Author: admin

The relationship between functional safety (FuSa) and the safety of the intended functionality (SOTIF) can be understood as two sides of the same coin: The two together result in one valuable whole. Both sides play a decisive role in modern driver assistance systems, or ADAS (advanced driver assistance systems) for short, as well as in autonomous driving (AD). FuSa addresses the classic question: What happens if a software or hardware component fails?

The idea of functional safety ensures that the system does not cause an unacceptable risk if internal malfunctions arise, such as a sensor failure or a software error. This is based on a process of structured analysis in which all relevant software and hardware errors are examined and evaluated for their effects. Effects rated as safety-critical are mitigated by technical and procedural measures. The functional safety methods are applied consistently, this being both during the concept phase and in the series implementation phase. SOTIF, the safety of the intended functionality, addresses another, equally important question: What happens if the system operates without failures but fails to master a real operating situation? This concerns the acceptability of risks that arise from the limitations of the function itself, for example when a vehicle camera is blinded by the sun or an algorithm does not detect a cyclist in a complex driving scene. 

SOTIF is an exploratory discovery process in which iterations are the central tool for gradual improvement of the function design and knowledge generation. In order to achieve the overall safety of the system, FuSa and SOTIF are systemically interconnected and complement each other.

“FuSa ensures that hardware and software work reliably. SOTIF ensures that the capabilities of these reliable components are sufficiently specified and proven to operate safely in the real world,” explains Marek Hudec, Senior Manager of System Safety at Porsche Engineering. “This is because a system can be safe from the traditional FuSa standpoint, but still not safe enough from a SOTIF standpoint due to performance limitations.”

Iterative approach for SOTIF

Despite the similarity, there are differences in the process steps between FuSa and SOTIF, because an iterative approach with exploratory analysis and test methods is generally preferred to achieve SOTIF (see box on page 38). “What that means is that the developers specify, test and revise the system design until an acceptable residual risk is reached,” reports Dennis Müller, Development Engineer at Porsche Engineering. Porsche Engineering offers its customers a comprehensive solution portfolio that includes both safety methods—SOTIF and FuSa—to manage the complex development and verify and validate of driver assistance systems and autonomous driving functions.

“Among other services, we support our customers in applying the relevant standards such as ISO 26262 (FuSa) and ISO 21448 (SOTIF). This includes their implementation in existing development processes, execution of the hazard and risk analyses, drawing up safety concepts, and supporting the entire safety lifecycle,” explains Müller. “At Porsche Engineering, we ensure safety-conformated development in accordance with FuSa and SOTIF through clearly defined, integrated processes with clearly dedicated responsibilities. This guarantees conformity to standards and provides traceability.“

Porsche Engineering has many years of expertise throughout the entire development chain: From drawing up requirements to simulating and testing real vehicles, Porsche Engineering uses state-of-the-art simulation and test methods, including ones for developing warning functions, parking systems, and (partially) autonomous driving functions. As an example, one out of many results of this expertise is the modular software component called “Guardian”. It is designed to facilitate the transition from advanced Level 2 systems to highly automated Level 3 driving. It offers a robust, safe, and standard-conforming solution for the implementation of safety components for autonomous driving systems. By analyzing real driving data, potentially critical situations and special cases—referred to as corner cases and edge cases— are identified exploratively and used for data-driven scenario generation. As the responsibility of the system increases, the challenges the system is facing also become bigger. As far as functional safety is concerned, these challenges primarily consist of the fact that degradation and warning concepts can no longer rely solely on the driver, who bears sole responsibility for all vehicle maneuvers during assisted driving (Level 1) and semi-automated driving (Level 2).

This will change from Level 3 on: In this case, the systems must be able to handle failures autonomously, as the driver will no longer have a constant duty of attention. Only if the systems reach their limits must it be possible to intervene after an appropriate warning period. In principle, therefore, safe operability must continue to be guaranteed when failures occur, at least for a certain period of time – this makes the leap from Level 2 to Level 3 challenging. As a side effect, the number of redundancies in vehicle electronics is increasing rapidly—and so are the associated development workload and costs. With regard to SOTIF, the challenge lies in the depth and breadth of the set of all possible operating scenarios that the function needs to be able to master.

“These include the continuously changing vehicle environment, the behavior of road users, and unforeseeable events, which are referred to as unknown unsafe scenarios,” says Hudec. To deal with this complexity, systems are initially designed for a defined operational design domain (ODD). The scenarios to be safely mastered are thus restricted to a systematically derived space, which is divided into discrete individual scenarios by means of a scenario portfolio. The system must ensure that the approach to the boundary of this space is detected at an early stage so that either control can be handed over to the driver or the vehicle can be stopped safely within the boundaries of the ODD. “This approach is extremely important for driver assistance development: The more responsibility a system assumes for the actual driving, the more critical it becomes to consider the safety aspects of FuSa and SOTIF,” explains Müller.

Improved safety due to redundancy

One example from practice that illustrates the different but complementary approaches of FuSa and SOTIF is an SAE Level 3 situation for automated driving on the highway in which the driver completely relinquishes responsibility. When it comes to managing hardware or software failures, FuSa is required: Suppose that the radar sensor that measures the distance to the vehicle in front has a hardware defect and is no longer providing data. This example of a fault could lead to the function relying on outdated or invalid sensor data and possibly risking a rear-end collision. That is why the experts at Porsche Engineering use deductive and inductive safety analyses to identify such failures; the analyses must be verified by safety mechanisms. In this specific case, for example, redundancy would be useful to prevent this local individual failure from leading to “global unavailability” of the sensor data, at least until the point in time when the driver again takes responsibility for driving.

SOTIF comes into play when it is a matter of mastering performance limits for automated driving on the highway. For example, vehicle detection must be designed in such a way that all other vehicles around or approaching the vehicle, including all motorcycles, are detected. However, due to the general, technically inherent performance limits of the sensors used, the vehicle may not correctly detect certain narrow silhouettes and approach trajectories under unfavorable light or weather conditions. Although the hardware and software are working flawlessly, this could cause the function to initiate a lane change that could result in a collision risk with an overtaking motorcycle. In this case, the SOTIF processes stipulate that the design must be analyzed and validated across all operating scenarios and that the weaknesses identified are corrected with the next design iteration (specification update followed by implementation update). For example, additional cameras and lidar sensors could be installed in the rear section or the sensor fusion algorithms could be optimized.

“The biggest challenge is no longer just in the system itself, but in the almost infinite complexity of reality. It is not possible to test every conceivable scenario in advance, but it is necessary to achieve sufficient coverage of the range of operation. The development process is just as complex as one would expect. SOTIF provides the framework for understanding the limits of the system and designing them safely even when all system components are functioning perfectly,” Müller explains.

Providing qualitative and quantitative evidence that a system is safe requires large amounts of test data, a considerable amount of which is generated through simulations. The biggest challenge is dealing with unknown unsafe scenarios—dangerous situations that were not taken into account during development due to insufficient specifications or that could occur due to changes in operating conditions. To discover and minimize these is the core objective of SOTIF and represents a great challenge when developing the systems. “At Porsche Engineering, we offer our customers not only individual test services, but also close and long-term cooperation to meet the enormous demands placed on ADAS/AD development and to put safe, robust, and reliable functions on the road,” promises Hudec.

Methods such as AI-based recognition of corner cases or specially trained AI models will increasingly provide developers with support for this in the future. It is already clear today the use of AI in safety-critical systems will require even more complex verification procedures in the future. This topic is addressed by the new international standard draft ISO/PAS 880, which deals with the safety of AI when it is part of the end product. Another innovation is the international draft standard ISO/TS 5083, which focuses specifically on the topic of safety of autonomous driving functions of the vehicle and takes into account not only the vehicle on-board components, but considers also the off- board components and its effect on the overall safety. This is referred to as holistic safety. The safety-oriented V2X communication between vehicles and with the infrastructure not only brings with it new safety-enhancing possibilities, but also new potential sources of faults and new dependencies. These too must be safeguarded with the same consistency—a demanding process that the experts at Porsche Engineering devote themselves to on a daily basis.

Summary

The requirements placed on the functional safety of vehicles are significantly due to the widespread use of assistance systems. The performance of the correctly implemented system in corner cases is the main focus of SOTIF. Among other things, Porsche Engineering uses data-driven and AI-based methods to master complexity and thus bring reliable systems on the road.

Info

Text first published in Porsche Engineering Magazine, issue 1/2025.

Text: Ralf Bielefeldt

Copyright: All images, videos and audio files published in this article are subject to copyright. Reproduction in whole or in part is not permitted without the written consent of Dr. Ing. h.c. F. Porsche AG. Please contact magazin@porsche-engineering.de for further information.

With the upcoming Clean Corporate Vehicles proposal, the European Commission can further tap into this potential. Asking the corporate market to accelerate and lead Europe’s shift to electric is legitimate:

• In 23 out of 27 Member States, companies receive more benefits than private buyers for owning an EV. In Germany this goes up to €14.000 per car.

• Despite such benefits, in only 3 Member States companies are really driving the uptake of electric cars.

This means that the corporate market’s potential is far from exhausted: an EU-wide target (on Member States or companies) asking large corporations to electrify 75% of their new cars in 2030, with Made-in-EU requirements, could lead to an additional 1.2 million locally produced EVs by 2030.

1. Why the EC should ask companies to lead on electrification

The European Commission is preparing a legislative proposal on Clean Corporate Vehicles. This law is expected to set binding electrification targets on corporate cars – either on Member States or on large companies.

1.1. Companies benefit from tax breaks when owning an electric car

There are good reasons for the Commission to ask companies to lead Europe’s switch to electric: when companies buy or lease a car, they benefit from fiscal advantages that are not available to private buyers. Examples are VAT deductions, depreciation write-offs and Benefit-in-Kind.

In 23 out of 27 Member States, companies receive more benefits than private consumers when owning an electric car. T&E analysis shows that the average EU corporate tax relief for an EV buyer is €1,508 yearly. In Germany, where corporate EV tax benefits are among the highest, this goes up to €3,505 per year, or €14,020 over a typical ownership period of four years. Companies benefit from public money when owning an electric vehicle and should therefore drive the EU’s efforts in decarbonising road transport and boost demand for electric vehicles.

1.2. Only in three EU countries the corporate car market is clearly leading on electrification

Despite these fiscal benefits, companies are not clearly outpacing the private market in terms of electrification. This is partly due to the tax benefits that polluting company cars continue to receive. In only three EU countries the corporate market is significantly steering the adoption of BEVs (Belgium, Luxembourg, Netherlands). In large car markets such as Germany, France, Spain or Italy, their performance is underwhelming. Countries that have introduced structural fiscal reforms have a much higher corporate car electrification share. Since 2021, Belgium progressively phased out the fiscal deductibility for fossil fuel vehicles, creating a clear and growing incentive for BEV uptake. This has resulted in corporate BEV registrations of over 54% in the first half of 2025 (compared to 9% in the private market).

2. Electrifying corporate fleets brings more benefits for EU automotive industry

2.1. Companies buy more Made-in-EU EVs

Looking at the registration data of the first half year of 2025, companies tend to prefer purchasing more EVs that are made-in-EU than private households (73% against 63% for private buyers). Made-in-EU is defined as vehicles for which the final assembly line is located in the EU-27 (i.e. EVs of European brands that are produced in China and imported into the EU are not counted as Made-in-EU). Due to their high market share – 60% of new cars are corporate – and higher preference, there are 2.2 times more Made-in-EU electric cars registered by companies than private: 403,000 compared to 184,000 in just the first half of 2025.

2.2. What are the most popular EV models in the corporate and private market?

This trend is also reflected when zooming in on the most popular EV models for both the corporate and private segment: Made-in-EU EVs currently dominate the business segment, with 13 out of the 15 most popular models manufactured in the EU. For private buyers, these numbers are telling a different story: only 10 out of 15 top-selling models are EU made (see annex in full briefing attached on the left side of this page).

This gap becomes even more apparent when zooming in on the market share of the top 15 models that are not Made-in-EU (see figure below): for the corporate segment, the non Made-in-EU models (Tesla Model 3 and the Kia EV3), account for only 10% of the best-selling corporate EV sales in the first half of 2025. For the private segment, this is 32%.

3. How EU fleet targets can further boost demand for made-in-EU EVs

As T&E analysis confirms, companies currently have a higher preference for a Made-in-EU vehicle when purchasing an EV. Nevertheless, there is still a lot of untapped potential, as companies are currently not clearly leading on electrification (see Section 1). In order to assess the additional benefits of the forthcoming EU Clean Corporate Vehicles legislation on Made-in-EU EV production, we have analysed the impact of EU fleet targets on the demand for EVs produced in the EU under two scenarios.

• Business as usual: without any obligations on corporate vehicles and under today’s market conditions and CO₂ standards (Regulation 2019/631), we expect 13.1 million Made-in-EU electric vehicle sales between 2026 and 2030.

• Binding electrification targets on Member States (only affecting large companies): in this scenario, the European Commission proposes binding ZEV-purchasing targets on large companies (+250 employees) as part of the Clean Corporate Vehicles legislation: 50% of new large company registrations by 2028, and 75% by 2030 have to be zero emission vehicles, with a requirement that at least 90% of the targeted corporate cars must be Made-in-EU. These targets would increase the demand for additional made-in-EU electric cars by 1.2 million, bringing total production to 14.3 million vehicles. For illustration: the total production of the VW Wolfsburg plant in 2024 (all powertrain types) reached 521,000 units.

Being Europe’s largest manufacturing country, the benefits for electric car production in Germany are particularly big. Results for Germany can be found in the annex.

This potential increase is crucial for Europe. It proves the CCV initiative is essential for growing the European manufacturing scale and keeping our domestic EV supply chain competitive. It achieves this industrial boost without needing to raise the ambition of current CO₂ emission standards.

4. Policy recommendations

To fully unlock the potential of the corporate car market to drive both the clean transition and the competitiveness of European car manufacturers, the European Commission should:

• 1

  Propose a Regulation on Clean Corporate Vehicles: corporate fleets make up 60% of new cars and therefore have a lot of potential for both decarbonisation and European car manufacturing. Today, however, the corporate segment is not really leading on electrification in most Member States, despite existing tax benefits and incentives.

• 2

  Include ambitious, binding ZEV-targets: the Regulation must set ambitious, binding Zero-Emission Vehicle (ZEV) targets on Member States. When designing national policies, SMEs should be exempted from any requirements to obtain the targets. Instead, Member States should aim their measures at large companies (+250 employees) in order to tap into the industrial potential of corporate vehicles while limiting the impact on European businesses.

• 3

  Introduce local content requirements: this legislation should also include Made-in-EU requirements to further boost domestic EV production. By doing so, the Commission should clearly define what Made-in-EU EVs and batteries are and set up a transparent methodology rewarding Made-in-EU EVs, batteries, key components and materials.