ASIL

ASIL is assigned during hazard analysis and risk assessment by combining three factors for a given hazardous event: severity of potential harm, exposure to the operating situation, and controllability by the driver or other person. The combination maps to one of four integrity levels, ASIL A through D, or to QM where dedicated safety measures are not required.

How it is used

The assigned ASIL determines the rigour expected of subsequent development activities: the depth of requirements decomposition, the independence expected between development and verification roles, the analysis techniques applied to the architecture, and the coverage expected from testing. A higher ASIL does not change what the system must do; it changes how much confidence the evidence must provide that it does it.

• ASIL decomposition allows a requirement to be split across redundant elements with lower individual levels, provided independence is demonstrated.
• ASIL is attached to safety goals, then inherited by the requirements and architectural elements that implement them.
• Evidence expectations — reviews, analyses, test methods — scale with the assigned level rather than being fixed project-wide.

In practice, the classification is only as trustworthy as the hazard analysis behind it. Assessors expect to see the reasoning for severity, exposure and controllability recorded, not just the resulting letter.