What is ISO 26262?
ISO 26262 is the international standard for functional safety of electrical and electronic (E/E) systems in series-production road vehicles, which uses a risk-based safety lifecycle and four Automotive Safety Integrity Levels (ASIL A to D) to define how rigorously a function must be developed and verified. Published by ISO, it is a sector-specific adaptation of IEC 61508, tailored to the mass production, short development cycles and supply chain of the automotive industry. ISO 26262 protects against hazards caused by malfunctions in braking, steering, airbags or propulsion, from the first concept through production, service and decommissioning.
The standard describes how manufacturers and suppliers demonstrate that vehicle electronics do not create an unacceptable risk to occupants and other road users when something fails.
🧠 Which editions and parts does ISO 26262 have?
The first edition was published on 11 November 2011 and applied only to passenger cars with a maximum gross mass of 3,500 kg. The second edition of December 2018 extended the scope to all series-production road vehicles, including trucks, buses, trailers and motorcycles; mopeds are excluded. Unique E/E systems in special vehicles, such as adaptations for drivers with disabilities, are not addressed. A third edition is in development, with publication expected in 2027 at the earliest.
The 2018 edition consists of twelve parts:
| Part | Topic |
|---|---|
| Part 1 | Vocabulary |
| Part 2 | Management of functional safety, including safety culture and confirmation measures |
| Part 3 | Concept phase: item definition, HARA and functional safety concept |
| Part 4 | Product development at the system level |
| Part 5 | Product development at the hardware level, including the hardware metrics |
| Part 6 | Product development at the software level |
| Part 7 | Production, operation, service and decommissioning |
| Part 8 | Supporting processes, such as configuration management and tool qualification |
| Part 9 | ASIL-oriented and safety-oriented analyses, including ASIL decomposition |
| Part 10 | Guidelines on ISO 26262 (informative) |
| Part 11 | Guidelines on application to semiconductors (informative) |
| Part 12 | Adaptation for motorcycles |
Parts 4 to 6 together follow the familiar V-model: requirements are refined top-down and then integrated and tested step by step on the right-hand side of the V.
🎯 What is the purpose of the standard?
ISO 26262 addresses two kinds of faults:
- Random hardware faults - a capacitor that breaks down or a sensor that fails. You control these with diagnostics, redundancy and quantitative failure-rate targets.
- Systematic faults - design and software errors that are present from the start. You control these through process: requirements management, reviews, coding rules, verification and traceability.
The standard also requires a safety culture, a safety plan per project and a safety case: the structured argument and evidence that the safety goals have been achieved. It explicitly does not cover hazards from a correctly working function that falls short in an unforeseen situation; that is the domain of ISO 21448 (SOTIF).
🔧 How is the ASIL determined?
ASIL (Automotive Safety Integrity Level) expresses how rigorously a safety goal must be implemented. The ASIL results from the hazard analysis and risk assessment (HARA) in Part 3, a form of risk assessment. For each hazardous event the team rates three parameters:
| Parameter | Classes | Meaning |
|---|---|---|
| Severity (S) | S0–S3 | Severity of injury, from no injuries (S0) to life-threatening or fatal (S3) |
| Exposure (E) | E0–E4 | How often the driving situation occurs; E4 is roughly more than 10% of operating time |
| Controllability (C) | C0–C3 | Whether the driver can avoid the harm; with C1, 99% or more of drivers can, with C3 fewer than 90% |
The combination S3, E4 and C3 yields ASIL D, the highest level. Each step down in any of the three parameters lowers the ASIL by one level, through C, B and A down to QM (quality managed), where ordinary quality management is sufficient. An ASIL is therefore not a measure of severity alone but of the combined risk. Typical outcomes, which may differ per vehicle and HARA:
| Function | Typical ASIL |
|---|---|
| Loss of braking on all wheels, airbag deployment, unintended steering | ASIL D |
| Loss of rear-wheel braking only, cruise control | ASIL C |
| Headlights and brake lights | ASIL B |
| Tail lights | ASIL A |
| Infotainment without influence on driving functions | QM |
The ASIL resembles the Safety Integrity Level of IEC 61508, but the two scales are not directly interchangeable.
📊 Which requirements come with a higher ASIL?
The higher the ASIL, the more methods the standard recommends or highly recommends and the stricter the hardware targets. Part 5 gives target values for three metrics:
| Metric | ASIL B | ASIL C | ASIL D |
|---|---|---|---|
| Single Point Fault Metric (SPFM) | ≥ 90% | ≥ 97% | ≥ 99% |
| Latent Fault Metric (LFM) | ≥ 60% | ≥ 80% | ≥ 90% |
| PMHF (probability of violating the safety goal) | < 100 FIT (10⁻⁷/h) | < 100 FIT (10⁻⁷/h) | < 10 FIT (10⁻⁸/h) |
One FIT is one failure per billion operating hours. For software, Part 6 calls for measures such as a safe language subset (for example MISRA C), static analysis, unit testing with structural coverage, and freedom from interference between software components. A certified RTOS helps, but it does not relieve the manufacturer of providing evidence for the complete application.
ASIL decomposition (Part 9) allows a requirement to be split across two sufficiently independent, redundant elements. ASIL D can thus be implemented as C(D) plus A(D) or as B(D) plus B(D), and ASIL B as A(B) plus A(B). This is only allowed if no common cause can disable both elements at the same time.
🏭 How do you apply ISO 26262 in practice?
A typical project for a new function or electronic control unit (ECU) runs as follows:
- Item definition - describe the function, its boundaries and its interfaces with the rest of the vehicle.
- HARA - identify hazardous events, rate S, E and C, and derive safety goals with an ASIL.
- Functional and technical safety concept - turn safety goals into requirements, for example a safe state, diagnostics and fault-tolerant time intervals.
- Analyses - support the design with FMEA, fault tree analysis (FTA) and an FMEDA for the hardware metrics.
- Development and verification - design, code and test according to the tables in Parts 5 and 6, with full traceability.
- Tool qualification - determine the Tool Confidence Level (TCL1–TCL3) of each development tool and qualify it where needed; tools themselves do not get an ASIL.
- Confirmation measures - confirmation reviews, a functional safety audit and a functional safety assessment, with more independence required at higher ASILs.
Suppliers often develop chips and software components as a Safety Element out of Context (SEooC): based on assumed requirements, so the vehicle manufacturer can later integrate them into its own safety concept.
Dutch and European context. ISO 26262 is not a law. Vehicle type approval, carried out in the Netherlands by the RDW, relies on UN regulations such as UNECE R155 (cybersecurity) and R156 (software updates), which have been mandatory in the EU for new vehicle types since July 2022 and for all new vehicles since July 2024. In practice, however, ISO 26262 is treated as the state of the art in product liability cases, and vehicle manufacturers require it in their purchasing terms. As a result, ISO 26262 also affects Dutch companies in the supply chain, such as truck builders, semiconductor manufacturers and suppliers in the Brainport region.
🔄 How does ISO 26262 relate to other standards?
| Standard | Relation to ISO 26262 |
|---|---|
| IEC 61508 | Basic functional safety standard; ISO 26262 is its automotive derivative |
| ISO 21434 | ISO/SAE 21434 (2021) for automotive cybersecurity; complementary, because attacks can violate safety goals |
| ISO 21448 (SOTIF) | Safety of the intended functionality, for example limitations of cameras, radar and LiDAR |
| ISO/PAS 8800 | Safety of AI components in road vehicles |
| ISO 13849-1 | Machinery safety; different sector, using Performance Levels |
| IEC 62061 | Machinery safety using SIL, also derived from IEC 61508 |
| Automotive SPICE | Process maturity of software and system development; often audited in parallel |
For the IT/OT world the distinction matters. An AGV or AMR in a factory or warehouse does not fall under ISO 26262 but under machinery legislation, with ISO 3691-4, ISO 13849 and the Machinery Regulation. Industrial and automotive safety do meet in embedded hardware, though: many microcontrollers and operating systems are certified to both IEC 61508 and ISO 26262. Fieldbuses such as CAN are likewise part of safety concepts under ISO 26262 in cars. Type-approved vehicles are, incidentally, outside the scope of the Cyber Resilience Act, because the type-approval rules already cover their cybersecurity.
❓ Frequently asked questions
Is ISO 26262 legally mandatory?
ISO 26262 is not a legal requirement for vehicle type approval. It is, however, regarded as the state of the art in product liability, and vehicle manufacturers almost always require their suppliers to comply with ISO 26262 by contract.
What is the difference between ASIL and SIL?
ASIL comes from ISO 26262 and is determined from severity, exposure and the driver’s controllability. SIL comes from IEC 61508 and IEC 61511 and is linked to failure probabilities per hour or per demand. ASIL D and SIL 3 require comparable effort, but ISO 26262 defines no official conversion between the two scales.
Which vehicles are covered by ISO 26262?
Since the 2018 edition, ISO 26262 applies to all series-production road vehicles, including trucks, buses, trailers and motorcycles. Mopeds are excluded, and the standard does not address unique E/E systems in special vehicles, such as adaptations for drivers with disabilities.
What does ASIL B(D) mean?
The notation ASIL B(D) means that an element was developed to ASIL B after ASIL decomposition, but belongs to a safety goal rated ASIL D. Together with an independent second element, it must still achieve the original ASIL D goal of ISO 26262.
Can a company be ISO 26262 certified?
ISO 26262 has no formal accredited certification scheme like ISO 9001. Bodies such as TÜV SÜD, TÜV Rheinland and exida do issue certificates for processes, products and people, and these are widely accepted across the automotive supply chain.
How does ISO 26262 relate to cybersecurity?
ISO 26262 deals with unintended faults, whereas ISO/SAE 21434 deals with deliberate attacks. The two standards have to work together because a cyberattack can violate a safety goal, which is why teams align the HARA with the threat analysis and risk assessment (TARA).
📌 In summary
ISO 26262 is the standard for functional safety of E/E systems in road vehicles: through the ASIL it determines how rigorously a function must be developed, from concept to decommissioning.
The standard combines a risk analysis based on severity, exposure and controllability with concrete hardware targets, software rules and confirmation measures. Anyone developing embedded systems for both the automotive and industrial markets often works with ISO 26262 and IEC 61508 side by side, complemented by ISO 21434 for cybersecurity and safety standards from machine building.