Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
ISO 26262 hardware-element classes are not ASIL ratings. ISO 26262-8:2018 Clause 13 uses Class I, Class II, and Class III to help engineers evaluate existing or commercial-off-the-shelf hardware elements according to their complexity, analyzability, internal safety mechanisms, documentation, and dependence on implementation or development-process evidence.
In practice, Class I elements are usually simple and fully characterizable; Class II elements require a documented evaluation supported by analysis and testing; and Class III elements generally need substantially stronger supplier evidence, such as a safety manual, FMEDA data, architectural information, or SEooC documentation.
Why hardware-element classification matters
Automotive developers frequently integrate hardware that was not designed specifically for a particular vehicle item or safety concept. A resistor, power-management IC, sensor, FPGA, or microcontroller may come from an existing product family or commercial supply chain. The integrator must then establish whether the element can support the intended safety function and what additional controls are necessary.
Clause 13 of ISO 26262-8:2018 provides an evaluation approach for these existing hardware elements. It does not replace the normal hardware-development lifecycle. In particular, ISO 26262-5:2018 covers hardware safety requirements, hardware design, random-hardware-failure analysis, hardware architectural metrics, and hardware integration and verification.
#1 Best Overall
ISO lists ISO 26262-5:2018 as published and under revision as of August 16, 2026. The edition used for a project should therefore be stated explicitly.
What is a hardware element?
“Hardware element” is deliberately broad. ISO 26262 terminology can refer to an element at several levels of decomposition:
- Item: The vehicle-level function or combination of systems to which ISO 26262 is applied.
- System: A set of components that work together, such as a sensor, controller, and actuator.
- Component: A logically or technically separable non-system-level element containing hardware parts and/or software units.
- Hardware part: A portion of a hardware component at the first decomposition level.
- Hardware subpart: A logically separable lower-level portion of a hardware part.
- Hardware elementary subpart: The smallest hardware portion considered in a safety analysis.
Consequently, classification must be applied to the specific evaluated element and its intended safety role—not simply to a marketing category such as “sensor,” “power IC,” or “automotive MCU.”
The three classes at a glance
| Criterion | Class I | Class II | Class III |
|---|---|---|---|
| States and modes | Few and fully characterized | Limited modes or parameter ranges | Many or difficult-to-characterize modes |
| Implementation knowledge | Not needed | Usually not needed | Often necessary |
| Process evidence | Generally unnecessary for evaluation | May be limited | Often required |
| Internal safety mechanisms | None relevant | None relevant, or not relied upon | Relevant and relied upon |
| Typical examples | Resistor, capacitor, diode | Bounded analog or interface device | MCU, FPGA, complex ASIC, sophisticated PMIC |
The key question is not merely how complicated a product looks from outside. It is whether its safety-relevant behavior can be justified using the information available to the evaluator.
Class I: simple, fully characterizable elements
A Class I element generally has:
- Only a few states or behaviors that can be fully characterized, tested, and analyzed.
- Safety-related failure modes that can be identified without access to implementation details or production-process information.
- No internal safety mechanisms relevant to the safety concept.
Typical examples include resistors, capacitors, diodes, transistors, quartz devices, and resonators. A simple passive or discrete power element may also fit, if its actual construction and application justify that conclusion. These examples are consistent with the Clause 13 framework and explanatory material from Infineon.
Class I does not mean “ignore the part.” The analysis may still need to consider open circuit, short circuit, drift, tolerance, overstress, temperature, aging, derating, and common-cause dependencies. A resistor with an unsuitable power rating can fail dangerously even though the component itself is simple.
Nor does Class I mean that the surrounding system is exempt from ISO 26262 work. It only indicates that the element can generally be evaluated without a complex element-level development argument.
Class II: moderately complex elements
Class II is the intermediate category. The element usually has a limited number of operating modes, a bounded parameter range, or a small set of relevant behaviors. Its safety analysis can generally be performed without detailed implementation knowledge, provided that supplier documentation supports reasonable assumptions about systematic faults.
A relatively bounded analog device, simple regulator, or limited-function interface device might be Class II, but the product label does not decide the classification. Internal architecture, programmability, diagnostics, documentation, and intended safety role all matter.
Class II evaluation normally requires a documented evaluation plan and argument. Analysis and testing should demonstrate that the device performs according to its specification and that relevant systematic-fault concerns have been addressed. If the device includes internal diagnostics, the important question is whether those diagnostics are relevant to—or relied upon by—the safety concept. Texas Instruments highlights this distinction.
Available evidence may include the datasheet, application information, operating limits, failure-mode information, qualification data, errata, and supplier responses to safety questions. Missing evidence can make a theoretically Class II device difficult to justify in a particular safety case.
Class III: complex or implementation-dependent elements
Class III elements have safety-relevant behavior that cannot be adequately evaluated from external specifications alone. Typical characteristics include:
Rank #3
- Many operating modes or complex internal behavior.
- Programmable behavior or substantial configuration dependence.
- Internal safety mechanisms that the safety concept relies upon.
- Systematic-fault analysis requiring implementation or development-process information.
- Safety behavior that depends on software, boot configuration, tools, or detailed architectural assumptions.
Microcontrollers, microprocessors, FPGAs, complex ASICs, programmable logic, complex analog signal-chain devices, safety-oriented power-management devices, and integrated sensors with embedded processing are common Class III candidates. They are not universally Class III: the specific device, boundary, documentation, and safety role must be assessed.
Evidence for a Class III element may include a product safety manual, architectural descriptions, FMEDA data, diagnostic assumptions, development-process claims, qualification or assessment reports, errata, configuration restrictions, and SEooC documentation. The supplier may need to explain watchdog behavior, ECC, lockstep operation, clock monitoring, voltage monitoring, built-in self-test, fault signaling, reset behavior, and diagnostic reaction times.
Class, ASIL, and SEooC are different concepts
Hardware-element class describes how an element can be evaluated. ASIL describes the integrity level of a safety requirement derived from hazard analysis and risk assessment. ISO explains ASIL determination using severity, exposure, and controllability; see the ISO overview.
Therefore:
- A Class III element may be used in an ASIL-B, ASIL-C, or ASIL-D architecture.
- A simple Class I resistor can participate in an ASIL-D safety path.
- An MCU advertised as “ASIL-D capable” does not make an ECU or vehicle function ASIL-D compliant.
- Prefer wording such as “developed as an ASIL-D SEooC” or “contains safety mechanisms supporting an ASIL-D application,” subject to integration assumptions.
A Safety Element out of Context (SEooC) is developed without the complete context of a specific vehicle item. The supplier defines assumptions of use, safety requirements, analyses, safety mechanisms, and integration constraints. Microchip discusses the terminology, while the ISO 26262-10 example is available in this public copy.
SEooC documentation helps, but it does not eliminate the integrator’s responsibility. The customer must verify assumptions, interfaces, timing, diagnostics, dependent failures, configuration, and vehicle-level safety goals.
A practical classification and integration workflow
- Define the safety role. Decide whether the element implements a safety function, monitors one, controls a safe-state transition, or is merely supporting a non-safety function.
- Identify allocated requirements. Record the ASIL, safety mechanisms, timing, diagnostics, and fault-reaction requirements allocated to the element.
- Set the boundary. Include the relevant device, external memory, clock, reset, power, transceiver, PCB, or monitor dependencies rather than analyzing an artificially isolated part.
- Assess the three class criteria. Review states, modes, analyzability, programmability, internal mechanisms, documentation, implementation transparency, and process dependence.
- Collect supplier evidence. Request safety manuals, assumptions, errata, FMEDA information, diagnostic restrictions, qualification material, and SEooC evidence where applicable.
- Document the evaluation plan and argument. State what is characterized, what remains unknown, how uncertainty is controlled, and why the element is suitable for its role.
- Analyze random hardware failures. Address single-point, residual, latent, dependent, and common-cause failures.
- Check architectural metrics. Assess the element’s contribution to SPFM, LFM, and PMHF at the correct architectural boundary.
- Verify integration assumptions. Check voltage, clock, reset, startup, software configuration, communication timing, environmental conditions, and external diagnostics.
- Control residual constraints. Carry assumptions into the safety case, interface requirements, integration specification, verification plan, and change-control process.
What evidence should a buyer request?
For a safety-relevant device, ask the supplier for the following, as applicable:
- Product safety manual, revision, and applicability.
- Intended use and assumptions of use.
- Assumed ASIL or target application.
- Safety requirements and safety mechanisms.
- FMEDA or failure-rate data.
- SPFM, LFM, and PMHF contributions or constraints.
- Diagnostic coverage assumptions and test intervals.
- Safe-state behavior.
- Startup, shutdown, reset, watchdog, clock, memory, and communication behavior.
- Configuration restrictions, fuse settings, registers, boot requirements, and software dependencies.
- Safety-relevant errata and silicon-revision restrictions.
- Lifetime, temperature, voltage, environmental, and derating limits.
- Production-change notification policy.
- Qualification or independent assessment reports.
- Tool-chain and software dependencies for programmable devices.
- Required external monitoring, redundancy, and independence assumptions.
Not every supplier publishes all of this information. Safety collateral may be supplied under a safety agreement or NDA. Treat a datasheet or marketing page as product information, not as a complete safety argument.
Free tools Windows power users keep installed
One-click scans. No signup required.
Internal safety mechanisms: benefit and dependency
Internal watchdogs, ECC, lockstep cores, clock monitors, voltage monitors, built-in self-test, and diagnostic controllers can improve fault detection. They also create obligations. The integrator must understand what faults each mechanism detects, its diagnostic coverage, test interval, reaction time, reporting path, activation state, and independence from the monitored function.
A safety feature present in silicon is not automatically a safety mechanism accepted by the safety case. It may be disabled, configured incorrectly, unable to detect the relevant fault, or dependent on the same power, clock, logic, or software as the function it monitors. Additional diagnostics can therefore introduce dependencies and common-cause concerns rather than providing a free safety improvement.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.SPFM, LFM, and PMHF
The principal hardware architectural metrics for random hardware failures are:
- SPFM: Single-Point Fault Metric, measuring protection against single-point and residual faults that could violate a safety goal.
- LFM: Latent Fault Metric, measuring coverage of latent faults that remain undetected until another fault occurs.
- PMHF: Probabilistic Metric for random Hardware Failures, expressing the probabilistic contribution of random hardware failures to safety-goal violations, commonly in failures in time (FIT).
| ASIL | SPFM | LFM | PMHF |
|---|---|---|---|
| B | ≥90% | ≥60% | ≤100 FIT |
| C | ≥97% | ≥80% | ≤100 FIT |
| D | ≥99% | ≥90% | ≤10 FIT |
These commonly cited values should be interpreted with the applicable ISO 26262 clauses, ASIL, fault model, scope, failure-rate assumptions, and allocation method. ASIL A has no equivalent mandatory target in the commonly presented table. Sources include ISO 26262 Academy and Arm.
Recommended Free Tools
A supplier’s metric claim is not automatically the system result. Metrics do not prove freedom from interference, correct safety behavior, absence of dependent failures, or absence of systematic faults. Design errors, incorrect requirements, configuration mistakes, and inadequate verification require separate treatment.
Best Value
Worked examples
Example 1: Resistor in a monitored sensor input
The resistor is likely Class I if its relevant states and failure modes are fully characterized. Analyze open circuit, short circuit, drift, tolerance, overstress, temperature, and aging. Also analyze the surrounding pull-up or pull-down, ADC reference, input protection, diagnostic thresholds, and shared supply. The resistor does not receive an ASIL independently; its contribution is evaluated within the safety function.
Example 2: Power-management IC
A power-management IC may be Class II or Class III. The result depends on internal state complexity, programmability, diagnostics, and whether internal safety mechanisms are relied upon. Request evidence covering undervoltage, overvoltage, thermal shutdown, watchdog, reset, diagnostic output, fault latching, and failure-rate assumptions. Verify that the external controller can detect a stuck diagnostic signal and that shared supplies do not defeat independence.
Example 3: MCU controlling a safety actuator
An MCU in this role is usually a Class III candidate because it executes software, has multiple operating modes, contains complex internal mechanisms, and depends on development-process evidence. Establish whether it is being integrated as an existing COTS element, a qualified element, or a SEooC. Validate safety-manual assumptions, configuration limits, diagnostic architecture, boot behavior, software dependencies, tool-chain constraints, and dependent failures.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Common mistakes
- Misclassification: Treating a programmable device as simple because its external function appears narrow.
- Marketing substitution: Treating “ASIL-ready,” “ASIL-capable,” or “functional-safety product” as project-level compliance evidence.
- Incomplete boundary: Omitting clocks, power, reset, external memory, communication, or PCB dependencies.
- Hidden configuration dependence: Overlooking fuse settings, registers, boot code, compiler options, or diagnostic enablement.
- Misunderstood diagnostics: Crediting a watchdog, ECC, or monitor without verifying activation, coverage, timing, reporting, and independence.
- Double-counted coverage: Crediting the same diagnostic at multiple architectural levels.
- Supplier mismatch: Applying a safety manual outside its stated operating mode, temperature, clock architecture, diagnostic interval, software stack, or ASIL allocation.
- Uncontrolled changes: Ignoring safety-manual revisions, errata, silicon revisions, software revisions, or production-change notifications.
- Random-fault tunnel vision: Calculating SPFM, LFM, or PMHF while neglecting systematic faults.
- Scope confusion: Treating ISO 26262 as a replacement for cybersecurity, SOTIF, EMC, electrical-safety, reliability, or other applicable disciplines.
Final decision tree
- Does the element contribute to a safety goal or safety mechanism?
- Can all relevant states and failure modes be characterized without implementation details?
- Does it contain internal safety mechanisms relevant to the safety concept?
- Can systematic faults be evaluated from the available documentation?
- Is significant programmable or highly complex behavior involved?
- Is supplier evidence sufficient for the intended use?
- Is ordinary evaluation enough, or are qualification or SEooC-style development and evidence required?
- Which external diagnostics, redundancy, environmental limits, and configuration constraints must enter the safety case?
If the answers point toward hidden behavior, relied-upon internal diagnostics, or process-dependent systematic-fault evidence, Class III treatment is generally the more defensible starting point. If the element is simple and completely characterizable, Class I may be appropriate. Class II applies when the behavior is bounded but still requires a documented evaluation supported by evidence.
For authoritative project decisions, use the purchased ISO 26262 edition as the controlling source; publicly available copies and vendor explanations are useful aids but do not replace the standard.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
