1. ISO/PAS 21448 (SOTIF) in the
Development of ADAS /
Autonomous Vehicles
Szabolcs Agai
Safety & Regulatory Expert, Intland Software
Laszlo Katona
Business Analyst, Intland Software

2. Agenda • Aspects of vehicle safety
• Scope of ASPICE, ISO 26262, and SOTIF
• ISO 26262 vs SOTIF
• Risk mitigation
• SOTIF use cases in codeBeamer
• codeBeamer’s SOTIF workspace design

3. • Founded in 1998, HQ in Stuttgart, Germany
• Active in safety-critical markets
for over 10 years
• Products and processes
certified by TÜV Nord and TÜV Süd
About
Intland Software

4. Factors customers consider when buying a car
Safety
Quality
Fuel consumption / Sustainability
Price
Ease of operation
Comfort
Technical innovation
Size / Storage space
Design
Resale value
Power of the engine
Brand image
Integrated communication
72 23
62 32
46 42
44 43
35 46
31 46
28 42
25 43
26 40
25 39
21 36
21 29
15 35
Very important
Rather important
*Source: E. &. Young, “Autonomes Fahren – Die Zukunft des PKW Marktes?”

5. Vehicle architecture
Purpose-built layers of components
Components:
Mechanical
Hardware
Software
Others (Liquids, oils, glues, etc.)
OEM – Tier 1 – Tier 2 – … – Tier n

6. Aspects of vehicle safety
Passive
safety
Active
safety
Functional
safety

7. Lessons learned

8. Automotive value
chain
Final
Assembly
Light module
Cockpit Door system
Control unit Window
Radio unit Handles Cladding
Individual parts
Domain Domain HW Scope View
OEM Vehicle
OEM Tier 1 Subsystem
Tier 1 ECU
Tier 2 MCU
OEM
Suppliers

9. Automotive standards & regulatory landscape
Vienna Convention on Road Traffic 1968, AMD 2016
SAE J 3016-2018
Useful Safe
ISO 11270:2014 LKAS
ISO 15622:2018 ACC
ISO 17387:2008 LCDAS
Automotive SPICE
ISO 26262:2018
ISO/PAS 21448:2019
SOTIF
UL 4600:2020

10. Safety standards
Safety
Functional Safety
ISO 26262
SOTIF
Cybersecurity
ASPICE

11. Question to the audience:
What is your company’s greatest
challenge with regards to safety
standards?

12. Scope of ASPICE
5
4
3
2
1
Generic Practice
Generic Resources
Base
Practices
Work
Products

13. ISO 26262
Scope of ISO 26262
Random
errors
Systematic
errors
We can calculate, estimate,
and plan for failures
Control:
Safety Analysis
(DFMEA,PFMEA,FMEDA,
DFA, etc. - ISO 26262)
(SW & HW Design)
Probability is 100%, failures
can come anytime
Control:
Process control measures
(ASPICE, ISO 26262)

14. Scope of SOTIF
Safety Technique Process Definition
Methods
Lifecycle

15. Scope of SOTIF regarding SAE levels
Assisted
Partial automation
Conditional automation
High automation
Full automation
SOTIF

16. Performance
limitations

17. Disturbances of
sensors and
algorithms

18. Failed human
interaction including
misuse

19. Differences between ISO 26262 and SOTIF
ISO 26262
Malfunctioning E/E system due to failures
SOTIF
Malfunctioning failure-free system

20. Failure scenario analysis
Unsafe Safe
Known
Unknown
2 1
3 4

21. Mitigation of risks
1
4 4
1
3
2
3
2
Known 2 1
Unsafe Safe
Unknown 3 4

22. Types of testing for risk mitigation
Simulation HIL Test Closed Track Public Road

23. codeBeamer use cases based on SOTIF
Safety Technique
Lifecycle &
Process Definition
Methods
Use case 1 Use case 2
Use case 3

24. Use case 1: SOTIF Lifecycle and processes
Intended functionality
Hazards
Triggering events
SOTIF risk mitigation
V&V strategy
Verification area 2
Validation area 3
SOTIF release

25. Use case 2: Methods
Accidents (FARS, etc.)
Road collections
Critical sets
Others
Variables (environment)
Driver
fault
Sensor errors
Performance
Permutation
Driving Simulator
HIL Tests
Closed track tests
Scenario
Repository

26. ADAS scenario management in codeBeamer

27. ADAS scenario management in codeBeamer

28. Scenario development process

29. Scenario description language

30. Scenario description language

31. Use case 3: Safety technique
Known and
unknown
triggering effects
(including
reasonably
foreseeable
misuse) as part of
the scenario
Occurence over
the operating
lifetime
Outputs: SOTIF-relevant hazardous events (leading to credible harm)
& acceptance criteria (Validation targets)
Potentially
hazardous
behaviour
System
Hazard
Operational
Situation
Probability of
exposure
&
Hazardous
Event
& Harm
Reactions of the
involved persons
Controllability
Severity
Legend: Causality Evaluated characteristics

32. codeBeamer’s SOTIF workspace design
Processes
Methods
Practices
Roles
Activities
Stages
Collaborative
workflows
Work products
Roles
Activities
Stages
Intelligent
design
contents

33. codeBeamer’s SOTIF workspace design
Workflows
Information Access Roles
Contents
ALM

34. codeBeamer’s SOTIF workspace design
Workflows
Information Access Roles
Contents
ALM - Automotive Template
SOTIF
example
workspace

35. Live demo:
SOTIF Workspace in
codeBeamer

36. Questions and Answers