ASIL calculator
For orientation only. ASIL determination belongs in your hazard analysis and risk assessment (HARA), reviewed under your safety plan.
The three parameters
| Class | Severity (S) | Exposure (E) | Controllability (C) |
|---|---|---|---|
| 0 | S0: no injuries | E0: incredible | C0: controllable in general |
| 1 | S1: light and moderate injuries | E1: very low probability | C1: simply controllable |
| 2 | S2: severe and life-threatening injuries (survival probable) | E2: low probability | C2: normally controllable |
| 3 | S3: life-threatening injuries (survival uncertain), fatal injuries | E3: medium probability | C3: difficult to control or uncontrollable |
| 4 | – | E4: high probability | – |
ISO 26262-3 ASIL determination table
| Severity | Exposure | C1 | C2 | C3 |
|---|---|---|---|---|
| S1 | E1 | QM | QM | QM |
| S1 | E2 | QM | QM | QM |
| S1 | E3 | QM | QM | ASIL A |
| S1 | E4 | QM | ASIL A | ASIL B |
| S2 | E1 | QM | QM | QM |
| S2 | E2 | QM | QM | ASIL A |
| S2 | E3 | QM | ASIL A | ASIL B |
| S2 | E4 | ASIL A | ASIL B | ASIL C |
| S3 | E1 | QM | QM | ASIL A |
| S3 | E2 | QM | ASIL A | ASIL B |
| S3 | E3 | ASIL A | ASIL B | ASIL C |
| S3 | E4 | ASIL B | ASIL C | ASIL D |
How the risk graph works
ISO 26262-3 (concept phase) asks you to identify hazardous events for an item, meaning a malfunctioning behaviour in a specific operational situation, and to classify each one for severity, exposure and controllability. The table above combines the three classes into an ASIL. If any class is 0 (S0, E0 or C0), no ASIL is assigned and the event is QM, handled by normal quality management.
A useful check: with S, E and C as numbers, a sum of 10 gives ASIL D, 9 gives C, 8 gives B, 7 gives A and 6 or below gives QM. That shortcut matches the table, but the table is the normative reference.
Exposure is the probability of being in the operational situation, not the probability of the failure. It can be judged by duration (the share of driving time spent in the situation) or by frequency (how often the situation occurs). Controllability considers the driver and other people at risk, and assumes the driver is in an appropriate condition and has normal driving skills.
The highest ASIL among the hazardous events covered by a safety goal becomes that safety goal's ASIL. It then flows down to functional and technical safety requirements, and can later be reduced on redundant elements through ASIL decomposition under ISO 26262-9. See ISO 26262 engineering and the ASIL glossary entry.
Worked examples
Illustrative only. Real ratings depend on the item definition, vehicle type, market and the rationale recorded in your HARA.
| Hazardous event (illustrative) | S | E | C | Result |
|---|---|---|---|---|
| Unintended full braking on a motorway at high speed | S3 | E4 | C3 | ASIL D |
| Unintended acceleration while manoeuvring in a car park | S2 | E4 | C2 | ASIL B |
| Loss of electric power steering assist at low speed | S1 | E4 | C2 | ASIL A |
| Function fault that only matters in a rare situation, such as towing a trailer downhill | S3 | E1 | C3 | ASIL A |
| Interior ambient lighting fails to switch on | S0 | E4 | C0 | QM |
Limitations
- The calculator applies the table; it cannot judge whether your S, E and C ratings are right. Those need an engineering rationale and review under your safety process.
- It assesses one hazardous event at a time. A complete HARA covers every relevant malfunction in every relevant operational situation.
- ISO 26262 addresses hazards caused by malfunctioning E/E systems. Hazards from functional insufficiencies without a fault are in the scope of ISO 21448 (SOTIF), see ADAS and sensor fusion.
- Results are for information. They are not a safety assessment or a confirmation review, and Stalwart accepts no liability for decisions based on them. See the terms.
Frequently asked questions
What is an ASIL?
An Automotive Safety Integrity Level is the ISO 26262 classification of how much risk reduction a safety goal needs. There are four levels, from ASIL A (lowest) to ASIL D (highest). Events that need no ASIL are QM, handled by normal quality management. The ASIL drives the methods and rigour required in development.
How is the ASIL determined in ISO 26262?
During hazard analysis and risk assessment in ISO 26262-3, each hazardous event is rated for severity (S0-S3), exposure (E0-E4) and controllability (C0-C3). The standard's table combines the three into QM or ASIL A to D. This calculator applies that table.
Why does S3, E4, C3 give ASIL D?
It is the worst combination: potentially fatal injuries, in a situation that occurs often, which the driver or others are unlikely to be able to avoid. That is the only combination in the table that reaches ASIL D.
Why is the result QM whenever one rating is 0?
S0 means no injuries, E0 means the situation is incredible and C0 means the hazard is controllable in general. In each case ISO 26262 does not require an ASIL, so the event is handled under normal quality management.
Is exposure the probability of the failure?
No. Exposure is the probability of being in the operational situation in which the malfunction would be hazardous, such as motorway driving or reversing. The failure rate of the hardware is dealt with later, in the hardware design and its metrics.
Can the ASIL be lowered after it is assigned?
A safety goal's ASIL comes from the HARA and only changes if the analysis is revised. Lower ASILs on individual elements can be achieved through ASIL decomposition under ISO 26262-9, which requires sufficiently independent redundant elements.
Can Stalwart help with our HARA and safety concept?
Yes. Our functional safety engineers prepare and review HARA, safety goals, functional and technical safety concepts and safety case work products. See ISO 26262 engineering or start a project.
Tell us your domain, standard and team size — get a scoped brief in 2 minutes.