⚡ electrical engineering

Re-imagining ISO 26262 in the Age of Autonomous Vehicles: Enhancing Controllability through Transferability and Predictability

This paper proposes re-imagining the ISO 26262 Controllability criterion for autonomous vehicles by decomposing it into measurable dimensions of Transferability and Predictability, thereby creating a mathematical framework to quantify and falsify fallback capabilities and interaction behaviors in driverless systems.

Original authors: Chaitanya Shinde, Hadi Hajieghrary, Paul Schmitt, Adam Shoemaker, Bodo Seifert, Steve Kenner

Published 2026-06-08

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Chaitanya Shinde, Hadi Hajieghrary, Paul Schmitt, Adam Shoemaker, Bodo Seifert, Steve Kenner

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are teaching a new driver how to handle a car. The current safety rules (called ISO 26262) were written for humans. They ask three big questions to decide how dangerous a situation is:

How bad could the crash be? (Severity)
How often does this happen? (Exposure)
Can the driver steer or brake to avoid it? (Controllability)

The third question, "Can the driver avoid it?", works great for humans. But what happens when you take the human driver out of the car and replace them with a robot? The robot can't "steer" in the same way a human reacts, and there is no human to "take over" if the robot gets confused.

This paper proposes a new way to answer that third question for self-driving cars. Instead of asking "Can a human control this?", it splits the answer into two new, measurable parts: Transferability and Predictability.

Here is the breakdown using simple analogies:

1. Transferability: The "Emergency Backup Plan"

In a human car, "Controllability" is about how fast a human can react. In a self-driving car, we need to know: If the main brain fails, can the car's backup system take over safely?

The Analogy: Imagine a pilot flying a plane. If the autopilot fails, the pilot must be able to grab the controls and land the plane safely. In a self-driving car, the "pilot" is the backup software.
The Paper's Claim: The authors call this Transferability. It measures how well the car can hand off control from its main system to a "safety net" (a fallback mechanism) before a disaster happens.
The "Gap" (∆T): The paper introduces a concept called the "Designed vs. Achievable Gap."
- Designed: What the engineers think the backup system can do on paper.
- Achievable: What the backup system actually does when tested in real, messy situations (like rain, blocked roads, or glare).
- If the real-world performance is worse than the design, there is a "gap." The paper argues we must measure this gap honestly rather than just trusting the design drawings.

2. Predictability: The "Clear Intent"

The second part of the problem is that self-driving cars don't just need to be safe internally; they need to be safe with other people. If a car stops suddenly or moves weirdly, pedestrians and other drivers might get confused and panic.

The Analogy: Imagine you are walking down a busy street. You can tell a person is about to cross the road because they look at you, step forward, and wave. You can "predict" their move. If someone walked toward you, stopped, spun in a circle, and then ran backward, you wouldn't know what they were doing, and you might trip or get hurt.
The Paper's Claim: The authors call this Predictability. It measures how easy it is for a pedestrian or another driver to guess what the self-driving car will do next.
How it works: The paper suggests checking four things to see if the car is "predictable":
1. Context: Is the car moving like a normal car in this situation?
2. Intent: Is it clear what the car wants to do? (e.g., turning left vs. going straight).
3. Signals: Do the turn signals and brake lights match the car's actual movement?
4. Surprise: Did the car make a sudden, jerky move that no one could explain?

Putting It Together: The New Safety Score

The paper suggests combining these two new scores (Transferability and Predictability) to create a new, upgraded version of the old "Controllability" score.

The Logic: If a car has a great backup plan (High Transferability) but drives in a confusing, jerky way (Low Predictability), it is still dangerous.
The Result: The paper creates a mathematical formula to mix these scores. If the car is good at both, it gets a "safe" rating. If it fails at either, the safety rating drops, and the car needs to be fixed or restricted to simpler roads.

Why This Matters

The authors aren't saying the old rules are wrong; they are saying the old rules were built for humans, and self-driving cars are different.

Old Rule: "Can the human driver fix this?"
New Rule: "Can the car's backup system fix it (Transferability) AND can the people around it understand what the car is doing (Predictability)?"

By measuring these two things, regulators and engineers can prove that a self-driving car is safe not just because it has good sensors, but because it has a reliable backup plan and behaves in a way that humans can understand.

Important Note from the Paper:
The authors are very careful to say this is a proposal for how to update the rules, not a finished law. They emphasize that these new scores are meant to add to the existing safety checks, not to let companies skip the hard work of making cars safe. They also warn that you can't just use the same computer program to design the car and then test if the car is predictable; the test must be independent to be trusted.

Technical Summary: Re-imagining ISO 26262 in the Age of Autonomous Vehicles

Problem Statement

The ISO 26262 standard provides a comprehensive framework for functional safety in road vehicles, fundamentally grounded in a human-driven paradigm. Its risk assessment model relies on three parameters: Severity (S), Exposure (E), and Controllability (C). The "Controllability" parameter specifically estimates the probability that a human driver can mitigate a hazardous event through timely reaction.

This driver-centric assumption becomes invalid for SAE Levels 4 and 5 autonomous vehicles (AVs), where no human operator is available to intervene during the dynamic driving task. Consequently, the traditional Controllability metric cannot be directly applied to driverless systems. The paper identifies a critical gap: existing standards lack a systematic method to decompose and quantify "controllability" in the absence of a human driver, necessitating a reinterpretation of how hazard mitigation and situational control are assessed for autonomous systems.

Methodology

The authors propose a methodological extension to ISO 26262 that decomposes the Controllability placeholder into two auditable, measurable sub-dimensions: Transferability and Predictability. These dimensions are designed to complement, rather than replace, existing ISO 26262 processes and align with ISO/PAS 21448 (SOTIF).

1. Transferability (System-Level Capability)

Transferability redefines Controllability from a human reaction to a system capability. It is formally defined as the ability of an AV to execute a safe and timely transition from primary autonomy to a dedicated fallback mechanism within the Fault-Tolerant Time Interval (FTTI), achieving a minimal-risk condition without introducing new hazards.

Formalization: Transferability ( $T$ ) is modeled as a function of the operational context: $T = T(o, f, s, m, \tau_{FTTI})$ , where $o$ is the Operational Design Domain (ODD) slice, $f$ is the fault family, $s$ is the scene state, $m$ is the Minimal Risk Maneuver (MRM) class, and $\tau_{FTTI}$ is the time interval.
Evidence Tuple ( $E_T$ ): Claims are supported by a specific evidence tuple recording detection latency, initiation latency, MRM success time, stop zone compliance, and the per-demand success probability with confidence intervals.
Designed vs. Achievable Gap ( $\Delta T$ ): The paper introduces a metric to distinguish between architectural fallback claims ( $T_{designed}$ ) and scene-conditioned achievable capability ( $T_{achievable}$ ). The gap $\Delta T = T_{achievable} - T_{designed}$ is calculated on an ordinal scale ( $T_0$ to $T_3$ ) to identify where environmental or contextual limitations degrade performance below design expectations.
Classification: Transferability is classified into four levels ( $T_0$ – $T_3$ ) based on the lower confidence bound of MRM success probability, conditioned on specific ODD slices and fault families.

2. Predictability (External Interaction Dimension)

Predictability addresses the safety of interactions between the AV and external road users (pedestrians, cyclists, other drivers). It quantifies the extent to which these external agents can anticipate the AV's near-future behavior based on observable motion, signals, and context before they must commit to their own response.

Formalization: Predictability is defined via a reference model of expected motion ( $p_{ref}$ ) and an observer model for goal inference ( $p(g | \xi_{0:t}, c, a)$ ).
Vector Monitor ( $M_P$ ): Predictability is assessed through four diagnostic channels:
1. Contextual Conformity ( $Q_{conf}$ ): Measures how well the trajectory fits the declared reference distribution.
2. Intent Clarity ( $S_{intent}$ ): Quantifies the reduction of ambiguity in the observer's goal inference (based on Shannon entropy).
3. Signal Consistency ( $S_{signal}$ ): Assesses alignment between turn signals, brake lights, and actual motion.
4. Kinematic Surprise ( $S_{kin}$ ): Detects unexplained jerks, hard braking, or hesitation.
Aggregation: These channels are aggregated into an ordinal class ( $P_0$ – $P_3$ ) using a "worst-channel" rule, where a single failure in a channel can degrade the overall class.

3. Unified Enhanced Controllability ( $C_u$ )

The paper proposes a unified computation for Controllability in driverless contexts ( $C_u$ ) by composing Transferability ( $T$ ) and Predictability ( $P$ ).

Composition Rule: The authors suggest an additive-penalty rule: $C_u = \min(3, T + \Delta P)$ , where $\Delta P$ is a penalty derived from the Predictability class.
Integration: This unified class $C_u$ is reported alongside standard Severity and Exposure parameters in Hazard Analysis and Risk Assessment (HARA) as supplementary evidence. It does not replace the normative ASIL determination but informs it with scenario-conditioned, auditable data.

Key Contributions

The paper makes three principal methodological contributions:

Formalization of Transferability: It extends the Controllability construct for driverless contexts by evaluating Minimal Risk Maneuver (MRM) performance against Fault-Tolerant Time Intervals, introducing the "Designed vs. Achievable" gap ( $\Delta T$ ) to make fallback claims falsifiable and traceable.
Establishment of Predictability: It defines Predictability as a quantifiable dimension of external road-user safety, capturing both conformity to expected motion patterns and the clarity of intent communication, supported by a four-channel vector monitor.
Validation Methodologies: It proposes specific acceptance criteria and validation methods, including fault-injection testing for Transferability and human-observer studies (or calibrated observer models) for Predictability, enabling their adoption as falsifiable metrics within ISO 26262 and SOTIF safety lifecycles.

Results and Proposed Framework

The paper does not present empirical experimental results from a specific vehicle deployment but rather establishes a theoretical and procedural framework. The "results" are the proposed definitions, mathematical formulations, and integration points:

Classification Tables: The paper defines non-normative reporting classes for Transferability ( $T_0$ – $T_3$ ) and Predictability ( $P_0$ – $P_3$ ) with qualitative acceptance criteria (e.g., $T_0$ requires seamless, fail-operational transitions; $P_0$ requires all channels to remain within calibrated bounds).
Unified Mapping: A mapping table (Table IV) demonstrates how combinations of $T$ and $P$ classes result in a unified Controllability class ( $C_0$ – $C_3$ ), preserving the ordinal scaling of ISO 26262.
Amendments to ISO 26262: The authors outline specific, concise amendments across ISO 26262 Parts 1–10. These include adding definitions for Transferability and Predictability, updating HARA to record $T$ and $P$ ratings, and requiring independent monitors for planner design to avoid circular dependencies between training signals and safety evidence.

Significance and Claims

The paper claims that its framework provides a scalable, evidence-driven pathway for certifying the safety of highly automated (L4) and fully autonomous (L5) systems. Its significance lies in:

Preserving Standards: It maintains the structure and intent of ISO 26262 while extending its applicability to driverless systems, avoiding the need for a completely new standard.
Bridging Disciplines: It harmonizes functional safety (ISO 26262) with SOTIF (ISO 21448) by quantifying both intrinsic system control (Transferability) and external human understanding (Predictability).
Falsifiability: By introducing measurable metrics like $\Delta T$ and the vector monitor $M_P$ , the framework renders fallback and interaction claims falsifiable and traceable across specific ODD slices, moving away from opaque, aggregate safety claims.
Independence: The paper emphasizes that planner design and safety evidence must remain independent; using Predictability metrics as training rewards must not compromise the validity of the safety case evidence.

The authors explicitly state that these proposals are research recommendations for standards bodies and do not constitute normative requirements or reflect the compliance posture of their employers. They acknowledge limitations, noting that numerical targets are scenario-specific and require re-calibration, and that the framework does not propose relaxing ASIL requirements based on high Transferability or Predictability scores.