SOTIF Explained – Safety of the Intended Functionality (ISO 21448)
Why SOTIF Matters in Modern Automotive Systems
Modern vehicles increasingly rely on advanced driver assistance systems (ADAS) and autonomous functions.
These systems use sensors, algorithms, and artificial intelligence to interpret their environment and make decisions.
However, this introduces a new type of risk:
What happens if the system works exactly as intended… but still makes the wrong decision?
Traditional safety approaches focus on system failures.
But in many modern systems, there is no failure.
Instead, the system behaves correctly according to its design—but the design itself is insufficient.
This is where ISO 21448 (SOTIF) becomes critical.
What Is SOTIF?
SOTIF stands for Safety of the Intended Functionality.
It is defined in ISO 21448 and focuses on hazards that arise without system faults.
This is a key distinction.
In functional safety, risks are caused by malfunctions.
In SOTIF, risks are caused by limitations of the intended functionality.
Examples include:
- A camera system misinterpreting an object
- A sensor failing to detect a pedestrian
- An algorithm making an incorrect decision
In all of these cases:
The system works as designed—but the outcome is still unsafe.
SOTIF vs ISO 26262
To fully understand SOTIF, it is important to compare it with ISO 26262.
ISO 26262 focuses on functional safety.
It addresses hazards caused by malfunctioning system behavior.
SOTIF addresses hazards caused by performance limitations, not failures.
Key difference:
- ISO 26262 → failure-based risks
- SOTIF → performance-based risks
These two domains complement each other.
A complete safety concept requires both.
Typical SOTIF Scenarios (ADAS)
SOTIF is particularly relevant for ADAS and autonomous driving systems.
These systems rely heavily on perception and interpretation.
Typical scenarios include:
- A camera misclassifies an object due to lighting conditions
- A radar system cannot detect certain materials
- A machine learning model makes an incorrect prediction
- Environmental conditions reduce sensor performance
These are not failures in the traditional sense.
They are limitations of the system.
If you want to understand ISO 26262 and SOTIF in detail:
Sources of SOTIF Risks
SOTIF risks can originate from different sources.
One major source is sensor limitations.
Sensors have physical constraints and cannot detect everything perfectly.
Another source is algorithm limitations.
Even well-designed algorithms can produce incorrect results in edge cases.
Environmental conditions also play a role.
Weather, lighting, and road conditions can affect system performance.
Finally, insufficient system design can lead to incomplete coverage of real-world scenarios.
How SOTIF Is Addressed
SOTIF does not rely on traditional failure detection.
Instead, it focuses on improving system performance and understanding its limitations.
Typical approaches include:
- Extensive scenario-based testing
- Simulation of edge cases
- Validation using real-world data
- Improving perception algorithms
- Defining safe operational boundaries
The goal is to identify situations where the system may behave incorrectly and reduce the associated risks.
Challenges in Practice
Implementing SOTIF in real projects is challenging.
One major difficulty is identifying all relevant scenarios.
The real world is complex and unpredictable.
Another challenge is validating system behavior.
Unlike traditional systems, there is no clear “correct” or “incorrect” in many cases.
Additionally, SOTIF requires a strong understanding of system limitations.
This includes both technical and environmental factors.
Common Misunderstandings
There are several common misconceptions about SOTIF.
One is the belief that SOTIF replaces functional safety.
In reality, both are required.
Another misunderstanding is assuming that SOTIF only applies to autonomous vehicles.
In fact, it is relevant for many ADAS functions.
A third mistake is treating SOTIF as purely a testing activity.
SOTIF must be considered throughout the entire development process.
Finally, some assume that eliminating failures is sufficient.
SOTIF shows that even without failures, systems can still be unsafe.
Summary
SOTIF addresses a critical gap in modern automotive safety.
Key takeaways:
- SOTIF focuses on risks without system faults
- It is defined in ISO 21448
- It complements ISO 26262
- It is especially relevant for ADAS and autonomous systems
- Understanding system limitations is essential
SOTIF is a key concept for developing safe and reliable modern vehicles.
