Introduction

The safety of road vehicles during their operation phase is of paramount concern for the road vehicles industry. Recent years have seen a large increase in the number of advanced functionalities included in vehicles. These rely on sensing, processing of complex algorithms and actuation implemented by electrical and/or electronic (E/E) systems.

An acceptable level of safety for road vehicles requires the avoidance of unreasonable risk caused by every hazard associated with the intended functionality and its implementation, especially those not due to failures, e.g. due to performance limitations. ISO 26262‑1 defines the vehicle safety as the absence of unreasonable risks that arise from malfunctions of the E/E system. ISO 26262‑3 specifies a Hazard Analysis and Risk Assessment to determine vehicle level hazards. This evaluates the potential risks due to malfunctioning behaviour of the item and enables the definition of top-level safety requirements, i.e. the safety goals, necessary to mitigate the risks. The other parts of the ISO 26262 series provide requirements and recommendations to avoid and control random hardware failures and systematic failures that could violate safety goals.

For some systems, which rely on sensing the external or internal environment, there can be potentially hazardous behaviour caused by the intended functionality or performance limitation of a system that is free from the faults addressed in the ISO 26262 series. Examples of such limitations include:

— The inability of the function to correctly comprehend the situation and operate safely; this also includes functions that use machine learning algorithms;
— Insufficient robustness of the function with respect to sensor input variations or diverse environmental conditions.

The absence of unreasonable risk due to these potentially hazardous behaviours related to such limitations is defined as the safety of the intended functionality (SOTIF). Functional safety (addressed by the ISO 26262 series) and SOTIF are distinct and complementary aspects of safety.

To address the SOTIF, activities are implemented during the following phases:

— Measures in the design phase;

EXAMPLE

Requirement on sensor performance.
— Measures in the verification phase;

EXAMPLE

Technical Reviews, test cases with a high coverage of relevant scenarios, injection of potential triggering events, in the loop testing (e.g. SIL/HIL/MIL) of selected SOTIF are relevant use cases.
— Measures in the Validation phase.

EXAMPLE

Long term vehicle test, simulations.

A proper understanding of the function by the user, its behaviour and its limitations (including the human/machine interface) is the key to ensuring safety.

In many instances, a triggering event is necessary to cause a potentially hazardous behaviour; hence the importance of analysing hazards in the context of particular use cases.

In this document the hazards caused by a potentially hazardous system behaviour, due to a triggering event, are considered both for use cases when the vehicle is correctly used and for use cases when it is incorrectly used in a reasonably foreseeable way (this excludes intentional alterations made to the system’s operation).

EXAMPLE

Lack of driver attention while using a level 2 driving automation.

In addition, reasonably foreseeable misuse, which could lead directly to potentially hazardous system behaviour, is also considered as a possible triggering event.

A successful attack exploiting vehicle security vulnerabilities can also have very serious consequences (i.e. data or identity theft, privacy violation, etc.). Although security risks can also lead to potentially hazardous behaviour that needs to be addressed, security is not addressed by this document.

It is assumed that the E/E random hardware faults and systematic faults of the E/E system are addressed using the ISO 26262 series. The activities mentioned in this document are complementary to those given in the ISO 26262 series.

Table 1 illustrates how the possible causes of hazardous event map to existing standards.

Table 1 — Overview of safety relevant topics addressed by different ISO standards

Source	Cause of hazardous event	Within scope of
System	E/E System failures	ISO 26262 series
	Performance limitations or insufficient situational awareness, with or without reasonably foreseeable misuse	ISO/PAS 21448
	Reasonably foreseeable misuse, incorrect HMI (e.g. user confusion, user overload)	ISO/PAS 21448 ISO 26262 series European statement of principal on the design of human-machine-interface
	Hazards caused by the system technology	Specific standards
External factor	successful attack exploiting vehicle security vulnerabilities	ISO 21434 ^a or SAE J3061
	Impact from active Infrastructure and/or vehicle to vehicle communication, external devices and cloud services.	ISO 20077 series; ISO 26262 series
	Impact from car surroundings (other users, “passive” infrastructure, environmental conditions: weather, Electro-Magnetic Interference…)	ISO/PAS 21448 ISO 26262 series

a Under preparation. Stage at the time of publication: ISO/SAE CD 21434.

NOTE Options for automated driving level definitions (from NHTSA, SAE and OICA, etc.) are discussed in the ITS-Informal Group ECE/TRANS/WP29.

PD ISO/PAS 21448:2019

Road vehicles. Safety of the intended functionality

Published:

31 Jan 2019

Withdrawn:

6 Jul 2022