SOTIF HARA: Hazard and Risk Assessment according to ISO 21448 - Part 1
- Sahil Subodh Bane
- Jul 10
- 2 min read
Hazards that are not due to malfunctions
Classical functional safety assumes something "failed". A sensor failed, a wire shorted, a software routine crashed. ISO 26262 is built around this idea: identify the malfunctions, judge how bad they'd be, and engineer against them.
But consider a perception system that saw the road exactly as designed and still failed to recognize a stationary truck in dense fog. Nothing malfunctioned. Every component behaved to specification. The system simply wasn't good enough for the situation it found itself in.
That hazard is invisible to classical HARA. There's no fault to point at, no failure mode to rate. This is the gap that SOTIF (the Safety Of The Intended Functionality) exists to close.
What SOTIF Actually Is
SOTIF is defined in ISO 21448:2022. Where ISO 26262 addresses hazards caused by malfunctions, SOTIF addresses hazards caused by the limitations of the intended function itself, even when everything is working correctly.
It matters most for the systems that now dominate automotive development: ADAS, automated driving, and anything built on machine-learning perception. A radar that can't distinguish a stationary vehicle from an overhead sign, a camera blinded by low sun, a classifier that misreads a rare object. None of these are faults. They're performance limitations of a function doing exactly what it was designed to do.
SOTIF complements ISO 26262; it doesn't replace it. A complete safety case for a modern feature usually needs both.
Why Classical HARA Falls Short
The ISO 26262 HARA is built for malfunctions. You rate Severity, Exposure, and Controllability, feed them into a table, and get an ASIL that tells you how rigorously to engineer against the fault.
That machinery assumes there's a fault to engineer against. SOTIF hazards break the assumption. There's no malfunction to prevent, because the function is already doing its best. The question is no longer "how do we stop this from failing" but "is the residual risk that remains, after the function performs as designed, acceptable?"
The Core Shift: From ASIL to Unreasonable Risk
This is the heart of SOTIF HARA. The S × E × C = ASIL pipeline is replaced by a single, binary judgement: is the residual risk unreasonable, yes or no? It sounds simpler than ASIL. It isn't. The word unreasonable carries the whole weight of the analysis. It's not asking how likely a failure is. It's asking a harder question: given how good the system actually is, is what remains acceptable to society?
A system that misses one stationary vehicle in ten billion kilometres might be reasonable. One that misses one in ten thousand almost certainly isn't. Somewhere between those lies a line, and drawing that line defensibly is what SOTIF HARA demands. The answer can't be a gut call. It has to be anchored to something measurable.
That something is the Acceptance Criteria.
In principle, the concepts of a classical HARA can be used to determine a risk in SOTIF HARA. But we dont need to carry over the ASILs, that are defined in a classical HARA.
Comments