ISO/TC 22/SC 32/WG 8 N 701
REPLACES: ISO/TC 22/SC 32/WG 8 N 700
ISO/TC 22/SC 32/WG 8
Functional safety
E-mail of Secretary: fritzsche@vda.de
Secretariat: DIN
700 ISO WD21448 RC2
Date of document
2019-05-20
Expected action
Due Date
Comment
2019-08-08
Background
Working Draft for circulation and national commenting
Members of SC32/WG8 are kindly requested to study and comment the attached draft. Please use only the
commenting formsheet as provided in Folder "Public Information" of this committee and will in all columns in a
correct way, except the last column.
Only 1 Comment Sheet per P-Member country shall be send to the PL nicolas.becker@mpsa.com and to the
secretatiat fritzsche@vda.de by E-Mail as WordFile (.docx) before the above mentined deadline as agreed at
our last meeting.
Remarks for using Commenting formsheet:
- all collumns 1 to 7 need to be filled in
- tabels neet be be inserted as "bitmap" in a cell not as table
- Column 8 need to be totally empty
- no information after the table, those additional information need to be stored in the relevant cell as a "linked
file"
Version date 2019-05-17; please reply before 2019-08-17
ISO/WD 21448 :2019
ISOTC22/SC32/WG8
Secretariat: DIN
Road vehicles—Safety of the Intended Functionality
Working Draft
This document is not an ISO International Standard. It is distributed for review and comment. It is subject to
change without notice and may not be referred to as an International Standard.
Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of
which they are aware and to provide supporting documentation.
Warning for WDs and CDs
© ISO 2018
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or
utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or
posting on the internet or an intranet, without prior written permission. Permission can be requested
from either ISO at the address below or ISO's member body in the country of the requester.
ISO copyright office
Case postale56 CH-1211 Geneva 20
Tel.+ 41 22 749 01 11
Fax+ 41 22 749 09 47
E-mailcopyright@iso.org
Webwww.iso.org
Published in Switzerland.
© ISO2017–All rights reserved
2
Contents
Foreword ..................................................................................................................................................................1
Introduction.............................................................................................................................................................2
1
2
Scope ............................................................................................................................................................3
Normative references..............................................................................................................................4
Terms and definitions .............................................................................................................................4
3
4
5
6
Function, system specification and design (intended functionality content)........................20
Overview and organization of activities in the development process.....................................11
Identification and Evaluation of hazards caused by the intended functionality ..................23
Overview of activities in the development process....................................................................................11
Distributed SOTIF development activities.......................................................................................................19
Objectives..........................................................................................................................................................................20
Functional description...............................................................................................................................................20
Consideration on system design and architecture......................................................................................21
Work Products...............................................................................................................................................................23
Objectives..........................................................................................................................................................................23
Hazard identification..................................................................................................................................................23
Hazard analysis..............................................................................................................................................................25
Risk evaluation of the intended function.........................................................................................................25
Analysis of reasonably foreseeable misuse.....................................................................................................25
Specification of a validation target......................................................................................................................26
Work Products...............................................................................................................................................................27
Objectives..........................................................................................................................................................................27
Inputs to this clause.....................................................................................................................................................27
Analysis of triggering conditions..........................................................................................................................28
Acceptability of the response of the system to the triggering conditions.......................................32
Work Products...............................................................................................................................................................33
Objectives..........................................................................................................................................................................33
General...............................................................................................................................................................................33
4.1
4.2
5.1
5.2
5.3
5.4
6.1
6.2
6.3
6.4
6.5
6.6
6.7
7.1
7.2
7.3
7.4
7.5
8.1
8.2
© ISO2017–All rights reserved
7
Identification and evaluation of performance limitations and potential triggering
conditions...............................................................................................................................................................27
8
Functional modifications to reduce SOTIF related risks .............................................................33
3
9
Definition of the verification and validation strategy ..................................................................37
10
Evaluate known hazardous scenarios (Area 2)..............................................................................39
11
Evaluate unknown hazardous scenarios (Area 3).........................................................................42
Measures to improve the SOTIF............................................................................................................................34
8.3
Updating the system specification.......................................................................................................................36
8.4
Work Products...............................................................................................................................................................36
8.5
Objectives..........................................................................................................................................................................37
9.1
Planning and specification of integration and testing...............................................................................38
9.2
Work products...............................................................................................................................................................39
9.3
Objectives..........................................................................................................................................................................39
10.1
Sensor verification.......................................................................................................................................................40
10.2
Decision algorithm verification.............................................................................................................................40
10.3
Actuation verification.................................................................................................................................................41
10.4
Integrated system verification...............................................................................................................................41
10.5
Work products...............................................................................................................................................................42
10.6
Objectives..........................................................................................................................................................................42
11.1
Evaluation of residual risk.......................................................................................................................................43
11.2
Validation test parameters......................................................................................................................................43
11.3
Work products...............................................................................................................................................................44
11.4
Objectives..........................................................................................................................................................................44
12.1
Methodology for evaluating SOTIF for release..............................................................................................44
12.2
Criteria for SOTIF evaluation..................................................................................................................................45
12.3
Examples of structuring the SOTIF argumentation with GSN...............................................................47
A.1
Example of interaction between ISO 26262 and ISO 21448..................................................................57
A.2
Examples of the application of SOTIF activities............................................................................................66
A.3
Method for deriving SOTIF misuse scenarios................................................................................................73
B.1
Example construction of scenario for SOTIF safety analysis method...............................................76
B.2
Introduction to the SORA method........................................................................................................................79
B.3
Examples of adaptation of safety analyses to identify and evaluate the potential triggering
B.4
conditions and performance limitations................................................................................................................................83
© ISO2017–All rights reserved
Annex A (informative) General guidance on SOTIF....................................................................................47
Annex C (informative) Guidance on SOTIF verification and validation ...............................................94
Annex B (informative) Guidance on Scenario and system analyses .....................................................73
12
Methodology and criteria for SOTIF release ...................................................................................44
4
C.1
systems 94
C.2
C.3
C.4
D.1
D.2
D.3
Example for definition and validation of an acceptable false positive activation rate in AEB
Validation of SOTIF Applicable Systems.........................................................................................................101
Perception system verification and validation............................................................................................103
Guidance on Simulation and Scenario Based Testing..............................................................................113
Guidance for driving policy specification.......................................................................................................119
Implications for Machine Learning....................................................................................................................127
SOTIF considerations for HD-maps...................................................................................................................131
Annex D (informative) Guidance on specific aspects of SOTIF............................................................ 119
© ISO2017–All rights reserved
5
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO
collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part1. In particular the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part2. www.iso.org/directives
Attention is drawn to thepossibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any
patent rights identified during the development of the document will be in the Introduction and/or on
the ISO list of patent declarations received. www.iso.org/patents
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the meaning of ISO specific terms and expressions related to conformity
assessment, as well as information about ISO's adherence to the WTO principles in the Technical Barriers
to Trade (TBT) see the following URL: Foreword - Supplementary information
The committee responsiblefor this document is ISO/TC22/SC32/WG8
ISO21448consists of this documentonly.
© ISO2017–All rights reserved
1