ISO 21448, titled ‘Road Vehicles, Safety of the Intended Functionality (SOTIF),’ addresses a critical safety concern distinct from traditional functional safety: the risk of harm arising not from system malfunctions or failures, but from limitations in system design or foreseeable misuse during normal operation. This standard is particularly relevant for Advanced Driver Assistance Systems (ADAS) and autonomous vehicles, where sophisticated perception and decision-making systems may behave exactly as designed yet still create hazardous situations due to inherent functional limitations.
The SOTIF concept recognizes that even perfectly functioning systems have boundaries. A camera-based lane-keeping system may lose lane markings in snow or fog; a radar-based automatic emergency braking system may not detect stationary objects at certain closing speeds; a GNSS-based positioning system may provide degraded accuracy in urban canyons or during atmospheric anomalies. These scenarios represent ‘functional insufficiencies’, inherent limitations that can lead to unsafe outcomes even without any component failures.
ISO 21448 provides methodologies for identifying and mitigating SOTIF-related risks. The process involves defining the system’s intended functionality and operational design domain (ODD), identifying triggering conditions that could lead to hazardous behavior, evaluating the potential for both known and unknown unsafe scenarios, implementing measures to reduce triggering event probability or improve system response, and validating through extensive testing that residual risk is acceptable. The standard explicitly addresses the challenge of ‘unknown unknowns’, scenarios not anticipated during development that may emerge during real-world operation.
For GNSS positioning systems integrated into ADAS or autonomous vehicles, SOTIF considerations are substantial. Known functional insufficiencies include accuracy degradation in urban environments, susceptibility to multipath and interference, and atmospheric effects on signal propagation. SOTIF analysis must evaluate how positioning limitations could affect vehicle behavior, for example, whether accuracy degradation could cause lane-keeping assist to guide a vehicle out of its lane, and implement appropriate mitigations such as integrity monitoring, sensor fusion, and operational domain restrictions.
