For over a decade, automotive functional safety engineers operated under a clear mandate: follow ISO 26262, eliminate single points of failure, verify code with MC/DC tests, and the vehicle will be safe. But as vehicles took over steering decisions through machine learning models, fatal accidents began occurring where every single sensor, actuator, and processor functioned with 100% electronic perfection. This article dissects the fundamental divide between fault-triggered safety and performance-limited safety.
An ISO 26262 hazard arises from an internal fault: an electromigration void severs a copper trace, or a stack overflow corrupts memory. The physical component deviates from its intended specification. An ISO 21448 hazard occurs when all components perform strictly according to specification: a 1.3-megapixel camera meets all MTF and SNR parameters, yet fails to resolve a dark tire fragment on a rainy asphalt road at 100 km/h due to optical diffraction limits.