Zoox publishes safety case framework requiring robotaxis to be significantly safer than human drivers

Zoox's safety case framework explains how the company evaluates the safety of its purpose-built robotaxis, which it designs and manufactures from the ground up with its own driving software and operated fleet. This vertical integration is meant to allow continuous safety optimization from system architecture through every public-road ride. The safety case quantifies robotaxi safety within a target Operational Design Domain (ODD), with the goal of being significantly safer than a human driver. It uses a system safety approach to address random and systemic fault causes and aggregates residual risk through a quantitative risk assessment framework.

Rooted in systems engineering, the safety case treats safety as a property of the entire system rather than individual component failures. The process begins with structured hazard analysis and historical learnings to identify, classify, and mitigate risks, and those analyses drive architectural decisions such as redundancy and fault-monitoring strategies. Safety requirements and test scenarios are implemented and validated across hardware, software, and operations, and real-world operations learnings feed back into the systems engineering process for continuous improvement.

Safety clearance combines three domains: autonomy behavior safety, robot platform safety, and operational safety. Before any safety-relevant software release, hardware change, or operations revision, Zoox updates its safety case and confirms the combined risk meets targets. The primary metric is CIF, the estimated rate of potential Collision, Injury, and Fatality events measured in miles per event, which accounts for three severity levels—Collision, Injury (MAIS1+), and Fatality—and harm to vehicle occupants, VRUs, and occupants of other vehicles. Targets are set against a human benchmark built from NHTSA's CRSS and FARS, FHWA's SHRP2 and annual vehicle miles traveled estimates, parsed for road-speed segments such as 25 mph vs. 55 mph within the target ODD, with Zoox test-fleet data validating it. Zoox also tracks additional metrics for rare collision avoidance scenarios, and follows ISO 26262 and industry best practices, plus rules-of-the-road, near-miss, and operational safety metrics.

Autonomy behavior safety evaluates the ADS through five integrated software functions: localization, perception, prediction, planning, and control, plus an independent collision-checking layer. Validation combines synthetic simulation and real-world log-based simulation; synthetic pipelines use optimization to search for likely collision conditions, results are weighted by fleet exposure, and log-based simulation replays actual fleet data with machine-learning-based sampling for rare safety-critical events. Closed-course testing stages perception-sensitive scenarios that are hard to reproduce in simulation, and a dedicated collision avoidance test targets high-risk, rare scenarios especially involving VRUs. After these methodologies, the ready-to-be-cleared software is validated on-road in retrofitted test vehicles with human drivers monitoring before driverless clearance is approved.

For the robot platform, Zoox follows the ISO 26262 functional safety process, starting with HARA to define safety goals and assign ASIL ratings, captured in functional and technical safety concepts. FMEDA quantifies hardware architectural metrics, FTA evaluates redundancy and fault coverage, and fail-operational and fail-safe analyses define safe-state steps; verification uses software-in-the-loop, hardware-in-the-loop fault-injection, and closed-course vehicle testing, with hardware redundancies maintaining safety-critical functions after faults and FMVSS performance requirements tested. Operational safety centers on continuous fleet monitoring, feeding real-world findings back into software, operator training, and procedures, with the option to restrict, pause, or ground operations if risk rises above acceptable levels. TeleGuidance remote tacticians provide high-level assistance such as approving or suggesting alternate routes without driving, and their potential human error or tool malfunction is quantified into the CIF model.