Introduction
Within the automated-driving safety landscape, SOTIF (safety of the intended functionality) is often underestimated, yet it is the key to situations that are "unsafe even without a fault". This article explains the three core concepts — SOTIF, ODD and MRM — in plain language.
1. What Is SOTIF?
SOTIF (Safety Of The Intended Functionality) addresses situations in which "the system itself has not failed and has not been attacked, yet it is unsafe because of insufficient functionality or misuse". A typical example: an AI misjudging an obstacle in complex scenarios such as heavy rain or a tunnel.
2. ODD (Operational Design Domain)
The ODD is the "safe operating envelope" of an automated driving function, covering boundaries such as the roads it can drive on, the weather it may encounter and the speeds it can travel at. The system is safe only while operating within the ODD, and must exit safely once that boundary is exceeded.
3. MRM (Minimum Risk Maneuver)
When the system leaves the ODD or can no longer cope, the MRM triggers the vehicle to bring itself to a safe stop — pulling over and coming to rest — so that no harm is caused.
4. How the Three Relate
SOTIF requires the system to: define the ODD boundary → trigger the MRM when it is exceeded → exit or hand over safely. This mechanism ensures that "no one is harmed even when the system's capability falls short".
5. Differences from Functional Safety and Cybersecurity
| Dimension | Functional safety | Cybersecurity | SOTIF |
|---|---|---|---|
| What it addresses | Hardware / system failure | Malicious attack | Insufficient functionality / misuse |
Conclusion
SOTIF is the "last line of defense" for automated-driving safety. Understanding and implementing the ODD and MRM is an essential capability for L2-and-above automated driving products.
Need Compliance Support?
Does your automated driving system need SOTIF analysis and ODD/MRM design? QinGuard provides end-to-end consulting on safety of the intended functionality.