M1: General safety (systems, functional, intended)

https://academy.nit-institute.com/wp-content/uploads/2024/08/FSS-M1.png

Understanding the definition of safety and its nuances in different application domains, and differences compared to security. The lecture examines various parts of the safety iceberg: from the accidents and incidents, up to their underlying pathology – a causal chain of faults, errors, and failures, and on the other side, the manifestations – hazards and risks with accompanying methods to measure and quantify them.
Additional aspects specific to SOTIF risks are introduced: foreseeable misuse and functional insufficiencies (specification and performance).
Furthermore, learning the similarities and differences between system and functional safety, together with the definition of the necessary aspects like the safe state, the safety function, and the safety integrity. The lecture provides an overview of the rich canvas of available technical standards and motivates the necessity and importance of standards.

none

1 hour 30 minutes

M2: Safety Standards – canvas, scope, interactions

https://academy.nit-institute.com/wp-content/uploads/2025/01/sotif_2.png

Laying out some basic details of the key technical safety standards – from generic umbrella standard IEC 61508 for primarily one-off systems (e.g. plants), up to the most relevant automotive safety standards (both FuSa and SOTIF, but also safety of the AI and ways how to construct a safety case for the ADS).The lecture provides details about the standards, their genesis, motivation, as well as, key building blocks and ideas that were followed when creating the automotive standard for road vehicles (ISO 2626 and ISO 21448). Finally, the lecture contrasts the differences but also complementary nature of the two automotive standards – how to go beyond the legacy automotive E/E systems towards building the autonomous driving systems.

none

2 hours

M3: ISO 21448 – Overview, Terminology, Management, and Work Products

https://academy.nit-institute.com/wp-content/uploads/2025/01/sotif_3.png

Introducing the contents, structure, workflow, life-cycle of the standard with appropriate methods to read it and understand the necessary terms from the vocabulary (both ISO 21448 and ISO 22736 – SAE J3016). The lecture further dwells on the SOTIF principles, including related hazardous event model and four scenario areas ((not)hazard/(not)known) to derive goals – perform a risk acceptance evaluation and reduce the probability of hazardous scenarios either through functional modification and/or adequate verification and validation strategy.

none

2 hours

M4: ISO 21448 – Intended functionality (IF) – specification and architectural design considerations

https://academy.nit-institute.com/wp-content/uploads/2025/01/sotif_4.png

Learning how to correctly describe and understand the intended functionality (ODD, authority, strategy, …), corresponding performance targets for enabling peripherals (sensor/controller/actuator), dependencies, interactions or interfaces of the IF (driver, road users and infrastructure, communication exchange, etc.).
Finally, how to describe a warning and degradation concept (warning strategies, DDT takeover/fallback conditions and schemes, etc.) and procedures supporting data collection and monitoring (during and after development of the intended functionality).

none

2 hours

M5a: ISO 21448 – STPA – overview and step 1 – purpose (loss and hazards)

https://academy.nit-institute.com/wp-content/uploads/2025/01/sotif_5a.png

The focus of the lecture is to provide practical (hands-on) knowledge on how to perform SOTIF hazard identification in practice.
Students will get a chance to learn to execute STPA (System Theoretic Process Analysis).
Motivation for introduction of the STPA, as well as step 1 of the analysis are covered in details. Focus is to lay the foundation for the consecutive steps by reusing and reframing the work done while describing the intended functionality. Finally, students will get a chance to define key terms like loss, hazards, and system constraints for their intended functionality of choice.

none

2 hours

M5b: ISO 21448 – STPA – steps 2 and 3 – unsafe control actions w/ misuse

https://academy.nit-institute.com/wp-content/uploads/2025/01/sotif_5b.png

The aim of the lecture is to illustrate how the 2nd and 3rd step of the STPA are properly executed and how their results help to complete the requirements from the Chapters 6 and 7 of SOTIF standard. Students will learn how to “Model the Control Structure” (step 2) with a single goal: to model the internal representation of our system. We start by recognizing the control building blocks and then describe the interactions among them: control actions and feedback.
Finally, the lecture provides further practical (hands-on) knowledge on how to identify and describe unsafe control actions stemming from the interaction of the driver/user with the system including reasonably foreseeable misuse (direct or indirect).

none

2 hours

M5c: ISO 21448 – STPA – step 4 – loss scenarios + HF

https://academy.nit-institute.com/wp-content/uploads/2025/01/sotif_5c.png

Continuing further with concluding aspects of the STPA in practice – determining the loss scenarios. This is where things get interesting. STPA looks for the causal factors that can lead to the unsafe control actions and to hazards. For example, a bright sun glare could interfere with the car’s camera, causing it to misjudge the proximity of a nearby vehicle. Furthermore, the vehicle can have the inconsistent process model e.g., believing that there are no obstacles due to incorrect or missing information from the sensors. Loss scenario step helps us determine where UCAs might emerge within the system control flows.
Finally, the lecture provides guidance on how to encounter for human factor i.e. how to identify the reasonably foreseeable misuse (direct and indirect) and triggering conditions.

none

1 hour

M6: ISO 21448 – STPA loss scenarios + risk evaluation, acceptance criteria, and validation targets

https://academy.nit-institute.com/wp-content/uploads/2025/01/sotif_6.png

The lecture provides insights on how to understand, evaluate, determine, and assign appropriate risk parameters (severity, controllability, exposure, and occurrence).
Once the foundation is set, the lecture showcases main difference between FuSa and SOTIF when evaluating whether risk is unreasonable.
Appropriate risk acceptance criteria is defined, illustrated, and a systematic way how to structure the selection is presented.
Furthermore, the lecture discusses acceptance criteria for the residual risk considering governmental and industry regulations, maturity of the function on the market, nominal driver performance, available traffic data etc.
Finally, validation target concept is put in context of area 2 and 3 scenarios and practical ways how to calculate it are laid out.

none

2 hours

M7: Verification and Validation

https://academy.nit-institute.com/wp-content/uploads/2025/01/sotif_7.png

The lectures focus on the right side of the proverbial V-model, where the idea is to provide a strategy that will yield evidence that the SOTIF-related vehicle-level residual risk is below an acceptable level and elements meet their functional requirements and the coverage over the operational design domain (ODD) is sufficient.
The students will get familiar with both evaluation of the known and unknown hazardous scenarios and learn about various testing methods, their goals, necessary steps and how to translate them into real projects.

none

2 hours

M8: Safety Case

https://academy.nit-institute.com/wp-content/uploads/2025/01/sotif_12.png

To conclude the lectures, the students have the opportunity to learn about the seminal work product answering the fundamental question “How do we know that our system is safe enough?”.
The lecture explores several possible approaches to construct a safety case, to provide appealing arguments, and to be able to convince the safety assessors (like a jury in the court case).
Students will learn about the simple textual form, structured prose (XML-alike format), and a graphical way (Goal Structuring Notation (GSN)[currently being standardized and widely used.])
The latest development in formulating and structuring the safety case for autonomous vehicles (UL4600 standard) is explained with key concepts (structure of the standard, prompts and their rigor, and most importantly Safety Performance Indicators).

none

12 hours

Final exam

none

none

none

1 hour 30 minutes