The phrase is used constantly, but it is not one qualification — it is four independent ones. Confusing them leads to conclusions like "this chip is automotive grade, so it can make the braking decision." It cannot.
When a chip is called "automotive grade," that claim may only cover one of the four things below.
The window between cold and hot in which it still works correctly.
Thousands of hours of ageing, thermal cycling, vibration and humidity stress.
Zero-defect culture, lot traceability, change notification, ten-year availability.
Whether the system can contain the consequences when the part fails.
The two most often confused are the second and the fourth.
AEC-Q100 answers "will it fail?" ISO 26262 answers "what happens when it does?" These are entirely separate qualifications. A chip can pass AEC-Q100 in full and carry no ASIL capability whatsoever.
The most concrete of the four. The grades differ only in how much heat the part survives — because where it sits in the vehicle decides what it endures.
Different locations in the vehicle impose very different thermal loads:
A real case. A supplier design document listed a part as "not automotive grade, but rated −30 to +85 °C." That looks close enough — until you remember the vehicle ships to the Nordics, where the vehicle-level requirement is −40 to +85 °C.
Those ten degrees are not margin. They decide whether the truck starts in a Norwegian winter. And the part does not even reach Grade 3, the lowest automotive tier — whose floor is exactly −40 °C.
This is the bulk of AEC-Q100: more than forty stress tests, thousands of hours, hundreds of samples. The purpose is to force defects that would otherwise surface in year ten to appear within months.
What do you get when it passes? A failure-rate commitment — normally expressed in PPM (parts per million) or FIT (failures per billion hours) — together with traceable test reports.
Consumer parts skip most of this, or run only a few of the tests. "It works" and "it still works in ten years" are different claims. A phone is replaced after two years; a truck runs for fifteen.
The most overlooked of the four, and the most punishing for a commercial vehicle with a fifteen-year service life.
Put plainly: a consumer part can go out of production while our truck is still under warranty. That means no service spares — or a board redesign. And a redesign means re-certification.
The first three ask how good the chip is. The fourth asks what happens to people when it fails.
Reliability. Reduces the probability of failure. Tests the part itself — ageing, temperature, vibration, electrostatic discharge.
Functional safety. Manages the consequence of failure. Tests the whole system — is there a second channel that notices, and can the system reach a safe state?
ASIL is not a quality ranking. It is computed from the hazard. ISO 26262 scores three dimensions:
S has three usable values, E has four, C has three. That is 36 combinations — not an unlimited number. And those 36 map onto only five outcomes, because the ISO 26262 table behaves like simple addition: score S, E and C as 1, 2, 3 (E up to 4), add them, and read off the level.
Out of 36 combinations, exactly one reaches ASIL-D: S3 × E4 × C3. The most severe harm, in the most common driving situation, where the driver cannot recover. All three dimensions must be maxed out simultaneously. Half the table — 18 cells — needs no functional-safety process at all.
And there are only five levels because ASIL does not describe risk precisely — it decides how much work must be done. Each level carries a full set of development requirements: coverage targets, verification methods, process independence, lockstep hardware. With 36 levels the standard would be unusable. It is a deliberately coarse ruler.
What separates ASIL-B from ASIL-D:
| Metric | ASIL-B | ASIL-D |
|---|---|---|
| Single-point fault metric | ≥ 90 % | ≥ 99 % |
| Latent fault metric | ≥ 60 % | ≥ 90 % |
| Random hardware failure rate | < 10⁻⁷ / hour | < 10⁻⁸ / hourTen times stricter |
| Hardware architecture | Single core with watchdog is usually enough | Lockstep cores typically required |
| Process independence | Relaxed | Independent review, audit and assessment |
What is a lockstep core? Two CPU cores execute the same code in step while hardware compares their outputs in real time. Any mismatch raises an immediate fault. It is the most effective way to catch random hardware faults — which is why high ASIL rarely goes without it.
Reaching ASIL-D without lockstep means compensating with extensive software self-tests and redundant computation: expensive, and difficult to argue in front of a technical service.
The examples below are illustrative, not normative. ASIL is a property of a specific hazard, not of a component type — the same function can land in a different cell under a different manufacturer's hazard analysis.
ASIL-D — one combination
| S × E × C | Sum | Typical functions |
|---|---|---|
| S3 × E4 × C3 | 10 | Electric power steering failure · ESC / EBS unintended braking · Airbag inadvertent deployment · Unintended full acceleration (torque safety monitoring) · AEB unintended braking · Steer-by-wire and brake-by-wireFatal harm, in the most common driving situation, with no way for the driver to recover. |
ASIL-C — three combinations
| S × E × C | Sum | Typical functions |
|---|---|---|
| S2 × E4 × C3 | 9 | Abrupt change in steering assist during normal driving (degraded, not lost) |
| S3 × E3 × C3 | 9 | High-voltage battery fails to disconnect after a crash · loss of HV insulation |
| S3 × E4 × C2 | 9 | Partial loss of braking force during normal driving (other circuits still available) |
ASIL-C is rare in practice — most teams either design straight to D, or use ASIL decomposition.
ASIL-B — six combinations
| S × E × C | Sum | Typical functions |
|---|---|---|
| S1 × E4 × C3 | 8 | Tail and marker lamp failure — constant exposure, and the driver cannot see their own rear lights |
| S2 × E3 × C3 | 8 | Total headlamp failure — no illumination at night |
| S2 × E4 × C2 | 8 | Brake lamp failure — the vehicle behind does not know you are braking |
| S3 × E2 × C3 | 8 | Missing high-voltage insulation monitoring — electrocution risk a person cannot perceive |
| S3 × E3 × C2 | 8 | Unintended acceleration from cruise control or ACC |
| S3 × E4 × C1 | 8 | Loss of propulsion during normal driving — the vehicle can still coast to the shoulder |
Also typically ASIL-B: instrument cluster speed display, tyre pressure monitoring, and the perception layer of radar and camera systems.
ASIL-A — eight combinations
| S × E × C | Sum | Typical functions |
|---|---|---|
| S1 × E3 × C3 | 7 | Reversing camera blanks out — low-speed collision while manoeuvring |
| S1 × E4 × C2 | 7 | Interior lighting stuck on, degrading night vision |
| S2 × E2 × C3 | 7 | Total wiper failure in rain — loss of forward visibility |
| S2 × E3 × C2 | 7 | Single headlamp failure |
| S2 × E4 × C1 | 7 | Speedometer reading error — the driver can still judge speed from traffic and gear |
| S3 × E1 × C3 | 7 | Loss of thermal-runaway warning in a rare operating condition |
| S3 × E2 × C2 | 7 | Trailer brake coordination anomaly in specific conditions |
| S3 × E3 × C1 | 7 | Loss of propulsion at moderate exposure — the vehicle can pull over |
QM — eighteen combinations
| Severity | Combinations | Typical functions |
|---|---|---|
| S1 · nine cells | E1C1 · E1C2 · E1C3 E2C1 · E2C2 · E2C3 E3C1 · E3C2 · E4C1 | Cargo bay lighting, seat heating, reading lamps, window pinch, sunroof blind, HVAC blower, mirror heating, cluster brightness.The infotainment head unit, navigation, Bluetooth, wireless charging and ambient lighting all sit in this band. |
| S2 · six cells | E1C1 · E1C2 · E1C3 E2C1 · E2C2 · E3C1 | Seat adjustment runaway in rare conditions, trailer lighting anomalies, low-speed wiper failure (high speed still available), park-brake hill assist anomaly, tyre pressure warning not raised |
| S3 · three cells | E1C1 · E1C2 · E2C1 | Fatal-severity hazards in rare conditions that the driver can fully control; propulsion anomalies at low exposure that braking can contain |
Three patterns worth internalising.
Controllability is the strongest lever. Speedometer error at S2 × E4 × C1 is ASIL-A; brake lamp failure at S2 × E4 × C2 is ASIL-B. Identical severity, identical exposure — the whole difference is whether the driver can notice and compensate.
Severity alone decides nothing. S3 appears in QM (three cells), A (three), B (three), C (two) and D (one) — it spans every level. Fatal does not mean high ASIL.
Only a full sweep reaches D. S3 × E4 × C3 is the single cell. That is why there are so few ASIL-D items on a vehicle: steering, braking, airbag, torque safety monitoring — and little else.
Applied to automatic emergency braking, the asymmetry is the whole argument.
Unintended braking — braking when it should not — lands on S3 × E4 × C3. That is ASIL-D, the single cell.
Failure to brake — not braking when it should — lands around S3 × E3–E4 × C1, which is ASIL-A or B. The baseline is a truck without AEB: the driver was always expected to brake.
Every ASIL-D requirement in an AEB system exists to prevent braking that should not happen — not to guarantee braking that should.
Any combination is possible. Knowing one of the four tells you nothing about the others.
| Chip | Temperature | Reliability | Functional safety | Fit for an AEB braking decision? |
|---|---|---|---|---|
| Consumer SoC | 0 to 70 °C | No AEC-Q100 | No ASIL | No |
| Industrial SoC | −40 to 85 °C | No AEC-Q100 | No ASIL | NoTemperature only; nothing else |
| Automotive-qualified SoC | −40 to 105 °C | Grade 2 | May still carry none | Perception onlyNot the safety decision |
| Safety MCU, ASIL-B | −40 to 125 °C | Grade 1 | ASIL-B, no lockstep | Needs further argument |
| Safety MCU, ASIL-D | −40 to 125 °C | Grade 1 | ASIL-D, lockstep cores | Yes |
The third row is the trap. "We use the automotive-qualified version" sounds reassuring, but that sentence answers temperature and reliability only. It says nothing at all about functional safety.
Which AEC-Q100 grade? Ask for the certificate itself, showing the exact part number and grade.
Is there an AEC-Q100 certificate? "Designed to automotive standards" and "qualified to them" are different claims.
Which ASIL? Lockstep or not? Demand a product-level certificate — a process certificate does not count.
How many years of supply are committed? Is there PCN and EOL discipline behind it?
Three common claims, and what they actually mean: