When FMEA meets AI

What exactly is the failure mode that your Failure Mode and Effects Analysis (FMEA) is supposed to describe when a neural network in an Advanced Driver Assistance System (ADAS) detects a pedestrian? In which form does it appear? Many development programs today leave this question unanswered.

Machine learning (ML) has arrived in series production. At the same time, the regulatory landscape has become more complex. UN R155 and R156 have been relevant for the type approval of all new vehicles since July 2024. ISO/SAE 21434 serves as the central standard for their implementation. ASPICE 4.0 includes a dedicated process group for ML engineering. The industry, which has reliably validated deterministic hardware for decades, is now expected to ensure the safety of probabilistic components.

The cost of these disconnections

Methodological fragmentation manifests as concrete project risks.

The most expensive scenario is late findings shortly before production starts. In quality assurance, the rule of ten states that errors discovered only in the field cost many times more than those identified during the design phase. When safety, security, and SOTIF risks only converge during the audit, rework becomes unavoidable.

Added to this is the duplicate maintenance of risk artifacts. Three separate analyses generate effort without providing additional insight. A “failure mode” in the FMEA is a “threat scenario” in the TARA and a “functional inadequacy” in the SOTIF analysis. The content overlaps, but the formats do not.

Meanwhile, regulatory pressure continues to mount. UN R155 and R156 have been mandatory for all new vehicles since July 2024. Starting August 2, 2027, the high-risk requirements of the EU AI Act for AI as a safety component will take effect, carrying penalties of up to 35 million euros or seven percent of global annual turnover. Those who build their engineering foundation only under this pressure will pay twice.

The answer does not lie in a new method

Safe AI in vehicles is not achieved by replacing proven methods, but rather by consistently building on them. Three building blocks form the core of an integrated engineering model:

• A harmonized FMEA that unifies safety, cybersecurity, and SOTIF under one umbrella. Rather than creating three parallel risk artifacts, one end-to-end traceable document is created.
• AI-specific architectural patterns, such as Shadow Mode and Confidence-Based Decisions, make non-deterministic behavior manageable at the system level.
• Scenario-based validationmakes ML behavior verifiable. With reusable scenario suites and a validation pyramid comprising simulation, model-in-the-loop (MIL), software-in-the-loop (SIL), hardware-in-the-loop (HIL), and track testing, an audit-ready chain of reasoning is created.

It is crucial to consider these building blocks together from the beginning, not as an afterthought shortly before the assessment.

Sources

• The Rule of Ten for failure costs is an established heuristic in quality assurance. See Pfeifer, T. & Schmitt, R. (2021). Masing Handbuch Qualitätsmanagement (7th ed.). Hanser. Also: Six Sigma Blackbelt. (n.d.). Fehlerkosten 10er Regel.
• United Nations Economic Commission for Europe. (2021). UN Regulation No. 155: Cyber security and cyber security management system.
• European Parliament and Council of the European Union. (2024). Regulation (EU) 2024/1689 (AI Act). Official Journal of the EU, L 2024/1689.
• VDA QMC / Automotive SIG. (2023). Automotive SPICE Process Assessment / Reference Model, Version 4.0.