2.1 Functional safety

With the development of automotive electronics technology and increasing functionality, the complexity and number of electronic control units (ECUs) on the vehicle are increasing, resulting in a significant increase in the probability of systematic failures and random hardware failures in electronic control systems [8]. At the same time, the new intelligent functions often require coupling and linkage of multiple controllers to achieve. Therefore, if a controller fails, the consequences will not only affect the realization of the module's function but also further extend to the whole system and even affect the driver's life.

Functional safety has emerged to address the safety issues caused by such hardware and software failures. Functional safety refers to the absence of unreasonable risk due to hazards caused by the malfunctioning behavior of Electrical/Electronic (E/E) systems [9]. Functional safety in automobiles mainly addresses the risks caused by hardware and software failures in the vehicle's E/E systems. For example, the failure of the EHB's (electric hydraulic brake) software may result in incorrect power delivery to the value and pump motor, reducing braking effectiveness and significantly increasing the risk of an accident.

To cope with the above failures that may occur in automobiles and to standardize the design and development process of functional safety for ICVs, a functional safety standard for electrical and electronic systems that meets the requirements of the automotive industry was compiled by the Technical Committee on Road Vehicles (ISO/TC 22) based on IEC 61508 in 2011, named ISO 26262 [10]. The ISO 26262 series defines the automotive safety integrity level (ASIL) based on the safety integrity level (SIL) from IEC 61508, which contains five levels from QM to D. ASIL is composed of three parameters together: severity (S), exposure (E), and controllability (C), which improves operability for vehicle engineers. To address the need for functional safety development and analysis of high-computing power, complex controllers, and autonomous driving algorithms, the ISO organization released a revised version in 2018. The new standard forms a separate requirement for functional safety development for semiconductors. At the same time, requirements and descriptions for a fail-operational system (FOS) have been added to the fail-safe System, which is crucial for the development of functional safety for autonomous driving systems.

In recent years, with the changes in vehicle E/E architecture, as well as the further development of intelligence and network connectivity, the functional safety design analysis and development process based on ISO 26262 has encountered some new challenges.

The new generation of E/E architecture means new system and controller architectures. After the Distributed E/E architecture, automotive E/E architectures are moving towards domain-centralized E/E architecture and domain fusion E/E architecture. The evolution is driven by the continuous improvement in the integration level of controllers, particularly in the field of autonomous driving [11]. A typical autonomous driving domain controller will contain multiple heterogeneous compute units such as CPUs, DSPs, APUs (BPUs), etc., and can run multiple operating systems and perform multiple complex tasks simultaneously. This makes the verification and monitoring of functional safety more complicated, having the trend of multi-dimensional and multi-level and putting forward higher requirements for functional safety development and design.

Vehicle-road-cloud collaboration allows devices outside the vehicle to participate in the control link. The new generation of vehicle E/E architecture introduces cloud computing and V2X, which means the vehicle can connect and communicate with the road infrastructure and other traffic participants, including pedestrians. In this working environment, many out-of-vehicle devices or nodes will be deeply involved in the vehicle's perception, decision-making, control, and other automated driving tasks, providing more comprehensive information for the vehicle or undertaking part of the computation and data processing. However, these devices and nodes are mainly developed and produced by third-party enterprises or organizations and are not directly linked to the vehicle's design process. Therefore, this collaborative approach introduces new functional safety risks to the vehicle. The scope of functional safety analysis of this type of question has gone beyond the boundaries of traditional vehicle functional systems [12]. To realize comprehensive and reliable functional safety in the environment of vehicle-road-cloud collaboration has aroused the attention of the industry, and there is an urgent need to develop new methods and technologies to address this new risk of functional safety.

The black-box nature of artificial intelligence algorithms creates new challenges for functional safety. Traditionally, functional safety has been designed primarily through hardware and software to ensure that automotive systems remain safe in the face of abnormal conditions. However, with the rise of AI technology, more and more functions in automotive systems, especially autonomous driving perception and decision-making, rely on complex machine learning and deep learning models. Traditional functional safety analysis methods are difficult to apply directly to AI models. While functional safety analysis methods are usually based on well-defined rules and strict system architectures, AI models are characterized by autonomous learning and adaptability, and their internal decision-making processes are complex to explain [13, 14]. As a result, understanding the behavior of models for functional safety analysis becomes complex and challenging. Methods such as failure mode and effect analysis (FMEA) often struggle to manage models' interpretability, robustness, and ability to handle uncertainty effectively. This leads to a limited comprehensive understanding of the potential risks of the models and the limitations of traditional means in assessing the safety of AI models. Therefore, in the new generation of intelligent vehicle systems, functional safety analysis methods applicable to AI models must be innovatively developed to ensure that these models can operate safely and reliably in various complex scenarios, which is also a key challenge facing the automotive industry with the convergence of AI.

Over the past 20 years, functional safety has accompanied the development of automotive E/E systems along the way and made remarkable progress, providing a reliable framework and laying the cornerstone for the safe development of the industry. However, with the continuous development of technology and the increasing complexity of automotive systems, functional safety is facing new challenges. Therefore, further in-depth research is needed to adapt to the continuous evolution of emerging technologies and systems to ensure that automobiles will still be able to operate safely and reliably in the future.

2.2 Cybersecurity

Emerging communication and intelligence technologies have led to substantial progress in automobile electronic control systems. Consequently, the automobile has transcended its erstwhile status as a self-contained entity. It has evolved into a mobile terminal endowed with communicative capabilities and a discernible degree of autonomous decision-making functionality. The ICVs can connect and transmit information to other vehicles, roads, clouds, and people, make judgments, and execute decisions based on the information collected and transmitted. However, while this brings more convenience and better experience, it also introduces cybersecurity threats, such as cyber-attacks and theft of sensitive data. Therefore, besides functional safety, cybersecurity has become a necessary concern in the automotive field. Ensuring that the automotive network communication process is normal and that the data is in a state of effective protection and legitimate utilization is the goal of cybersecurity in ICVs. The following section will introduce cybersecurity issues, the development of standards and regulations, and some new challenges of ICVs.

The cybersecurity threats faced by ICVs mainly originate from the automobile's internal and external communication networks. The cybersecurity problems of internal automobile communication are mainly in the following aspects. First, the in-vehicle network is used for information interaction between ECUs, domain controllers, and in-vehicle gateways inside the vehicle [15, 16]. Sensing, decision-making, and control data rely on the in-vehicle network for transmission. A cybersecurity attack on the in-vehicle network will seriously affect the vehicle's function. Attackers can directly or indirectly access the in-vehicle network through the diagnostic interface, USB, bluetooth, wi-fi, and other interfaces. As a typical in-vehicle network protocol, the CAN bus lacks a security protection mechanism, and the open channel has the potential risk of malicious eavesdropping and illegal message injection. Back in 2013, Charlie Miller and Chris Valasek hacked the Toyota Prius through OBD [17]. In addition, many researchers have attacked vehicle infotainment systems by accessing malicious devices to interfere with the driver's decisions [18]. Nowadays, with the development of smart cockpits, a large number of assistive functions of the vehicle are integrated into it and controlled through smart vehicle computers. The latest upstream report shows increased automotive cybersecurity attacks triggered by third-party apps [19]. External automotive communications include vehicle-to-vehicle, vehicle-to-infrastructure, vehicle-to-cloud, vehicle-to-user device, and vehicle-to-satellite communications. Many of these communication processes have cybersecurity risks. Attackers may be able to disrupt the movement of a vehicle and cause traffic congestion by jamming, eavesdropping, tampering, or falsifying information in the communication channel. For example, in 2015, two well-known hackers, Charlie Miller and Chris Valasek, successfully compromised a Jeep Liberty through a remote attack, sending unauthorized messages to interfere with its steering and braking functions, controlling the vehicle to deviate from the direction of travel, and ultimately run into an incline, resulting in an emergency for 1.4 million related Chrysler Corporation models recall [20]. Albouq and Fredericks impersonated vehicle nodes and pretended to have the best routes between source and target nodes, deceiving other nodes in the network and realizing the black hole attack [21]. In addition, an attacker can affect the vehicle navigation through GPS spoofing attacks [22], causing the vehicle to deviate. In summary, the attackers may hack into a vehicle through its internal and external interfaces to gain access to information on the vehicle and interfere with its functionality.

As part of cybersecurity, data security cannot be overlooked. The software and hardware critical information of the vehicle itself, the personal privacy of drivers and passengers, and the sensitive data in the external environment of the vehicle may all become the target of attackers. The software and hardware information of the vehicle encompasses inherent attributes such as the VIN code, as well as data collected and processed by sensors during operation, including vehicle speed, acceleration, and other pertinent parameters. The development of intelligent cockpits has led to the collection of more frequent and varied data about the personal privacy of drivers and passengers, such as faces, voices, and driving habits. Sensitive data of the vehicle's external environment include license plates and faces of traffic participants that are collected when sensed by autonomous driving technologies. There is not only data directly associated with the subject but, more importantly, sensitive content that is mined from multiple data types and thus inferred. It is conservatively estimated that ICVs can generate 1–10 TB of data per day, with complex data types covering structured data sets, text, audio, video, trajectory, and images, etc., involving subjects such as drivers, other people in the cockpit, traffic participants, and the automobile manufacturer. In addition, automotive cloud platforms also have data security issues. Due to the substantial value of data encompassed within cloud platforms, these platforms may become targets for attackers aiming to acquire vehicle data and breach vehicular control systems illicitly. In 2018, Tesla was exposed to the hacking of its cloud server account, and a significant amount of sensitive data was leaked, including telemetry data, map information, and vehicle maintenance records [23]. In 2023, Toyota was exposed to several sensitive data leaks, including telemetry data, map information, and vehicle maintenance records, due to misconfigurations in its cloud environment [24]. The importance of data security is not only reflected at the individual level but also lies in its far-reaching impact on national security and social stability. However, the various data leakage and illegal utilization incidents that have emerged in recent years have significantly reduced the public's confidence in the data security of ICVs and seriously hindered the development of ICVs.

The issues above have prompted widespread attention, leading several countries and organizations to progressively formulate cybersecurity standards and regulations for ICVs over the past decade. These initiatives serve to standardize the design and management processes of cybersecurity. For example, the European Union initiated a standard for E-Safety Vehicle Intrusion Protected Applications (EVITA) in 2008 to standardize the design and management of cybersecurity throughout the life cycle of ICVs based on the four requirements of operability, safety, privacy, and finance. EVITA protects the network components in the security architecture according to four requirements. In addition, Europe has also proposed relevant standards such as PRESERVE and OVERSEE, etc. In 2016, SAE released the world's first vehicle cybersecurity standard, J3061, which refers to the V-model and proposes safeguarding automotive cybersecurity throughout the entire automotive lifecycle in terms of risk assessment and management, product development, operation/maintenance, and process auditing. The U. S. SAE and the ISO began jointly developing the international standard Road Vehicles – CybersecurityEngineering (ISO/SAE 21434) in 2018. ISO/SAE 21434 is the first international standard for constructing automotive cybersecurity, marking that a reliable cybersecurity guarantee mechanism has become an essential attribute of future automotive products. In January 2021, the first global mandatory cybersecurity standard for automobiles was adopted. In January 2021, the world's first mandatory automotive cybersecurity regulation, UNECE WP.29 R155, was released, which requires vehicles to pass both the cybersecurity Management System Certification (CSMS) and the Vehicle cybersecurity Type Approval (VTA). The former mainly requires OEMs to develop cybersecurity management processes during the complete life cycle of the vehicle, and the latter reviews the implementation of specific work in cybersecurity development to ensure that the vehicle's cybersecurity protection technology covers the entire life cycle of security. In terms of data security, the EU's Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility-related applications, released in January 2020, categorizes personal data in telematics according to its sensitivity and proposes the principle of data minimization to ensure that vendors and data users only collect personal data that is relevant and necessary for processing, to ensure the security and confidentiality of the data. The above standards and regulations have ensured the cybersecurity of ICVs to a certain extent and improved the standardization of cybersecurity in the design and use of vehicles. Still, many new challenges have emerged by introducing more cutting-edge intelligent and connected technologies.

The advent of sophisticated and novel attacks poses challenges to the communication infrastructure of automotive networks. Some studies have shown that attackers with a high level of experience in automotive network communication protocols and understanding of vehicle functions may design more complex attacks and utilize artificial intelligence methods to generate more covert network attacks [25], significantly increasing the difficulty of attack detection. In addition, new types of vulnerabilities may be introduced by the gradually updated hardware and software systems of ICVs, and some new types of attacks based on unknown vulnerabilities may bypass the protection of rule-based firewalls or intrusion detection systems.

The development of foundation models also brings new challenges to automotive cybersecurity. Firstly, foundation models with deep feature mining capability and reasoning ability can mine deep and sensitive information from the massive amount of data related to ICVs. As a result, even data that has been desensitized may be exploited by foundation models to portray user profiles or predict human or vehicle behaviors [26]. This poses new challenges for the data security and privacy protection of ICVs. Second, the existing encryption during internal and external communication of ICVs usually uses pseudo-random passwords, which may be violently broken by foundation models supported by large-scale data and significant computational resources. It will lead to severe problems in access and authentication, and static protection systems will face the risk of failure.

With the advancement of low earth orbit (LEO) satellites such as Starlink and XingYun, vehicular satellite Internet has become a potential communication method for automobiles. However, some satellite internet communications use brand-new network protocols, and their communication behavior and content are difficult to monitor. This results in the vehicle-sensitive data being able to be transmitted to any designated place via satellite Internet. At the same time, attackers can gain control of the autonomous driving system and manipulate the vehicle driving behavior via satellite Internet. This also poses new challenges to traditional cybersecurity.

To sum up, ICVs still face serious cybersecurity threats. Many research institutions, enterprises, and government agencies actively promote the construction of automotive cybersecurity systems. Compared to cybersecurity issues in the IT domain, the cybersecurity landscape of ICVs exhibits significant disparities across threat origins, attack repercussions, security design constraints, standards, and regulations. With the continuous integration of new technologies in ICVs, emerging issues in novel cybersecurity pose ongoing challenges. Traditional techniques and methods in cybersecurity may prove insufficient to meet the evolving security requirements introduced by these advancements. Therefore, it remains imperative to place continued emphasis on automotive cybersecurity.

2.3 SOTIF

Advanced intelligence systems, such as automated advanced driver assistance systems or self-driving systems in vehicles, may still face situations where they do not work correctly in the intended manner when there is no functional failure in the system, which can lead to potential dangers [27]. In March 2018, Uber's self-driving car accidentally struck and killed a pedestrian in the United States. The pedestrian was crossing a section of road that was not directly illuminated by streetlights, and the sensing system, in the absence of a malfunction, interpreted the pedestrian information captured as unknown objects, vehicles, and bicycles in the first six seconds of the collision [28]. In March 2020, Volvo announced a worldwide recall of nearly 740,000 vehicles involving nine models on sale due to the autonomous emergency braking system (AEB)not effectively recognizing objects in some scenarios, resulting in the AEB not functioning correctly in the intended operating scenario [29]. In June 2020, a Tesla Model 3 in autopilot mode crashed directly into an overturned truck, mistakenly identifying the truck as a white cloud.

To address such issues, the concept of SOTIF was proposed, and the International Organization for Standardization (ISO) was the first to publish ISO 21448∶2019 in 2019 to standardize the development and design of SOTIF, followed by a revised version, ISO 21448∶2022, in 2022. In contrast to its predecessor, the 2022 version extends its application to encompass all levels of automated driving, providing specific clarifications on the hazard model and introducing the operation phase of the system [30].

SOTIF issues arise due to system performance constraints that prevent the practical realization of the intended functionality or due to reasonably foreseeable human misuse [31]. The root causes of these problems are manifold, such as encountering unknown scenarios where the system is unable to perceive the environment accurately or where the functional modules or algorithms within the system may lack the necessary robustness, making it difficult to maintain stability under complex and changing operating conditions [32]. The hardware performance and algorithmic performance of the system directly affect the SOTIF. There are a series of problems and challenges for the SOTIF in edge scenarios, design operation domains, human-machine interaction, and testing and verification [33].

The unpredictability of edge scenarios poses problems and challenges. Real-world driving scenarios are an infinite collection of rare, extreme, or never-before-experienced edge scenarios. The unpredictability of these scenarios leads to the impossibility of exhausting all possibilities at the beginning of the system's design, and exhaustive testing and validation at the later stages of development becomes very challenging [34]. It isn't easy to exhaustively test and validate all possible scenarios, and the system still encounters edge scenarios that cannot be safely dealt with during operation. Edge scenarios expose the lack of system performance, which causes SOTIF problems. The sensing system of an autonomous driving system is limited under specific conditions, such as bad weather and insufficient light, leading to insufficient understanding of the surrounding environment around the system, directly affecting vehicle safety [35]. For the decision-making system, the system is unable to make safe and reasonable decisions promptly due to the complex and variable uncertainty of the upstream information caused by sensor errors, unusual road conditions, and sudden emergencies [36]. For the control system, it is impossible to ensure that the decision-making commands can be executed effectively and rapidly in different scenarios, and the lack of real-time and follow-ability of the control system in the face of unexpected situations may lead to vehicle destabilization.

Determining the operational domain of design (ODD) poses problems and challenges. The ODD describes the applicable scenarios and operating conditions of an automated driving system, including a range of factors such as geographic location, weather conditions, traffic conditions, road types, etc., as well as a variety of complexities and uncertainties that the system is capable of handling [37]. Designing the operational domain is critical to the safe operation of the system. However, the boundaries of the ODD are difficult to define clearly and precisely, which may result in the system unintentionally operating in conditions that are not appropriate, thus compromising safety. Another issue is the dynamic change of ODD; the design operational domain may change over time, such as the implementation of new traffic regulations, irreversible degradation of the system hardware due to time (hardware aging), and the update of urban planning. The system needs to adapt to the ODD's dynamic change and update and validate the ODD as it changes. Monitoring the design operational domain and determining whether the system is operating within the design operation domain directly affects the system's performance. Establishing an efficient real-time data acquisition and analysis system is essential. However, there is a lack of practical techniques and methods to quantitatively assess the deviation of the actual operating conditions from the design operation domain, and it is not possible to reasonably determine the relationship between the actual operating scenarios and the design operation domain.

The complexity of human-machine interaction poses problems and challenges. Human-vehicle cooperative driving conditional automatic driving will continue to exist for a period. The human-machine two sides need to reach a consistent understanding of the driving task in a particular scenario to carry out close, deep interaction and different people's habits and behavioral patterns lead to the human consciousness and behavior being difficult to predict [38]. In addition, even if the same driver faces the complexity of the working conditions due to the fluctuation of their brain load, such as attention distraction or comprehension of the scenario, it is straightforward to lead to misuse. In some emergency scenarios, personnel misuse will directly cause safety accidents. SOTIF Human misuse is also an essential concern for the SOTIF. With the increased system complexity, this problem is more prominent in human-machine interaction. The effectiveness of human-machine interaction is based on a person's full knowledge of the system. However, the complexity of system functionality often increases the difficulty of HCI design, making it challenging to ensure that the driver and passenger fully understand each system function. This complexity can also lead to incorrect expectations of the driver and passenger about the system and incorrect assumptions about how the system is designed to interact, which creates direct or indirect misuse of the intended functionality and increases the safety risk [39].

SOTIF encounters problems and challenges in testing and validation. One of them is insufficient scenario coverage. Testing needs to cover as many road and traffic conditions as possible in a limited time, especially safety-critical edge scenarios, so efficiently generating edge scenarios is a hot research topic in the testing field, i.e., how to design relatively rare or unique driving scenarios within a limited testing time [40] to ensure that the system can operate safely under various extreme conditions. To solve the problem of insufficient scenario coverage requires innovative approaches, including model-based scenario generation, data-driven scenario generation, and the application of digital twin tech-nology, to cover the various challenges of the system more comprehensively. Secondly, the testing of human-machine interaction, different behavioral patterns, cultural differences, etc., are difficult to quantify in testing for simulation testing. Human-machine interaction testing requires considering the complex interactions between the driving system and the driver, including language differences, cultural differences, and behavioral habits. Accurately modeling and evaluating these factors in testing is essential to ensure that the system can operate safely in real-world road conditions. Meanwhile, the system's handling of uncertainty, including sensor errors, environmental transformations, and algorithmic uncertainty, should also be considered in the testing process to ensure that the system can still maintain safety under uncertain conditions [41]. The fourth is the validation of the residual risk of unknown scenarios. Since unknown scenarios cannot be predicted in advance, it is difficult for the validation process to cover all possible unknown situations. Traditional validation methods are usually based on previous experience and data from known scenarios, making it difficult to consider the complexity and variability of unknown scenarios comprehensively. Meanwhile, the definition of reasonable risk in SOTIF is ambiguous, and the definition of reasonable risk varies depending on the environment, regulations, and even the understanding of different people, which increases the subjectivity and complexity of validation [42].

The application of AI technology brings new challenges. Autonomous driving systems apply a vast array of artificial intelligence technologies, from perception to decision-making. Regarding perception, such as convolutional neural networks are used to process image data to detect and recognize targets. Decision-making, such as end-to-end decision-making methods and deep learning methods, are employed to directly map the original input data to the output control commands, forming an end-to-end learning framework. Artificial intelligence technology improves the intelligence of autonomous driving and realizes a more human-like decision-making process, thus better adapting to various driving scenarios [43]. However, it also brings a series of problems, one of which is the limitation of datasets. AI models are usually based on a large amount of training data, which cannot exhaust all the possibilities relative to the actual scenarios. Models may produce uncertain predictions in the face of unseen situations, leading to the SOTIF problem [44]. Second, the process is not interpretable: complex AI models such as deep learning are often considered "black boxes", making it difficult to explain the model's decision-making process and affecting the feasibility of model validation and regulation. Thirdly, the unreliability of the output: when training the model, the data distribution used in the model may differ from that of the actual application, leading to conceptual bias [45]. The bias between the data distribution exposed during training and the data distribution in real applications makes the model output unreliable in the face of factual scenarios. Fourth, the effectiveness of algorithm generalization ability. Migration learning and continuous learning have been proposed as solutions to cope with the "long-tail problem" of scenarios. However, the introduction of new scenario data may bring new security risks. This may lead to fluctuations or even severe degradation of model performance in new scenarios, thus affecting the security of the system.

Along with the intelligent development of automobiles, the new issue of SOTIF has been derived [46], and the development of the ISO 21488 standard marks an essential step in SOTIF, which standardizes the development process of SOTIF of a system. However, compared with functional safety, the concept of SOTIF is relatively new, and it is still challenging to propose clear, quantitative standards and means of prevention and control, as is done for functional safety issues. Many related types of research are still in the preliminary exploration stage, and the concrete application of SOTIF into practice still faces many urgent problems [47].

2.4 Interrelations of the safety & security issues

From the application perspective, the work on functional safety (FuSa), cybersecurity (CS), and SOTIF is currently viewed as independent domains. However, from the problem perspective, as shown in Fig. 2, these three categories of safety issues demonstrate mutual influence and tight coupling [48]. Functional safety is the foundation for achieving SOTIF and cybersecurity. A failure in functionality can lead to a decline in system performance or expose vulnerabilities in cybersecurity. For instance, in August 2023, doctoral students from the Technical University of Berlin, in collaboration with independent researcher Oleg Drokin, successfully bypassed the MCU-Z AMD Security Processor (ASP) of a Tesla Model 3 through physical contact with the Infotainment and Connected Electronic Control Unit (ICE) board, using voltage fault injection. This enabled unrestricted access to the Tesla vehicle, including unlocking paid features [49]. Concurrently, malicious cyber-attacks can pose threats to functional safety. For example, attackers can incapacitate vehicle ECUs by overloading them with redundant information through intrusions into the vehicle's internal network, leading to excessive consumption of ECU resources. The SOTIF of the system relies on real-time and reliable sensor data. Cyber-attacks can affect SOTIF by altering sensor data, such as injecting previous video streams into the perception system through replay attacks, causing errors in road marking recognition. The functional safety of the system may depend on the correct implementation of SOTIF. Design flaws in SOTIF or failure to consider all possible usage scenarios can threaten functional safety or cybersecurity. For example, limitations in system performance can lead to inadequate defenses against specific cyberattacks, resulting in cybersecurity issues.

Figure 2 Interrelation of safety & security.

From the perspective of international standards, the connections and distinctions among the three categories of safety—functional safety, network and data security, and expected functional safety—are reflected through ISO 26262, ISO/SAE 21434, and ISO 21448, respectively. Each standard encompasses common areas such as management, concept development, system design, hardware development, software development, validation, verification, etc. However, there are differences in the specific content descriptions. For example, in the concept design phase, both functional safety and SOTIF undertake a crucial activity called hazard analysis and risk assessment (HARA), which involves analyzing and identifying hazardous events and setting safety goals to prevent and mitigate these events, avoiding unreasonable risks. In contrast, cybersecurity performs threat and risk assessment (TARA), identifying threat scenarios and assessing risks based on the impact of damage and the feasibility of attacks. Furthermore, each domain has different focal points, and each area's work is usually relatively isolated. In functional safety, analyzing design concepts or system architecture and considering technical measures is essential. In cybersecurity, considerations extend beyond safety to financial, operational, and privacy aspects (SFOP). Additionally, discussing cybersecurity strategies requires specific system specifications, such as communication methods, data exchange, asset location and type, and updates during post-development operations. In SOTIF, numerous issues related to advanced technologies, such as safety challenges posed by autonomous driving and artificial intelligence, are involved. Addressing these potential safety issues requires complex and comprehensive analysis, covering unknown potential hazardous scenarios, driver misuse, insufficient specifications, and inadequate performance. Moreover, compared to ISO 26262 and ISO/SAE 21434, ISO 21448 is relatively new. It faces a series of challenges in practical application, including the standard for quantitative assessment of risks related to SOTIF.

The mutual influences among the three aspects of safety introduce higher complexity and uncertainty into the safety design of ICVs. The interplay between functional safety, cybersecurity, and SOTIF significantly increases the complexity of the overall system design. ICVs must not only meet traditional functional safety requirements but also address issues arising from cybersecurity and SOTIF. During system design, testing, and verification, it is necessary to consider safety issues across multiple dimensions and layers, involving expertise from various fields, thus making the overall development process more intricate. Furthermore, the lack of explicit interconnection mechanisms among these three safety aspects adds to the complexity. Measures for functional safety may impact cybersecurity, while requirements for SOTIF may need to be considered within the framework of information network security. This potential lack of clarity introduces uncertain variables in system design. Additionally, SOTIF involves advanced technologies like artificial intelligence and machine learning, with the system's efficacy dependent on the correct functioning of these technologies. However, these new technologies may introduce novel risks related to functional safety and cybersecurity, such as attacks on or misusing models. The introduction of new technologies increases overall system uncertainty. Therefore, it is imperative to systematically study these three categories of safety issues to deeply understand their interrelationships, identify commonalities and intersections, and thereby develop more comprehensive and effective safety methods and techniques.

3.1 Methods and techniques for functional safety

Functional safety emphasizes designing safety mechanisms correctly and reasonably to avoid risks or mitigate hazards. Currently, the functional safety research of ICVs focuses on the vehicle's electronic and electrical (E/E) system, concerned with the abnormal behavior of the vehicle function after the failure of E/E components and the possible harm.

Since the Road Vehicle functional safety release in 2011, many industry organizations and enterprises have continuously enriched the content of functional safety based on the ISO 26262 standard and related practices. Many scholars have also researched the functional safety of ICVs [9]. It covers power functions such as the vehicle's battery management system (BMS) [50], drive motor [51], chassis functions such as electric power steering (EPS) system [52] and electronic stability control [53], autonomous driving functions such as forward collision warning (FCW) and adaptive cruise control (ACC) system [54], and related autonomous driving controllers and microchips [55]. Although functional safety standards and research results focus on different ICV systems, their ideas on functional safety analysis, verification, and evaluation all follow functional safety methods and activity processes.

The functional safety method covers the whole automotive system design, development, and operation process, mainly including functional safety design, fault diagnosis & fault tolerance control, and functional safety testing.

3.2 Methods and techniques for cybersecurity

With the development of automotive technology, vehicle systems no longer mean just the traditional combination of mechanical and electrical components but also involve software and network connectivity. Therefore, protecting automotive cybersecurity has become a crucial task. The objective of automotive network security protection is to ensure the security of automotive network communication and guarantee that data remains in a state of adequate protection and lawful utilization, particularly in the context of the increasingly intelligent and interconnected trends in modern vehicles. This Section introduces regular automotive cybersecurity technologies.

3.3 Methods and techniques for SOTIF

ISO 21448 provides a complete set of methods and guidelines for the development and design of SOTIF, and the standard uses the "V-model" to describe the flow of development activities for SOTIF. Compared to functional safety and cybersecurity standards, SOTIF clearly defines some specific steps in its process, including identifying potential functional deficiencies and triggers, assessing known and unknown scenarios, and assessing SOTIF results [98]. Among them, potential functional deficiency and trigger condition identification aim to analyze the planning algorithms, sensors, actuators, and environmental conditions and foreseeable misuse in the autonomous driving system to identify the trigger conditions that may lead to a hazardous event. Unknown scenarios assessment is the most challenging issue, which focuses on confirming that the residual risk from unknown scenarios meets the acceptance criteria through many long-term tests. In the SOTIF achievement evaluation, the standard lists methods and criteria for assessing the SOTIF but lacks clear quantitative criteria [99].

There are three basic principles for the design of SOTIF technologies: system performance enhancement, functional degraded use, and driver takeover. On the one hand, system performance enhancement can fundamentally solve the problem of system performance limitations and insufficient design specifications [100]; on the other hand, based on the infinity of real-world scenarios, it ensures the safe operation boundaries of the system by defining clear design operation domains [32], and once exceeding the design operation domains of the system, it is necessary to carry out performance degradation and use; when the system is degraded and used, the driver and passenger, as the only subject with independent judgment and action ability in the vehicle, play an essential role in ensuring the SOTIF of the system [101]. Based on the above three principles, the critical technologies for the SOTIF will be divided into system design, system testing and verification, and system operation safety [102].

The technology of SOTIF for system design involves environment sensing technology, decision planning technology, and human-machine interaction technology. The hardware level of environment sensing technology includes utilizing multiple sensors, including millimeter-wave radar, camera, and LiDAR, to obtain comprehensive and multidimensional environmental information [103]. At the algorithmic level, heterogeneous sensor data are fused, and the data are cross-analyzed and integrated to enhance the system's ability to understand the scene [104]. In the fusion process, the confidence and accuracy of different sensors are considered, giving higher weight to the high-reliability sensors, which has weakened the influence of other less powerful sensors. In addition, the perception must react adequately to so-called edge cases, such as overexposure of the sensed image or unexpected and potentially dangerous traffic situations. In other words, the perception system has to be extremely robust to environmental sensing [105] and still be able to perceive and understand the environment correctly in case of data anomalies. For decision planning, the industry has mainly adopted rule-based techniques that apply to regular scenarios and have shown good performance in specific scenarios, such as Baidu's Apollo [106]. Numerous researchers have also researched data-driven decision planning-based algorithms, such as end-to-end decision planning [107], where the algorithmic models have been trained to show good performance for test scenarios. However, both model-based and data-driven algorithms are a simple integration of decision planning for a single scenario and cannot meet the requirements of advanced autonomous driving. The core challenge of high-level decision-making algorithms lies in understanding and reasoning about driving scenarios [108]. Advanced autonomous driving requires a decision-planning technique that can cope with different scenarios, especially with a strong generalization ability for extreme scenarios. Like a good human driver, it can understand and reason about complex driving scenarios and extract valuable information to make the right maneuvers and navigate the environment well, regardless of the encountered situation [109]. Of particular note, the timeliness of decision-making is critical when responding to emergencies, and responding quickly and generating appropriate safety strategies, including emergency response behavior selection and real-time path planning, is essential to ensure that a vehicle can be driven safely in uncertain or dangerous situations. Emergency response behavior selection can be implemented using a finite state machine (FSM) algorithm that maps emergencies and corresponding behavioral rules to states and transfers of the FSM [110]; for real-time path planning, the key is the prediction of the movement of other traffic participants, Shao et al. propose a self-aware trajectory prediction method [111], which achieves online by combining a self-awareness module and a two-stage training performance evaluation to cope with possible scenarios where the expected functionality is insufficient. Similarly, human-machine interaction is an important concern in the SOTIF, on the one hand, to avoid safety problems caused by foreseeable human misuse, and on the other hand, to perform a safe transfer of driving rights when the system is downgraded for use. To avoid human misuse, the system cognition and operation ability of the driver and passengers can be improved by increasing the training of the driver and passengers; in addition, it is necessary to improve the design of the system human-machine interface (HMI), combining the visual, auditory, tactile and other sensory interactions through the graphical user interface (GUI) technology, the intelligent voice interaction technology, and the multi-modal interaction technology to improve the intuitiveness and comprehensibility of the HMI. When the system sends a takeover request to the driver, the system should adopt an effective feedback mechanism according to the driver's status to help the driver return to the driving task in time. It is possible to recognize driver fatigue and distraction state and assess emotional state through the technology of multi-dimensional comprehensive monitoring of vision, hearing, touch, and smell, and strengthen HMI feedback through enhanced display technology, intelligent voice interaction technology and haptic virtual display technology, etc., to help the driver understand the driving environment quickly and make driving decisions promptly [112]. Furthermore, the utilization of brain-computer interface technology represents an exploratory approach to enhancing SOTIF. A positive correlation between cerebral oxygen and the driving risk field is discovered in the literature [113]. Passengers' electroencephalography (EEG) signals are analyzed to distinguish between emergency and non-emergency situations in literature [114]. Both pieces of research illustrate the potential to enhance driving safety by considering humans' perception of driving risk.

Testing and verification play a crucial role in ensuring the SOTIF. For SOTIF testing of perceptual systems, diverse test cases are generated using a high-coverage test-set generation method with basic scenarios [115]. For SOTIF testing of decision planning systems, the dynamic adaptive design and optimization experiment (ADOE) approach is divided into scenario-based and mileage-based tests [116]. Through an adaptive approach, scenario-based testing focuses on quickly identifying scenarios that challenge the decision-making system in a complex logical scenario space. In contrast, mileage-based testing constructs various interactive driving models in a simulation environment to mimic actual traffic conditions and evaluates the system's performance in a natural traffic flow. In addition to independent testing of the perception and decision-making systems, testing and validation of the process from the perception system to the decision-planning system involves the use of error-injection-based reinforcement testing to generalize the error results produced by the perception system and to test the robustness of the decision-planning system through the error-injection method [117].

To ensure the SOTIF in system operation, performing real-time driving safety risk assessment is extremely important. Real-time driving safety risk assessment involves a variety of techniques, including temporal logic-based assessment techniques, which assess the risk based on temporal metrics such as time-to-collision (TTC) and time-headway (THW) [118]; physical model-based assessment techniques, which assess the driving safety risk of vehicles by simulating the vehicle's kinematics and dynamics behavior [119]; collision probability-based assessment techniques, which performs driving safety risk assessment by calculating the probability of all potential collision trajectories [120]; and statistical learning-based assessment techniques, including traditional machine learning, deep neural networks, and deep reinforcement learning, which predicts risk through big data analysis [121]. In addition, artificial potential field (APF) models are used to build driving risk fields to assess safety risks in dynamic environments [122]; safety force field-based approaches utilize the concept of physical forces to assess safety distances and collision risks; and entropy-based risk assessment techniques deal with system stochasticity and uncertainty by calculating the entropy value of a system's state to assess risk [123]. The comprehensive application of various technologies and algorithms is set to become a trend [124], aiming to achieve a more holistic and precise assessment of vehicular safety risks. For the SOTIF in system operation, in addition to real-time risk assessment, the importance of emergency response should not be neglected. Feng et al. proposed an active collision avoidance strategy based on the uncertainty of pedestrian motion [125], which realizes fast and accurate planning of optimal paths to respond to emergencies in complex road environments.

With the development of cutting-edge technologies such as autonomous driving and artificial intelligence, the concept of SOTIF has been derived, becoming a new safety concept independent of functional safety and cybersecurity. Although the ISO 21448 standard provides a series of guidelines and methods, there remains a gap in its practical implementation and application. Meanwhile, SOTIF technology is still in the early stages and has not yet been well developed. The application of artificial intelligence and deep learning in the field of autonomous driving not only raises concerns about SOTIF itself but also has a profound impact on the methods and techniques of functional safety and cybersecurity [126].

3.4 Integrated design for safety

When contemplating the safety design of future ICVs, it is important to recognize the integrated and interdependent relationship among functional safety, cybersecurity, and SOTIF. The interconnection of different categories of safety risks has gained attention, leading to the release of ISO/TR 4804∶2020 by the International Standards Organization in 2020. This standard focuses on the safety of autonomous driving systems and integrates it with cybersecurity. ISO/TS 5083 has introduced cybersecurity considerations in the design, validation, and confirmation methods of autonomous driving. Additionally, the ISO/IEC DTR 5469 and ISO 8800 standards, currently under development by the International Standards Organization, attempt to combine vehicle functional safety with artificial intelligence technologies. Beyond these standards, the analysis of the relationship between cybersecurity and safety in the field of autonomous driving is discussed in the 2019 whitepaper titled Safety First for Automated Driving (SaFAD). This publication elucidates the impact of cybersecurity on functional safety and SOTIF. Researchers are also exploring the fusion of various safety technologies. Suo et al. [127] present a novel approach, combining hazard analysis and risk assessment with threat analysis and risk assessment analyses. Martin et al. [129] proposed a workflow based on the safety pattern, which considers both functional safety incidents and information security incidents as a safety pattern. Research on various safety coupling issues is a significant engineering challenge, and its scope extends beyond the automobile domain. Dotsenko et al. [130] introduce a method for enterprise security management. This methodology introduces an additional ecological safety management unit, fostering mutual coordination among cybersecurity, functional safety, and other safety facets within its purview.

In general, the interconnectivity of various safety issues has begun to be noticed, with some corresponding international standards currently in the drafting stage and preliminary research foundations established in related fields. However, it is crucial to note that no unified standard or methodology encompasses all three categories of safety issues.

3.5 Limitations of existing methods and techniques

As automotive electronic and electrical systems become increasingly complex, functional safety, the earliest proposed concept, has relatively matured in its methods and technologies. However, the development of ICVs has led to significant expansion in the definition and boundaries of vehicles. Traditional functional safety methods and technologies are insufficient to address the novel issues brought about by new technologies. (existing techniques see Table 1) For example, the development of vehicle-cloud collaborative technologies has shifted important functionalities to the cloud. Traditional functional safety primarily focuses on the vehicle system itself, often neglecting the security of cloud systems. The failure of cloud-side system functionalities may result in the inability of ICVs to receive critical traffic information in real-time, thereby increasing safety risks. Simultaneously, with the application of big data and large models in the automobile industry, emerging cybersecurity issues such as large-scale data mining, model-based data encryption, and the processing of remote uncontrolled information are becoming increasingly apparent. These problems become more challenging due to the vehicle's limited computing power, storage resources, and cost considerations. Hence, there is a need to reassess and address these emerging cybersecurity issues to adapt to the specific requirements and challenges of ICVs. Compared to functional safety and cybersecurity, the concept of SOTIF is the latest to be introduced. Despite the growing recognition of the importance of SOTIF, this field still lacks a mature, quantifiable methodology and technology, with no clear solutions. This implies that the actual implementation of SOTIF concepts still faces significant gaps.

While there has been some research on the interconnection of different types of safety issues, the study of composite safety problems often involves the combination of only two types of safety issues. There is a lack of a comprehensive, systematic framework that unifies the consideration of all three types of safety. This isolated research approach and technology are challenging to address the increasingly complex safety requirements of ICVs effectively.

4.1 The concept of fusion safety

Fusion Safety is a high-dimensional security concept developed from functional safety, cybersecurity, and SOTIF. Fusion Safety is not a mere aggregation and integration of these three safety categories but an organic, systematic, and multi-layered fusion. In Fig. 4, the relationship between safety and security is akin to a Möbius strip, representing the dual aspects of the same concept. Their interdependence and close connection render them an inseparable whole. From a dynamic development perspective, safety and security are intertwined and spiral upwards in their evolution, continuous and boundless, analogous to the shape of a Möbius strip and the infinity symbol in mathematics. The close integration of safety and security forms the core concept of Fusion Safety.

Figure 4 Concept and design of fusion safety.

Surrounding this core concept, fusion safety integrates and intercommunicates across four dimensions: value, process, toolchain, and information. At the process level, the fusion concept encompasses concept definition, system design, testing, verification, and production, comprehensively considering all three safety types at every stage. At the toolchain level, the unification and collaboration in areas like code generation, model development, test calibration, and simulation platforms provide robust support for fusion safety. At the information level, the seamless integration and fusion of data collection, mining, transmission, and integration maximize and enhance data value. finally, at the value level, the design philosophy of fusion safety extends beyond the direct safety of vehicles and humans to play a pivotal role in promoting societal and ecological values, aiming to foster coordinated, symbiotic development in these areas.

The fusion of these four dimensions creates a closely linked ecosystem. Value creation drives the development of the entire process, which is supported and realized by the toolchain. The toolchain, in turn, adds value to data, benefiting the entire system. Ultimately, the value of this data further promotes and shapes value creation, forming a closed-loop interactive system. In the design philosophy of Fusion Safety, each dimension is interconnected and interdependent, collectively enhancing the overall safety and efficacy of the system.

4.2 Framework for fusion safety protection system

Based on the concept of fusion safety and guided by the field-vehicle-human safety interaction model, a "safety brain system" aimed at fusion safety is proposed, as illustrated in Fig. 5. A field-vehicle-human safety interaction model is proposed to thoroughly consider the complex driving scenarios faced by ICVs within the fusion safety design. This model comprehensively and hierarchically depicts the multi-dimensional characteristics of driving scenarios and the dynamic interactions between different factors within the Field. In the model, "Field" includes both the physical space and the cyber space, corresponding to the physical world and the data-constructed virtual world. At the same time, "Human" refers not only to the driver but also to the passengers in the vehicle. The field-vehicle-human safety interaction model serves as the foundation and input for the design of the safety brain system. The protection system is divided into the primary safety brain system and cloud collaboration [138]. The safety brain system provides real-time safety protection, while the cloud offers intelligent remote protection, ensuring fusion safety through end-cloud collaboration.

Figure 5 Fusion safety system framework.

The vehicle-edge "safety brain" encompasses three key functional modules: monitoring, assessment, and prevention & control. The monitoring module implements real-time global safety risk monitoring, utilizing multi-fusion sense technology and overall perception to capture information about vehicle status and the external environment. The assessment module quantitatively evaluates the vehicle's fusion safety status in real-time based on data from the monitoring module, involving risks of functional failure, performance degradation, and cybersecurity. It performs an integrated assessment of fusion safety risks based on independent analysis of these factors. The prevention and control module, based on assessment results, generates fusion safety strategies and implements protective measures to ensure real-time vehicle-edge protection.

The cloud acts as an information and strategy processing center, equipped with safety risk alert capabilities, recording (critical scenario record) and analyzing (scenario reasoning and analysis) critical scenarios. Utilizing its big data storage and high-performance computing capabilities, the cloud optimizes safety strategies [139] to ensure optimal safety performance of the entire system. The cloud is capable of providing remote intervention control when necessary [140], serving as a redundancy plan for vehicle-edge protection. The safety brain enables ICVs to adapt dynamically to complex and variable traffic environments. End-cloud collaboration not only enhances the vehicle's safety protection capabilities but also strengthens its ability to respond to external safety risks, thus realizing a comprehensive, integrated fusion safety management system.

4.2.1 Field-vehicle-human safety interaction model

The field-vehicle-human safety interaction model is proposed to comprehensively understand and address the complex safety challenges in the environment around ICVs. The environment, vehicle, and humans interact, forming a complex system that collectively determines the system's safety. The field-vehicle-human model allows for a systematic analysis of the interactions between these three components, thereby more thoroughly identifying and addressing potential safety risks. As shown in Fig. 6, the field in the field-vehicle-human safety interaction model is divided into physical space and cyber space. Physical space includes the natural domain and the traffic domain, where the natural domain encompasses natural environments like weather, climate, and lighting, and the traffic domain includes traffic elements such as infrastructure, traffic signals, traffic flow, and road conditions [141]. Cyber space is categorized into near-field and far-field communication domains based on communication distance, where the local communication domain [142] primarily refers to the information domain created through short-distance communication methods such as V2X and mobile communication with the vehicle, and the global communication domain refers to the information domain that involves long-distance data exchange with the vehicle through satellite communication. Physical space and cyber space, surrounding the microsystem of vehicles and humans, collectively form a macro-system for safety interaction.

Figure 6 Field-vehicle-human safety interaction model.

In the field-vehicle-human safety interaction theory, safety risks are considered due to the system state, which we define as "safety potential energy". This concept draws from the idea of potential energy in physics, which describes the likelihood and severity of potential safety risks in a given system state. The level of safety potential energy depends on the interaction of various factors, specifically in the physical space through "energy" transformations representing interactions [143] and in the cyber space through data exchange representing the influence between different elements. Both energy transformation and data exchange affect the system's state, influencing changes in safety potential energy. If the safety potential energy exceeds the safety margin of the system under study, safety risks may evolve into hazardous events, leading to systemic safety collapse. In the field-vehicle-human safety interaction model, the vehicle and human form an intelligent entity capable of cognition, decision-making, and action, considered as the microsystem in field-vehicle-human, with the surrounding field forming the macro-system. The macro-system and microsystem interact through energy transformation and data exchange. Within the microsystem, the interaction between vehicles and humans is reflected in the complementary role in driving tasks, with human attributes divided into personal, intrinsic, and extrinsic characteristics. Personal characteristics include age, gender, race, etc.; intrinsic characteristics cover physiological and psychological features like reaction ability, cognitive ability, attention, etc.; extrinsic characteristics represent driving takeover ability, decision-making ability, driving style, etc., directly influencing vehicle-human interaction. In terms of the vehicle, it is divided into three levels: the functional layer, including basic functional modules such as the power system, steering system, and braking system; the intelligent layer, including advanced functional modules like the intelligent cockpit and ADAS system [144]; and the connectivity layer, consisting of the vehicular network made up of CAN/FD, LIN, Ethernet, etc. [145], responsible for data transmission between different layers.

4.2.2 "Safety brain" system

Monitoring module. The "Monitoring" module integrates various sensory methods such as vision, hearing, and touch to monitor and assess the safety risks of ICVs comprehensively. It considers unsafe factors caused by natural environments, such as adverse weather conditions [146], potential risks in traffic conditions, such as congestion and accident-prone areas, and safety hazards that may arise during vehicle-cloud communication (Fig. 7). Additionally, the module focuses on the safety state of the vehicle itself, including the reliability of the vehicle's essential systems, the performance of advanced intelligent systems, and the security of onboard network communications. The status of drivers and passengers, including their behavioral intentions [147] and potential erroneous operations, are also crucial monitoring points as they significantly impact vehicle safety. By real-time monitoring and analysis of this multifaceted information, the module comprehensively perceives potential threats, monitors global safety risks, and provides information support to other parts of the system to ensure safe vehicle operation.

Figure 7 Monitoring module of the safety brain.

Assessment module. The "Assessment" module, building upon the risk information provided by the "Monitoring" module, further identifies and analyzes sources of safety risks, including unsafe conditions in the field, unsafe states of the vehicle, and unsafe behaviors of humans (Fig. 8). The unsafe conditions in the field encompass severe weather in the natural domain, intricate traffic scenarios in the traffic domain, and either packet loss of vital traffic information or cyber-attacks in the informational domain. Concerning the vehicle, unsafe states arise from malfunctions at the function layer, connectivity disruptions at the communication layer, and performance insufficiencies at the intelligence layer. Beyond mere misuse related to SOTIF, human unsafe behaviors extend to disregarding safety alerts, thereby increasing the risk to functional safety and engaging in actions threatening cybersecurity, such as connecting virus-infected devices to the vehicle. It conducts an in-depth analysis of safety risks due to functional failure [148], SOTIF risks, and cybersecurity risks from network attacks. This module is not limited to assessing individual safety risks but also considers the occurrence of multiple safety risks simultaneously to evaluate potential safety risks comprehensively. After separately assessing the three categories of safety risks, it conducts a joint analysis of the concurrent multiple safety risks and their composite harmful impacts, revealing their potential interplay and combined effects. Combining the vehicle's level of safety risk response capability, it quantitatively assesses the vehicle's fusion safety risk state.

Figure 8 Assessment module of the safety brain.

Prevention and control module. Based on the results from the "Assessment" module (Fig. 9), the "Prevention and Control" module addresses various identified safety protection needs, including protection against functional failure, performance degradation, and network attack safety protection [149]. It solves strategies within the designed safety strategy space, generating a tiered combination of safety protection strategies (strategy portfolio). This module elevates traditional singular protective measures to a more comprehensive defensive level, transitioning from passive to active adaptive protection, thus constructing a safety prevention and control system that is in-depth, highly adaptive, and integrates multiple safety measures. The core of this module lies in its ability not only to respond precisely to a specific category of safety risk but also to dynamically adjust protection strategies in real-time according to various compound safety protection needs, adapting to the ever-changing safety environment. This comprehensive approach to safety prevention and control enhances the vehicle system's ability to withstand safety risks and strengthens the safety resilience of the entire macro-traffic system.

Figure 9 Protection & control module of the safe brain.

4.2.3 Edge-cloud collaboration

In the safety protection system of ICVs, digital twin technology plays a key role [150]. Digital twins create a virtual model of a physical entity in the cloud, simulating the system interrelations and risk evolution mechanisms of the actual physical space world. Advanced data exchange protocols and real-time data processing frameworks are employed for real-time data synchronization between the physical entity and its virtual model. This framework encompasses immediate collection and transmission of vehicle data, ensuring timeliness and accuracy. In this manner, data is efficiently obtained from the vehicle's sensing system, including but not limited to speed, location, and environmental information. After immediate processing, the real-time collected data, including data cleaning, normalization, and feature extraction, is used for real-time monitoring of vehicle performance and predicting safety states. Additionally, when potential safety risks are detected as uncontrollable, the cloud can perform remote diagnostics and intervention through the digital twin model and even remotely control the vehicle in emergencies to prevent accidents [151]. Recording high-risk safety-critical scenarios and analyzing synchronized data makes it possible to trace and analyze the scenarios of safety incidents, infer the causes of safety risks, and thereby provide a basis for optimizing future preventive measures. Combining historical data with real-time monitoring data, the cloud collaboration platform can deduce optimal safety strategies through algorithms based on large-model analysis and, through OTA (over-the-air) technology, continuously optimize these strategies on the vehicle edge to adapt to the ever-changing driving environment and conditions.

Through edge-cloud collaboration (Fig. 10), the "safety brain" system leverages the complementary advantages of both the vehicle-edge and cloud systems. The vehicle edge focuses on real-time data collection and rapid response, while the cloud provides robust data storage, analysis capabilities, and superior computational power [152]. The protection system can execute highly real-time monitoring and protection while possessing the ability to self-evolve through learning and experience accumulation. This dual functionality ensures that the system can react to immediate risks and address new safety challenges through self-iteration and continuous learning.

Figure 10 Edge-cloud collaboration for fusion safety system.

4.3 X-shaped fusion safety development process

4.3.1 Fusion safety development process

In the era of traditional fuel vehicles, the development cycle of a vehicle product typically spanned 5 to 6 years, with German brands taking about 5 to 7 years, while Japanese brands reduced this cycle to about four years by introducing parallel development models [153]. Entering the era of new energy vehicles, this development cycle has been further shortened to approximately 36 months. Some new automotive manufacturers have even reduced this period to 9 to 12 months. As the automotive industry fully enters the era of ICVs, development cycles are expected to compress further. On the other hand, the diversity and variability of user demands necessitate a focus on continuous iteration and rapid updating of in-vehicle product development to promptly meet customer needs [154]. Shorter development cycles and rapid functional iterations inevitably lead to insufficient safety testing and validation time, thereby increasing safety risks. In the rapid iteration and upgrading of ICVs, a major challenge in safety design and development is effectively addressing unknown or insufficiently understood scenarios [155]. Scenarios not considered during design and encountered during operation can lead to new safety issues, necessitating swift responses and timely functional upgrades.

Currently, the mainstream development model adopted in automotive electronics and electrical systems development is the V-model, with the left side of the V representing the design phase and the right side representing the testing phase [156]. The V-model delineates different software development and testing stages with well-defined documents and test cases. However, its relative rigidity and linearity pose challenges in dealing with changes and flexibility [157]. Additionally, the sequential execution model of the V-model leads to extended delivery cycles, failing to meet the demands for rapid delivery and continuous iteration of ICVs. Since all testing is concentrated in the latter stages of the project, issues identified during testing are complex to rectify promptly, increasing the risk of delays. The linear structure of the V-model is not flexible enough to rapidly deliver and iterate in response to frequently changing requirements.

In the software development field, new development processes like CI/CD (continuous integration/continuous delivery) have emerged [158]. CI/CD, by automating code integration and deployment, enhances software delivery speed and quality, but its automated processes may introduce potential security risks that require appropriate safeguards. Containerized development processes use container technology (such as Docker) [159] to package applications and their dependencies into portable containers, thereby improving development, testing, and deployment consistency and efficiency. However, in containerized environments, isolation between containers is achieved through the container runtime and operating system. Despite many security measures, improper configuration can lead to security vulnerabilities between containers. Moreover, if a component in a containerized environment fails, it can impact the availability of the entire application.

A comprehensive analysis reveals that traditional development processes like the V-model, with their rigid workflows, lack sufficient speed and continuous integration capabilities to meet the rapid and changing development needs of ICVs. New development processes in the software field, while enabling rapid delivery, struggle to ensure product safety and reliability. A new type of safety design and development process is urgently needed to meet the new challenges of ICV safety and fulfill the demands of fusion safety, encompassing functional safety, cybersecurity, and SOTIF. This paper proposes an X-shaped development process based on CHAIN, as shown in Fig. 11.

Figure 11 X-shaped fusion safety development process.

The CHAIN architecture is presented as one of the digital solutions to the interconnection of open complex giant systems [6, 7]. As an interactive multi-layer collaborative network architecture, CHAIN possesses powerful generalization capabilities and universality in facing complex dynamic system challenges, enabling the design, development, rapid deployment, and system iteration of ICVs' fusion safety.

The X-shaped development process integrates physical space and cyber space development processes, retaining the traditional V-model while mapping complex design and development processes from physical space to cyber space based on digital twins. This approach accelerates product delivery while ensuring design development rigor and compliance. In the physical process, for system, integration, and component levels, the left side of its V-model includes system concept, system design, aggregate design, and component design. In contrast, the right side encompasses component testing, aggregate testing, system testing, and release. In the cyber space, cyber system, cyber aggregate, and cyber components construction are performed for elements according to physical space, followed by the creation of high-fidelity virtual testing environments.

The physical and cyber processes interact during the design and testing phases in the X-shaped development process, enhancing development efficiency and reliability. On the one hand, in the physical process, after completing the system requirements, design, aggregate design, and component design, it can directly connect to the testing process in the cyber space, conducting functional and performance validation of cyber components, cyber assemblies, and cyber systems; on the other hand, after constructing cyber systems, cyber assemblies, and cyber components in the cyber space, hardware-in-the-loop and whole vehicle-in-the-loop testing and validation can be directly conducted in the physical space. Interactive design and development across physical and cyber spaces significantly improve the efficiency of the fusion safety development model. Additionally, cross-testing and validation across physical and cyber spaces enhance system safety and reliability.

In the fusion safety design and development process, the importance of the system's overall development and iteration cannot be overlooked. In the design and development phase, comprehensive consideration of planning, modeling, generation, and architecture is required, followed by interaction between the physical and cyber processes to achieve safer and smarter development design. After the product release phase, it's still necessary to focus on product deployment, operation, and safety monitoring, as well as achieve continuous integration and delivery through CI/CD, supporting rapid iteration of product functions.

This paper innovatively proposes a CHAIN-based X-shaped fusion safety development process, as presented in Fig. 11. The X-shaped development process is an advanced safety design method for ICVs, mirroring and integrating the two V-models of physical and cyber worlds through an interactive multi-layer collaborative network architecture. Combining digital twin and artificial intelligence technology, it achieves collaborative development between physical space and cyber space, effectively shortening development cycles and significantly improving the efficiency of Fusion Safety system development while enhancing system safety and reliability through cross-testing and validation in physical and cyber processes. The X-shaped development process has the following features:

(1) Digital twin: The proposed fusion safety development model encompasses both the physical space and the cyber space, constructing a V-model in both parts and connecting the two processes, breaking through the two development workflows, and realizing interactive development between physical space and cyber space. Starting from the physical V process end, it not only points to the physical space testing end but also to the cyber space's testing end. Starting from the virtual development end of the cyber world, it can point to the virtual testing end of the cyber space and the actual physical world's testing end. By bridging the development processes of the physical space and the cyber space, the system's development time is considerably shortened, development and testing costs are reduced, and a large number of physical and simulation cross-tests further ensure system safety [160].

(2) Rapid delivery and continuous iteration: The proposed fusion safety development process combines the characteristics of new development processes across disciplines, designing corresponding development processes on both the development and testing sides, ensuring rapid delivery and continuous iteration. On the development side, from the system, aggregate, and component levels, a plan-modeling-generation-architecture development structure is designed, integrating the development processes of physical space and cyber space, and shortening the time cost of system development from an architectural perspective. On the testing side, considering the operation phase, a deployment-operation-monitoring-CI/CD iterative process is designed and integrated into the testing ends of physical and cyber space, ensuring continuous iteration and upgrade after system release [161].

(3) Enhanced safety: First, the process combines physical and cyber space, allowing complex and costly design development and testing validation steps involved in functional safety, cybersecurity, and SOTIF to be directly conducted in cyber space. Additionally, digital twins can expand and enrich edge scenarios and new attack types and reduce safety risks due to difficulties obtaining test samples and insufficient testing validation. In addition, the proposed fusion safety development process incorporates the traditional V-model [162], ensuring the rigor and completeness of the development process. The fusion safety development model, in both the physical space and the cyber space, is based on the V process architecture, with each stage having clearly defined tasks and objectives. Clear stage divisions clarify the tasks and roles of each stage, ensuring system safety and security [163]. Since the V-model requires establishing clear links between the design and testing phases, issues can be discovered and fixed early in the development process, reducing the cost of finding issues in later stages. Moreover, the traditional single-dimensionality safety development process cannot satisfy the rapid development of ICVs. In contrast, the three types of safety in the X-shaped development process are coupled in models, data, and scenarios at each stage. Developing and designing according to the X-shaped development process can address some fusion safety issues.

(4) Intelligence: The proposed fusion safety development architecture adopts a digital twin development process that integrates physical space with cyber space. In cyber space, the latest deep-learning algorithms can be modularly integrated. By cleaning and analyzing vast amounts of system data and extracting core features, targeted models for cyber systems, aggregates, and components are constructed, ensuring high fidelity of test and validation in cyberspace. Additionally, generative AI algorithms can be applied to generate many simulation test cases specifically for different scenarios, creating comprehensive testing strategies to test and verify the functionality of cyber components, aggregates and systems. Furthermore, the X-shaped development process adopts an automated development process throughout the entire development and iteration cycles, enhancing development efficiency significantly.

The new safety development architecture proposed in this paper, while designed for ICVs, also has application value and significance in other domains. For example, in the context of web applications, mobile applications, and embedded systems, adopting this new safety development architecture can ensure system safety and reliability while shortening the delivery cycles and achieving rapid iteration. Additionally, the proposed new safety development architecture is not limited by project scale and is applicable to development processes for projects of various sizes. This new safety development process allows new safety components or modules to be expanded according to different development needs, offering substantial flexibility to other development projects. Each safety component within it is relatively independent and replaceable, allowing for modifications or replacements according to specific requirements. Moreover, this new safety development architecture can be easily integrated into different development tools and integrated development environments (IDEs), supporting new extensions to various development luggage and requirements.

4.3.2 AI-enabled fusion safety development process

Artificial intelligence applications provide a powerful development tool for the fusion safety development process. For instance, AI can be used for automated business analysis, scientifically planning project schedules, accurately assessing development progress, optimizing resource allocation, and balancing development time [164]. In empowering the fusion safety development model, as shown in Fig. 12, AI is mainly reflected in the following aspects.

Figure 12 AI-enabled development process.

In database construction, AI can automatically collect, store, and utilize data from various sources, including driving scenario databases, safety event databases, vehicle malfunction databases, driver behavior databases, and user feedback databases [165]. AI facilitates the mining of interrelated features between databases, further summarizing development laws. AI has advantages in data anonymization and encryption, strengthening user privacy and data security [166]. through natural language processing (NLP), AI can extract essential user requirements and accurately depict user profiles, thereby enhancing the directionality and effectiveness of product development.

In modeling fusion safety development architecture, AI automatically creates and updates views of large and complex models, aiding developers in better understanding and analyzing the structure and internal mechanisms of the fusion safety system. With automated vulnerability mining, AI can uncover potential security risks in the architecture, identify the root causes of risks, and determine appropriate safety measures. During model creation, AI can rapidly auto-generate model code [167], reducing development time and minimizing the risk of human errors.

In terms of testing and validation, AI can automate repetitive testing tasks such as functional testing, performance testing, and regression testing, thereby improving testing efficiency and coverage. By analyzing historical test data and identifying critical issues in the testing process, AI helps develop more effective testing strategies [168]. With extensive safety events and data, AI technology can automate the generation of test cases for critical scenarios, enhancing the efficiency of system testing and validation. Additionally, AI's in-depth test results analysis can uncover security vulnerabilities and update the system promptly to fix bugs, enhancing system safety.

To enhance the capability of ICVs in dealing with unknown scenarios in real-world operations, it's essential to ensure that the developed systems have continuous optimization capabilities to improve generalization performance in various new scenarios. In recent years, the concept of continual learning has been proposed in artificial intelligence [169]. Continual learning methods enable accumulating new knowledge from new data, tasks, or environments without significantly forgetting previously learned knowledge. Integrating continual learning with the X-shaped development process can help vehicles update the fusion safety model in real time, allowing vehicles to make safer decisions in new scenarios based on the constantly updated knowledge base. Additionally, continual learning ensures that models maintain high performance in complex dynamic environments, which is crucial for ICVs to address safety risks in physical space [170]. Therefore, by introducing continual learning methods into the X-shaped development process, the self-optimization ability of ICV systems is enhanced, improving vehicle safety in unknown and complex scenarios to meet new requirements of functional safety, cybersecurity, and SOTIF.