DRSPI - A Framework for Preserving Automated Vehicle Safety Claims by Unknown Unknowns Recognition and Dynamic Runtime Safety Performance Indicator Improvement 2022-01-0813

A safe automated vehicle must “know when it doesn’t know.” Automated vehicles cannot depend on the traditional drive-fail-fix cycle due to heavy tail problem distributions supplying virtually infinite problems. In order to be safe, automated vehicles require the ability to handle unforeseen untested “unknown unknown” situations. Safety Performance Indicators (SPIs) at deep-enough sub-claim levels can uncover safety case claim violations in a ‘leading’ fashion - prior to safety events. This paper introduces Dynamic Realtime SPIs (SPIs calculated at runtime) at sufficiently low safety case claim levels which yield runtime recognition of safety case claim violations and can be used by the ADS to infer that it is encountering an “unknown unknown” situation. Then, because “knowing when an ADS doesn’t know” is insufficient to ensure AV safety, we introduce the Dynamic Realtime SPI (DRSPI) framework, for handling such occurrences. The DRSPI framework includes methodical assignment of one or more SPI improvement mechanisms (IMs) to each SPI such that the ADS can dynamically adjust its performance in response to unknown situations as witnessed by leading SPIs monitored in real-time. As a result, unknown unknowns are recognized, control is adjusted, safety performance is brought back up, and the integrity of the safety case sub-claim(s) are re-established in the face of unknown unknown situations. An example application of the Dynamic Realtime SPI Improvement framework, including Realtime SPIs attached to safety case sub-claims, is also presented.