Title: SotIF for the Functional Safety Engineer | ISO 26262 Academy URL: https://iso26262.academy/features/concepts/sotif-for-fusi Description: A FuSi-engineer manual for extending HARA, FSC, TSC, FMEDA, and the safety case into ISO 21448 (SotIF), ISO/PAS 8800, and ISO/IEC TR 5469. --- Concept guide · ISO 21448 · 12 chapters # SotIF for the Functional Safety Engineer A FuSi-engineer handbook for extending HARA, FSC, TSC, FMEDA and the safety case into ISO 21448 (SotIF), ISO/PAS 8800 and ISO/IEC TR 5469. Triggering conditions, acceptance criteria, statistical validation, ML-aware FuSi and field monitoring with a continuous AEB worked example. 12 Chapters 50+ Diagrams & Tables AEB Continuous Example 3 Standards Bridged Included in Pro Expert [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fsotif-for-fusi&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) See the chapters Inside the course 1. 01 **Why FuSi Engineers Need SotIF** 2. 02 **ISO 21448:2022 Clause-by-Clause** 3. 03 **From Faults to Functional Insufficiencies** 4. 04 **Fault vs Insufficiency Decision Tree** 5. 05 **Extending HARA with Triggering Conditions** The short version ## Quick answers What is SOTIF (ISO 21448) and how does it differ from ISO 26262? SOTIF - Safety of the Intended Functionality, standardized as ISO 21448:2022 - addresses hazards that occur without any system fault: the E/E system works exactly as specified, but the specification or its performance is insufficient for a real-world situation. A radar reporting a phantom target from guardrail multi-path is not a fault; it is a functional insufficiency activated by a triggering condition. ISO 26262 covers hazards from malfunctioning E/E behaviour (faults); ISO 21448 covers hazards from performance limitations and specification gaps. For ADAS and automated driving, both are needed, and the two lifecycles run in parallel on the same architecture with shared work products. What is the difference between a fault and a functional insufficiency? A fault is an abnormal condition inside the system - a broken sensor, a corrupted memory cell, a software bug - that causes behaviour to deviate from specification; ISO 26262 owns it. A functional insufficiency is a limitation of the specified function itself: the sensor operates within spec but its specification cannot handle low sun, or the detection algorithm was never specified for a scenario it meets in the field. The practical triage asks three questions - is there an E/E deviation from specification, is it a performance-versus-specification issue, is ML involved - routing each issue to ISO 26262, SOTIF, or SOTIF plus ISO/PAS 8800. Misclassification sends the issue into the wrong lifecycle with the wrong countermeasures. Keep going, free - [Article · 6 min read SOTIF for Functional Safety Engineers: An Exploratory Guide](https://iso26262.academy/blog/sotif-functional-safety-engineers-iso-21448-guide) - [Demo exam · no account Test yourself with 7 exam-style questions](https://iso26262.academy/demo-exam) Why this course ## Why it pays for itself ### Route every issue correctly Apply the three-question fault-versus-insufficiency triage to send each safety issue to ISO 26262, ISO 21448 or ISO/PAS 8800 with defensible reasoning, practiced on ten worked scenarios. ### Extend your HARA, not replace it Add SOTIF columns to the HARA you already have: triggering-condition catalogs built with HAZOP guide-words, insufficiency classification, and acceptance targets decomposed per hazardous event. ### Argue validation statistically Derive quantitative acceptance targets from an acceptance philosophy and baseline data, structure Area 2 and Area 3 arguments, and apply the zero-event stopping rule for validation mileage. After the course ## What you’ll be able to do ### Route Issues with the Decision Tree Apply the three-question fault vs insufficiency triage to classify every safety issue to ISO 26262, ISO 21448 or ISO/PAS 8800 with defensible reasoning. ### Extend HARA with Triggering Conditions Add SotIF columns to your existing HARA, populate the TC catalog via HAZOP and inductive analysis, and decompose acceptance targets per hazardous event. ### Derive SotIF Acceptance Targets Select an acceptance philosophy (GAMAB, MEM, ALARP, PRB), apply the three-factor risk decomposition, and derive quantitative targets from NHTSA-style baselines. ### Specify Functional Modifications Classify countermeasures into the five SotIF response categories and write a driving policy with traceable rules linked to triggering conditions. ### Plan SotIF Verification & Validation Combine the 5-level pipeline (BV/APV/VIV/TTV/ORV) with fault-injection, TC activation and OoD probing, and structure Area 2 + Area 3 acceptance arguments. ### Build a Joint Safety Case & Monitor in the Field Author one GSN tree covering 26262, 21448 and 8800, run release defensibility checks, and operate Clause 13 field monitoring with re-evaluation SLAs. The curriculum · 12 chapters ## Chapter by chapter 1. 01 **Why FuSi Engineers Need SotIF** The scope gap between ISO 26262 faults and ISO 21448 functional insufficiencies. - Faults vs insufficiencies - Hazard routing rules - Domain example catalog 2. 02 **ISO 21448:2022 Clause-by-Clause** Lifecycle mapping with V-model alignment and joint vs separate work products. - 9-clause SotIF lifecycle - V-model parallel - 2019 to 2022 deltas 3. 03 **From Faults to Functional Insufficiencies** Eighteen SotIF terms in six families, mapped to their ISO 26262 equivalents. - 18-term vocabulary - 26262 equivalents - Misclassification traps 4. 04 **Fault vs Insufficiency Decision Tree** Three-question triage that routes every issue to 26262, SotIF or SotIF + 8800. - Three-question triage - 10 worked scenarios - Verdict by colour 5. 05 **Extending HARA with Triggering Conditions** HARA extended with SotIF columns, HAZOP guide-words and VLSS tiering. - HARA + SotIF columns - HAZOP guide-words - VLSS tiering 6. 06 **SotIF Risk Model & Targets** Acceptance philosophies, the three-factor risk decomposition and NHTSA-baseline targets. - 4 acceptance philosophies - 3-factor decomposition - NHTSA baseline 7. 07 **Functional Modifications as Safety Mechanisms** Five SotIF response categories, driving policy and sensor-fusion performance budgets. - 5 modification categories - Driving policy spec - Fusion budgets 8. 08 **Verification with Triggering Conditions** Five-level BV/APV/VIV/TTV/ORV pipeline and FMEDA, FTA, STPA repurposed for SotIF. - 5-level pipeline - FMEDA TC columns - FTA-for-SotIF tree 9. 09 **Validation: Statistical Acceptance** Area 2 vs Area 3, NHTSA severity baselines and the zero-event Poisson stopping rule. - Area 2 vs Area 3 - NHTSA severity buckets - Zero-event Poisson rule 10. 10 **ML-Aware FuSi (8800 & TR 5469)** Responsibility split across 26262, 21448 and 8800 with KPI sufficiency rules. - Three-standard ML matrix - KPI sufficiency rule - 7-phase data lifecycle 11. 11 **Joint 26262 + 21448 + 8800 Safety Case** One GSN tree, five defensibility principles and UL 4600 integration. - Single GSN argument - 5 defensibility principles - UL 4600 integration 12. 12 **Field Monitoring & Continuous Safety** Clause 13 observation channels, re-evaluation SLAs and OTA safety playbooks. - 6 observation channels - Re-evaluation SLAs - OTA safety playbook Interactive Diagrams & Worksheets ## Not just text: the visual toolkit ### Fault vs Insufficiency Decision Tree Three-question triage (E/E deviation, performance vs specification, ML involved) with verdict colour-coding for 26262, SotIF, SotIF+8800 and cybersecurity, plus 10 worked scenarios. ### HARA + SotIF Extension Worksheet AEB HARA base table extended with triggering conditions, FI classification, P_E|HB / P_C|E / P_S|C factors, VLSS tier and acceptance target, plus a HAZOP guide-word workbook. ### SotIF Risk-Decomposition Formula P_H = P_E|HB x P_C|E x P_S|C with parameter definitions, plus the four-step AEB target derivation from NHTSA GES baseline through functional-modification coverage. ### 5-Level Verification Pipeline BV, APV, VIV, TTV, ORV cards showing scope, infrastructure, pros, cons, and 26262 analog, with a combined fault-injection + TC activation + OoD probing test plan example. ### ML Responsibility Matrix Twelve-row matrix splitting KPI definition, KPI achievement, dataset bias, OoD, model calibration and drift across ISO 26262, ISO 21448 and ISO/PAS 8800 with FuSi notes. ### Joint GSN Safety Case Tree AEB safety case skeleton with three branches (26262 faults, 21448 insufficiencies, 8800 ML KPI), six GSN node types, defensibility principles and standard-source colour badges. Continuous Worked Example ## AEB From HARA to Field Monitoring A single AEB function carried through every chapter so vocabulary, triage, HARA extension, validation and monitoring all reinforce one example. - HARA extended with a triggering-condition catalog - Acceptance target derived from NHTSA baseline - Driving policy and sensor-fusion budgets - Combined fault injection, TC activation and OoD probing - Field monitoring with OTA retraining playbook AEB Triggering-Condition Catalog Radar multi-path on motorway guardrail produces a phantom stationary target Unlock the full AEB example Built for ## Who this guide is for - Functional safety engineers extending into ADAS and automated driving work - Safety managers planning a joint ISO 26262 plus ISO 21448 program with one set of work products - V&V engineers who must justify statistical validation targets and test mileage - Engineers wiring ML components into a safety case via ISO/PAS 8800 and ISO/IEC TR 5469 ## Frequently Asked Questions Common questions about SotIF for the Functional Safety Engineer A triggering condition is a specific scenario element or environmental condition that activates a functional insufficiency and turns it into hazardous behaviour - for example, radar multi-path on a motorway guardrail producing a phantom stationary target that triggers unjustified emergency braking. Triggering conditions play the role in SOTIF that faults play in ISO 26262: they are catalogued systematically (HAZOP guide-words and inductive analysis over the sensor chain are the standard methods), linked to the insufficiencies they activate, and drive both the functional modifications that mitigate them and the verification scenarios that must be tested. The guide builds a full triggering-condition catalog for an AEB function as its running example. First choose an explicit acceptance philosophy - GAMAB, MEM, ALARP or a positive risk balance - then decompose the target using the three-factor risk model into scenario exposure, hazard-given-behaviour and severity-given-hazard components, anchored to baseline data such as NHTSA crash statistics. Verification exercises known triggering conditions (Area 2) across a five-level pipeline; validation must also bound the risk from unknown scenarios (Area 3), which is where statistics enter: the zero-event Poisson stopping rule tells you how much observation without a hazardous event is needed to claim the target with confidence. Field monitoring then continues the argument after release, feeding re-evaluation when reality disagrees. The guide has 12 chapters, from the FuSi-to-SOTIF scope gap and a clause-by-clause tour of ISO 21448:2022, through the fault-versus-insufficiency decision tree, HARA extension, acceptance targets, functional modifications, verification and statistical validation, to ML-aware safety with ISO/PAS 8800 and ISO/IEC TR 5469, the joint safety case and field monitoring - supported by more than 50 diagrams and tables. A continuous AEB worked example runs from HARA extension to field monitoring. A free account starts you off, and the Pro and Expert plans unlock more of the library. ## Start the course today A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov simulator, and 5 practice exams per month. The Pro and Expert plans unlock more of the 78-guide library. No credit card required. [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fsotif-for-fusi&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) [View Pricing Plans](https://iso26262.academy/pricing)