"The client wants ASIL D!" That day, our boss's face went pale
That afternoon, the production line suddenly stopped. It wasn't because a machine broke down; a foreigner sent by the client came to audit and directly put a hold on the automotive chips we were currently running. I remember the foreigner pointing to a glaring ASIL D in the report, looking very displeased. Our boss, standing nearby, went pale because that batch of goods was originally only planned for ASIL B. This hold not only stalled subsequent orders but also caused significant financial losses, and more importantly, a loss of face.
This illustrates the immense importance of functional safety, particularly ASIL levels, in automotive semiconductors. Did you think it was just about writing more documents? Wrong! It requires changes across the entire process, from design and manufacturing to testing, and is a major challenge that frequently impacts delivery times and costs.
What Exactly Does ASIL "Secure"?
Simply put, ASIL (Automotive Safety Integrity Level) is a standard used to determine "how critical the safety is" for automotive electronic products. It's not about whether your chip will burn out if it fails, but rather assessing, "If the chip's function fails, will it cause personal injury or even death?"
For example, if the electric window control chip in your car fails, the worst that happens is the window gets stuck, posing no immediate danger. This might be ASIL A or B. However, if the braking system chip in your autonomous vehicle fails, it could be fatal! Such a case would definitely be ASIL D, the highest level. The key takeaway is: the higher the ASIL level, the lower the probability of danger, and consequently, the stricter the corresponding development processes and validation requirements.
How ASIL Levels Are Actually Determined
Determining ASIL is not that complicated; it primarily considers three dimensions:
- Severity (S): The degree of harm caused to individuals after a functional failure.
* S2: Moderate Injuries, e.g., bone fracture.
* S3: Severe/Life-threatening Injuries, e.g., amputation or death.
- Exposure (E): How high is the probability of the functional failure occurring?
* E2: Low, e.g., occurs occasionally, probability 1% to 10%.
* E3: Medium, e.g., occurs frequently, probability 10% to 50%.
* E4: High, e.g., almost always occurs, probability greater than 50%.
- Controllability (C): Can the driver or other road users timely control or avoid danger after a functional failure?
* C2: Normally controllable, e.g., the driver requires certain skills and reaction time.
* C3: Difficult to control, e.g., the driver can hardly react, such as sudden brake failure.
By taking these three dimensions and mapping them to an ISO 26262 table, you can derive the ASIL level. For example, S3 (Severe Injury) + E4 (High Exposure) + C3 (Difficult to control) would essentially result in ASIL D. Conversely, S1 + E1 + C1 might lead to QM (Quality Management), indicating no functional safety relevance.
The Most Common Pitfall: Treating Client Requirements as Gospel, Starting Work Without Clarification
The most exaggerated case I've heard is when a client initially stated, "We need ASIL B!" Our factory then foolishly followed the ASIL B process, getting all documentation and testing in place. Just before delivery, the client suddenly dropped a bombshell: "Oh, we eventually found out this function will be cascaded with another ASIL D module, so it also needs to be ASIL D."
Isn't that frustrating? It's a complete waste of time and money. The validation requirements for ASIL B and ASIL D are vastly different, from FMEA/FTA in the design phase to DPMO calculations and test coverage requirements — they are worlds apart. Frankly, sometimes clients themselves aren't clear, or their requirements change. Therefore, the key is to clearly define the ASIL level determination criteria and all relevant functional failure scenarios with the client at the project's outset, putting it all down in writing. Otherwise, you'll be driven to immense frustration.
One Thing You Can Do Today
Go back and check your current automotive projects: how were the ASIL levels determined, and have they been confirmed with the client?