Although the chart above shows how to arrive at an ASIL based on the severity, exposure, and controllability levels, there is some amount of subjectivity involved in assigning those levels. For example, road conditions, environmental factors, traffic density, driver competence, and likelihood of exposure can all vary widely. A driver who is operating a vehicle on a wide, empty, dry road may be more likely to control for a hazardous event than a driver operating in heavy traffic during a rainstorm. The ASIL classification system depends on subjective interpretation with words such as “usually,” “likely,” and “probably,” which involves some level of educated judgment on the part of engineers and developers. Another challenge with determining ASIL levels is the temptation to make an assumption based on past level assignments without doing a full hazard analysis and risk assessment. For example, if a system was previously assigned ASIL level B, it might be tempting to assume its current level should be the same. However, improvements in the system or integrations with other systems could change the level. If a GPS system now integrates with camera equipment or some other intelligent technology, that new integration could raise or lower the ASIL level.

Finally, teams that are not keeping good documentation records or tracking requirements properly may arrive at inaccurate ASILs — or even neglect risks entirely. When documentation and requirements aren’t thoroughly tracked, teams may miss key functional safety risks. Requirements tracking and traceability is essential not only for compliance with ISO 26262, but also for the practical market need to thoroughly and accurately assess and mitigate risks.