ISO 26262 in China: Functional Safety Standards for Automotive Software Explained
1000+
Successful Projects
10+ Years
Industry Experience
Worldwide
Certification Services
24/7 Support
Expert Consultation
A vehicle software failure is not always just a software problem. In a modern car, a mistake in an electronic control system can affect braking, steering, acceleration, battery management, driver assistance, or another function directly connected to safety. That is why automotive software teams in China increasingly need to think beyond whether their code works. They need to demonstrate that safety risks were identified, controlled, tested, and managed throughout the vehicle development process. ISO 26262 provides the functional-safety framework used for this purpose. It is particularly relevant as China’s automotive industry moves toward software-defined vehicles, advanced driver assistance, electrification, and increasingly complex electronic architectures.
Table of Contents
Why Functional Safety Has Become a Software Issue
There was a time when automotive safety discussions focused primarily on mechanical components.
A braking component either worked or it did not. A physical switch had a relatively limited role. Software existed, but it was not responsible for controlling such a large proportion of the vehicle’s behaviour.
That has changed.
Today’s vehicle may contain numerous electronic control units, sensors, communication networks and software functions working together. A driver may interact with systems that continuously interpret sensor information and make decisions within milliseconds.
That creates a different kind of engineering problem.
Software can behave correctly under normal conditions and still create a safety problem when an unusual combination of inputs occurs.
A sensor may provide an incorrect value.
A communication message may be delayed.
A component may fail.
A software assumption may no longer be valid after a system change.
Functional safety is concerned with what happens when those situations occur.
ISO 26262 Certification in China is designed around that question: how can a manufacturer or supplier systematically reduce the risk of hazardous behaviour caused by malfunctioning electrical or electronic systems?
That makes the standard particularly relevant to companies developing automotive electronics and software in China.
ISO 26262 Is Not Simply a Software Testing Standard
One of the most common misunderstandings is to treat ISO 26262 as another testing framework.
It is much broader.
ISO 26262 covers functional safety across the automotive product lifecycle, from concept development and system design through hardware, software, production and related activities. The second edition, published in 2018, consists of multiple parts covering areas including vocabulary, management of functional safety, concept phase, product development at system, hardware and software levels, production and operation, supporting processes, ASIL-oriented analysis and guidance
Trending Posts
Get Free Consultation
Our Clients
Projects
Our Happy Clients
⭐⭐⭐⭐⭐
“PopularCert made our ISO certification process smooth and professional.”
— Manufacturing Client, Oman
⭐⭐⭐⭐⭐
“Excellent support and documentation guidance.”
— Healthcare Client, Saudi Arabia
⭐⭐⭐⭐⭐
“PopularCert simplified our ISO certification process with professional guidance and fast support.”
— Manufacturing Client, Saudi Arabia
For software teams, this distinction matters.
You cannot simply finish development and then ask a testing team to prove that the software is safe.
Safety needs to influence decisions much earlier.
What could go wrong?
How severe would the consequence be?
How frequently could the situation occur?
Can the driver reasonably control the situation?
What safety mechanisms should exist?
What evidence will demonstrate that those mechanisms work?
These questions influence architecture, requirements, implementation and verification.
Testing remains important, but it becomes one part of a much larger safety-development process.
The ASIL Concept: Why Not Every Function Receives the Same Treatment
A vehicle does not need the same level of safety controls for every software function.
An entertainment feature and a function involved in vehicle control clearly present different safety consequences if something goes wrong.
ISO 26262 addresses this through Automotive Safety Integrity Levels, commonly known as ASILs.
The levels range from QM (Quality Management) through ASIL A, B, C and D, with ASIL D representing the highest level of automotive safety integrity.
The classification is based on factors including the potential severity of harm, exposure to the operational situation and the controllability of the hazardous event.
This creates an important practical consequence for development teams.
A company cannot decide that every piece of software should simply be treated as ASIL D.
That would create enormous engineering effort without necessarily being technically justified.
Instead, the safety analysis helps determine the appropriate level of rigour.
For a Chinese automotive software company, understanding this principle early can prevent a common problem: discovering late in development that a function requires stronger safety evidence than the original project plan allowed for.
What Happens Before the Software Team Starts Coding?
One of the most useful ways to understand ISO 26262 is to look at what happens before software implementation.
The process begins with the vehicle or system function.
Engineers consider how the function is intended to operate and identify potentially hazardous situations arising from malfunctions.
This leads into the Hazard Analysis and Risk Assessment (HARA).
The objective is not to predict every possible software bug.
Instead, engineers consider hazards associated with malfunctioning behaviour and evaluate their safety significance.
From this work, safety goals can be established.
Those safety goals then influence the functional safety concept and technical safety concept before development moves further into system, hardware and software design.
This is why functional safety cannot sit exclusively within the software department.
The vehicle manufacturer, system engineers, hardware engineers, software developers, safety engineers and testing teams may all have responsibilities.
Software inherits safety requirements from higher-level system decisions.
If those requirements are unclear, developers may produce technically excellent code that does not provide the evidence required to demonstrate the intended safety behaviour.
What ISO 26262 Means for Chinese Automotive Software Teams
China’s automotive sector includes global OEMs, domestic vehicle manufacturers, Tier 1 suppliers, semiconductor companies, embedded-software developers and specialist technology firms.
They do not all approach functional safety from the same starting point.
A large OEM may have dedicated functional-safety departments and established development processes.
A smaller software supplier may have excellent engineering talent but limited experience documenting safety activities.
The challenge for smaller organisations is often not coding capability.
It is process maturity.
A development team may already perform code reviews, automated testing, static analysis and integration testing. Those practices are useful, but the team also needs to understand how its activities fit into the safety lifecycle and how evidence is maintained.
For example, a developer may be able to explain why a particular piece of code works.
A safety assessor may ask a different question:
Which safety requirement does this code implement, and where is the evidence that the requirement was verified?
That difference is fundamental.
Functional safety depends heavily on traceability between requirements, architecture, implementation and verification.
The Software Development Lifecycle Needs a Safety Thread Running Through It
A conventional software project can sometimes tolerate requirements changing late in development.
Safety-related automotive software has less room for uncontrolled change.
A modification may affect an existing safety mechanism, introduce a new dependency, change an assumption or require additional verification.
ISO 26262 therefore places considerable importance on supporting processes, configuration management, change management, verification and validation activities.
A practical software team needs to be able to answer questions such as:
Development Area | Functional-Safety Question |
Requirements | Can every safety-related software requirement be identified and understood? |
Architecture | Does the architecture provide the necessary safety mechanisms? |
Coding | Are applicable coding rules and development constraints followed? |
Verification | Has the software been tested against defined requirements? |
Traceability | Can requirements be linked to implementation and verification evidence? |
Change management | What safety impact does a proposed modification create? |
Configuration | Can the exact software version and supporting artefacts be identified? |
Defect management | Are safety-related defects analysed and controlled appropriately? |
The table illustrates an important point: functional safety is not one activity performed at the end.
It is a thread running through development.
Why Tool Qualification and Evidence Matter
- Modern automotive software development depends heavily on tools.
- Static analysers, compilers, modelling environments, testing platforms and automated verification systems can save enormous amounts of engineering time.
- But when tools contribute to safety-related development or verification, teams need to understand whether their use creates confidence that the resulting evidence is trustworthy.
- ISO 26262 includes requirements and guidance concerning confidence in the use of software tools, including tool qualification considerations where applicable.
- This does not mean every tool used by a developer automatically needs some elaborate qualification process.
- The applicable approach depends on how the tool is being used and the role it plays in producing or checking safety-related work products.
- Again, context matters.
- That is why organisations should avoid blindly copying a tool-qualification checklist from another company. A tool used only for developer productivity is not necessarily treated in the same way as a tool whose output is relied upon as part of a safety verification argument.
ISO 26262 and China's Move Toward Software-Defined Vehicles
The relevance of functional safety becomes clearer as vehicles become increasingly software-defined.
Vehicle functions are no longer necessarily fixed for the entire life of the product. Software may be updated, configurations may change and new functionality can be introduced through increasingly sophisticated electronic architectures.
At the same time, Chinese automotive manufacturers are investing heavily in intelligent driving and connected-vehicle technologies.
This creates an interesting engineering tension.
More software creates more opportunities for functionality.
It also creates more dependencies.
A safety engineer therefore needs to understand not only whether an individual component works but how the complete system behaves when components interact.
ISO 26262 does not solve every issue associated with modern automotive technology. It is not a cybersecurity standard, and it does not replace other engineering or regulatory requirements.
For example, cybersecurity is addressed by standards and regulations such as ISO/SAE 21434 and relevant automotive cybersecurity requirements.
The standards address different risks.
Functional safety asks, broadly, what happens when an electrical or electronic system malfunctions.
Cybersecurity asks how malicious attacks can affect vehicle systems and information.
For modern Chinese automotive programmes, these concerns increasingly need to be considered alongside each other rather than treated as completely separate engineering worlds.
Where Companies Usually Get Functional Safety Wrong
The most expensive mistakes often happen when functional safety is introduced too late.
A company may complete most of its software architecture before asking how the safety case will be developed.
Another may treat safety documentation as a responsibility belonging entirely to the safety manager.
A third may perform extensive testing but struggle to demonstrate why particular tests were selected.
Another common problem is assuming that purchasing a tool automatically solves a process problem.
None of these approaches addresses the underlying issue.
Functional safety requires coordination.
Engineering teams need to understand the safety requirements relevant to their work. Project managers need to account for safety activities when planning schedules. Quality teams need to understand the evidence being generated. Management needs visibility into safety-related risks and decisions.
The earlier these responsibilities are integrated, the less disruptive the process becomes.
Preparing for ISO 26262 Without Turning Development Into Paperwork
Companies considering ISO 26262 should resist the temptation to begin by writing dozens of procedures.
Start by understanding the product.
Identify the functions that matter from a safety perspective. Understand the intended architecture. Determine applicable ASIL classifications. Map responsibilities across the development lifecycle.
Then examine the existing engineering process.
What already works?
Where is evidence missing?
Which activities are performed informally?
Where are requirements difficult to trace?
Where do engineering and safety teams use different terminology?
This approach often reveals that a company already has many useful engineering practices.
The objective is to strengthen those practices and connect them to a functional-safety framework.
That is much more effective than replacing an established engineering culture with a collection of documents nobody uses.
How PopularCert Can Support Automotive Organisations in China
PopularCert can assist automotive organisations in China that need support understanding and preparing their management processes around applicable ISO and automotive standards.
For ISO 26262-related projects, the focus should be on understanding the organisation’s role in the automotive supply chain, the relevant development activities, existing engineering controls and the evidence required for the applicable safety processes.
Support can include gap assessment, process documentation, awareness activities, internal assessment preparation and guidance on integrating safety-related controls into existing workflows.
The objective is straightforward: make the required process understandable to the people who actually have to use it.
Conclusion
ISO 26262 matters because automotive software has moved far beyond convenience features.
Software now influences functions where failure can have serious consequences. As Chinese automotive manufacturers and suppliers develop increasingly electronic and software-defined vehicles, demonstrating functional safety requires more than successful software testing.
The development process needs to show how hazards were considered, how safety requirements were derived, how responsibilities were assigned, how safety mechanisms were implemented and how the resulting system was verified.
For software teams, perhaps the most important lesson is that functional safety should not arrive at the end of development as an additional compliance layer.
It should be present from the beginning.
When safety engineering and software engineering work together from the concept stage, the resulting development process is easier to understand, easier to verify and far less likely to require expensive changes late in the programme.
FAQ
What is ISO 26262?
ISO 26262 is an international standard for functional safety of electrical and electronic systems in road vehicles.
Does ISO 26262 apply only to software companies?
No, it covers functional safety across relevant automotive electrical and electronic development activities.
What does ASIL mean?
ASIL stands for Automotive Safety Integrity Level and defines different levels of safety requirements based on risk.
Is ISO 26262 the same as ISO 21434?
No, ISO 26262 addresses functional safety while ISO/SAE 21434 focuses on automotive cybersecurity.
Why is ISO 26262 important for Chinese automotive suppliers?
It provides a structured framework for managing functional-safety risks as vehicles become increasingly electronic and software-driven.
- Join 1000+ Certified Companies
Ready to Get Certified for Your Next Project?
- Free Consultation
- Expert Guidance
- Fast Turnaround
Reach Us Now