The rules that decide how carefully an electronic car system must be engineered, from the 2011 passenger car edition to the 2018 standard covering every road vehicle except mopeds.
ISO 26262 is the international functional safety standard for electrical and electronic systems in road vehicles. It rates hazards by severity, exposure and controllability, producing ASIL levels from QM to ASIL D that decide how rigorously each safety function must be engineered.
ISO 26262 is the international standard for the functional safety of electrical and electronic systems in series-production road vehicles. Published by the International Organization for Standardization, it asks engineers to find hazards that electronics could cause, to rate how serious each one is and to design controls that keep the residual risk acceptable. Its risk classes, called automotive safety integrity levels or ASILs, shape how carefully each feature must be developed and tested.
What is ISO 26262 and what does it cover?
ISO 26262 defines functional safety for automotive equipment across the whole life of a safety-related system, from specification through design, implementation, integration, verification, validation and production release. It is an adaptation of the functional safety standard IEC 61508, applied to the electrical and electronic systems in cars and other vehicles. The standard is about the safety of the systems themselves, including mechanical parts that those systems control.
Its concern is hazards caused by the malfunctioning behaviour of electronic and electrical systems. Like IEC 61508, it is a risk-based standard. Engineers assess the risk of hazardous situations in a qualitative way, then define safety measures that avoid or control systematic failures, detect or control random hardware faults, or reduce their effects.
A rating system that starts from how badly a hazard could hurt someone and works back to how carefully the electronics must be built.
How has ISO 26262 changed since 2011?
The first edition, ISO 26262:2011, was published on 11 November 2011. It applied only to electrical and electronic systems in series-production passenger cars with a maximum gross weight of 3,500 kg (7,700 lb). That scope was narrow, and it left out trucks, buses and other vehicle classes that carry similar electronics.
The second edition, ISO 26262:2018, was published in December 2018 and widened the scope from passenger cars to all road vehicles except mopeds. It also reorganised the document, adding parts that cover guidance and specific vehicle types. The revision matters for suppliers that build the same electronics for several classes of vehicle.
How is the standard organised?
The 2018 edition has twelve parts. Ten are normative, meaning they set mandatory requirements, and two are guidelines. The table lists each part and its subject.
| Part | Subject | Type |
|---|---|---|
| 1 | Vocabulary | Normative |
| 2 | Management of functional safety | Normative |
| 3 | Concept phase | Normative |
| 4 | Product development at the system level | Normative |
| 5 | Product development at the hardware level | Normative |
| 6 | Product development at the software level | Normative |
| 7 | Production, operation, service and decommissioning | Normative |
| 8 | Supporting processes | Normative |
| 9 | ASIL-oriented and safety-oriented analysis | Normative |
| 10 | Guidelines on ISO 26262 | Guideline |
| 11 | Guidelines on application to semiconductors | Guideline |
| 12 | Adaptation for motorcycles | Normative |
The 2011 edition had ten parts with slightly different names. Part 7 was called only production and operation, part 10 was titled as a single guideline, and parts 11 and 12 did not exist. The later additions show how the standard grew to cover semiconductors and motorcycles.
What vocabulary does ISO 26262 define?
Part 1 sets out a project glossary of terms, definitions and abbreviations used across the standard. The most important distinction is between a fault, an error and a failure. A fault is an abnormal condition that can cause an element or an item to fail. An error is a discrepancy between a computed or measured value and the correct value. A failure is the termination of an intended behaviour caused by a fault. A fault can show up as an error, and that error can ultimately lead to a failure.
Other key terms include item and element. An item is the system, or combination of systems, to which the safety lifecycle is applied at vehicle level. An element is any part of a system that can be distinctly identified and manipulated, whether it is a whole subsystem, a hardware part or a single software unit. A hazard is a potential source of physical injury or health damage caused by malfunctioning behaviour, and functional safety means the absence of unreasonable risk from such hazards.
The 2018 edition added a definition of fault tolerance, which the 2011 edition had left out because it was assumed impossible to foresee every possible fault. ISO 26262 also avoids the term safe failure fraction used in IEC 61508, relying instead on a single point faults metric and a latent faults metric.
How does the safety lifecycle work?
Processes within the lifecycle identify and assess hazards, set safety requirements that reduce those risks to acceptable levels, and track those requirements through to the finished product. These safety processes run alongside a conventional quality management system, so that the safety requirements remain managed throughout development.
The sequence begins with defining the item and its top-level functional requirements. Analysts then identify a comprehensive set of hazardous events and assign an ASIL to each one. Each hazardous event produces a safety goal that inherits the ASIL of its hazard. A vehicle-level functional safety concept defines an architecture that delivers those goals, and the goals are refined into lower-level safety requirements.
Safety requirements are then allocated to architectural components, such as subsystems, hardware and software. Each requirement generally inherits the ASIL of its parent, although the inherited level can be lowered by decomposing a requirement into redundant requirements carried by independent components. Components are developed in line with the processes suggested for the highest ASIL allocated to them, and then validated against their safety and functional requirements.
What are the core safety management concepts?
ISO 26262 works with four management concepts: hazardous events, safety goals, automotive safety integrity levels and safety requirements. Each one builds on the last, moving from a situation on the road to the specific requirement that an engineer must meet.
A hazardous event pairs a hazard at vehicle level with a driving situation, and it could end in a crash if the driver fails to respond in time. A safety goal is a top-level requirement assigned to a system to reduce the risk of one or more hazardous events to a tolerable level.
An automotive safety integrity level classifies a safety goal on a risk basis and sets the validation and confirmation measures needed to achieve it. Safety requirements include all safety goals together with every lower level of requirement, decomposed down to the functional and technical requirements allocated to hardware and software components.
What supporting processes does the standard require?
Part 8 defines processes that run continuously through every lifecycle phase. They include controlled interfaces with suppliers so that objectives and requirements flow down properly in distributed development, and explicit specification and management of safety requirements. They also cover configuration control, formal change management and planned verification with review, analysis and testing.
Further supporting activities cover the qualification of software tools, the qualification of previously developed hardware and software for reuse, and the use of service history as evidence that an item has proven sufficiently safe in use. Documentation must be identified and managed through every phase so that safety can be assessed continuously.
How is an ASIL rating assigned?
An automotive safety integrity level is a risk-based classification of inherent safety risk in a system or its elements. ASIL D represents the highest hazard level and ASIL A the lowest. The rating comes from a hazard analysis and risk assessment, which weighs the severity of possible injuries against how often the vehicle is exposed to the hazard and how likely the driver is to prevent the injury.
Each hazardous event is classified on three scales. Severity runs from S0, with no injuries, through S1 for light to moderate injuries and S2 for severe but survivable injuries, to S3 for life-threatening or fatal injuries. Exposure runs from E0, which is incredibly unlikely, to E4, which means a high probability in most operating conditions. Controllability runs from C0, controllable in general, to C3, which means difficult or uncontrollable.
What does an ASIL D rating mean?
ASIL D is the combination of the most serious classes on each scale: S3, E4 and C3. It describes an event with a reasonable possibility of life-threatening or fatal injury, physically possible in most operating conditions, with little chance the driver can prevent it. Each single reduction from the maximum on any scale lowers the ASIL by one level from D. Reducing controllability from C1 to C0 is excluded from that rule.
The arithmetic works in both directions. A hypothetical uncontrollable, fatal hazard with a very low probability of occurring could be classified as ASIL A. Below ASIL A lies QM, which means there is no safety relevance and only standard quality management applies. Most electronic features that have no direct bearing on a serious hazard fall into that category.
The standard acknowledges that its scales leave room for judgement. The severity, exposure and control definitions are informative rather than prescriptive, so automakers and suppliers can interpret them differently. The Society of Automotive Engineers responded with J2980, which gives more explicit guidance for classifying exposure, severity and controllability.
What are the main goals of the standard?
ISO 26262 aims to provide a complete automotive safety lifecycle, covering management, development, production, operation, service and decommissioning. It supports tailoring so that the required activities fit the scale of each project. It also covers the whole development process, including requirements specification, design, implementation, integration, verification, validation and configuration.
Its risk method is specific to cars. It determines ASILs for each hazard and uses them to specify the safety requirements needed to reach an acceptable residual risk. It also sets requirements for validation and confirmation, so that a sufficient level of safety is demonstrated rather than assumed.
How does ISO 26262 relate to other safety standards?
ISO 26262 adapts IEC 61508 to road vehicles, with minor differences. Other standards cover related fields. ARP4754 gives guidelines for developing civil aircraft and their systems, and DO-178C covers aerospace software. ISO 60730 covers household appliances, while the Automotive SPICE framework offers a software process assessment that relates to some ISO 26262 specifications.
Engineers who work across sectors often find the same ideas recurring. Each standard assesses hazards, sets integrity or assurance levels and then demands evidence that the design meets them. ISO 26262's contribution is the automotive-specific ASIL scheme, which ties the rating to exposure on the road and to the driver's ability to intervene.
