道路车辆.预期功能的安全性

[中文适用范围]： 本文件提供了一个一般论证框架和关于确保预期功能安全的措施指南（ISOTIF），即不存在由于功能不足引起的危险而导致的不合理风险，即：a）预期功能规范的不足在车辆层面； b) 系统中电气和/或电子（E/E）元件实施中的规范不足或性能不足。 本文件提供了有关实现和维护 ISOTIF 所需的适用设计、验证和确认措施以及操作阶段活动的指南。 本文件适用于适当的态势感知对于安全至关重要且此类态势感知源自复杂的传感器和处理算法的预期功能，特别是紧急干预系统和具有 1 至 5 级驾驶自动化水平的系统的功能[2]。 本文件适用于包括安装在批量生产道路车辆（轻便摩托车除外）中的一个或多个 E/E 系统的预期功能。 合理可预见的滥用属于本文件的范围。 此外，远程用户对车辆的操作或协助，或者与后台的通信，如果可能导致安全隐患，则可能影响车辆决策，也属于本文件的范围。 本文件不适用于： ——ISO 26262 系列涵盖的故障； ——网络安全威胁； ——系统技术直接造成的危险（例如激光雷达光束对眼睛的伤害）； ——与电击、火灾、烟雾、热、辐射、毒性、可燃性、反应性、能量释放和类似危险相关的危险，除非直接由 E/E 系统的预期功能引起； - 明显违反系统预期用途的故意行为（被视为功能滥用）。 本文件不适用于现有系统的功能，这些系统具有完善且值得信赖的设计、验证和确认（V&V）措施（例如动态稳定控制系统、安全气囊）。 [外文原描述]： This document provides a general argument framework and guidance on measures to ensure the safety of the intended functionality (SOTIF), which is the absence of unreasonable risk due to a hazard caused by functional insufficiencies, i.e.: a) the insufficiencies of specification of the intended functionality at the vehicle level; or b) the insufficiencies of specification or performance insufficiencies in the implementation of electric and/or electronic (E/E) elements in the system. This document provides guidance on the applicable design, verification and validation measures, as well as activities during the operation phase, that are needed to achieve and maintain the SOTIF. This document is applicable to intended functionalities where proper situational awareness is essential to safety and where such situational awareness is derived from complex sensors and processing algorithms, especially functionalities of emergency intervention systems and systems having levels of driving automation from 1 to 5 [ 2 ] . This document is applicable to intended functionalities that include one or more E/E systems installed in series production road vehicles, excluding mopeds. Reasonably foreseeable misuse is in the scope of this document. In addition, operation or assistance of a vehicle by a remote user or communication with a back office that can affect vehicle decision making is in scope of this document when it can lead to safety hazards. This document does not apply to: — faults covered by the ISO 26262 series; — cybersecurity threats; — hazards directly caused by the system technology (e.g. eye damage from the beam of a lidar); — hazards related to electric shock, fire, smoke, heat, radiation, toxicity, flammability, reactivity, release of energy and similar hazards, unless directly caused by the intended functionality of E/E systems; and — deliberate actions that clearly violate the system’s intended use, (which are considered feature abuse). This document is not intended for functions of existing systems for which well-established and well-trusted design, verification and validation (V&V) measures exist (e.g. dynamic stability control systems, airbags).