The Brazilian Program for Functional Safety Labeling of Critical Subsystems in Electric Vehicles: A Framework Based on Risk and Evidence

Abstract

The lack of standardized functional safety information limits the adoption of electric vehicles (EVs) in Brazil. This study proposes a voluntary Brazilian safety labeling program for critical EV subsystems, based on ISO 26262:2018 (Functional Safety) and ISO 21448:2022 (Safety of the Intended Functionality, SOTIF), adapted to the Brazilian regulatory context. The framework integrates (i) comparative analysis of international vehicle labeling programs; (ii) hazard analysis and risk assessment (HARA) for four critical subsystems (battery management, electric powertrain, charging system, HV cables/connectors); and (iii) a document reliability index (DRI) that weights generic relative risk (RRI_gen) by the robustness of technical documentation (Evidence Score). The DRI calculation assumes statistical independence among subsystems as a simplification, to be validated in the pilot phase. Application to a simulated dataset of 100 BEV models yielded DRI scores ranging from 1.6 to 9.3 (mean = 5.0, SD = 1.8, CV = 36.7%). Vehicles were classified into five safety classes (1–5), with approximately 85% distributed across intermediate classes 2–4, demonstrating strong discriminatory power. Results are communicated via a physical label integrated into Brazil’s National Energy Conservation Label (ENCE), with QR codes linking to detailed subsystem data. The proposal can reduce consumer risk perceptions, stimulate industrial innovation in safety documentation, support regulatory harmonization with ISO standards, and advance electric mobility adoption in emerging markets.

1. Introduction

The global automotive industry is undergoing a structural transformation, driven by the rapid adoption of electric vehicles (EVs), which include both battery electric vehicles (BEVs) and plug-in hybrid electric vehicles (PHEVs) [1]. In 2012, only 120,000 units were sold worldwide; by 2024, consolidated global sales surpassed 17 million, representing about 20% of global light-vehicle sales [2]. This trend reflects technological advancements, policy incentives, and greater environmental awareness, affecting both developed countries and emerging economies [3,4]. In this context, the present study addresses the regulatory needs common to emerging markets—with Brazil as the main case study—and proposes guidelines aligned with international best practices.

The positive environmental impact of EVs is significant in contexts with a clean electrical grid and intensive use, which makes them advantageous in terms of life-cycle carbon dioxide (CO₂) emissions [5]. In addition, electrified architectures change the operational reliability profile of vehicles, increasing the criticality of electrical and electronic failures and raising the challenge of ensuring the functional safety (FS) outlined in the International Organization for Standardization (ISO) 26262:2018 series—Road vehicles—Functional safety [6]. In BEVs, the reduction in mechanical complexity eliminates components like turbochargers and injection systems. In PHEVs, the combination of conventional and high-voltage systems increases overall complexity. In both cases, failures now occur more frequently in electronic and software-based systems, such as battery management systems (BMS) and traction inverters [5,7].

Beyond collision safety, recent surveys underscore the importance of online fault detection and diagnosis (FDD) in EV power electronics and drivetrains. Reviews report rapid signal-based detection for converter open/short-circuit events and growing hybrid/model-based and data-driven FDD methods for permanent magnet synchronous motor (PMSM) drives and battery packs, reinforcing the need for functional safety-oriented labeling of high-voltage subsystems.

Public trust in EVs also depends on the safety of their high-voltage components; this concern adds to existing barriers related to range, initial cost, and the availability of charging infrastructure [3,8,9,10]. In this context, FS—the avoidance of unreasonable risk from hazards caused by malfunctioning behavior of electrical/electronic (E/E) systems, as defined in ISO 26262-1:2018 [11]—becomes an essential parameter for comparison. Although relevant international standards exist, such as IEC 62660-1:2018 [12] and ISO 6469-3:2021 [13], they remain strictly voluntary in the absence of specific national regulations [14]—a situation that still prevails in countries like Brazil and makes objective comparison among models available on the market difficult.

Complementing ISO 26262, the ISO 21448:2022 [15] standard addresses the Safety of the Intended Functionality (SOTIF), which focuses on hazards arising from functional insufficiencies (such as performance limitations, sensor uncertainties) and reasonably foreseeable misuse, even in the absence of system faults. For EV high-voltage subsystems—particularly battery management systems with state-of-charge estimation algorithms and charging systems with communication protocol dependencies—SOTIF scenarios are highly relevant. For this first version, the qualitative scenarios in Appendix A, Appendix B, Appendix C and Appendix D are based only on malfunctions as defined in ISO 26262, while SOTIF-based scenarios will be progressively integrated into future iterations of the fault trees and labeling tiers.

In this context, the Brazilian Vehicle Labeling Program (PBE-V), launched in 2009, already provides comparative information on energy consumption and CO₂ emissions. Its expansion to include hybrid and electric models demonstrates the institutional capacity to adapt to new technologies [16]. However, the country’s market lacks an instrument that communicates the level of functional safety of high-voltage subsystems to consumers in a standardized manner.

To fill this gap, an independent method was developed to assess the FS of four high-voltage EV subsystems, based on international technical standards and adapted to the Brazilian technical and regulatory context. The proposal provides for the development of a conceptual model for classification by presumed functional risk—a risk inferred for each subsystem from the parameters of Severity, Exposure, and Controllability (S–E–C) described in ISO 26262-3:2018 [17], without requiring access to proprietary design data—supported by technical evidence generated by third-party laboratories, in line with international best practices for conformity assessment [18]. This approach differs from traditional homologation, which focuses on the verification of products already manufactured and acquired by automakers, but is instead geared toward the labeling of new vehicles, with an emphasis on ease of access to information, comparability, and transparency for the consumer.

Unlike New Car Assessment Programs (NCAPs), which focus on structural protection in collisions and, more recently, on advanced driver assistance systems (ADASs) [19], the present proposal focuses on the FS of high-voltage EV subsystems. By consolidating an aggregate safety index based on the ISO 26262:2018 series [6] into a single physical label, complemented by the robustness of the documentation presented for each subsystem, the program fills the gap identified in major international initiatives: none of them communicates the relative criticality of batteries, electric powertrains, charging systems, and high-voltage cables to consumers in a comparable and standardized manner. This voluntary approach, aligned with the conformity assessment infrastructure of the Brazilian National Institute of Metrology, Quality and Technology (Inmetro), seeks to increase transparency regarding electrical risks, stimulate technological improvements, and harmonize the Brazilian market with global best practices, acting as an efficient complement—and not a competitor—to the vehicle safety ratings already provided by regional NCAPs.

2. Materials and Methods

This study adopted an integrated research approach, comprising (i) a qualitative and exploratory analysis of international vehicle labeling programs, to identify best practices in governance and communication; and (ii) a normative model for functional risk, based on quantitative procedures grounded in the ISO 26262:2018 series [6], which served as the foundation for the proposed classification. This integration aimed to ensure analytical depth and reproducibility of results.

The method was structured into four main stages, detailed in Section 2.1, Section 2.2, Section 2.3 and Section 2.4. The first involved a comparative analysis of international vehicle labeling programs that communicate relevant technical attributes to consumers. The second comprised the construction of a generic reference hazard analysis and risk assessment (HARA), based on the ISO 26262:2018 series [6], to attribute presumed functional risks to the main electrified subsystems by considering their Severity, Exposure, and Controllability. The third stage addressed the proposal for the graphical and informational structure of the safety label, adapted for EVs and aligned with best practices in visual communication. Finally, the fourth stage defined the classification protocol and the voluntary participation model.

2.1. Analysis of International Vehicle Labeling Programs

The first stage consisted of mapping 14 vehicle labeling initiatives with publicly available documentation (in English, Spanish, or Portuguese), which were reviewed between 1 March and 30 June 2025—the cutoff date adopted for this study. Three inclusion criteria were applied: (i) direct applicability to the automotive sector, defined as the assessment of passenger cars or light vehicles; (ii) the public availability of the methods, defined as the existence of a complete, free, and accessible online technical protocol that allows for the reproduction of the test and classification stages; and (iii) institutional recognition, characterized by the formal endorsement of governments, independent technical bodies, or regulatory consortia at the national or international level.

Three groups of portals were examined: (a) regulatory portals—the United Nations Economic Commission for Europe (UNECE), the U.S. National Highway Traffic Safety Administration (NHTSA), and the Ministry of Land, Infrastructure and Transport (MOLIT, Republic of Korea); (b) institutional portals—the China Automotive Technology and Research Center (CATARC), the Korea Automobile Testing & Research Institute (KATRI), and the Brazilian National Institute of Metrology, Quality and Technology (Inmetro); and (c) New Car Assessment Program (NCAP) portals—the Global New Car Assessment Programme (Global NCAP), the European New Car Assessment Programme (Euro NCAP), and the Latin New Car Assessment Programme (Latin NCAP).

The Scopus and Web of Science bibliographic databases were also queried using the search string: (“vehicle label” OR (“rating program” AND (vehicle OR automotive OR vehic*))) AND (safety OR efficiency). Documents written in English, Spanish, or Portuguese were considered eligible. The screening resulted in 37 initial records, of which 14 complete protocols met the criteria; no additional programs were identified by the cutoff date, indicating that the sample had reached thematic saturation.

Six initiatives were excluded for not simultaneously meeting the criteria for sectoral applicability, protocol transparency, and institutional recognition: (i) the Bharat New Car Assessment Program (Bharat NCAP)—official portal unavailable; (ii) the Japan New Car Assessment Program (JNCAP)—official documentation available exclusively in Japanese; (iii) the Auto Review Car Assessment Program (ARCAP)/Russian New Car Assessment Program (RuNCAP)—absence of a public technical protocol; (iv) the Insurance Institute for Highway Safety (IIHS)—does not have a standardized physical labeling system; (v) the U.S. Environmental Protection Agency’s (EPA) SmartWay—focused exclusively on heavy-duty vehicles; and (vi) EU Regulation 2019/1242/VECTO—also restricted to heavy-duty vehicles. Despite these exclusions, secondary analyses indicate that these programs follow classification logic similar to the included initiatives, thus their absence does not compromise the conceptual axes—classification, evidence, and communication—adopted in this study.

This left eight international programs: NHTSA NCAP [20,21,22] and EPA/DOE Fuel Economy & Environment Label [23,24,25,26,27,28] (USA), C-NCAP [29,30,31,32,33] (China), KNCAP [34,35,36,37,38,39,40,41] (Republic of Korea), Euro NCAP [42,43,44,45,46,47,48,49,50,51] and Green NCAP [52,53,54,55,56,57,58,59,60,61] (Europe), Latin NCAP [62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77] (Latin America) and PBE-V [16,78,79,80,81,82,83,84,85] (Brazil). Although the EPA/DOE, Green NCAP, and PBE-V programs are primarily focused on energy efficiency and environmental impacts, they were kept in the sample because of their best practices in governance, data transparency, and communication design—all aspects considered relevant to the construction of the safety label proposed here. All the programs analyzed, which collectively cover markets accounting for more than 95% of global EV sales in 2024 [2], communicate technical attributes related to vehicle safety, performance, or reliability, and span North America, Europe, Asia-Pacific, and Latin America. This diversity ensures a sufficiently broad institutional and geographical basis for extracting comparative best practices, even without aiming for global exhaustiveness. For each program, the most recent protocol was obtained directly from its official portal, and the version and date of access were recorded to ensure the information was up to date. However, we recognize the geographical asymmetry resulting from the unavailability of public protocols in Africa and the Middle East, and plan to include these regions in future updates when public availability allows.

The analysis was based on a systematic examination of technical documents, reference manuals, and specialized publications, considering criteria for classification, the parameters evaluated, and the communication formats used. Elements such as the classification logic (ranges, stars, or indices), the technical parameters addressed, and the conformity assessment mechanisms were compared. The data collected informed the methodological decisions adopted in the subsequent stages, including the construction of the generic HARA, the definition of the classification algorithm based on the robustness of the evidence presented, and the design of the proposed label. The results of the international survey informed three pillars of the proposed method: the classification structure, the evidence hierarchy, and the communication strategies (detailed in Section 3.1).

2.2. Analysis of Operational Risks in Critical Subsystems

This stage of the study established a systematic technical criterion for classifying the functional risk of the main EV subsystems, based on their operational characteristics and the hazards associated with plausible failures. The analysis was grounded in the principles of the ISO 26262:2018 series [6], particularly Part 3 (Concept phase), and used the HARA method [17].

2.2.1. Subsystem Scope and Generic HARA

In this conceptual stage of the proposal, four high-voltage subsystems were considered: battery, electric powertrain (traction inverter and electric machine), charging system (EV supply equipment (EVSE) and on-board charger), and cables and connectors (harnesses, internal connectors, and vehicle couplers, as part of the high-voltage distribution system). These subsystems were selected because they are classified as voltage class B based on maximum working voltage (AC > 30 V and ≤1000 V; DC > 60 V and ≤1500 V) and on their high energy density or energy flow, criteria established by ISO 6469-3:2021 [13] for the categorization of electrical risks. They also concentrate on the fundamental functional safety requirements addressed in the main technical standards applicable to electromobility. Among these standards are IEC 62660-1:2018 [12], which focuses on the performance assessment of lithium-ion cells; IEC 62660-2:2018 [86], which covers durability and resistance tests to mechanical, thermal, and electrical abuse; IEC 61851-1:2017 [87], which specifies requirements for conductive charging systems; IEC 61851-23:2023 [88], which specifies DC EVSE requirements; and IEC 62196-3:2022 [89], which standardizes AC and/or DC connectors. This taxonomy also aligns with preliminary results from a complementary study currently underway, conducted by the authors (data not yet published).

Auxiliary high-voltage components, such as DC-DC converters, the heating, ventilation, and air conditioning (HVAC) system, and BMS logic modules, were modeled in this study as internal elements of the four reference items. In this approach, any failures in these components are represented as failure scenarios of the subsystems to which they are functionally integrated—for example, BMS failures are allocated to the battery item—which avoids double-counting and ensures a full representation of the risk. In line with the definition of an item in ISO 26262-1:2018 [11], each of the four subsystems is deliberately defined as an autonomous functional item for analysis purposes, which allows independent evaluation in relation to the vehicle architecture and ensures compatibility with post-homologation analyses.

The application of the generic HARA occurred outside the traditional development cycle specified in the ISO 26262:2018 series [6]. According to Clause 6.4.5 of ISO 26262-2:2018 [90], activities in the safety cycle may be modified or omitted, as long as they are technically justified and properly documented. In this study, the essential steps for inferring functional risk are preserved—that is, the hazard analysis, the classification of Severity, Exposure, and Controllability (S–E–C) parameters, the definition of the automotive safety integrity level (ASIL), and verification by technical evidence. By contrast, activities related to system development—such as the definition of requirements, failure simulations, and architecture validation—were omitted because they are not applicable in post-homologation assessments. The described failure scenarios, in turn, represent the most critical risk contexts among those actually analyzed; they are not intended to be exhaustive. As new field evidence, laboratory tests, or expert contributions are incorporated, the scope of the HARA can be expanded and the S–E–C parameters refined, maintaining normative traceability and enabling continuous updates to the risk classification.

2.2.2. Derivation of the Generic Relative Risk Index (RRI_gen)

For each of the four delimited subsystems, a generic reference HARA was developed by combining the parameters of Severity (S), Exposure (E), and Controllability (C), as established in ISO 26262-3:2018 [17]. Among the various scenarios analyzed, the scenario yielding the highest ASIL was selected to ensure that the index represents the most critical functional context among those analyzed. The detailed logic of the fault tree analyses (FTAs) is available in Appendix A, Appendix B, Appendix C and Appendix D. Due to the current unavailability of representative field statistics, this version remained strictly qualitative, as permitted by IEC 61025:2006. Inclusion of quantitative failure rate values will depend on the collection of field data in future versions.

The generic ASIL attributed to each subsystem—QM (quality management, no ASIL) or ASIL A-D—was then converted into a numerical value for operational assignment purposes, according to the linear correspondence QM = 0.5; A = 1; B = 2; C = 3; and D = 4. The assignment of a value of 0.5 to the QM level preserves the hierarchical order between the levels (i.e., A > QM) and ensures that subsystems classified as QM—that is, those that do not require formal functional safety goals according to the ISO 26262:2018 series [6]—still contribute, even if minimally, to the subsequent stages of the protocol.

This linearization is of an exclusively operational nature, allowing for the conversion of the standard’s ordinal scale into a continuous numerical metric. This does not assume that the intervals between ASILs are equidistant; the intention is only to ensure that higher values represent greater functional criticality, in accordance with the warnings in the specialized literature on the use of arithmetic in ordinal scales [91]. The provisional adoption of equidistant values follows consolidated practices in safety engineering, such as the risk priority number (RPN), an optional prioritization approach referenced in IEC 60812:2018 [92], which converts three ordinal scales into a numerical index for prioritizing actions. We recognize, however, that operating arithmetically on ordinal data is conceptually controversial [91]. To verify the robustness of this simplification, a preliminary sensitivity analysis was conducted—described in Section 2.2.5, with results presented in Section 3.2.6—in which linear, exponential, and logarithmic functions were compared. The adopted conversion will be re-evaluated through empirical validation during the pilot phase and consultation with a Delphi panel (Section 2.4.2); iterative adjustments or eventual substitution with non-parametric methods—such as lookup tables based on percentiles or ordinal rankings—may be implemented if technical consensus or field evidence recommends an alternative representation of the scales. This approach aims to ensure a balance between operational simplification and the functional representativeness of the attributed risks.

The resulting value for each subsystem, called the Generic Relative Risk Index (RRI_gen), represents a standardized numerical measure of functional criticality. This index synthesizes the most critical risk scenario observed, in terms of Severity, Exposure, and Controllability, and was used as input for the calculation of the Document Reliability Index (DRI), which is detailed in Section 2.2.3.

2.2.3. DRI Calculation Based on Submitted Technical Evidence

Once the RRI_gen had been assigned to each subsystem, the DRI was calculated, which combines the presumed functional risk with the robustness of the technical documentation submitted by the proponent. For this purpose, the Evidence Score (ES), a graduated scale from 0 to 9, was adopted. Conformity assessment bodies accredited by accreditation bodies operating in accordance with ISO/IEC 17011:2017 [93] offer a higher degree of reliability [94,95]. An ES = 9 is assigned when the subsystem has certification by a product certification body accredited to ISO/IEC 17065:2012 [96], which ensures a high degree of reliability with independent verification. An ES = 7 corresponds to test reports prepared by independent testing laboratories accredited to ISO/IEC 17025:2017 [97], which have relevant technical support even if limited to the scope of the test. An ES = 5 refers to internal reports with complete traceability and an explicit method. Analytical evidence was assigned an ES = 3, provided that it demonstrates the lack of functional criticality of the subsystem and includes, at a minimum: a complete description of the test or modeling method, the traceability of the sample (with a part number, lot, and date), records of the instruments used, with their respective calibrations where applicable, and a signature by an authorized laboratory signatory. When the evidence does not meet these minimum criteria, or is absent, an ES = 0 was assigned, representing the maximum penalty. Details on documentary traceability and the audit process for verifying analytical evidence are provided in Section 2.4.4, which sets out the conditions for directed audits and possible retesting.

The scale adopted regular two-point intervals between levels 9, 7, 5, and 3, while the transition from 3 to 0 entailed an abrupt penalty. This transition represented a deliberate conceptual cutoff, as ES = 3 already constitutes the lower threshold of technical acceptability for functional classification. The granularity of the scale may be re-evaluated during a pilot phase, based on empirical data and technical contributions from experts. The value of the DRI for each subsystem is calculated according to Equation (1), and the practical application of this procedure is detailed in Section 3.2.5.

$$DRI=RR{I}_{\mathrm{gen}}\left(1-{\displaystyle \frac{ES}{10}}\right)$$

(1)

2.2.4. Calculation of the Vehicle’s Global Index (DRI_total) and Mapping to the Label

With the DRI values assigned to the four subsystems, the vehicle’s global index is calculated by the direct sum of these indices, as shown in Equation (2):

$$DR{I}_{\mathrm{total}}=DR{I}_{\mathrm{battery}}+DR{I}_{\mathrm{powertrain}}+DR{I}_{\mathrm{charging}}+DR{I}_{\mathrm{HV}-\mathrm{cables}}$$

(2)

The additive calculation of DRI_total (Equation (2)) assumes statistical independence between the four high-voltage subsystems (battery, powertrain, charging, HV cables/connectors). This is a methodological simplification adopted in the conceptual phase to enable a tractable first-order risk assessment. During the pilot phase (Section 2.4.2), inter-subsystem correlations will be investigated using field data, incident reports, and recall records. Statistical dependency tests (e.g., Pearson correlation, chi-square test) will be applied to detect significant cross-failure mechanisms. Scenarios of potential common-cause failures include: (i) high-voltage harness insulation faults propagating to both battery and inverter; (ii) overcurrent events during DC fast charging affecting both the charging system and powertrain traction drive; (iii) thermal events originating in the battery compartment impacting adjacent HV connectors. If statistically significant dependencies are detected, established coupling methods from functional safety standards—such as the beta-factor model for common-cause failures (IEC 61508-6:2010) or common-cause event analysis (ISO 26262-5:2018)—will be integrated into the DRI_total calculation formula to account for systemic risks.

Each subsystem can take values from 0 (fully mitigated risk) to 4 (generic risk without technical evidence), which defines a theoretical DRI_total range between 0 and 16. The effective RRI_gen values assigned to each subsystem, as well as the practical limits of the DRI_total observed in the application of the protocol, are presented and discussed in Section 3.2.5, along with details of the distribution among the proposed classes. If future versions of the protocol include or remove critical subsystems, this range can be adjusted proportionally to ensure that the residual risk is never completely nullified.

In this conceptual version, the DRI_total was converted into five numerical classes of functional safety (1–5), obtained by uniform division of the observed effective range. Its provisional limits preserve discriminatory power and will be recalibrated at the end of the pilot phase, with rules for extreme values and periodic revisions that ensure comparability between cycles. The resulting number will be presented on the label as a color bar and a numerical symbol (1–5), whose layout will be validated in the pilot phase for intelligibility, visual standardization, and communication effectiveness. A Quick Response (QR) code will provide access to detailed subsystem information and Evidence Scores, which will promote transparency and traceability.

2.2.5. Sensitivity Analysis of the DRI Algorithm

To verify the robustness and suitability of the adjustment function adopted for calculating the DRI (Equation (1)), a sensitivity analysis was conducted, which considered different variations in the Evidence Score (ES).

Three adjustment functions were compared: (i) linear (Equation (1), already presented); (ii) exponential (Equation (3)); and (iii) logarithmic (Equation (4)). The parameters α and β were set to satisfy two anchor points: (i) ES = 0, which does not reduce the generic risk, and (ii) ES = 9, which limits the residual risk to ≈ 10% of the original value. For the exponential function, solving for α yields α = ln(10)/9 ≈ 0.25; for the logarithmic formulation, a scaled form was adopted that enforces the same anchors, and β was calibrated to ≈ 0.85 to match the mid-range attenuation while preserving monotonicity and transparency. These choices approximately enforce the desired extremes (10% residual at ES = 9 for the exponential case), maintaining method transparency until empirical data from the pilot phase allow for statistical refinement.

$$DR{I}_{\exp }=RR{I}_{\mathrm{gen}}\exp \left(-{\displaystyle \frac{\ln \left(10\right)}{9}}ES\right)$$

(3)

$$DR{I}_{\log }=RR{I}_{\mathrm{gen}}\left(0.1+0.9\left(1-{\displaystyle \frac{\ln \left(1+0.85 ES\right)}{\ln \left(1+0.85\times 9\right)}}\right)\right)$$

(4)

Although all three functions were analyzed for robustness and theoretical adherence, for application in this conceptual version, the linear function was provisionally adopted for all calculations, examples, and simulations presented. This choice is based on operational simplicity, model transparency, and ease of implementation, criteria that are well established in risk assessments in engineering.

The simulated scenarios included a uniform variation in ES values (0, 3, 5, 7, 9) applied equally to the four subsystems; realistic combinations, in which different ES values were assigned among the subsystems; and the assessment of the protocol’s theoretical minimum and maximum limits. The quantitative results of these simulations, including tables, graphs, and interpretive analyses, are presented in Section 3.2.6.

2.2.6. Flow of the Classification Protocol

The procedure for classifying functional risk adopted in this study was structured in four conceptual stages, formulated to ensure normative coherence, technical reproducibility, and practical viability in post-homologation assessment contexts.

The first stage consisted of defining the functional items, with the definition of the technical boundaries and operational description of the four critical EV subsystems, as described in Section 2.2.1. In the next stage, typical failure scenarios were identified by combining technical data, field records, and specialized literature, prioritizing plausible situations that could generate hazardous events. A qualitative fault tree analysis (FTA) was developed for each subsystem in accordance with IEC 61025:2006 [98]. The fault trees were verified by a coauthor who did not participate in their initial modeling and were validated by consensus among all the authors—engineers with over ten years of experience in system reliability. Appendix A, Appendix B, Appendix C and Appendix D include the graphical representation of the FTAs, the textual description of the events, and the minimal cut set (MCS) tables. Due to the current unavailability of representative field statistics, this version remained strictly qualitative, as permitted by IEC 61025:2006 [98]. Probabilistic quantification and the verification of statistical independence will be performed in the pilot phase (Section 2.4.2).

In the third stage, the S–E–C parameters were classified, with the assignment of levels of Severity (S0–S3), Exposure (E0–E4), and Controllability (C0–C3), according to the tables in ISO 26262-3:2018 [17]. For each subsystem, all the identified failure scenarios were evaluated and the one that led to the highest ASIL is selected according to the qualitative S–E–C matrix specified by the standard. That is, the most critical scenario is considered to be the one whose S–E–C combination results in the highest ASIL within the set of hypotheses evaluated. Finally, the obtained ASIL value was then converted into a numerical index called the RRI_gen, through a linear mapping. This index was subsequently used to calculate the DRI, based on the ES assigned to the submitted technical documentation, as described in Section 2.2.3. The application of Equation (1) generated the DRI values, which were summed to calculate the vehicle’s DRI_total, used in the final classification, as defined in Section 2.2.4.

To ensure traceability between the generic HARA and the evidence presented, the proponent must include a traceability matrix in the safety dossier, established in accordance with ISO 26262-8:2018 [99], Clause 6.4.3. This matrix links the derived requirement, the implemented safety measure, and the respective mitigation evidence to each hazard listed in the generic HARA. Additionally, during audits performed by third-party bodies, the consistency among the identified hazards, the implemented safety measures, and the submitted documents will be verified.

2.2.7. Justification of the Approach

The adoption of a model based on presumed functional risks, structured from a generic reference HARA, represents a methodological advancement over traditional risk matrices, which only consider the probability and severity parameters. By explicitly incorporating the criterion of Controllability—as established in ISO 26262-3:2018 [17]—the proposed model allows for an evaluation of not only the severity of hazardous events and their estimated frequency but also the mitigation capacity on the part of the driver, occupants, or third-party road users. The resulting products—notably the generic risk matrix, the assigned ASILs, and the respective RRI_gen values—constitute the primary technical basis for the functional safety classification and for the structuring of the proposed label.

It is important to note that ISO 21448 [15] is not formally integrated into this conceptual version of the framework. However, during the pilot phase, SOTIF-based scenarios will be evaluated for subsystems with high algorithmic dependency, such as battery management systems (BMS) for state-of-charge estimation and charging systems with complex communication protocols.

2.3. Proposal for the Safety Label Structure

Based on the presumed functional risks assigned to the critical EV subsystems, this stage focused on the development of the functional safety label’s structure. The goal was to reconcile technical criteria, derived from the systematic risk analysis, with accessible communication strategies, to translate complex information into a visual format that is clear, comparable, and understandable for the consumer.

The DRI_total of each vehicle, according to the classification established in Section 2.2.4, was visually represented by five ordinal classes (1–5), displayed as a color bar, a class number, and a QR code. This approach maintains coherence with widely recognized models for communicating technical risk, while simultaneously promoting the acceptance and immediate recognition of the new label by the final consumer. Although graphically spaced uniformly, the bands represent ordinal levels of functional risk; therefore, the perceived jump between categories should not be interpreted as a linear or proportional variation in severity. To ensure full accessibility, each band will include, in addition to its corresponding color, the class number in high contrast, so that the safety level can be identified even by people with color vision deficiency.

To enable industrial adoption and avoid the proliferation of labels on the vehicle, the functional safety module will be printed on the same self-adhesive vinyl substrate as the ENCE/PBE-V label, forming a composite label. The layout preserves the original energy efficiency block and adds, to the right, a 25 mm wide column containing a color bar segmented by class (1–5), the corresponding number, and the QR code.

The alignment of the functional safety label with the existing ENCE label height serves two key purposes. First, integration onto a single substrate (vinyl adhesive) reduces printing costs and facilitates industrial adoption by vehicle manufacturers. Second, the 25 mm column width represents the minimum dimension necessary to ensure clear readability of the 1-5 class classification and QR code scanning on modern smartphone devices at typical viewing distances (30–50 cm).

To avoid scope overlap, this new column will be identified in the header as “Electrical Safety,” making it clear that the classification refers exclusively to high-voltage subsystems. The proposal thus seeks to consolidate a reliable and effective technical tool for communication, one that is capable of supporting purchasing decisions and fostering a culture of functional safety in the EV market. The label complements, without replacing, the collision resistance ratings already provided by NCAPs, which remain responsible for communicating the structural aspects of vehicle safety.

2.4. Classification Protocol and Voluntary Participation Model

This section presents the classification protocol and the proposed procedures for voluntary participation in the functional safety labeling program. The procedure was adapted from a model previously developed by the authors for voluntary conformity assessment programs, currently under publication. The proposal presented here seeks to align sectoral initiatives with the new Brazilian regulatory architecture, incorporating the principles of international quality infrastructure and maintaining coherence with the practices recognized by multilateral bodies.

2.4.1. Participation Process and Evidence Submission

Participation in the program is voluntary and may be initiated by interested manufacturers, importers, or other economic agents. The process involves submitting technical evidence that enables the reclassification or confirmation of the presumed functional risk originally assigned to each subsystem. Each type of technical evidence is associated with an ES, according to the criteria described in Section 2.2.3.

2.4.2. Validation and Pilot Phase

After the conclusion of the conceptual phase, the protocol will be submitted to a two-stage validation process. The first stage corresponds to the execution of a Delphi panel, structured using the Analytic Hierarchy Process (AHP), and will include the participation of specialists linked to Inmetro, the automotive industry, accredited laboratories, certification bodies, universities, and consumer protection entities. The panel will be composed of at least twelve specialists, distributed in a balanced manner among the represented segments.

Participants will be required to evaluate different structural aspects of the proposed model. At the technical-functional level, the adequacy of the selected failure scenarios, the consistency with ISO 26262-5:2018 [100] regarding the future possibility of using reference failure rates under specified reference conditions (per IEC 61709:2017 [101]) and the criteria for replacing them with field data, the coherence of the S–E–C classifications assigned to the subsystems, and the relevance of adopting the highest ASIL as representative of each item’s functional risk will be examined. At the mathematical–inferential level, the validity of the linearization of the ordinal ASIL scale, the consistency of the adjustment function (1—ES/10), and the robustness of the direct-summation criterion for calculating DRI_total will be analyzed. Finally, the plausibility of the assumption of statistical independence among the subsystems will be evaluated, as well as the logic of the distribution of the classification scale (the limits between classes 1–5). If any of these items remain at a level of agreement below 75% at the end of the third round, a virtual consolidation meeting will be held, at which the alternatives will be voted on by a simple majority. The result of this vote will be considered the panel’s final decision.

The second stage refers to the pilot phase, which will last 12 months and will involve the application of the protocol to at least twenty EV models, or a set corresponding to 10% of the BEV and PHEV models licensed in the previous base year, whichever value is greater. The sampling should, whenever possible, include vehicles from different market categories, such as hatchbacks, sedans, sport utility vehicles (SUVs), or light trucks, to ensure a minimum level of technological diversity for adjusting the 1–5 scale. The present study introduces the conceptual framework prior to formal validation. No preliminary pilot trials or expert panels were conducted before manuscript submission.

2.4.3. International Recognition and Foreign Evidence

During the first year of the program’s implementation, while the mapping of the national testing infrastructure is consolidated, test reports and certificates issued by foreign bodies that have an agreement with Inmetro will be provisionally accepted. This will be done within the scope of the International Laboratory Accreditation Cooperation Mutual Recognition Arrangement (ILAC-MRA) or the International Accreditation Forum Multilateral Recognition Arrangement (IAF-MLA). The acceptance of these documents will be contingent upon the submission of a formal declaration of technical equivalence, issued by the responsible laboratory or certification body.

This declaration must demonstrate that the procedures adopted, including the test standards, environmental conditions, sampling criteria, and assessment methods, are technically compatible with the requirements established in the Brazilian protocol. The goal is to ensure international traceability, comparability between national and foreign evidence, and the preservation of the rigor of the protocol’s methodology, allowing the program to operate immediately even before the full consolidation of national laboratory capacity.

2.4.4. Traceability and Reliability Control

The documents submitted for the purpose of calculating the DRI must meet minimum traceability requirements, according to the nature of the evidence. For certifications issued by accredited bodies in accordance with ISO/IEC 17065:2012 [96] (ES = 9), the traceability of the subsystem is presumed within the scope of the certification process itself. For test reports prepared by accredited third-party laboratories in accordance with ISO/IEC 17025:2017 [97] (ES = 7), the document must explicitly state that the sample was received without post-production interventions and include the part identification, lot number, and date of manufacture, in accordance with the requirements of Section 7.8 of the cited standard. For internal technical reports (ES = 5) or analytical studies (ES = 3), the set of requirements described in Section 2.2.3 applies. In all cases, the documents must be linked to the traceability matrix described in Section 2.2.6. During audits conducted by third-party bodies, the managing entity may require new tests with random sampling if evidence of directed selection, inconsistencies between the submitted documents and the commercialized product, or inadequate evidence regarding the origin of the data is detected.

Each test report or technical certificate must be accompanied by a traceability record containing the lot numbers, part codes, or software and firmware versions that precisely identify the subsystem to which the evidence applies. The class (1–5) printed in the “Electrical Safety” column will be valid exclusively for the model evaluated under the declared testing conditions and will not be retroactively altered by methodological revisions or by any subsequent recall. If the manufacturer implements design modifications or supplier substitutions that are classified as an engineering change, the submission of new testing evidence will be required, or alternatively, a formal declaration of technical equivalence signed by the engineering manager. In these cases, re-evaluation will be voluntary and applicable only to units produced after the change, generating a new label in accordance with the current version of the protocol. This control ensures that the technical evidence remains directly linked to the evaluated configuration, thereby guaranteeing the validity and comparability of the issued classifications.

3. Results

This section presents the main results stemming from the conceptual application of the proposed method. The organization follows the four stages described in Section 2, highlighting how international benchmarks, risk analyses, and normative requirements were integrated into the formulation of the EV safety label. The goal is to systematically demonstrate the proposal’s viability by detailing its technical components, the classification logic, and the potential impacts on the automotive sector. Thus, Section 3.1 consolidates the findings from Stage 1 (comparative analysis of international programs); Section 3.2 corresponds to Stage 2 (risk classification by subsystem); Section 3.3 presents Stage 3 (label design); and Section 3.4 consolidates Stage 4, which discusses the pilot phase and the anticipated impacts.

3.1. Synthesis of the Analyzed International Programs

The international comparison began with programs that have a primary focus on vehicle safety—especially the New Car Assessment Programs (NCAPs). These programs, which are classified here as governmental informative or independent voluntary programs, were included because they met the three criteria established in Section 2.1 (geographical representativeness, protocol transparency, and institutional recognition).

In the United States, the NCAP administered by the National Highway Traffic Safety Administration (NHTSA) operates as a governmental consumer information program, without a regulatory performance mandate [20]. Automakers are not required to submit every vehicle; NHTSA itself acquires vehicles at retail and conducts the tests, without the need for prior registration or consent. Once tested, the model must display a 1- to 5-star rating on the Monroney label. Models that have never been evaluated remain unrated [21,22]. The tests combine instrumented crash tests and track tests, in addition to the verification of advanced driver assistance systems (ADAS) technologies; computer modeling is only used in internal research and does not influence the official rating [20]. Since 2024, the protocol has been under public review, structured around three pillars (crash safety, accident prevention, and vulnerable road users (VRU)) and four new ADAS technologies; the results will be published online from the 2026 model year. The 2024–2033 modernization roadmap plans to integrate specific ratings for each pillar into a revised general system, from the 2028 model year [20]. The program, however, does not explicitly evaluate the integrity of high-voltage (HV) subsystems.

The China NCAP (C-NCAP), administered by the China Automotive Technology and Research Center (CATARC), is a voluntary governmental program [29,30]. The current protocol (7th revision, 2024) evaluates occupant protection, VRU, and Safety Assist, assigning ratings from 0 to 5 stars. For scores above 92%, it awards the Super Five-Star seal, which operates as a distinction above the maximum rating of five stars [29,31]. The 2024 revision introduced specific scenarios for EVs (for example, a side impact focused on the battery) [31], but it continues not to publish a specific index dedicated to HV risks. The results, published on the CATARC portal, influence Chinese regulations but do not require a physical label on the vehicle [29,31,32].

The Korean New Car Assessment Program (KNCAP), conducted by the Ministry of Land, Infrastructure and Transport (MOLIT) and executed by the Korea Automobile Testing & Research Institute (KATRI) of the Korea Transportation Safety Authority (KOTSA), is a governmental informative program that meets the criteria of Section 2.1 [34,35]. The current protocol evaluates three domains: crash safety, VRU, and Safety Assist [36]. In addition to the three domains that make up the global classification, the KNCAP has begun to separately publish a safety rating for the battery pack based on BMS functions. This score is released separately and does not contribute to the vehicle’s global classification, nor does it cover other high-voltage subsystems such as inverters, cables, or charging systems [37]. The final classification is based on five ordered classes derived from a percentage score, where Class 1 represents the best performance and Class 5, the worst [35]. Although informative in nature, the results are published online and influence the market; there is no requirement for a physical label [35,38].

The Euro NCAP, an independent voluntary consortium, also meets the three requirements of Section 2.1 [42]. Its protocol evaluates four domains—adult occupants, child occupants, VRU, and Safety Assist—consolidating them into a scale of 0 to 5 stars [43,44]. Although the modernization roadmap includes requirements for EVs [42], the program still does not provide a specific indicator for HV risks. The official logo can only be used in accordance with the Star Rating Guidelines, and the widespread dissemination of reports gives the Euro NCAP a strong influence on insurers, manufacturers, and public policies, even without a mandatory physical label [42,44,45].

The Latin NCAP, an independent voluntary consortium, also satisfies the criteria of Section 2.1 [62,63]. Vehicles are acquired anonymously and tested in independent laboratories, resulting in a single classification from 0 to 5 stars that combines four domains (adult occupants, child occupants, VRU, and Safety Assist) [62,64]. The 2020–2024 method cycle will be succeeded, in 2026, by version 2.0.1, which will introduce a child dummy equivalent to a 10-year-old child (Q10) and new criteria for Safety Assist [65,66]. Despite incorporating specific items for EVs in some tests [67,68], it does not publish an index dedicated to HV risks. The results, widely publicized online, guide public policies without the need for a physical label [63,64].

The Fuel Economy and Environment Label—a compulsory regulatory program jointly administered by the U.S. Environmental Protection Agency (EPA) and the NHTSA, with the technical support of the U.S. Department of Energy (DOE)—also meets the selection criteria [23]. Since 2013, the label must be affixed to all new light-duty vehicles sold in the U.S., displaying standardized metrics for fuel consumption, emissions, and annual costs. The emissions indices—Greenhouse Gas Rating and Smog Rating—are presented on an ordinal scale from 1 to 10, while energy consumption is presented in absolute values [23,24,25]. The design includes a QR code that directs consumers to personalized comparisons [25,26]. There are specific versions for BEVs, PHEVs, and fuel cell vehicles (FCVs) [23].

The Green NCAP, an independent consortium associated with the Euro NCAP, assigns 0 to 5 green stars by combining three indices—air quality, energy efficiency, and greenhouse gas emissions—which are obtained through laboratory tests and real-world usage measurements [52,53,54]. The method, which is more demanding than regulatory requirements, incorporates a weighting factor for PHEVs and, since 2022, has adopted a “well-to-wheel+” approach, covering emissions associated with the production and distribution of fuels and electricity, as well as the construction and operation of refueling infrastructure [54]. In 2023, it launched the Greener-Choice LCA Award and plans to provide life-cycle assessment sheets per model starting in 2025 [55]. Despite the wide dissemination of results on its portal, the Green NCAP does not require the physical affixing of a label on the evaluated vehicles.

Finally, the PBE-V, coordinated by Inmetro, operates as a governmental informative program [16,78]. Although participation is voluntary, the link to tax incentives (Law 14.902/2024—Mover Program) has, in practice, resulted in the labeling of 100% of marketed models [79,80]. The National Energy Conservation Label (ENCE) classifies efficiency into five classes (A–E) and includes the electric range of EVs [78,79,85]. Under Inmetro Ordinance No. 169/2023 [16], the ENCE must be affixed in a visible location on every vehicle participating in the PBE-V, even if participation in the program remains optional. Detailed values are public and can be consulted in the technical database of the corresponding cycle.

Due to this institutional, methodological, and geographical diversity,

Table 1. Comparison of International Vehicle Labeling Programs.

Program	Region	Program Type	Technical Focus	Classification System	Physical Label
NHTSA NCAP	USA	Governmental informative	Vehicle safety	Stars (1–5)	Mandatory only for tested vehicles
C-NCAP	China	Governmental voluntary	Vehicle safety	Stars (0–5) + Super Five-Star seal	Not mandatory
KNCAP	Republic of Korea	Governmental informative	Vehicle safety	Classes (1–5)	Not mandatory
Euro NCAP	Europe	Independent voluntary	Vehicle safety	Stars (0–5)	Not mandatory
Latin NCAP	Latin America and the Caribbean	Independent voluntary	Vehicle safety	Stars (0–5)	Not mandatory
EPA/DOE Label	USA	Governmental regulatory	Energy efficiency, emissions, and cost of use	Emissions indices (1–10) + energy consumption (absolute)	Mandatory
Green NCAP	Europe	Independent voluntary	Energy efficiency, emissions, and life-cycle	Green stars (0–5)	Not mandatory
PBE-V (Inmetro)	Brazil	Governmental informative	Energy efficiency and emissions	Classes (A–E)	Mandatory for participating vehicles

summarizes the main characteristics of the analyzed programs across six dimensions: name, region of application, institutional typology (governmental regulatory, governmental informative, or independent voluntary), predominant technical focus (vehicle safety, energy efficiency, or environmental impact), classification system (stars, bands, or indices), and physical affixing requirement. This consolidated information underpins the critical discussion in the following subsection.

3.2. Qualitative Risk Classification by Subsystem

The results obtained from the application of the procedure described in Section 2.2 are presented below. Section 3.2.1 details the case of the Battery Subsystem, including its fault tree and the justification for the S–E–C parameters; the following subsections summarize the results of the other subsystems. The complete representations of the FTAs can be found in Appendix A, Appendix B, Appendix C and Appendix D.

3.2.1. Battery Subsystem

The high-voltage battery is identified as the most functionally critical element in EVs, as it combines high energy density (250–300 Wh·kg⁻¹), electrochemical complexity, and significant operating currents. In the exploratory phase, multiple failure scenarios described in the literature were compared—thermal runaway, object penetration, external overheating, electrical overload, and BMS malfunction [102,103,104,105,106,107].

The most critical scenario identified for the battery was determined by the HARA procedure summarized in Section 2.2.6: a single top-event FTA—“catastrophic battery pack fire during DC charging”—was combined with documentary validation, identifying the condition S3–E3–C3 (ASIL C). The qualitative classification of the events confirms the plausibility of this result; further detail is omitted here. Five main factors justify the choice of this most critical scenario identified:

• Increase in the specific energy (energy density) of lithium-ion cells, which increases the heat released during thermal runaway, intensifying the severity of the event [102,108].
• Very high charging or discharging currents, which are capable of generating internal thermal gradients and promoting the deposition of metallic lithium (dendrites), a mechanism frequently associated with internal shorts [105,106,107,109].
• Maintaining a high state of charge (SoC), which reduces the onset temperature of thermal runaway, as more electrochemical energy is available for exothermic reactions [102,106].
• Ambient temperatures around 40 °C, which significantly decrease the thermal safety margin, bringing normal operation closer to the threshold of cellular self-heating [102,105,108].
• The speed of cell-to-module propagation, verified in abuse tests: after the trigger, the expansion can occur in a few minutes, and actions by the driver or the BMS only limit residual currents, without extinguishing the fire [102,108].

The FTA for this subsystem contains one conditional event, BT_CE1, four main branches (BT_G1–BT_G4), and six basic events (BT_B1–BT_B6). The branches “Internal short in cell” (BT_G1) and “Mechanical penetration” (BT_G4) are modeled as intermediate events to preserve traceability to the respective basic events (BT_B1 and BT_B6). The operational condition representing the highest criticality—a combination of high SoC and high ambient temperature during fast DC charging (SoC ≥ 80% and ambient temperature ≥ 40 °C)—was modeled as conditional event BT_CE1, which feeds an INHIBIT gate linked to the OR operator of the four primary causes (BT_G1–BT_G4).

To estimate the Exposure parameter (E), we considered the situation to occur at least once per month, which, according to Table B.3 of ISO 26262-3:2018 [17], falls into class E3—medium probability of occurrence. The values are based on a conservative estimate by the authors and will be adjusted by a Delphi panel or replaced by public statistics when available. In accordance with Clause 6 of the same standard, the Severity (S), Exposure (E), and Controllability (C) parameters for this scenario were evaluated, with the results presented in

Table 2. Classification of S–E–C parameters for the Battery Subsystem.

Parameter	Class	Justification
Severity	S3	Catastrophic fire with the potential for multiple casualties
Exposure	E3	Frequent use of fast DC charging
Controllability	C3	Cell-to-module propagation in minutes; driver has no means of containment

.

The complete fault tree structure is shown in Figure A1. The S–E–C matrix leads to an ASIL C level; according to the conversion defined in Section 2.2.2, this result is equivalent to RRI_gen = 3. The DRI calculation will then follow the procedure in Equation (1).

3.2.2. Electric Powertrain Subsystem

The combination of electric motors and inverters is responsible for converting the energy stored in the battery into motion and plays a central role in the EV propulsion system. The most relevant risks are associated with insulation failures, which can result in electric discharge, electronic interference, or a momentary loss of traction [110]. During the exploratory phase of this study, different operational failure scenarios were evaluated, such as inverter overheating, control system failure, rotor locking, and loss of insulation resistance between live parts and the electric chassis [110,111,112].

From the set of failure modes evaluated, the sudden loss of traction during active driving was identified as the most critical scenario. This condition can occur, for example, due to a permanent short circuit in a power semiconductor of the inverter, which is responsible for about 38% of incidents in traction drives [110,112]. In this event, the affected phase remains energized, causing an immediate overcurrent and reverse braking torque that compromises the vehicle’s longitudinal stability [112]. According to ISO 26262-3:2018 [17] the possibility of losing control at cruising speed—with the risk of a high-energy collision—places the severity in class S3. The defect can manifest during passing maneuvers on highways, a condition that repeats several times a month in a passenger car’s use cycle; for this reason, exposure is classified as E3 (medium frequency), following the example in Table B.3 of the standard [17]. Although the protection system acts almost instantaneously, the resulting abrupt deceleration, accompanied by reverse torque, makes an effective driver reaction impossible, characterizing the controllability as C3 (difficult or uncontrollable). The S3–E3–C3 combination leads to an ASIL C level, which, through the adopted linearization, corresponds to RRI_gen = 3 for the electric powertrain subsystem (see

Table 3. Classification of S–E–C parameters for the Electric Powertrain Subsystem.

Parameter	Class	Justification
Severity	S3	Sudden loss of directional control, with the potential for high-energy collision and fatal injuries
Exposure	E3	Failure is possible during active driving (medium frequency)
Controllability	C3	Instantaneous overcurrent; the driver has no means of mitigation

and Appendix B).

3.2.3. Charging System Subsystem

The charging system establishes the electrical and functional interface between the vehicle and the electric vehicle supply equipment (EVSE), which encompasses the vehicle’s inlet, high-voltage cables, communication circuits, and protection devices. In AC Modes 1–3, the on-board charger converts the energy; in Mode 4 (DC fast charging), the power converter is external to the vehicle. Operational risks are higher during fast DC recharges, which typically operate between 400–1000 V and 150–500 A, in external environments subject to heat, rain, and dust. In the exploratory phase, scenarios such as prolonged overcurrent, cable overheating, protective earthing continuity failures, and degradation of insulation in connectors subjected to intense use were evaluated [105,110,113,114,115].

From the set of failure modes evaluated, the occurrence of a sustained overcurrent in the high-voltage conductor during DC fast-charging sessions (mode 4) was identified as the most critical scenario, which is associated with a deficient performance of thermal and electrical protection devices in both the EVSE and the vehicle. This condition can occur in contexts where there is a progressive degradation of thermal sensors in the connector, preventing a timely shutdown [114]. Simulations and tests indicate that, during fast charging, the temperature of the terminals can reach values above 90 °C—a level at which the IEC 61851-23:2023 standard [88] requires immediate shutdown of charging for thermal safety reasons. There is technical evidence that high currents in DC EVSE connectors can cause insulation failures and act as a source of ignition, especially in poorly designed interfaces or those exposed to intense thermal cycles [116]. Studies with lithium nickel manganese cobalt oxide (NMC) cells show that, even with active cooling, thermal gradients of up to 20 °C can arise during charging cycles with high current [117]. The C-rate—which expresses the ratio between the applied current and the cell’s capacity—was not specified in the study, but the results suggest thermal behavior comparable to that of fast-charging applications, reinforcing the plausibility of undetected internal heating in cases of sustained overcurrent. The technical standards IEC 62196-3:2022 [89] and IEC 61851-23:2023 [88] establish limits for temperature rise and protection requirements in DC charging systems. In accordance with ISO 26262-3:2018 [17], the event is classified as S3 (fire risk with a direct threat to life), E3 (frequent in urban operations with successive recharges), and C3 (a difficult-to-control event, without immediate signaling to the driver). This combination leads to an ASIL C level, which corresponds to RRI_gen = 3 (see

Table 4. Classification of S–E–C parameters for the Charging System Subsystem.

Parameter	Class	Justification
Severity	S3	Localized overheating with fire risk in the connector, with the potential for a vehicle fire
Exposure	E3	Fast DC charging is used frequently in intensive urban cycles
Controllability	C3	Progressive and unperceivable heating; user has no means of direct intervention

and Appendix C).

3.2.4. Cables and Connectors Subsystem

High-voltage cables and connectors are responsible for interconnecting the vehicle’s main electrical subsystems—such as the battery, inverters, motors, and charging system—ensuring the integrity of energy conduction and the safety of the circuit. Although they are passive components, their reliability is essential for the performance and functional protection of the system as a whole, mainly due to their length, environmental exposure, and direct involvement in high-power current paths. During the exploratory phase of this study, scenarios such as accidental disconnection under load, thermal degradation of insulators, mechanical locking failure, and external abrasion with exposed conductors were analyzed [105,110,114,115].

From the set of failure modes evaluated, the abrasion of the external insulating coating in high-voltage harnesses was identified as the most critical scenario. This exposes live parts, promotes a short-to-ground, and triggers sustained electrical arcs—typically at around 150 V and with energies of a few kilojoules [118]. This mechanism dominates situations where the harness is routed through tight spaces, experiences continuous vibration, or rubs against metal edges of the unibody. Isolated thermal aging studies show that cross-linked polyethylene (XLPE) loses 17% to 23% of its dielectric strength after 500 h at 135 °C or 672 h at 120 °C [119,120] when this degradation is added to localized abrasion, an additional reduction in the dielectric margin is expected, though specific quantification has yet to be published. In normative terms, the potential occurrence of an electrical arc in the engine compartment constitutes a severity of S2 (serious non-fatal injuries); the vehicle experiences cycles of twisting and friction on virtually all urban routes, resulting in an exposure of E3 (frequent); the failure remains partially controllable by overcurrent protective devices and by the insulation resistance monitoring system, but the circuit interruption is not always immediate, classifying the controllability as C2 (limited). The matrix leads to ASIL A; the adopted linearization converts this result into RRI_gen = 1 (see

Table 5. Classification of S–E–C parameters for the Cables and Connectors Subsystem.

Parameter	Class	Justification
Severity	S2	Localized electrical arc can cause severe burns or a localized fire (serious injuries)
Exposure	E3	Vibration/abrasion in urban use; monthly or more frequent occurrence
Controllability	C2	Protective devices interrupt the circuit with a delay; situations remain “normally controllable” (>90%)

and Appendix D).

3.2.5. Calculations and Examples of the DRI

The results of the qualitative analyses performed for each subsystem (Section 3.2.1, Section 3.2.2, Section 3.2.3 and Section 3.2.4) are summarized in

Table 6. Severity (S), Exposure (E), and Controllability (C) values, generic ASIL, and RRI_gen of the evaluated subsystems.

Subsystem	S–E–C	ASIL_gen	RRI_gen
Battery	S3–E3–C3	C	3
Electric Powertrain	S3–E3–C3	C	3
Charging System	S3–E3–C3	C	3
Cables and Connectors	S2–E3–C2	A	1

, which consolidates the S–E–C parameters, the generic ASIL, and the RRI_gen value assigned to each item evaluated.

After obtaining the RRI_gen values for each subsystem, the DRI is calculated according to the robustness of the submitted technical documentation (ES), as established in Equation (1) (Section 2.2.3). This expression ensures that the DRI of each subsystem is proportionally reduced as the quality of the evidence increases, while maintaining a minimum residual risk (10% of the original value) even for the most robust documentation. As an illustrative example, for the battery subsystem with RRI_gen = 3 and ES = 7 (accredited laboratory report), the DRI obtained is 0.9. If the evidence corresponds to only an analytical study with ES = 3, the resulting value would be 2.1.

Considering the RRI_gen values assigned to the four reference subsystems—three subsystems with RRI_gen = 3 and one subsystem with RRI_gen = 1—the lowest possible DRI_total (obtained when all have ES = 9) is 1.00. Lower values would only occur if all subsystems were classified as QM, a hypothesis not considered in this version. Based on these results, the effective range of the DRI_total in this version is from 1 to 10. Thus, the provisional boundaries between the five classes were established at 2.8, 4.6, 6.4, and 8.2, so that values < 2.8 belong to Class 5; values ≥ 2.8 and <4.6 belong to Class 4; values ≥ 4.6 and <6.4 belong to Class 3; values ≥ 6.4 and <8.2 belong to Class 2; and values ≥ 8.2 belong to Class 1. To avoid ambiguity at the lower end, any result ≥ 0.20 and <1.00—a scenario only possible if all subsystems were classified as QM—is also included in Class 5. If future versions of the protocol include or remove critical subsystems, the lower and upper limits can be adjusted proportionally, ensuring that the residual risk is never completely nullified. These intervals may be revised at the end of the pilot phase, using the 20th, 40th, 60th, and 80th percentiles of the observed distribution.

3.2.6. Sensitivity Analysis of the DRI Algorithm

Based on the method described in Section 2.2.5, a sensitivity analysis was performed to evaluate how different adjustment functions and variations in the Evidence Score (ES) impact the DRI and DRI_total. The results for the three simulated scenarios are presented in

Table 7. Variation in the DRI_total with a uniform ES—Scenario S-1 (base vector [3 3 3 1]).

ES	DRI_lin	Class_lin	DRI_exp	Class_exp	DRI_log	Class_log
0	10.00	1	10.00	1	10.00	1
3	7.00	2	4.72	3	4.72	3
5	5.00	3	2.87	4	3.08	4
7	3.00	4	1.74	5	1.90	5
9	1.00	5	1.05	5	1.00	5

and

Table 8. DRI_total ranges in realistic (S-2) and extreme (S-3) scenarios.

Scenario	ES Configuration 1	DRI_lin	Class_lin	DRI_exp	Class_exp	DRI_log	Class_log
S-2 (min)	9 9 9 7	1.20	5	1.12	5	1.09	5
S-2 (max)	5 5 5 3	5.20	3	3.05	4	3.25	4
S-3 (min)	QM, ES = 9	0.20	5	0.21	5	0.20	5
S-3 (max)	ASIL D, ES = 0	16.00	1	16.00	1	16.00	1

¹ Subsystem order: Battery, Electric Powertrain, Charging System, Cables and Connectors.

and illustrated in Figure 1.

Table 7 presents the variation in the DRI_total with a uniform ES in Scenario S-1 (the base vector [3 3 3 1]). It is observed that, for ES = 0, the DRI_total remains at 10.00 and falls into Class 1 for all three models. With ES = 3, there is a more pronounced reduction in the exponential and logarithmic models (4.72, Class 3) compared to the linear model (7.00, Class 2). As the ES increases, the DRI_total drops more significantly in the exponential and logarithmic adjustments: at ES = 5, both nonlinear models are in Class 4 (exponential = 2.87; logarithmic = 3.08), while the linear model remains in Class 3 (5.00). At ES = 7, both nonlinear models are in Class 5 (exponential = 1.74; logarithmic = 1.90), while the linear model remains in Class 4 (3.00). At ES = 9, all models converge to Class 5, with values close to 1.00.

Table 8 shows the DRI_total ranges for realistic (S-2) and extreme (S-3) scenarios. In Scenario S-2 (min), with ES = 9, 9, 9, 7, the DRI_total varies from 1.20 (Class 5, linear) to 1.12 (Class 5, exponential) and 1.09 (Class 5, logarithmic). In Scenario S-2 (max), with ES = 5, 5, 5, 3, the index oscillates between 5.20 (Class 3, linear), 3.05 (Class 4, exponential), and 3.25 (Class 4, logarithmic). The extreme scenarios (S-3) confirm the theoretical maximum limit (16.00) in all three models; the theoretical minimum of 0.20 is reached in the linear and logarithmic adjustments, while the exponential results in 0.21, with all remaining in Class 5.

Figure 1 graphically illustrates the behavior of the DRI_total in Scenario S-1 for the three adjustment models, showing that the linear adjustment changes class only at the defined cutoff points, while the exponential and logarithmic adjustments anticipate this transition to Class 5 as early as ES = 7. The dotted horizontal lines indicate the provisional limits of classes 1–5, allowing for a visual comparison of the results obtained in Table 7 and Table 8.

The parameters α = ln(10)/9 ≈ 0.25 (exponential) and β = 0.85 (logarithmic) were defined by calibrating the anchor points (ES = 0 and ES = 9), ensuring the monotonicity and maintenance of the ordinal hierarchy in the analyzed ES range; it should be noted that these values do not constitute a definitive calibration but rather a provisional operational reference for the conceptual stage of the protocol. The final calibration of the parameters, as well as the choice of the adjustment function that best adheres to the empirical behavior of the documentary evidence, will be performed based on the data collected during the pilot phase and validated by technical consensus in the Delphi panel (Section 2.4.2), in order to ensure statistical representativeness and consistency with the model’s formulation.

3.3. Proposed Structure of the Safety Label

The safety label was designed to communicate the functional risk level of EVs unambiguously, ensuring consistency with the DRI algorithm described in Section 2.2 and the consolidated values in Section 3.2. As illustrated in Figure 2, the layout occupies an additional 25 mm column on the right-hand margin of the ENCE/PBE-V, while preserving the same self-adhesive vinyl substrate and avoiding visual or thematic overlap with the existing energy efficiency bands.

To ensure traceability, a QR code was integrated into the lower corner of the “Electrical Safety” column; scans redirect to a digital dossier that displays: (i) the DRIs for the battery, electric powertrain, charging system, and cables and connectors; (ii) the Evidence Scores for each subsystem; and (iii) a summary of the protocol. The modular structure allows biennial—or extraordinary, as per Section 4.3.1—revisions without changing dimensions or attachment points, thereby ensuring retroactive compatibility and a minimal logistical burden for manufacturers.

3.4. Application Simulation

To demonstrate the operability of the DRI and the proposed label, a hypothetical simulation was conducted involving 100 EV models. With the generic ASILs adopted (C, C, C, and A), the lowest value that the DRI_total can effectively reach is 1. The RRI_gen values presented in Table 6 were kept constant; the variability was exclusively due to the Evidence Score (ES) (0, 3, 5, 7, or 9) which was randomly assigned to each subsystem. For each vehicle, the DRI (Equation (1)) and the DRI_total (Equation (2)) were calculated, followed by the corresponding Class. The distribution obtained is presented in

Table 9. Simulated distribution of 100 vehicles according to DRI_total ranges.

Class	DRI_total Range	n	Average DRI_total
5 (safest)	<2.8	12	2.24
4	≥2.8 and <4.6	30	3.65
3	≥4.6 and <6.4	34	5.33
2	≥6.4 and <8.2	19	7.20
1 (least safe)	≥8.2	5	8.68

.

4. Discussion

The introduction of a functional safety labeling program for EVs has, in the preceding sections, established the necessary elements for the critical analysis that follows. The results obtained—the risk index, the ordinal classification, and EV high-voltage subsystems is expected to generate significant impacts across the Brazilian automotive value chain. For consumers, the label reduces informational asymmetry by providing standardized, comparable safety metrics (classes 1–5) that were previously unavailable, potentially increasing purchase confidence and accelerating EV adoption among risk-averse segments. Behavioral studies on energy efficiency labels demonstrate that visible, interpretable ratings influence purchasing decisions, particularly when integrated into existing trusted frameworks such as the ENCE/PBE-V label. For manufacturers, the program creates competitive incentives to invest in ISO 26262 compliance and obtain third-party certifications (ES = 9), differentiating products in an emerging market where regulatory requirements remain largely voluntary. This voluntary approach allows manufacturers to signal quality proactively, aligning with international market trends toward transparency in EV safety. For regulators, the adjustment program offers a market-driven data collection mechanism—are examined in that can inform future mandatory standards, tracking the following subsections for their impact on consumers, industry, and policymakers. evolution of safety practices across the Brazilian fleet without imposing immediate compliance burdens on a developing industry. This phased, evidence-based approach to regulation is consistent with best practices in emerging automotive markets.

In this section, the results are analyzed against the hypotheses that motivated the study, with a focus on the information gap regarding high-voltage risks in EVs. The discussion is organized into four parts: (i) lessons learned from the analysis of international programs; (ii) the model’s potential benefits and contributions to consumers, industry, and policymakers; (iii) aspects of governance, updates, and next steps for the program; and (iv) the method’s main challenges and identified limitations, and opportunities for protocol improvement.

4.1. Lessons Learned from International Models

The comparative analysis presented in Section 3.1 highlights five fundamental lessons for structuring a Brazilian safety labeling program for EVs. These lessons, extracted from the convergences and gaps identified in the eight international programs examined, ensure the technical consistency and alignment of the proposed model with best practices in conformity assessment.

First, none of the analyzed programs provides a physical label that enables consumers to compare the functional risk of high-voltage subsystems. Only KNCAP publishes a specific indicator for batteries, which is restricted to its portal and does not affect the vehicle’s overall rating, thereby reinforcing the need for an integrated index. Second, we note that, with the exception of the EPA/DOE label, all other programs use ordinal scales of five or six levels. For this reason, this study adopts five classes (1–5), as defined previously.

The third point highlights the importance of a hierarchy of technical evidence: protocols such as Euro NCAP, Green NCAP, and KNCAP assign greater weight to tests or certifications from accredited third-party bodies, a principle that is adopted in this study’s ES scale. The fourth aspect refers to the role of economic incentives in voluntary participation. The experience of the PBE-V demonstrated that the link to tax benefits resulted in the participation of the entire national fleet in 2023 [79]. Applying this strategy to the functional safety module is likely to increase participation without the need for regulatory mandates.

Finally, independent programs like Euro NCAP, Green NCAP, and Latin NCAP demonstrate that credibility depends on transparent governance, external audits, and periodic protocol revisions—elements that are also incorporated into the model proposed here. These five lessons—integrated communication, a compact scale, robust evidence, economic incentives, and transparent governance—form the conceptual basis of the Brazilian program presented in this study.

4.2. Potential Benefits and Contributions

The results presented in Section 3 demonstrate that the DRI algorithm, combined with the 1–5 scale, offers concrete benefits for consumers, industry, and policymakers. For consumers, the label introduces a comparable metric for the functional risk of the main subsystems, which is absent from both NCAPs and the PBE-V. By consolidating this information into a single indicator, the proposal reduces the information asymmetry traditionally recognized as an obstacle to the adoption of EVs. The simulation in Table 9 confirms the scale’s discriminatory power, allowing it to guide purchasing decisions and reduce uncertainties at the point of sale. The average DRI_total values evolve almost linearly between the classes, with intervals of approximately 1.7 points, which also reinforces its usefulness as a reference for incentive policies.

For manufacturers, the model offers a tool for competitive differentiation. Vehicles classified in Classes 4 or 5 demonstrate adequate adherence to functional safety requirements. This transparency is valued by investors, stimulates the use of accredited testing—which is already recognized by Euro NCAP and Green NCAP—and strengthens the national laboratory infrastructure.

In the regulatory and academic spheres, the periodic consolidation of the DRI_total results will enable the creation of a relevant statistical repository for adjusting public policies and class intervals. Although the voluntary nature preserves the program’s normative flexibility, the eventual link to tax incentives could accelerate participation, as occurred with the PBE-V.

From a methodological perspective, the proposal brings together a generic HARA, the linearization of ASIL, and a hierarchy of evidence into a post-homologation protocol that can be replicated in other emerging markets. The future integration of cybersecurity requirements (UN Regulation No. 155:2021 [122]; ISO/SAE 21434:2021 [123]) will expand the scope of protection and could position Brazil at the regulatory forefront of electromobility.

4.3. Governance, Updates, and Next Steps

The robustness of a voluntary program depends not only on its technical foundations but also on its management and capacity to adapt over time. This section presents the guidelines for governance, the mechanisms for periodic review, and the gradual incorporation of new requirements, initially addressing the protocol’s updates, the integration of cybersecurity, and, finally, the institutional structure envisioned to sustain the program.

4.3.1. Protocol Update

After the pilot phase, the protocol will undergo regular updates every two years, incorporating normative advancements, technological innovations, and evidence generated by its practical application. In addition to this schedule, extraordinary revisions may be carried out in response to specific situations: a recall involving 5% or more of the national fleet in a high-voltage subsystem; the publication of a new international standard that alters Severity, Exposure, or Controllability criteria; or the submission of technical data by any interested party that warrants adjustments to the classification parameters. In these cases, it will be the responsibility of the managing entity to propose the necessary revisions, open a public consultation, and conclude the process within six months, ensuring that the protocol remains aligned with the sector’s technical and normative requirements.

4.3.2. Cybersecurity Integration

Although the protocol in this phase only addresses functional safety related to physical electrical or electronic failures, it is recognized that cybersecurity vulnerabilities can also impair the controllability of vehicle systems or cause combined failures with a critical impact. For this reason, the progressive integration of a cybersecurity module is planned, aligned with UN Regulation No. 155:2021 [122] and the ISO/SAE 21434:2021 standard [123], to be implemented in two stages.

In the first stage, after the pilot phase, each proponent will be required to submit a declaration of conformity with an internal cybersecurity management process, in accordance with the principles of ISO/SAE 21434:2021 [123]. During this period, proven incidents of loss of controllability caused by cybersecurity vulnerabilities (C2 or C3) may lead, following an evaluation by the managing entity, to an extraordinary reduction in the Evidence Score (ES) of the corresponding subsystem.

In the second stage, which is planned within 24 months after the publication of the final protocol, a formal cybersecurity audit will be required, to be performed by a certification body accredited in accordance with the cited standards. The technical report from this audit may be used as additional evidence to adjust the RRI_gen, especially in cases where cybersecurity risks impact the critical functions of the evaluated subsystems.

This two-stage approach allows for the gradual alignment of the Brazilian protocol with international requirements, without imposing excessive requirements in the initial phase and giving manufacturers time to adapt technically to the new demands.

4.3.3. Governance and Program Management

To ensure the institutional credibility and effectiveness of the protocol, it is recommended that the program’s management be entrusted to a Brazilian public body with statutory authority for conformity assessment, preferably Inmetro. Alternatively, the coordination could be carried out by an interinstitutional consortium that includes representatives from Inmetro, the automotive industry, accredited laboratories, and consumer protection entities.

The managing entity should follow the principles of ISO/IEC 17067:2013 [124], particularly those of Type 5 schemes, which provide for initial conformity assessment, documentary audits, and periodic surveillance. It will also be necessary to establish a formal dispute-resolution procedure, ensuring that queries regarding the issued classifications are handled in a technical, transparent, and properly recorded manner.

In the event of serious nonconformities, the regulation must provide for graduated corrective measures, starting with a formal warning, and potentially including the temporary suspension of the classification and, if necessary, the permanent removal of the label. The proponent is entitled to a single appeal, within fifteen days, and the final decision will be made by the managing entity, supported by an independent technical opinion.

All decisions related to the suspension, revocation, or alteration of classifications must be published on a dedicated portal, maintained by the managing entity, with open access and regular updates. This transparency is essential for preserving consumer trust, ensuring predictability, and reinforcing the deterrent effect of the system.

4.4. Challenges and Limitations

Despite the methodological advancements, the proposal has limitations that must be explicitly stated to guide its scientific and operational evolution. In the pilot phase, aspects such as the viability of the classification algorithm, the quality and traceability of documents, and consumers’ perception of the label’s clarity, usefulness, and reliability will be evaluated. The corrections and adjustments to the classification scale, in accordance with Section 2.2.4, must be incorporated into the final version of the protocol before its publication. This stage will serve as a basis for addressing seven main challenges:

• Initial parametric robustness: The values assigned to Severity, Exposure, and Controllability are derived from international literature and engineering judgment. Although the generic HARA follows ISO 26262-3:2018 [17], the absence of national statistics could bias the RRI_gen. The pilot phase and the Delphi panel (Section 2.4) will enable the collection of field data to recalibrate these distributions. These records will subsequently be used to quantify the fault trees, gradually replacing the qualitative modeling with real occurrence rates and refining the S–E–C parameters.
• The assumption of independence among subsystems: The direct calculation of the DRI presupposes an absence of correlation between subsystem failures. In the pilot phase, empirical correlations must be estimated (as detailed in Section 2.2.4); if relevant, the model may be adjusted to incorporate coupling factors or common cause events in the FTAs.
• Linearization of the ASIL and model sensitivity: The conversion QM = 0.5, …, D = 4 is used solely for operational purposes and does not assume a real proportionality between the levels. Sensitivity tests (Section 2.2.5) indicated acceptable monotonicity, and the analysis in Section 3.2.6 showed that the model covers the entire scale (1–5) even in realistic and extreme ES scenarios, preserving the ordinal hierarchy and discriminatory power. However, the final adjustments of the linearization and class limits will depend on real data collected in the pilot phase, including complementary simulations based on realistic ES distributions, to ensure a better statistical fit to market data. These results show that the algorithm exhibits stable behavior, but its definitive calibration will be conditioned on empirical validation and the evolution of the protocol.
• Sample representativeness and subsystem coverage: The current protocol considers four high-voltage items, and the inclusion of new components will depend on Pareto analyses of the incidents recorded. Similarly, the simulated sample of 100 models (Section 3.4) must be compared with the actual fleet to validate the discriminatory power of the 1–5 scale.
• The cybersecurity dimension: Failures resulting from remote attacks can cause a loss of controllability without prior physical damage. The schedule for integrating the UN Regulation No. 155:2021 [122] and ISO/SAE 21434:2021 [123] module (Section 4.3.2) seeks to mitigate this gap, but it will require specific metrics and consistent integration with the Evidence Score (ES).
• Voluntary participation and governance: The program’s success is associated with a link to economic incentives and the transparency of audits. It will be necessary to define sustainable financing models to maintain the database and enable biennial revisions before implementation nationwide.
• Validation of the label layout: The graphic prototype (Figure 2, Section 3.3)—especially the ‘Electrical Safety’ column integrated into the ENCE—will be evaluated during the pilot phase for legibility, color contrast, and QR code ergonomics. Usability results may require dimensional or color adjustments before the final version, which would impact the industrial acceptance and communication effectiveness of the label.

5. Conclusions

The present study proposes a voluntary safety labeling program for electric vehicle high-voltage subsystems, adapted to the Brazilian regulatory context and grounded in ISO 26262:2018 (Functional Safety) and ISO 21448:2022 (SOTIF) principles. The framework integrates three core components: (i) a generic HARA-based risk classification model that assigns presumed functional criticality (RRI_gen) to four critical subsystems (battery, powertrain, charging, HV cables/connectors); (ii) a Document Reliability Index (DRI) that weights generic risk by the robustness of submitted technical evidence (Evidence Score 0–9); and (iii) a consumer-facing label with five ordinal classes (1–5) integrated into Brazil’s existing ENCE/PBE-V energy efficiency label, linked via a QR code to detailed subsystem data.

Application of the protocol to a simulated dataset of 100 BEV models demonstrated strong discriminatory power (CV = 36.7%), with approximately 85% of vehicles distributed across intermediate safety classes 2–4. The proposal addresses a critical gap in existing international vehicle assessment programs, none of which currently communicate functional safety performance of electrified subsystems to consumers in a standardized, comparable format.

The program is expected to (i) reduce consumer risk perceptions and information asymmetries, facilitating evidence-based EV purchasing decisions; (ii) incentivize manufacturers to invest in functional safety compliance and third-party certification as competitive differentiators; and (iii) provide regulators with market-driven data to inform future mandatory standards, supporting Brazil’s transition toward sustainable mobility.

Validation will proceed through a two-stage process: a Delphi panel with ≥12 multidisciplinary experts using an Analytic Hierarchy Process (AHP) methodology to refine model parameters (Q1 2026), followed by a 12-month pilot phase involving ≥20 EV models to empirically validate the classification algorithm, assess inter-subsystem correlations, and integrate cybersecurity dimensions per UN Regulation No. 155:2021 and ISO/SAE 21434:2021. Future program versions will incorporate SOTIF-based scenarios for algorithmically dependent subsystems (e.g., BMS state-of-charge estimation, charging communication protocols) and explore adaptability to other emerging markets through international accreditation frameworks (ILAC-MRA, IAF-MLA).

By harmonizing voluntary conformity assessment with global best practices in functional safety and consumer information, the proposed framework advances electric mobility adoption in Brazil while establishing a scalable model for emerging automotive markets worldwide.