ISO/DIS 21448

Road vehicles -- Safety of the intended functionality

Véhicules routiers -- Sécurité de la fonction attendue

Standards Content (sample)

DRAFT INTERNATIONAL STANDARD
ISO/DIS 21448
ISO/TC 22/SC 32 Secretariat: JISC
Voting begins on: Voting terminates on:
2021-01-20 2021-04-14
Road vehicles — Safety of the intended functionality
Véhicules routiers — Sécurité de la fonction attendue
ICS: 43.040.10
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENT AND APPROVAL. IT IS
THEREFORE SUBJECT TO CHANGE AND MAY
NOT BE REFERRED TO AS AN INTERNATIONAL
STANDARD UNTIL PUBLISHED AS SUCH.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
This document is circulated as received from the committee secretariat.
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
STANDARDS MAY ON OCCASION HAVE TO
BE CONSIDERED IN THE LIGHT OF THEIR
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
Reference number
NATIONAL REGULATIONS.
ISO/DIS 21448:2021(E)
RECIPIENTS OF THIS DRAFT ARE INVITED
TO SUBMIT, WITH THEIR COMMENTS,
NOTIFICATION OF ANY RELEVANT PATENT
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION. ISO 2021
---------------------- Page: 1 ----------------------
ISO 21448:2020(X)
ISO/DIS 21448:2021(E)

6.4 Risk evaluation ...................................................................................................................................................... 33

6.5 Specification of acceptance criteria .............................................................................................................. 34

6.6 Work Products....................................................................................................................................................... 36

7 Identification and evaluation of potential functional insufficiencies and triggering

conditions......................................................................................................................................................................36

7.1 Objectives................................................................................................................................................................. 36

7.2 General...................................................................................................................................................................... 36

7.3 Analysis of potential functional insufficiencies and triggering conditions .................................. 36

7.4 Estimation of the acceptability of the response of the system to the triggering conditions. 42

7.5 Work Products....................................................................................................................................................... 43

8 Functional modifications addressing SOTIF-related risks............................................................ 43

8.1 Objectives................................................................................................................................................................. 43

8.2 General...................................................................................................................................................................... 43

8.3 Measures to improve the SOTIF ..................................................................................................................... 44

8.4 Updating the input information for “Specification and design”........................................................ 46

8.5 Work Products....................................................................................................................................................... 47

9 Definition of the verification and validation strategy.....................................................................47

9.1 Objectives................................................................................................................................................................. 47

9.2 General...................................................................................................................................................................... 47

9.3 Specification of integration and testing ...................................................................................................... 48

9.4 Work products....................................................................................................................................................... 51

10 Evaluation of known hazardous scenarios (Area 2)........................................................................51

10.1 Objectives................................................................................................................................................................. 51

10.2 General...................................................................................................................................................................... 51

10.3 Sensing verification ............................................................................................................................................. 51

10.4 Planning algorithm verification...................................................................................................................... 52

10.5 Actuation verification ......................................................................................................................................... 53

COPYRIGHT PROTECTED DOCUMENT

10.6 Integrated system verification........................................................................................................................ 54

© ISO 2021

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

10.7 Acceptability of residual risk due to known hazardous scenarios .................................................. 54

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting

on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address

10.8 Work products....................................................................................................................................................... 55

below or ISO’s member body in the country of the requester.
ISO copyright office

11 Evaluation of unknown hazardous scenarios (Area 3)...................................................................55

CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]

11.1 Objectives................................................................................................................................................................. 55

Fax: [phone]
Email: [e-mail]

11.2 General...................................................................................................................................................................... 55

Website: www.iso.org
Published in Switzerland

11.3 Evaluation of residual risk due to unknown scenarios......................................................................... 55

ii © ISO 2021 – All rights reserved
© ISO 2020 – All rights reserved iii
---------------------- Page: 2 ----------------------
ISO/DIS 21448:2021(E)
ISO 21448:2020(X)
© ISO 2018

All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or

utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or

posting on the internet or an intranet, without prior written permission. Permission can be requested

from either ISO at the address below or ISO's member body in the country of the requester.

ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail [e-mail]
Web www.iso.org
Published in Switzerland.
Contents

Foreword .......................................................................................................................................................................... 6

Introduction..................................................................................................................................................................... 7

1 Scope ................................................................................................................................................................. 10

2 Normative references ................................................................................................................................. 11

3 Terms and definitions................................................................................................................................. 11

4 Overview and organization of SOTIF activities ................................................................................. 18

4.1 General ...................................................................................................................................................................... 18

4.2 SOTIF principles .................................................................................................................................................... 18

4.3 Use of this document ........................................................................................................................................... 23

4.4 Management of SOTIF activities and supporting processes ............................................................... 25

5 Specification and design ............................................................................................................................ 27

5.1 Objectives................................................................................................................................................................. 27

5.2 Specification of the functionality and considerations for the design .............................................. 27

5.3 Consideration on system design and architecture ................................................................................. 28

5.4 Work Products ....................................................................................................................................................... 31

6 Identification and evaluation of hazards ............................................................................................. 31

6.1 Objectives................................................................................................................................................................. 31

6.2 General ...................................................................................................................................................................... 31

6.3 Hazard identification .......................................................................................................................................... 31

ii © ISO 2021 – All rights reserved
---------------------- Page: 3 ----------------------
ISO/DIS 21448:2021(E)
ISO 21448:2020(X)

6.4 Risk evaluation ...................................................................................................................................................... 33

6.5 Specification of acceptance criteria .............................................................................................................. 34

6.6 Work Products ....................................................................................................................................................... 36

7 Identification and evaluation of potential functional insufficiencies and triggering

conditions ...................................................................................................................................................................... 36

7.1 Objectives................................................................................................................................................................. 36

7.2 General ...................................................................................................................................................................... 36

7.3 Analysis of potential functional insufficiencies and triggering conditions .................................. 36

7.4 Estimation of the acceptability of the response of the system to the triggering conditions . 42

7.5 Work Products ....................................................................................................................................................... 43

8 Functional modifications addressing SOTIF-related risks ............................................................ 43

8.1 Objectives................................................................................................................................................................. 43

8.2 General ...................................................................................................................................................................... 43

8.3 Measures to improve the SOTIF ..................................................................................................................... 44

8.4 Updating the input information for “Specification and design” ........................................................ 46

8.5 Work Products ....................................................................................................................................................... 47

9 Definition of the verification and validation strategy ..................................................................... 47

9.1 Objectives................................................................................................................................................................. 47

9.2 General ...................................................................................................................................................................... 47

9.3 Specification of integration and testing ...................................................................................................... 48

9.4 Work products ....................................................................................................................................................... 51

10 Evaluation of known hazardous scenarios (Area 2) ........................................................................ 51

10.1 Objectives................................................................................................................................................................. 51

10.2 General ...................................................................................................................................................................... 51

10.3 Sensing verification ............................................................................................................................................. 51

10.4 Planning algorithm verification ...................................................................................................................... 52

10.5 Actuation verification ......................................................................................................................................... 53

10.6 Integrated system verification ........................................................................................................................ 54

10.7 Acceptability of residual risk due to known hazardous scenarios .................................................. 54

10.8 Work products ....................................................................................................................................................... 55

11 Evaluation of unknown hazardous scenarios (Area 3) ................................................................... 55

11.1 Objectives................................................................................................................................................................. 55

11.2 General ...................................................................................................................................................................... 55

11.3 Evaluation of residual risk due to unknown scenarios ......................................................................... 55

© ISO 2021 – All rights reserved iii
---------------------- Page: 4 ----------------------
ISO/DIS 21448:2021(E)
ISO 21448:2020(X)

11.4 Acceptability of residual risk due to unknown hazardous scenarios ............................................. 57

11.5 Work products ....................................................................................................................................................... 57

12 Criteria for SOTIF release .......................................................................................................................... 57

12.1 Objectives................................................................................................................................................................. 57

12.2 General ...................................................................................................................................................................... 58

12.3 Criteria for evaluating SOTIF for release .................................................................................................... 58

12.4 Criteria and methods for SOTIF evaluation ............................................................................................... 60

12.5 Work products ....................................................................................................................................................... 60

13 Operation phase activities ........................................................................................................................ 60

13.1 Objectives................................................................................................................................................................. 60

13.2 General ...................................................................................................................................................................... 60

13.3 Objects of observation ........................................................................................................................................ 61

13.4 SOTIF issue evaluation and resolution process ....................................................................................... 62

13.5 Work Products ....................................................................................................................................................... 63

Annex A (informative) General guidance on SOTIF ....................................................................................... 64

A.1 Examples of structuring the SOTIF argumentation with GSN ........................................................... 64

A.2 Explanations regarding the interaction between functional safety according to the ISO 26262

series and this document....................................................................................................................................................... 83

A.3 Simplified SOTIF Application Examples ...................................................................................................... 93

Annex B (informative) Guidance on Scenario and system analyses ....................................................... 96

B.1 Method for deriving SOTIF misuse scenarios ........................................................................................... 96

B.2 Example construction of scenario factors for SOTIF safety analysis method ............................. 99

B.3 Examples of adaptation of safety analyses to identify and evaluate the potential triggering

conditions and functional insufficiencies ..................................................................................................................... 105

B.4 Applying STPA in the Context of SOTIF for ADAS and Automated Vehicles .............................. 115

Annex C (informative) Guidance on SOTIF verification and validation .............................................. 120

C.1 Purpose of the Validation Strategy .............................................................................................................. 120

C.2 Example for definition and validation of an acceptable false positive activation rate in AEB

systems 121

C.3 Validation of SOTIF Applicable Systems ................................................................................................... 127

C.4 Perception system verification and validation ....................................................................................... 130

C.5 Guidance on scenario parameterization and sampling ...................................................................... 140

C.6 Considerations for reducing validation testing...................................................................................... 148

Annex D (informative) Guidance on specific aspects of SOTIF............................................................... 156

D.1 Guidance for driving policy specification ................................................................................................. 156

iv © ISO 2021 – All rights reserved
---------------------- Page: 5 ----------------------
ISO/DIS 21448:2021(E)
ISO 21448:2020(X)

D.2 Implications for machine learning .............................................................................................................. 166

D.3 SOTIF considerations for maps..................................................................................................................... 172

D.4 SOTIF considerations for V2X ....................................................................................................................... 174

© ISO 2021 – All rights reserved v
---------------------- Page: 6 ----------------------
ISO/DIS 21448:2021(E)
ISO 21448:2020(X)
1 Foreword

2 ISO (the International Organization for Standardization) is a worldwide federation of national standards

3 bodies (ISO member bodies). The work of preparing International Standards is normally carried out

4 through ISO technical committees. Each member body interested in a subject for which a technical

5 committee has been established has the right to be represented on that committee. International

6 organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO

7 collaborates closely with the International Electrotechnical Commission (IEC) on all matters of

8 electrotechnical standardization.

9 The procedures used to develop this document and those intended for its further maintenance are

10 described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the

11 different types of ISO documents should be noted. This document was drafted in accordance with the

12 editorial rules of the ISO/IEC Directives, Part 2. www.iso.org/directives

13 Attention is drawn to the possibility that some of the elements of this document may be the subject of

14 patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any

15 patent rights identified during the development of the document will be in the Introduction and/or on

16 the ISO list of patent declarations received. www.iso.org/patents

17 Any trade name used in this document is information given for the convenience of users and does not

18 constitute an endorsement.

19 For an explanation on the meaning of ISO specific terms and expressions related to conformity

20 assessment, as well as information about ISO's adherence to the WTO principles in the Technical Barriers

21 to Trade (TBT) see the following URL: Foreword - Supplementary information
22 The committee responsible for this document is ISO/TC22/SC32/WG8
23 ISO 21448 consists of this document only.
6 © ISO 2021 – All rights reserved
---------------------- Page: 7 ----------------------
ISO/DIS 21448:2021(E)
ISO 21448:2020(X)
24 Introduction

25 The safety of road vehicles during their operation phase is of paramount concern for the road vehicles

26 industry. The number of advanced functionalities included in vehicles is increasing. These rely on sensing,

27 processing of complex algorithms and actuation implemented by electrical and/or electronic (E/E)

28 systems.

29 An acceptable level of safety for road vehicles requires the avoidance of unreasonable risk caused by

30 every hazard associated with the intended functionality and its implementation, especially those hazards

31 not due to failures, but due to insufficiencies of specification or performance limitations.

32 For the achievement of functional safety (FuSa), ISO 26262-1 defines the functional safety as the absence

33 of unreasonable risk due to hazards caused by malfunctioning behaviour of the E/E system. ISO 26262-3

34 defines how to develop a Hazard Analysis and Risk Assessment (HARA) to determine vehicle level

35 hazards. The HARA evaluates the potential risks due to malfunctioning behaviour of the item to

36 determine top-level safety requirements, i.e. the safety goals, necessary to mitigate the risks. The other

37 parts of the ISO 26262 series provide requirements and recommendations to avoid and control random

38 hardware failures and systematic failures that could violate safety goals.

39 For some E/E systems, which rely on sensing the external or internal environment to build situational

40 awareness, there can be potentially hazardous behaviour caused by the intended functionality, despite

41 these systems being free from the faults addressed in the ISO 26262 series. Example causes of such

42 potentially hazardous behaviour include:
43 - the inability of the function to correctly perceive the environment;

44 - the lack of robustness of the function, system, or algorithm with respect to sensor input

45 variations, heuristics used for fusion, or diverse environmental conditions;

46 - the unexpected behaviour due to decision making algorithm and/or divergent human

47 expectations.

48 This also applies to functions, systems or algorithms that use machine learning. The absence of

49 unreasonable risk due to these potentially hazardous behaviours related to these functional

50 insufficiencies is defined as the safety of the intended functionality (SOTIF). Functional safety (addressed

51 by the ISO 26262 series) and SOTIF are distinct and complementary aspects of safety.

52 To address the SOTIF, measures to eliminate hazards or reduce risks are implemented during the

53 following phases:
54 - the specification and design phase;

55 EXAMPLE Modification of vehicle functionality or of sensor performance requirements, driven by

56 identified system limitations or by previously unknown hazardous scenarios.
57 - the verification phase;

58 EXAMPLE Technical Reviews, test cases with a high coverage of relevant scenarios, injection of

59 potential triggering conditions, in the loop testing (e.g. SIL : Software in the loop / HIL : Hardware in the

60 loop / MIL : Model in the loop) of selected SOTIF-relevant scenarios.
© ISO 2021 – All rights reserved 7
---------------------- Page: 8 ----------------------
ISO/DIS 21448:2021(E)
ISO 21448:2020(X)
61 - the validation phase;
62 EXAMPLE Long-term vehicle test, simulation-based testing.
63 - the operation phase;
64 EXAMPLE Field monitoring of SOTIF incidents.

65 In many instances, triggering conditions are necessary to cause a potentially hazardous behaviour. In

66 addition, triggering conditions include reasonably foreseeable direct misuse. Therefore, a proper

67 understanding by the user of the functionality, its behaviour and its limitations (including the

68 human/machine interface) is essential to ensure safety.

69 In this document, potentially hazardous behaviour is considered for use cases when the vehicle is

70 correctly used and for use cases when it is incorrectly used in a reasonably foreseeable way (this excludes

71 intentional alterations made to the system’s operation).
72 EXAMPLE Lack of driver attention while using a level 2 driving automation

73 In addition, reasonably foreseeable misuse, which could lead directly to potentially hazardous behaviour,

74 is also considered as possible triggering conditions.

75 EXAMPLE Mode confusion (e.g. the driver thinks the function is activated when it is deactivated) can directly

76 lead to a hazard.

77 EXAMPLE By opening the door, the user unintentionally obstructs a sensor’s field of view.

78 A successful attack exploiting vehicle security vulnerabilities can also have very serious consequences

79 (i.e. data or identity theft, privacy violation). Although security risks can also lead to potentially

80 hazardous behaviour that needs to be addressed, security is not considered by this document.

81 Ensuring compliance with local driving laws, policies, or road norms is out of scope of this document,

82 except in the case where not following laws and rules of the road could lead to safety hazards.

83 In addition, operation or assistance of a vehicle by a remote user or communication with a back office

84 that can affect vehicle decision making is in scope of this document when it can lead to safety hazards.

85 One could interpret the functional insufficiencies addressed in this document as systematic faults.

86 However, the measures to address these functional insufficiencies are specific to this document and

87 complementary to the one
...