Scenario- and Model-Based Systems Engineering Procedure for the SOTIF-Compliant Design of Automated Driving Functions

Advances in automated driving are creating new challenges for product development in the automotive industry and continuously driving up the cost of product verification and validation. Modern automated driving systems (ADS) must safely handle a considerable number of driving scenarios in compliance with the Safety of the Intended Functionality ( SOTIF) standard. While model-based systems engineering (MBSE) has successfully proven itself in the automotive industry as an enabler for complex system and test design, common procedures are neither scenario-based nor do they consider SOTIF. It is yet to be shown, how MBSE approaches can meet these specific requirements of ADS development and, what advantages they can offer over non-model-based methods. In this paper, an extended variant of the established feature-driven MBSE procedure CUBE is presented that includes the analysis of use cases and scenarios. Use-case-specific logical scenarios and the corresponding expected behavior and system architecture are specified using SysML profile extensions. It is demonstrated, how specification model artifacts are used for identifying potentially hazardous scenarios and functional deficiencies and how SOTIF analysis results flow back into the specification process by means of the function "Multi-Story Car Park Chauffeur". The SysML model is linked to a safety argumentation created using the Goal Structuring Notation to integrate the system specification and the evidence from the SOTIF analysis in a single procedure and toolchain, ensuring full traceability.