3 SIL and ASIL Classification

For many industrial applications, SIL levels are used to classify hazards and define the acceptable failure rates of the safety concept components. The criteria for assigning SIL levels is defined in the International Electrotechnical Commission (IEC) 61508 functional safety standard. IEC 61508 is used in many industries and covers safety-related systems that incorporate electrical, electronic, or programmable electronic devices (or any combination of these three functions).

In IEC 61508, each hazard is classified in terms of Consequence, Frequency and exposure time, Possibility of failing to avoid, and Probability of unwanted occurrence.

Figure 3-1 shows the matrix used to rate each hazard from SIL 1 to SIL 4 (SIL 1 being the lowest risk of harm).

Figure 3-1 IEC 61508 Risk Graph, Hazard Classification Matrix

For automotive applications, ASIL levels are used to classify hazards and define the acceptable failure rates of the safety concept components. The criteria for assigning ASIL levels is defined in the International Organization for Standardization (ISO) 26262 standard. IEC 61508 and ISO 26262 are similar in objectives, but use different methodologies and safety metrics

ISO 26262 classifies each hazard using Severity or harm, probability of Exposure, and Controllability which is the degree to which the hazard can be avoided. Using the matrix shown Figure 3-2, each hazard is classified as quality managed (QM) or one of 4 levels from ASIL A to ASIL D. A QM rating indicates the identified hazard does not require a dedicated safety goal to reduce the risk while an ASIL D rating indicates the highest potential risk of harm.

Figure 3-2 ISO 26262 Hazard Classification Matrix

FIT rate is a key compliance metric for defining acceptable risk levels in both IEC 61508 and ISO 26262. FIT is defined as the number of Failures In Time in an interval of 10⁹ hours of operation (that is, 1 billion hours of operation).

Not all faults are equal in terms of potential harm and therefore faults are classified into different categories such as non-safety related faults, detected safe faults, undetected safe faults, dangerous detected faults, and dangerous undetected faults. For obvious reasons, the most critical category is the dangerous undetected fault. The other faults categories do not create a significant safety concern or can be detected through diagnostics and mitigated to eliminate any potential harm. The FIT rate at the component level defines the maximum number of dangerous undetected faults that can occur over time.

IEC 61508 SIL and ISO 26262 ASIL metrics are listed in Table 3-1 and Table 3-2.

The IEC 61508 standard uses Probability of Failure per Hour (PFH) to represent the total number of dangerous undetected faults per hour. Safe Failure Fraction (SFF) represents the percentage of faults that are not dangerous undetected faults.

Similar to the PFH metric, ISO 26262 uses PMHF which stands for Probabilistic Metric for random Hardware Failures to represent the total number of dangerous undetected faults. Single Point Fault Metric (SPFM) is analogous to SFF.

ISO 26262 adds an additional fault metric called the Latent Fault Metric (LFM) for diagnostic hardware that is not found in IEC 61508. A diagnostic hardware fault is considered latent because the fault cannot be detected during normal operation, reveling the fault only when a detectable failure is not detected. To reduce the number of LFM faults, the diagnostic hardware must be designed with a high percentage of test coverage and be extensively tested prior to field deployment.