Toyota redefines SDVs not as “cars that can be updated,” but as “cars whose safety does not waver even after updates.” While President Hirofumi Inoue expands the boundary of safety beyond the vehicle - toward people, infrastructure, and social systems - Jean-Francois Compeau, Vice President at Woven by Toyota, presents a software-driven method for proving that safety through verification. Yui-maru, THUMS, and GAIA symbolize Toyota’s operational strength in running safety not as an intention or slogan, but as a continuous loop of data - intervention - verification. In the SDV era, trust does not begin with impressive features. It begins with verifiable safety - safety that ensures a car behaves, tomorrow morning, just as uneventfully as “mother’s car.”

By Sang-Min Han _ han@autoelectronics.co.kr
한글로보기





The automobile has become a “giant computer,” continuously connected to the cloud. As updates and services become routine, complexity increases - but one expectation from users remains unchanged: that the car will start this morning just as it did yesterday.
The moment that “obviousness” is broken, trust collapses - not in an app or a feature, but in the car itself.
In the SDV era, preserving this obviousness is not merely about convenience or brand experience. The first principle of SDV is safety. Once software shapes the vehicle experience throughout its entire lifecycle, safety is no longer a selectable option or a performance metric of a single function. Safety becomes a baseline state that the entire system must maintain every day.
As updates accumulate and complexity grows, the assumption of “it’ll probably be fine” can no longer guarantee safety. Before competing on speed, SDVs must first prove that they can evolve without allowing safety to erode.
At Automotive World 2026 at Tokyo Big Sight, two Toyota figures addressed this challenge from different layers: Hirofumi Inoue, President of Toyota’s Advanced R&D and Engineering Company, and Jean-Francois Compeau, Vice President at Woven by Toyota.
Inoue expanded the definition of safety beyond the vehicle itself, while Compeau explained how that safety can be proven through software. Their languages differ, but their conclusion converges on one point:
An SDV is not a car that can be updated - it is a car whose safety remains intact after every update.
The keyword connecting the two is verification. Once Toyota redefines “zero accidents” as a societal outcome, the method for maintaining and improving that system can no longer rely on belief - it must rely on verification. Woven’s Arene is an attempt to build a structure where repeated updates do not increase anxiety, but instead accumulate safety and trust.
Toyota’s blueprint for ensuring that “mother’s car” still starts tomorrow morning leads from the principle of “safety first” to its realization as a verifiable system.



When “Mother’s Car” Breaks

“My mother drives a 17-year-old Japanese car, and she doesn’t even know it has software. What matters to her is whether the car starts in the morning, no matter what happened overnight.”
Compeau opened his keynote with the metaphor of “mother’s car.” What customers want first in the SDV era is not new features, but continuity of basic operation. This story, however, does not stop at emotional appeal. In SDVs, when basic operation fails, the issue escalates beyond inconvenience - it becomes a fracture in safety itself. At that moment, the question shifts from software reliability to a fundamental one: Can this car be trusted?
Drawing from his own experience of a PC freezing moments before a presentation, Compeau described customer experience as fundamentally emotional. Discomfort leads to dissatisfaction; fear destroys trust. And the object of that trust is not a service - it is the car itself.
In SDVs, this emotional sensitivity intensifies. Persistent connectivity introduces external variables - cloud outages, network instability, supply-chain updates, unpredictable interactions - all of which can affect vehicle behavior.
“We can no longer keep building cars, validating them once, and then simply believing everything will be fine.”
The core of Compeau’s message was not update capability itself, but the stamina of trust - the ability for safety to improve as updates accumulate. Verification cannot be a one-time, end-stage event; it must repeat from the very beginning. The competition in SDVs is not about how fast features are added, but about whether safety becomes more certain with each addition.



Toyota’s Definition of Safety - and Its Roots

The “safety” described by President Inoue is not a checklist of features. Airbags, braking, and body rigidity alone cannot address the complexity of the SDV era.
“Zero accidents cannot be achieved by vehicle performance alone.”
Safety does not end inside the vehicle. It is an outcome created through cooperation among people, infrastructure, and vehicles. In SDVs - where software repeatedly modifies vehicle behavior - safety is no longer a product attribute but a state the system must continuously maintain. Once safety becomes a premise, it cannot remain confined within the car; it must expand to the entire system boundary.
This definition is not a sudden slogan. It is an extension of Toyota’s historical narrative. Inoue traces Toyota’s origins to “thinking of someone else.” Sakichi Toyoda invented the automatic loom for his mother, who worked late into the night. Kiichiro Toyoda, witnessing trucks sustain society after the Great Kanto Earthquake, dreamed of cars accessible to everyone.
These are not sentimental anecdotes - they establish a direction: technology exists to serve people. Hence Toyota’s mission of “mass-producing happiness,” with safety as its most fundamental condition.
Inoue further explains Toyota’s transition from an automotive company to a mobility company through three phases. Mobility 1.0 focused on convenience; 2.0 expanded access for those with limited mobility; and 3.0 integrates society itself. Energy, cities, logistics, and transportation must be designed as interconnected systems, not silos.
This philosophy underpins initiatives such as Woven City, where Toyota validates autonomous driving and hydrogen infrastructure at the urban scale.
“Zero accidents cannot be achieved by vehicle performance alone. Infrastructure, people, and vehicles must cooperate.”
Sensors at intersections detect unseen vehicles, while AI agents advise drivers to watch for pedestrians and cross traffic. The focus shifts from post-accident response to pre-emptive risk detection and behavioral guidance. Safety expands beyond the car into an anticipatory system.



Okinawa Yui-maru Project. Toyota’s field results demonstrating reduced accidents, risky behavior, and fuel consumption through a loop of “observe → intervene → verify.”



Yui-maru Project
Finding Risk Through Data - and Changing Behavior

A concrete example of this system-level safety is the Yui-maru Project in Okinawa. Designed for a tourist region with high rental-car usage, the project integrates vehicle data with police accident records. Driving behaviors - hard braking, sudden acceleration, lane deviation - are mapped against accident hotspots.
Before entering these zones, drivers receive alerts such as: “Sharp curve ahead. Reduce speed and watch the road.” The goal is not post-incident analysis, but pre-emptive behavioral change.
The results were measurable. Collisions in left-turn priority-free zones dropped by over 70%. Simple interventions - rubber poles and road markings - guided attention and delivered outcomes.
This illustrates Toyota’s concept of safety: identifying risk through data, intervening, and verifying results. Safety becomes a measurable outcome, sustained by a continuous loop operating both inside and outside the vehicle.




THUMS simulation assuming new seating postures in the autonomous driving era—next-generation occupant protection concepts controlling pelvis and upper-body motion in reclining environments.



THUMS
Opening Safety Research as a Fundamental Right

While Yui-maru addresses societal safety, THUMS focuses on the human body inside the vehicle. THUMS (Total Human Model for Safety) is a virtual human model used for crash simulation, representing bones, muscles, and organs with finite elements at 3 - 5 mm resolution.
Unlike crash dummies that measure impact forces, THUMS predicts internal injuries virtually.
In 2021, Toyota released THUMS free of charge. Over 100 organizations and 400 users now apply it across diverse research fields. By supporting variations in age, gender, body type, posture, and reclining positions, THUMS reduces experimental costs and accelerates safety development.
This openness reflects Toyota’s belief that safety is not a competitive advantage, but a shared foundation. In the SDV era, safety must be collectively improved, not enclosed behind proprietary walls.



GAIA
Not “AI Adoption,” but Organizational Learning Capacity

Inoue defines AI not as Artificial Intelligence, but Augmented Intelligence - AI that supports human judgment and imagination rather than replacing it. Toyota institutionalizes this philosophy through GAIA (Global AI Accelerator).
GAIA is less about branding than function. In SDVs, safety insights cannot simply accumulate in isolated silos; they must propagate across the organization and feed into future products and updates. Safety is not a one-time design result - it is a state repeatedly maintained in a changing environment.
GAIA represents the learning and diffusion capacity required to sustain that state.



Toyota’s SDV development platform, Arene. Connecting requirements, development, testing, and verification through a virtual vehicle and unified data—treating SDV safety as a verifiable system rather than a feature.



Woven’s Challenge to “Verification”
Shift-Left and Arene

Compeau argues that traditional automotive development paradigms break down in the SDV era - not because of technology, but culture. Modularization, black-box thinking, and mature processes create inertia: Why change?
In SDVs, late integration and late verification are wasteful. The traditional V-model must be reinterpreted as a sequence of many small V-models. Software integration itself no longer creates customer value - it becomes waste when unmanaged.
Black boxes, silos, and NDA-driven fragmentation undermine Shift-Left practices. Verification must move earlier, with continuous collaboration and testing.
Compeau outlined five principles: transition from black-box to white-box thinking; centralized architectures and signal management; agile and transparent processes; early verification via virtualization and emulation; and treating tools as long-term assets.
Arene operationalizes these principles. Arene SDK reduces hardware dependencies and enables reusable software modules, while Arene Tools visualize, test, and verify software in virtual environments - reducing reliance on physical prototypes.
The core is not “building a platform,” but shifting the time axis of safety proof. If safety is only verified at the end, repeated updates create verification gaps. When safety is a premise, it must be continuously proven from the beginning.
Requirements, code, tests, and results must remain traceable. If a function requires a one-second response, simulations and test cases must directly reflect that requirement. Break that link, and an SDV can pass tests yet fail safety.
Virtualization and emulation allow errors to surface early - before hardware is finalized. Verification is shifted left not for speed, but to reduce uncertainty in safety.




Domatics and WAVEBASE concepts at the Toyota booth. A data-driven operational model connecting selection and verification - applied equally to SDV safety across requirements, design, supply chain, and operations.



Harmonizing Prediction and Emotion
“Natural Intervention” Makes Safety Tangible

“If you tell an angry person, ‘You’re angry,’ they become angrier. Suggest first - control should be the last resort.”
Warnings must be timely; control should be a final option. Predictable systems create emotional reassurance. Safety is not only about sensors and algorithms, but about how humans perceive them. When anxiety accumulates, even a technically safe system feels unsafe.
Safety is completed at the level of experience: does the system respond in a way people can anticipate?
Aging Together with the Car, Sustaining Trust
Taken together, the two keynotes form a coherent message. Toyota re-establishes safety as the baseline of SDVs, while Woven demonstrates how that safety can be proven through software and operations.
The competition in the SDV era is not about flashy UI. It is about ensuring that “mother’s car” still starts tomorrow morning - and that this obviousness is backed by verifiable safety systems.
Toyota’s vision of a car that ages together with people emerges from integrating hardware, software, and social infrastructure into a single, predictable system.
The final question remains simple - and fundamental:
Will the car start tomorrow morning, as if nothing happened?
And will that “obviousness” be proven in the language of safety?


 

AEM(오토모티브일렉트로닉스매거진)