original level in parentheses, and the standard requires evidence of independence between the decomposed elements; decomposition without an independence argument is one of the most common findings in automotive assessments.
The ASIL attaches first to safety goals produced by the , then flows down through the functional safety concept and technical safety requirements to hardware and software. Hardware metrics targets (single-point fault metric, latent fault metric, and probabilistic targets) and the required software techniques all scale with the ASIL.
ASIL levels (rigor increases, no fixed PFH targets)
Why ASIL matters
ASIL ratings decide the engineering economics of an automotive program: an ASIL D allocation on a component drives redundant hardware, lockstep or diverse processing, extensive tool qualification, and independent confirmation measures, often multiplying that component's development cost.
OEMs pass ASIL allocations to suppliers contractually through the development interface agreement, so a supplier's ability to accept and demonstrate a given ASIL determines which sourcing opportunities are winnable. Misjudging controllability or exposure in the can therefore misprice an entire program.
How ASIL is applied
ASIL determination and flow-down
During the concept phase, the evaluates each hazardous event for severity (S0-S3), exposure (E0-E4), and controllability (C0-C3); the standard's table maps each combination to QM or ASIL A through D. The resulting safety goals carry the ASIL, and systems engineering allocates it down to elements, optionally using decomposition where independent channels exist.
Confirmation measures, including confirmation reviews, functional safety audit, and functional safety assessment, are performed with independence that scales with the ASIL.
Assessors scrutinize the parameter choices (especially optimistic controllability claims), the independence evidence behind any decomposition, and whether the hardware metrics and software technique selections actually match the allocated level.
ASIL pitfalls to avoid
ASIL and its standards
ISO 26262 sets the requirements that ASIL work has to satisfy: automotive functional safety standard defining asil levels and the automotive safety lifecycle.
Cross-sector integrity alignment (approximate)
| ISO 26262 ASIL | IEC 61508 SIL | ISO 13849 PL | EN 50128 SW-SIL |
|---|---|---|---|
| ASIL A | SIL 1 | PL b / c | SIL 1 |
| ASIL B | SIL 1-2 | PL c / d | SIL 1-2 |
| ASIL C | SIL 2 | PL d | SIL 2 |
| ASIL D | SIL 3 | PL e | SIL 3 |
Industries where ASIL applies
Autonomous Systems programs lean on ASIL because the sector covers autonomous mobile equipment, off-highway autonomy, and driverless platforms.
Ask our team about ASIL
Ben TwomblyFounder & CEOLeads CSA's functional-safety, certification, and engineering programs for safety-critical products and organizations. His assessor-side background informs practical programs that connect standards, engineering work, and credible evidence.
Tom CyrPrincipal Safety Engineer, IFSPSupports industrial and rail functional-safety programs with safety analysis, requirements, lifecycle planning, and certification-readiness guidance.
Robert EllsworthSenior Safety EngineerSupports system-safety analysis, requirements, verification, and evidence development for safety-critical product and transportation programs.Terms related to ASIL
How each connects to ASIL:
Programs that deal with ASIL almost always involve SIL in the same phase.
HARA appears in the same lifecycle work as ASIL and is usually produced or reviewed alongside it.
FMEA is governed by ISO 26262 as well, which is why the two show up together in audits.
Both ASIL and FMEDA sit under ISO 26262, so evidence for one usually references the other.
Both ASIL and Functional Safety Plan sit under ISO 26262, so evidence for one usually references the other.
ISO 26262 connects the two: ASIL and Safety Manager are assessed against the same lifecycle.
ISO 26262 connects the two: ASIL and V-Model are assessed against the same lifecycle.
Both ASIL and Functional Safety Assessment sit under ISO 26262, so evidence for one usually references the other.
ISO 26262 connects the two: ASIL and Functional Safety Audit are assessed against the same lifecycle.
Both ASIL and Safety-Critical System sit under ISO 26262, so evidence for one usually references the other.
Both ASIL and Hazard Analysis sit under ISO 26262, so evidence for one usually references the other.