Porsche Engineering Tackles Modern Vehicle Safety with Integrated FuSa and SOTIF Approach

Porsche Engineering is at the forefront of ensuring safety in increasingly complex modern vehicles, particularly in advanced driver assistance systems (ADAS) and autonomous driving (AD). The company emphasizes an integrated approach that combines Functional Safety (FuSa) and the Safety of the Intended Functionality (SOTIF) to address all potential risks.

Key Takeaways

• Functional Safety (FuSa) addresses risks arising from hardware or software failures.

• Safety of the Intended Functionality (SOTIF) addresses risks when systems operate without failure but encounter real-world limitations.

• An iterative, exploratory process is crucial for SOTIF.

• Porsche Engineering offers comprehensive solutions for both FuSa and SOTIF, supporting customers in applying relevant standards like ISO 26262 and ISO 21448.

Understanding Functional Safety and SOTIF

Functional Safety (FuSa) is concerned with what happens when a system component fails. It ensures that internal malfunctions, such as a sensor failure or software error, do not lead to unacceptable risks. This involves structured analysis of potential errors and implementing technical and procedural measures to mitigate safety-critical effects throughout the development lifecycle.

In contrast, SOTIF tackles the question of what happens when a system operates without failures but still fails to handle a real-world situation safely. This arises from the inherent limitations of the system's functionality, such as a camera being blinded by the sun or an algorithm failing to detect a cyclist in a complex environment. SOTIF relies on an iterative discovery process to gradually improve system design and knowledge.

The Integrated Approach to Vehicle Safety

Marek Hudec, Senior Manager of System Safety at Porsche Engineering, explains, "FuSa ensures that hardware and software work reliably. SOTIF ensures that the capabilities of these reliable components are sufficiently specified and proven to operate safely in the real world." This highlights that a system can be FuSa-compliant yet still unsafe due to performance limitations.

Dennis Müller, Development Engineer at Porsche Engineering, elaborates on the SOTIF process: "What that means is that the developers specify, test and revise the system design until an acceptable residual risk is reached." Porsche Engineering provides a full suite of services, including support in applying standards like ISO 26262 for FuSa and ISO 21448 for SOTIF, from hazard analysis to safety concept development and lifecycle support.

Navigating Complexity in ADAS and Autonomous Driving

As vehicles move towards higher levels of automation (Level 3 and beyond), the challenges intensify. For FuSa, degradation and warning concepts can no longer solely rely on the driver's constant attention. Systems must autonomously handle failures for a period. SOTIF faces the challenge of mastering an almost infinite array of real-world scenarios, including continuously changing environments, unpredictable road user behavior, and unforeseen events.

Porsche Engineering utilizes data-driven and AI-based methods to identify and address these complexities. The development of modular software components like "Guardian" aims to facilitate the transition to higher automation levels. The company also addresses emerging standards like ISO/PAS 880 for AI safety and ISO/TS 5083 for holistic safety in autonomous driving, considering both on-board and off-board components.

Ensuring Safety Through Redundancy and Iteration

An example illustrating the complementary nature of FuSa and SOTIF involves an SAE Level 3 highway driving scenario. If a radar sensor fails (a FuSa concern), redundancy mechanisms can ensure continued sensor data availability until the driver retakes control. If, however, sensors have performance limitations and fail to detect a motorcycle under unfavorable conditions despite functioning correctly (a SOTIF concern), iterative design updates and sensor fusion optimization are necessary to correct these weaknesses.

Porsche Engineering emphasizes close, long-term cooperation with customers to meet the demands of ADAS/AD development, aiming to deliver safe, robust, and reliable functions. The complexity of reality means that while not every scenario can be tested beforehand, achieving sufficient operational coverage is paramount, a goal SOTIF helps to achieve by defining and safely managing system limits.