Overview

Defines safety of the intended functionality (SOTIF) and gives an argument framework and design, verification, validation and operation measures for hazards arising from functional insufficiencies rather than component failures.

ISO 21448:2022 addresses the safety of the intended functionality, or SOTIF, defined as the absence of unreasonable risk due to hazards resulting from functional insufficiencies of the intended functionality or its implementation. It became a full International Standard in 2022, replacing ISO/PAS 21448:2019.

The central idea is that a system can be entirely free of faults and still be unsafe. A perception system whose camera and processing chain work exactly as designed may still fail to classify an unusual object; an emergency braking function may activate in a situation its specification never anticipated. ISO 21448 deals with these two categories of functional insufficiency: incomplete or inadequate specification of the intended functionality at vehicle or system level, and performance limitations in the implementation of the electrical and/or electronic (E/E) elements — including sensors and algorithms — under real-world conditions.

Relationship to ISO 26262. SOTIF and functional safety are complementary. ISO 26262 addresses unreasonable risk arising from malfunctioning behaviour caused by faults in E/E systems, with its ASIL-based development process. ISO 21448 addresses risk that remains when there is no fault at all. A modern ADAS or automated driving programme typically applies both: ISO 26262 for the fault-driven hazards and ISO 21448 for the specification and performance-driven ones. ISO/SAE 21434 covers a third dimension — cybersecurity engineering — and SAE J3016 provides the driving automation level taxonomy referenced when scoping SOTIF work.

Scope of application. The standard is intended for functionality where correct situational awareness is critical to safety and where that awareness is derived from complex sensors and processing algorithms. Emergency intervention systems such as automatic emergency braking, and Advanced Driver Assistance Systems at automation levels 1 and 2, are its explicit focus; the concepts are also widely applied to higher levels of automation.

Method. ISO 21448 provides a general argument framework rather than a fixed process. Its characteristic construct is the partition of the scenario space into known safe, known unsafe, unknown unsafe and unknown safe regions, with the goal of the SOTIF activity being to shrink the unknown and unsafe areas to an acceptable residual through hazard identification and evaluation, identification of triggering conditions and functional insufficiencies, functional modification, and targeted verification and validation. It also addresses activities in the operation phase, since field data is the principal way that previously unknown scenarios are discovered after release.

Certification. There is no ISO certification scheme for organizations against ISO 21448. Conformance is demonstrated through the safety case and the development process, and is typically assessed by customers, independent assessors or type-approval activity rather than through a certificate. A revision of ISO 21448 is in development within ISO/TC 22.

Purpose

To provide a framework and set of measures for identifying, evaluating and reducing risk arising from functional insufficiencies and reasonably foreseeable misuse in road vehicle functionality, particularly ADAS and automated driving features that rely on complex sensing and algorithms.

Key Benefits

• Addresses safety risks that functional safety (ISO 26262) does not cover
• Structured argument framework for reducing unknown and unsafe scenarios
• Common vocabulary for functional insufficiencies and triggering conditions
• Guides scenario-based verification and validation strategy
• Covers the operation phase and use of field data after release
• Widely referenced by OEMs and suppliers in ADAS and automated driving programmes

Key Requirements

• Define the intended functionality and its operational context and boundaries
• Identify and evaluate SOTIF-relevant hazards at vehicle level
• Identify functional insufficiencies and their triggering conditions
• Define acceptance criteria and validation targets for residual risk
• Apply functional modifications to reduce identified insufficiencies
• Verify and validate the known scenario space, including scenario-based testing
• Evaluate residual risk in unknown scenario areas
• Define activities for the operation phase, including field monitoring and data collection
• Document the SOTIF argument and its supporting evidence

Who Needs This Standard?

Automotive OEMs and Tier 1/Tier 2 suppliers developing ADAS or automated driving functions, perception and sensor engineers, functional safety and SOTIF engineers, validation and simulation teams, and independent safety assessors reviewing automated driving safety cases.

Related Standards