Safety of the Intended Functionality (SOTIF / ISO 21448)

Safety of the Intended Functionality (SOTIF) refers to the absence of unreasonable risk stemming from hazardous behaviour caused by functional insufficiencies. Governed by ISO 21448, SOTIF addresses safety risks in autonomous driving and advanced driver assistance systems (ADAS) arising from inherent design limitations, performance insufficiencies, or reasonably foreseeable human misuse—even in the complete absence of system faults. Together with functional safety (ISO 26262) and cybersecurity (ISO 21434), SOTIF forms the core "iron triangle" of connected and automated vehicle (CAV) safety.

Background

Functional safety (ISO 26262) focuses on mitigating random hardware faults and systematic failures within electrical and electronic (E/E) architectures. However, real-world industry applications revealed that even when every component functions flawlessly, automated driving systems may still struggle in specific environments—such as camera blindness caused by direct glare, sensor blockages from extreme weather, or algorithmic misjudgements on complex, rare road layouts. As autonomous driving capabilities advance, risks stemming from pure "performance limitations" cannot be addressed by conventional functional safety frameworks alone, driving the development of the SOTIF methodology.

Core Concepts: The Three-Circle Model and Four-Quadrant Scenarios

ISO 21448 uses a three-circle model to illustrate the core principle of SOTIF, highlighting the discrepancies between the user's expected behaviour (ideal state), the engineer's specified behaviour (system specification), and the system's actual behaviour (real-world performance). The objective of SOTIF is to maximise the overlap among these three domains through iterative development, thereby minimising safety risks triggered by behavioural discrepancies.

The standard categorises operational scenarios encountered by automated driving systems into four quadrants:

• Area 1 (Known Safe Scenarios): Known scenarios that the system can handle safely.

• Area 2 (Known Hazardous Scenarios): Known hazardous scenarios where functional insufficiencies exist.

• Area 3 (Unknown Hazardous Scenarios): Unknown hazardous scenarios where functional insufficiencies exist.

• Area 4 (Unknown Safe Scenarios): Unknown scenarios that the system can handle safely.

The ultimate goal of SOTIF is to progressively expand Area 1 while reducing Area 2 and Area 3 to an acceptable risk threshold via continuous analysis, validation, and engineering refinements.

Key Risk Factors

SOTIF risks are primarily driven by two core factors:

Functional Insufficiencies: These include sensor perception limitations (e.g., degraded camera performance in heavy rain or fog), decision-making algorithm shortfalls (e.g., poor generalization due to limited training datasets), and actuator response deviations.

Reasonably Foreseeable Human Misuse: These include driver over-reliance due to a lack of understanding of system limits, human-machine interfaces (HMI) failing to clearly communicate operational status, and driver inattentiveness leading to an inability to regain manual control in time.

Differences Between SOTIF and ISO 26262 Functional Safety

Functional safety focuses on whether the system operates strictly according to its engineering design, tackling risks triggered by internal faults; SOTIF evaluates whether the system's intended design itself is safe and sufficient, tackling risks caused by functional insufficiencies. Simply put, functional safety takes an "execution-focused" approach—ensuring every part completes its designated task without breaking down; SOTIF takes a "big-picture" view—evaluating whether the overall design is truly comprehensive and whether critical real-world edge cases have been overlooked.

Both frameworks complement each other: functional safety serves as the baseline requirement, whilst SOTIF builds on top of it to ensure comprehensive operational safety.

Regulatory and Standardisation Progress

Preliminary research on ISO 21448 began in 2016, leading to formal project approval in 2018 and the official release of its first edition in 2022. According to the International Organization for Standardization (ISO), the standard is currently under revision (Stage: 20.00), with the second edition currently being drafted.

In China, the Ministry of Industry and Information Technology (MIIT) has integrated SOTIF into mandatory market access requirements under its guidelines for intelligent connected vehicle manufacturers. Concurrently, the European Union has implemented UN-R157 for Automated Lane Keeping Systems (ALKS)—the world's first formal Level 3 autonomous driving regulation—which sets out stringent, explicit technical requirements for SOTIF compliance.

Implementation Framework

A standard SOTIF implementation workflow involves several key phases: Item Definition (referencing ISO 26262 principles); Hazard Analysis and Risk Assessment (using tools such as HAZOP to assess severity, exposure rate, and controllability to determine acceptable risk levels); Identification of Functional Insufficiencies and Triggering Conditions (utilising STPA or FTA to pinpoint root causes behind hazards); Safety Measures and System Optimisation (mitigating risks via upgraded hardware, refined algorithms, added redundancy, or Operational Design Domain [ODD] restrictions); Verification and Validation (leveraging multi-tier testing, including simulations, Hardware-in-the-Loop [HIL], and real-world road tests); and Post-Deployment Field Monitoring (continuously capturing edge-case data for over-the-air updates and iterative refinements). Crucially, "scenario-based testing" remains the cornerstone methodology for achieving full SOTIF compliance.