Functional safety and cybersecurity remain distinct assessment streams
D08 evaluates the vehicle-level safety argument, fault and degraded-state response, intended-function limitations, foreseeable misuse and permitted computational evidence. D09 evaluates safety-relevant access, interfaces, update integrity, recovery, regression and external dependencies.
The domains are grouped on this page for navigation, but security controls cannot substitute for a complete functional-safety argument, and process documentation alone does not establish vehicle-level performance.
D08 · Functional & Intended Function Safety
70 points| D08.1 Vehicle safety argument and hazard coverage | 20 |
| D08.2 Fault response and degraded operation | 25 |
| D08.3 Intended-function limitations and misuse | 15 |
| D08.4 Validation of permitted computational evidence | 10 |
D09 · Cybersecurity & Software Integrity
50 points| D09.1 Safety-relevant access and interface protection | 15 |
| D09.2 Update integrity and safe recovery | 20 |
| D09.3 Regression and external-dependency controls | 15 |
Vehicle-level safety argument
Hazards are linked to safety requirements, design measures and verification evidence for the actual rated configuration, rather than inferred from possession of a process certificate.
Fault injection and degraded states
Released methods exercise credible faults or equivalent degraded states and record detection, transition, minimum-risk behaviour and restoration conditions.
Intended-function limits and misuse
Performance limitations without a hardware fault, driver supervision, takeover expectations, operational boundaries and foreseeable misuse are addressed without implying unlimited automated-driving capability.
Computational evidence validity
Simulated evidence identifies model validity, scenario coverage, uncertainty and physical correlation. Scenario counts or virtual distance alone do not establish an injury or failure probability.
Access and interface protection
Authorized, contained evidence addresses safety-relevant access control, diagnostic paths, communications boundaries and credentials for the evaluated interfaces.
Updates, recovery and dependencies
Update authenticity, integrity, interrupted installation, compatible recovery, regression and cloud or external dependencies are assessed for the identified baseline.
Draft scoring boundary
No ECU, keyless, OTA or other weakness creates an automatic penalty or cap unless the released protocol explicitly defines it. Annex F scoring functions, modifiers and gate caps remain under technical development.
Continue with the full technical document
Use IAF AUTOSAFE First Edition for complete domain requirements, proposed point ownership, evidence rules, gates and Annex F release conditions.