Analysis of functional insufficiencies and triggering conditions to improve the SOTIF of an MPC-based trajectory planner

Automated and autonomous driving has made a significant technological leap over the past decade. In this process, the complexity of algorithms used for vehicle control has grown significantly. Model Predictive Control (MPC) is a prominent example, which has gained enormous popularity and is now widely used for vehicle motion planning and control. However, safety concerns restrict its practical application, especially since traditional procedures of functional safety, with its universal standard ISO 26262, reach their limits. Concomitantly, the new aspect of safety of the intended functionality (SOTIF) has moved into the center of attention, whose standard, ISO 21448, has only been released in 2022. Experience with SOTIF, however, is low and few case studies are available in industry and research. Hence, this paper aims to make two main contributions: (1) an analysis of the SOTIF, with a certification guidance, for a generic MPC-based trajectory planner and (2) an interpretation and application of the generic procedures described in ISO 21448 to a research-based case study, with the goal of determining the functional insufficiencies (FIs) and triggering conditions (TCs). Particular novelties of the paper include an approach for the out-of-context development of SOTIF-related elements (SOTIF-EooC), a compilation of important FIs and TCs for a MPC-based trajectory planner, and an optimized safety concept based on the identified FIs and TCs for the MPC-based trajectory planner. • Interpretation and application of generic methods in the SOTIF standard ISO 21448. • Derivation of Triggering Conditions and Functional Insufficiencies. • Elaboration of the notion of a SOTIF-related element out of context (SOTIF-EooC). • Application to the case study of an MPC-based trajectory planner. • Refined safety concept based on SOTIF for an MPC-based trajectory planner.