Title: AV Safety: ISO 26262 + SotIF + ML in Practice | ISO 26262 Academy URL: https://iso26262.academy/features/concepts/av-safety-iso-sotif-ml Description: Practical handbook bridging ISO 26262, ISO 21448 (SotIF), ISO/PAS 8800, and UL 4600 for autonomous vehicles with machine learning. --- Concept guide · ISO 26262 + ISO 21448 + ISO/PAS 8800 · 12 chapters # AV Safety: ISO 26262 + SotIF + ML in Practice An end-to-end handbook for autonomous-vehicle safety that integrates ISO 26262, ISO 21448 (SotIF), ISO/PAS 8800 and UL 4600. ODD, fail-operational architectures, scenario-based V&V, ML safety, and a joint safety case applied to AEB, lane keeping and SAE L3/L4 highway pilot. 12 Chapters 45+ Diagrams & Tables 4 Standards Integrated AEB / L3 Worked Examples Included in Pro Expert [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fav-safety-iso-sotif-ml&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) See the chapters Inside the course 1. 01 **The AV/ML Safety Gap** 2. 02 **AV Levels, ODD & MRC** 3. 03 **SotIF (ISO 21448) in Practice** 4. 04 **Insufficiency vs Random Fault** 5. 05 **ML Component Safety (ISO/PAS 8800)** The short version ## Quick answers What is autonomous vehicle safety in ISO 26262? ISO 26262 covers hazards caused by E/E system malfunctions - faults that make hardware or software misbehave. Autonomous vehicles add a second hazard class the standard was never designed for: the system works exactly as specified yet still acts unsafely, because perception misreads a scene or the specification never anticipated it. Covering AV risk therefore takes a stack of standards: ISO 26262 for malfunctions, ISO 21448 (SOTIF) for performance insufficiencies of the intended functionality, ISO/PAS 8800 for the specific behavior of AI and machine learning components, and UL 4600 as the safety case framework arguing the whole vehicle is acceptably safe. What is the difference between ISO 26262 and ISO 21448 (SOTIF)? ISO 26262 asks "what if the system fails?" - a sensor breaks, memory corrupts, software crashes - and answers with safety mechanisms, metrics, and ASIL-graded rigor. ISO 21448 asks "what if the system works as designed and is still not safe?" - a camera-based perception function that has no fault yet misclassifies a pedestrian at dusk, or a specification that never considered a scenario. SOTIF manages triggering conditions and performance insufficiencies, aiming to shrink the unknown-unsafe scenario space through analysis, scenario-based verification, and field monitoring. AV programs need both: a fault-free perception stack can still be hazardous, and SOTIF analysis will not catch a random hardware fault. Keep going, free - [Article · 8 min read Demystifying AV Safety: Integrating ISO 26262, SOTIF, and ML](https://iso26262.academy/blog/av-safety-integrating-iso-26262-sotif-ml) - [Demo exam · no account Test yourself with 7 exam-style questions](https://iso26262.academy/demo-exam) Why this course · ISO 26262 ## Why it pays for itself ### Integrate four standards into one program ISO 26262, ISO 21448 SOTIF, ISO/PAS 8800, and UL 4600 each cover a different slice of AV risk. Learn what each one owns, where they hand off, and how to run them as one coherent safety program. ### Engineer beyond fail-safe A Level 3 system cannot simply shut off. Study fail-operational sensor and compute architectures, ODD specification, and minimal risk condition design that keep the vehicle safe when components fail mid-drive. ### Make ML safety concrete Move past "neural networks are black boxes" to the actual engineering: perception pipeline safety, insufficiency versus random fault thinking, scenario-based V&V, and quantitative acceptance criteria that survive review. After the course ## What you’ll be able to do ### Route Hazards to the Right Standard Apply the handoff rule to assign every hazardous event to ISO 26262, ISO 21448 or ISO/PAS 8800 without leaving structural gaps in the safety argument. ### Specify ODD and MRC for an L3/L4 Function Build an ODD using BSI PAS 1883 or ISO 34503 attributes, design runtime monitors that detect violations, and define MRC reachable within FTTI. ### Run an Integrated HARA + SotIF + TARA Conduct hazard analysis on the same functional architecture across safety, SotIF and cybersecurity with a single three-axis matrix per hazardous event. ### Engineer ML Safety per ISO/PAS 8800 Treat ML weights as versioned artifacts, design the six-step data lifecycle, and add runtime OoD detectors plus cross-modal monitors as functional modifications. ### Design Fail-Operational Architectures Select among single-path, dual-channel, 1oo2, 2oo3, DoerChecker and 3-path patterns with CCF budgeting and explicit MRC entry timing. ### Write a UL 4600 Joint Safety Case Decompose the root "acceptably safe" claim into hazards-identified, hazards-mitigated, residual-risk and lifecycle sub-claims using GSN with evidence per standard. The curriculum · 12 chapters ## Chapter by chapter 1. 01 **The AV/ML Safety Gap** Why ISO 26262 alone cannot cover autonomous and AI-driven systems. - Three insufficiency classes - Three-standard landscape - Sequential handoff rule 2. 02 **AV Levels, ODD & MRC** SAE J3016 levels, ODD attribute recipes and Minimal Risk Condition as the DDT-fallback target. - SAE J3016 responsibility - ODD attribute recipe - MRC and DDT-fallback 3. 03 **SotIF (ISO 21448) in Practice** The 4-area model, triggering-condition catalogs and the cause-effect chain. - 4-area SotIF model - TC catalog by subsystem - Cause-effect chain 4. 04 **Insufficiency vs Random Fault** The handoff rule that routes hazards between ISO 26262, ISO 21448 and ISO/PAS 8800. - Three-branch handoff - 8-dimension comparison - Same HW, two paths 5. 05 **ML Component Safety (ISO/PAS 8800)** ML weights as versioned artifacts, ten AI properties and the six-step data lifecycle. - ML weights as artifacts - 10 AI safety properties - 6-step data lifecycle 6. 06 **Perception Pipeline Safety** Sensor-set design, fusion architectures and eight runtime perception monitors. - Sensor-set trade-offs - Fusion architectures - 8 runtime monitors 7. 07 **Fail-Operational Architecture** Fail-passive, fail-silent and fail-operational patterns from single-path to 3-path fall-over. - Fail-operational vocabulary - 6 architectural patterns - 3-path with CCF budget 8. 08 **Scenario-Based V&V** Logical vs concrete scenarios, OpenSCENARIO 2.0 and eight V&V methods. - Logical vs concrete - OpenSCENARIO 2.0 - 8 V&V methods 9. 09 **Safety Case (UL 4600)** Goal-based safety case with GSN notation and a four-sub-claim decomposition. - UL 4600 vs process standards - GSN six node types - Top-level claim tree 10. 10 **Cybersecurity (ISO 21434)** TARA, Cybersecurity Assurance Level, and a three-axis hazard matrix with HARA and SotIF. - TARA + CAL framework - 3-axis hazard matrix - AV attack classes 11. 11 **Process Integration** Integrated V-model, a 12-item safety plan and release gates G0-G7. - Integrated V-model - 12-item safety plan - 8 roles, gates G0-G7 12. 12 **Real-World Pitfalls** Public-incident anti-patterns: disabled safety nets, handover blind-spots, dataset/ODD mismatch. - Public-incident catalog - Anti-pattern playbook - Audit checklist Interactive Diagrams & Worked Examples ## Not just text: the visual toolkit ### Three-Standard Landscape Map Reference cards for ISO 26262, ISO 21448, ISO/PAS 8800 and UL 4600 with scope, trigger criteria, and the decision rule that routes a hazard to the right standard. ### SotIF 4-Area Model & Cause-Effect Chain The 2x2 known/unknown by safe/unsafe matrix with each area's goal, plus the TC -> functional insufficiency -> output insufficiency -> hazardous behaviour flow. ### AV Levels, ODD & MRC Diagram SAE J3016 L0-L5 with DDT, monitoring and fallback responsibility, the six ODD attribute categories, and runtime monitors that trigger MRC entry. ### Fusion Architectures & Runtime Monitors Low/mid/high-level fusion topology cards with ASIL reachability, plus eight runtime monitors (freshness, cross-modal, temporal, calibration, occlusion, weather, ODD attribute, free-space). ### 3-Path Fail-Operational Architecture Nominal, redundant and limp-home paths with independent compute, sensor and power domains, CCF matrix, watchdog cross-checks, and FTTI/EOTTI timing analysis for MRC reachability. ### OpenSCENARIO 2.0 Cut-In Scenario Annotated DSL fragment for a parameterized cut-in (rel_speed, TTC, gap_rear), V&V method comparison across SiL, HiL, track and shadow mode with realism-vs-scalability trade-offs. Real-World Application ## L3 Highway Pilot AEB Across All Four Standards An SAE L3 highway pilot AEB carried from ODD specification through fail-operational architecture, scenario V&V and the joint UL 4600 safety case. - ODD specification with HD-map geofence - 3-path fail-operational sensor and compute architecture - Scenario V&V across SiL, closed course and field trials - Quantitative acceptance criteria with MRC reachability - UL 4600 safety case mapped to all four standards AEB Acceptance Criteria Quantified false-negative target within ODD; MRC reachable on triple-path failure Unlock the full L3 case study Built for ## Who this guide is for - Functional safety engineers moving from conventional ECUs to ADAS and AV programs - AV and ML engineers who need the safety-standards landscape mapped onto their stack - Safety architects designing fail-operational architectures for L3/L4 functions - Teams assembling a joint safety case across 26262, SOTIF, and ML evidence ## Frequently Asked Questions Common questions about AV Safety: ISO 26262 + SotIF + ML in Practice ISO/PAS 8800, published in 2024, addresses safety of artificial intelligence in road vehicles. Machine learning breaks assumptions both ISO 26262 and classic V&V rely on: behavior is learned from data rather than specified, so requirements coverage does not translate to behavior coverage; performance degrades statistically rather than failing discretely; and training data quality becomes a safety property. ISO/PAS 8800 supplies the missing lifecycle - dataset requirements and coverage, robustness, ML-specific verification, runtime monitoring, and assurance arguments for AI components - designed to slot into an ISO 26262 and ISO 21448 program rather than replace it. Fail-safe design reacts to a fault by shutting the function off and handing control back - acceptable when a human driver is the fallback. From Level 3 upward the driver is legally allowed to disengage, so for seconds to minutes there is no fallback: the system itself must continue operating safely after a failure, at least long enough to reach a minimal risk condition. That is fail-operational design - redundant and diverse sensing, redundant compute and power, and degraded operating modes. The course's L3 highway pilot case study uses a 3-path fail-operational architecture where the minimal risk condition stays reachable even on triple-path failure. The handbook integrates 4 standards - ISO 26262, ISO 21448, ISO/PAS 8800, and UL 4600 - across 12 chapters covering the AV/ML safety gap, ODD and minimal risk conditions, SOTIF in practice, ML component safety, perception pipeline safety, fail-operational architectures, scenario-based V&V, the UL 4600 safety case, cybersecurity, and real-world pitfalls, with 45+ diagrams and tables and worked AEB and L3 highway pilot examples. A free account starts you off, and the Pro and Expert plans unlock more of the library. ## Start the course today A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov simulator, and 5 practice exams per month. The Pro and Expert plans unlock more of the 78-guide library. No credit card required. [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fav-safety-iso-sotif-ml&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) [View Pricing Plans](https://iso26262.academy/pricing)