The system fails
A resistor drifts, a bit flips in RAM, a task overruns its deadline. Classic malfunctioning behaviour of an E/E system — random hardware faults and systematic faults in hardware and software.
Covered by ISO 26262
Functional safety · SOTIF · Safe AI
Three standards.One safety argument.
We bridge ISO 26262, ISO 21448 (SOTIF) and ISO/PAS 8800 into a single, traceable safety case — so your automated driving function is not only engineered safely, but demonstrably approvable.
The problem
Compliance in silos leaves gaps.
Accidents live in those gaps.
Each of the three standards is complete on its own terms — and blind outside them. Treat them as three separate audits and you will pass all three while the residual risk sits in the seams between them.
The system doesn't fail — it just isn't good enough
Every component works exactly as specified, and the vehicle still behaves unsafely: low sun blinds the camera, radar loses a stationary object, the specification never anticipated the scenario. Functional insufficiency, not fault.
Covered by ISO 21448
The system learned the wrong thing
The insufficiency is not in the code — it is in the data and the model. Distributional shift, an unrepresentative training set, brittle generalisation, and a decision boundary nobody can inspect line by line.
Covered by ISO/PAS 8800
The seam is the risk. A perception stack can meet every ASIL D hardware architectural metric and still fail to classify a stationary vehicle at closing speed. ISO 26262 records a pass. SOTIF records a hazard. ISO/PAS 8800 explains why the model was always going to miss it. Only an argument that spans all three can close the case.
What we do
We bridge three standards into one safety argument
One hazard. Three families of cause. One safety case that traces every hazard through every applicable framework to evidence — and states the residual risk in language an assessor and an approval authority will accept.
Vehicle-level hazard
Identified once, in a single HARA — unwanted behaviour that can lead to harm
ISO 26262
Cause: malfunction
The item is faulted. Answered with ASIL classification, safety mechanisms, diagnostic coverage and hardware metrics.
ISO 21448 · SOTIF
Cause: insufficiency
The item is fault-free but not capable enough. Answered with triggering conditions, scenario coverage and acceptance criteria.
ISO/PAS 8800
Cause: the AI itself
The insufficiency originates in data, training or generalisation. Answered with an AI safety lifecycle and model-level evidence.
One integrated safety case
Traceable to approval under AFGBV, UNECE R157/R155 and the EU AI Act
Services
Three practices, deliberately not separate
Engage one where you have a specific gap, or all three where you need a complete argument. Either way the work product is designed to slot into the same safety case.
01 / Functional safety
ISO 26262
Item definition, HARA and ASIL determination, functional and technical safety concepts, hardware metrics, software safety requirements, confirmation measures and the safety case.
Explore ISO 26262
02 / Intended functionality
SOTIF — ISO 21448
Triggering condition analysis, the known/unknown × safe/unsafe scenario space, quantitative acceptance criteria, scenario-based V&V strategy and field monitoring.
Explore SOTIF
03 / Artificial intelligence
Safe AI — ISO/PAS 8800
AI safety lifecycle, dataset specification and coverage, model-level safety requirements, robustness and out-of-distribution evidence, runtime monitoring and the AI safety argument.
Explore Safe AI
Engagement
How we work
Consulting that produces artefacts, not slideware. Every engagement ends with something you can hand to an assessor, a customer or the KBA.
Assess
Gap and readiness assessment against all applicable frameworks at once. You get a prioritised finding list mapped to clauses, not a generic maturity score.
Architect
Safety goals, decomposition and the allocation of requirements across functional safety, SOTIF and AI evidence — so the architecture carries the argument rather than fighting it.
Evidence
A V&V strategy that says what each test proves and what residual claim survives it: scenario catalogues, coverage rationale, dataset specifications, metrics and thresholds.
Argue
A structured safety case — goals, strategies, context, evidence — with a defensible residual risk statement, plus support through independent assessment and approval.
Regulatory readiness
The standards are the means. Approval is the end.
Standards conformance is necessary but not sufficient. We shape the technical evidence so it maps directly onto the regulatory instrument you actually have to satisfy.
AFGBV & StVG §1d–1l
Germany's autonomous vehicle approval and operation ordinance for SAE Level 4 in a defined operational area: technical supervision, risk-minimal state, data recording and the KBA dossier.
UNECE R157 & R171
Type approval for automated lane keeping and driver control assistance systems, including the audit and reporting scheme and the scenario catalogue expectations.
R155 / R156 & ISO 21434
Cybersecurity and software update management systems — the security case that a modern safety case can no longer be written without.
EU AI Act
Where safety-relevant AI meets horizontal AI regulation: risk management, data governance, logging, transparency and human oversight obligations.
German
English
French
Business-level fluency
About
Dr. Saim Simon Perveen
Build your trustworthy system with me
safeautonomy is an independent consultancy for the safety of automated and AI-driven vehicle functions. We work with OEMs, Tier 1 suppliers and automated-driving developers at exactly the point where functional safety, SOTIF and machine learning stop being separate disciplines.
- Safety concepts and safety cases for perception, planning and control functions
- Independent review and assessment readiness before it costs you a release slot
- Training and coaching that leaves your team able to run the process without us
Where we work
Based in Wolfsburg, working across the world
Headquartered in Wolfsburg — home to Volkswagen and a dense cluster of OEM and Tier 1 engineering teams — and working with clients well beyond it, on site wherever a programme needs us, not just reviewing documents from a distance.
Home base
Wolfsburg, Germany
Headquartered in Lower Saxony's automotive engineering hub.
Global reach
Worldwide
Remote-first engagements across the EU, North America and Asia.
Get in touch
Let's find out where your safety argument breaks
A 30-minute call is usually enough to tell whether your gap is in functional safety, in SOTIF, in the AI evidence — or in the traceability between them.
Phone / WhatsApp
+352 661 553 282Based in
Wolfsburg, Germany — working worldwide