Scenarios in which identified triggers occur are assessed to decide whether SOTIF is attainable. It is attainable with no further change when the chance left over of the system giving rise to a hazardous event is shown to be below the set acceptance criteria and no known scenario could expose particular road users to unreasonable risk, including cases where a fleet-level probability is low but an individual vehicle meets the scenario repeatedly, such as a roundabout structure that systematically triggers braking. Assumptions about system behaviour or user actions are recorded and demonstrated in clause 10, and an unacceptable response triggers functional modification.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.