China's Three Mandatory ADAS Standards Force Functional Safety Down to the Chip: Document Review Becomes a Mandatory Checkpoint, SoC/MCU/PMIC/PHY Allocated ASIL B to D

On 23 October 2026, Xinhua published an interpretation by Xi Wenxia, a chip functional-safety specialist at Zhongqixin (Shenzhen) Technology, on three mandatory Chinese automotive standards now entering their implementation windows: GB 39901, GB 47955 and GB 44721. The safety objectives set at vehicle level are being pushed down the reference chain to automotive chips, IP, wafer fabrication and packaging. For anyone supplying automotive-grade devices, this is not a routine compliance reminder — functional-safety documentation has become a mandatory item on the admission checklist rather than material that can be submitted after the fact.

Three standards, three different deadlines

The three standards were released and take effect on different dates spread over almost three years. Treating them as one batch of requirements will get the sequencing wrong. According to the National Standards Information Public Service Platform and the Ministry of Industry and Information Technology:

• GB 39901-2025, Technical requirements and testing methods for advanced emergency braking systems of light-duty vehicles: released 31 December 2025, effective 1 January 2028, fully replacing GB/T 39901-2021;
• GB 47955-2026, Safety requirements of combined driver assistance systems: released 27 June 2026, effective 1 January 2027, covering basic single-lane, basic multi-lane and navigated driver assistance products;
• GB 44721-2026, Safety requirements for automated driving systems: released 30 July 2026, effective 1 July 2027, fully replacing GB/T 44721-2024 and applying to M- and N-category vehicles with L3 and L4 systems, excluding automated parking.

The nearest milestone is 1 January 2027 — under three months away. For chips already shipping into volume programmes, the real preparation window does not end on the effective date; it ends when the customer folds the chip's safety documentation into the vehicle safety case, which normally happens before the standard takes effect.

No chip clauses, but the constraint lands on chips

As Xi explains, none of the three standards lists automotive chip clauses directly. Instead they normatively reference the GB/T 34590 series of functional-safety standards and decompose the vehicle-level safety goals downwards, passing requirements to the semiconductor layer. GB 47955-2026, GB 44721-2026 and GB 39901-2025 impose mandatory functional-safety documentation review and confirmation requirements through normative Annexes C, D and A respectively.

All three converge on one admission logic: beyond proving-ground and road testing, functional-safety documentation review is a mandatory checkpoint. At device level, domain SoCs, MCUs, sensor-processing chips, PMICs and communication PHYs are all classified as safety-related semiconductor components, with typical ASIL allocations from ASIL B to ASIL D.

The easy misreading is to file this under "the main controller's problem". In a safety architecture, PMICs and PHYs carry supply monitoring and link-integrity duties; if their deliverables are incomplete, the vehicle-level safety case has a gap too — and their suppliers are often the last to be drawn into the functional-safety discussion.

Why vehicle testing cannot substitute for chip-level assessment

Vehicle- and system-level testing verifies functional behaviour and the response of safety mechanisms; it cannot descend into the chip to validate the functional implementation or the effectiveness of internal safety mechanisms. Constrained by test conditions, it cannot adequately reproduce chip-level failure scenarios such as single-point faults and latent faults, so coverage is structurally incomplete. Passing vehicle tests alone therefore does not demonstrate that the vehicle remains in a safe state when a fault occurs inside the chip.

Seen from another angle the picture is clearer. A large share of automotive chips are developed as SEooC — Safety Elements out of Context. The safety manual, FMEA, FMEDA, assumptions of use and constraints that such a chip provides are the basic input to a controller's functional-safety development. Even with all vehicle tests passed, if the chip-level safety deliverables are missing, or the SEooC assumptions were never confirmed and verified in the project, the vehicle cannot demonstrate that it meets its safety goals. The chip is the controller's core hardware unit and its failure is the origin of system safety risk; skipping chip-level assessment leaves the safety argument of the controller and the vehicle without a foundation.

SEooC assumptions: what actually gets checked at selection

For OEMs and Tier 1s, the checkpoint at selection is shifting from "is the parameter table good enough" to "do the deliverables line up". In Xi's framing, the items to confirm are:

1. the safety duties, safety requirements and corresponding ASIL that the chip carries in the target system, together with interfaces, dependencies, assumptions of use and constraints;
2. for chips developed as SEooC, whether the assumptions made by the vendor during development match the target system's actual application — the item most often skipped, and the one that turns into rework later;
3. whether the functional-safety deliverables are complete, confirmed item by item against the real system architecture for assumptions of use, interface conditions and integration constraints;
4. where necessary, fault injection, interface testing and system integration testing to verify that key safety mechanisms work in the real application environment.

The order matters. Document completeness is only the first layer; assumption consistency is the second, and it decides whether a programme stays on schedule. A complete safety manual that does not match actual operating conditions is harder to resolve at review than missing pages, because the problem sits in the architecture rather than in the paperwork.

Three priorities for chip suppliers

Xi proposes three priorities for domestic automotive chip makers across the functional-safety lifecycle. First, define the target application scenarios, safety assumptions and constraints, functional boundaries and interfaces for typical use cases, and issue a proper safety manual. Second, perform a complete functional-safety assessment against the ASIL derived from top-level requirements — FMEA, FTA, FMEDA and DFA to identify systematic and random hardware failures, SPFM, LFM and PMHF metrics, plus safety mechanisms such as BIST, ECC and MPU validated by fault injection, forming a lifecycle safety file. Third, build a functional-safety management system compliant with GB/T 34590, covering chip definition, design, test, tape-out, volume production and change.

The third is the most underestimated in practice. Once change control for die revisions and IP iterations is missing, a single version update can trigger a re-assessment of the safety impact on controllers and vehicle applications, and that assessment usually costs far more time than the revision itself. For devices already in volume supply, change-impact analysis is effectively a delivery capability.

HSY Perspective

The real threshold in this round of standards is not vehicle testing but whether chip-level safety deliverables can be cited directly by the tier below. None of the three standards contains chip clauses, yet through the normative reference to GB/T 34590 they push review down to the device: domain SoCs, MCUs, sensor-processing chips, PMICs and PHYs are all classed as safety-related, with typical ASIL B to D allocations. What a controller vendor needs for its safety case is embeddable assumptions, interface conditions and metric results — not a well-covered manual.

A timing judgment follows. The combined driver assistance standard taking effect on 1 January 2027 will transmit pressure first to domestic devices already on volume platforms. Re-running a vehicle safety case typically takes longer than the gap between a standard's release and its effective date, so most of the months since release have already been consumed for suppliers still assembling SEooC assumptions and FMEDA data. Platforms still in sampling are, counter-intuitively, better placed: devices are not frozen, and the window to re-evaluate opens exactly when compliance pressure peaks.

The judgment has boundaries. It holds if customers fold chip-level documentation into the vehicle safety argument rather than absorbing risk through redundancy at system level. If OEMs choose dual-redundant controllers to cover single-point failure, documentation requirements for some non-host devices — PHYs and PMICs in particular — may be relaxed, and the rollout will look slower than the standard text suggests. There is an observable signal for when it stops holding: once Tier 1s begin asking for FMEDA and safety manuals together with samples at quotation, rather than after nomination, documentation has entered selection cost and the timetable is no longer negotiable.

Sources: Xinhua, "Zhongqixin's Xi Wenxia: three mandatory standards push automotive functional safety down to the chip level" (23 October 2026); National Standards Information Public Service Platform entries for GB 39901-2025, GB 47955-2026 and GB 44721-2026; MIIT Department of Equipment Industry I release notices.