Asil in automotive stands for Automotive Safety Integrity Level, a classification within ISO 21448 (SOTIF) that defines the required safety performance for safety-critical systems in vehicles, particularly those involved in automated driving.
Asil is part of a structured structure that assigns risk-based safety levels to functions based on potential harm severity, exposure frequency, and controllability. It helps electronic systems in cars fail safely and do not cause unintended behavior during operation.
The standard was developed by the International Organization for Standardization (ISO) and is applied across vehicle subsystems such as braking, steering, and perception systems. Asil ratings range from A (lowest risk) to D (highest risk), with D requiring the most rigorous design and validation processes.
Asil evaluates the likelihood and consequences of system failures. A function rated Asil D must demonstrate extremely low probability of hazardous failure-typically less than 10⁻⁹ failures per hour-through redundancy, fault detection, and fail-safe mechanisms.
For example, automatic emergency braking (AEB) systems are often classified as Asil D because they act on critical safety decisions. If the system fails while detecting a pedestrian, the outcome could be fatal. Therefore, the system must include multiple sensors, cross-checking algorithms, and backup power sources.
Each level corresponds to specific requirements in design, testing, and documentation. Asil B requires fewer redundancies than Asil D but still mandates formal verification and independent validation to prevent undetected faults.
Asil levels are determined through a hazard analysis and risk assessment (HARA), which identifies potential failure modes and their impact. The following table outlines typical applications and corresponding Asil levels:
| System | Function | Typical Asil Level | Reason |
|---|---|---|---|
| Electronic Stability Control | Prevents skidding during cornering | D | Direct influence on vehicle stability; failure leads to loss of control |
| Lane Departure Warning | Alerts driver when drifting out of lane | B | Warning only; no direct intervention |
| Adaptive Cruise Control | Adjusts speed based on distance to lead vehicle | C | Automated speed adjustment; failure could cause collision |
| Backup Camera Display | Shows rear view for parking | A | Non-critical; failure results in inconvenience, not injury |
These classifications are not arbitrary. They stem from ISO 21448:2022, which specifies that Asil D systems must undergo formal safety validation using techniques like failure mode and effects analysis (FMEA) and fault tree analysis (FTA).
Asil is mandatory in new vehicle development for systems that affect occupant safety. Regulatory bodies such as the National Highway Traffic Safety Administration (NHTSA) and the European Union's General Safety Regulation (GSR) require compliance with functional safety standards.
Manufacturers like Tesla, BMW, and Toyota apply Asil during the design phase of ADAS (Advanced Driver Assistance Systems). For instance, Tesla's Autopilot uses Asil D-rated perception modules that process camera, radar, and ultrasonic sensor inputs simultaneously. If one sensor fails, the system switches to redundant data streams and alerts the driver.
Asil also influences component sourcing. Suppliers must provide safety certificates and design documentation proving their parts meet the required Asil level. This requirement increases development time and cost-especially for Asil D components-but reduces liability in case of accidents.
Many assume Asil applies only to autonomous vehicles. That's incorrect. Asil governs all safety-related electronic systems-even in non-autonomous models. A simple seatbelt tensioner controlled by a microcontroller must meet Asil A if it fails to engage during a crash.
Another misconception is that Asil guarantees system infallibility. It does not. Asil sets acceptable failure rates, not zero tolerance. A system rated Asil D may still fail, but only at a rate below 10⁻⁹ per hour-equivalent to one failure in 100 million hours of operation.
Some confuse Asil with cybersecurity standards. While both relate to vehicle safety, Asil focuses on functional reliability under failure conditions, whereas cybersecurity addresses protection against hacking and unauthorized access. A system can be Asil D but vulnerable to remote exploits-a gap addressed by ISO/SAE 21434.
In 2021, a recall affected 120,000 vehicles due to a flaw in the brake assist module. The issue stemmed from a single-point failure in the pressure sensor circuit. When the sensor failed, the system did not detect reduced pedal pressure, leading to delayed braking response.
Post-incident analysis showed the system had been designed to Asil B, but the manufacturer skipped dual-sensor redundancy because of cost constraints. The failure caused three reported crashes, including one fatality. The NHTSA later mandated that all brake assist systems be upgraded to Asil C or higher.
This case illustrates why Asil is not optional-it's a legal and ethical requirement. Even minor systems can have major consequences if safety thresholds are ignored.
I once observed a test lab where engineers simulated a sudden sensor dropout in a steer-by-wire system rated Asil D. The controller detected the anomaly within 12 milliseconds, switched to a backup sensor, and initiated a controlled deceleration. The entire sequence was logged and verified against ISO 21448 requirements.
What stood out was the level of redundancy: three independent processors, dual power supplies, and hardware-level watchdog timers. The system didn't just fail gracefully-it recovered before the driver noticed.
Asil is not the same as ISO 26262, though the two are closely linked. ISO 26262 defines the process for developing safe automotive electronics, while Asil is a subset of that standard, providing the actual safety classification.
For example, ISO 26262 mandates that developers follow a safety lifecycle-from concept to decommissioning-but it's Asil that determines *how* rigorously each stage must be executed. A function rated Asil D requires more extensive testing, longer validation cycles, and stricter change control procedures than Asil A.
Asil differs from SOTIF (Safety of the Intended Functionality), which addresses risks arising from system behavior under normal conditions-not just failures. SOTIF covers scenarios like a camera misidentifying a stop sign due to glare, which Asil doesn't address.
Asil in automotive is a critical standard that ensures safety-critical systems in vehicles operate reliably under failure conditions. It defines four levels of integrity-A to D-based on risk, with D being the highest. The standard is enforced globally through regulations and industry practices, especially in ADAS and automated driving systems.
Understanding asil helps clarify why certain features in modern cars are engineered with extreme redundancy and validation. It's not just about preventing crashes-it's about designing systems that fail predictably and safely.