Q/A: How engineers must design AVs to drive safely

Self-driving vehicles rely on multiple sensors to operate safely, but how can engineers design-in a sufficiently diverse mix of sensors to avoid crashes? And what assumptions go into consensus-based decision making?

Taylor Gage, automotive ADAS engineer at Texas Instruments, has answers.

At Sensors Converge 2026, he will speak on the subject of SOTIF:  “Safety of the Intended Functionality: The Linchpin of Advancing Vehicle Autonomy.”  SOTIF is aligned with ISO 21448, a standard to identify scenarios where the intended functionality of a sensor or other component may actually result in an unsafe condition because of various triggers, such as when a functioning camera sensor is blinded by glare from the sun or oncoming vehicle lights.  

A better understanding of SOTIF will help engineers enhance passenger safety and expand the environments where vehicles with higher levels of autonomy are allowed to function, Gage believes. He’s an expert in FPD-Link auto networking with experience in TI’s radar technology.  Fierce Sensors had a chance to ask Gage about his work and his view that AVs can be designed to be “truly safe.”

Fierce: Hi Taylor, your topic at Sensors Converge is “Safety of the Intended Functionality: The Linchpin of Advancing Vehicle Autonomy.”  What’s your elevator pitch about what you’ll be covering?

Gage: Automotive safety has historically been all about preventing technical failures, such as power loss or overheating systems, but autonomy changes everything. As human intervention in driving decreases, systems can work exactly as designed but still result in unsafe or even deadly conditions. This is because while there might not be any hardware or software faults, the real risk has gone unaddressed: misunderstanding the environment.

This is where Safety of the Intended Functionality (SOTIF) comes in. By focusing on things like sensor limitations, situational ambiguity, and operational edge cases, sensor designers and automakers can create autonomous vehicles that are truly safe for everyone. In my presentation at Sensors Converge, I will explain why SOTIF is the real bottleneck to higher autonomy, and why the goal of fully self-driving vehicles won’t be reached by redundancy alone, but by defining and validating safe behavior when systems are incomplete rather than broken.

Fierce: What are some examples of SOTIF where intended functionality might become unsafe?  You mentioned the example of a camera sensor being blinded by glare but what are some others?

Gage: Finding examples of unsafe operation despite full functionality is where the rubber meets the road for SOTIF. Other examples include:

      1. Roads under construction, where old lane markers overlap with new lanes. This plays directly into the weaknesses of a camera. Do you prioritize the most clear lane markers, avoiding collision with the car next to you, or does the system fall into an unknown state?

      2. A person on a skateboard, traveling at faster than running speeds. A radar system would see the object’s size, reflectivity, etc. and correctly deduce that it’s a human, but its velocity would be naturally impossible. As a result, the radar system very well might discard the person’s signature as a false positive, leading to a collision!

      3. There are situations referred to as “high dynamic-range” scenarios. This is when a very reflective object is near a much less reflective second object, such as a person standing next to an 18-wheeler. This introduces issues in radar and LiDAR systems, which prioritize high-intensity signal returns and often filter out the significantly less reflective objects entirely. In situations like these, the safety of vulnerable road users is compromised as the car may drive dangerously close to the pedestrian.

Fierce: Your online description mentions the need to implement a diverse sensor mix in an AV. Can you provide an example and what problem it is attempting to solve?

Gage: As a fun example, some municipalities are using illusionary painting schemes to trick drivers into slowing down. The picture (below) shows a crosswalk painted to look like 3D concrete columns in the middle of the road by the human eye. The problem for autonomous vehicles is that this will trick cameras too! Now as you’re cruising down the road, your camera system suddenly says it sees massive objects blocking the path. Do you slam on the brakes? Do you swerve? Relying on a single sensor to make these decisions can quickly put you in dangerous situations. If you have a variety of sensors, however, you can face virtually any situation with confidence.

Going back to the example, let’s now assume you have a forward facing camera and radar system. Now as you’re driving, the camera sends out the alarm, but the radar sees clear roadway ahead. The camera’s strength is object classification, but anything it sees should be picked up by the radar system as well, because the strength of radar is object detection. Now you can properly conclude that the camera is hallucinating, and that no drastic action must be taken. This concept is what I refer to as “consensus-based decision making,” and it solves the problems inherent to the weaknesses of any one sensing modality.

Fierce: Is SOTIF leading designers and OEMs toward greater vehicle autonomy?  Is there any pushback against SOTIF or is it being widely adhered to?  

SOTIF is leading designers to think outside of the box. Too often, it’s all too easy to zoom in on technical debugging and failure analysis, chasing functional safety (ISO26262) without consideration of the world and its real conditions. Through the SOTIF design process, engineers and designers will consider the strengths and weaknesses of their individual systems, identifying edge cases where everything is running fine at the sensor level, but the vehicle is approaching or already in a hazardous situation.

The goal is to reduce unknown factors to acceptable levels, thereby creating an autonomous vehicle that is ready for anything. This means that the more SOTIF is considered and implemented, the higher the level of autonomy vehicles can achieve.

I have not seen any pushback on SOTIF in my experience, as the advantages are clear and undeniable. What I have seen though is a lack of knowledge or understanding of what SOTIF is and what it means for companies. This is what my talk is looking to rectify!

Editor’s Note:  Taylor Gage will speak on SOTIF at Sensors Converge 2026 at 2:30 pm PT on Wednesday May 6.  Sensors Converge 2026 runs May 5-7 at the Santa Clara, CA, Convention Center.  Registration for the expo and conference online.