自动驾驶安全工程师和标准制定者终于有了量化可控性的方法——可转移性和可预测性让ISO 26262在L4/L5场景下可落地，做功能安全验证的团队可以直接参考论文中的数学框架来改进测试用例。
这篇论文针对自动驾驶汽车（AV）中缺乏人类驾驶员的情况，重新审视了ISO 26262功能安全标准中的可控性概念。作者将可控性分解为两个可审计的证据维度：可转移性和可预测性。可转移性衡量AV系统将控制权移交给专用后备安全机制的能力，而可预测性则量化外部实体预测AV行为的难易程度。论文还引入了设计能力与可实现能力之间的差距，以区分架构后备声明与场景条件下的实际后备能力。这些指标与ISO 26262和ISO/PAS 21448（SOTIF）兼容，使后备和交互声明在ODD切片上可证伪和可追溯，从而将标准扩展到SAE L4和L5级无人驾驶系统。
Re-imagining ISO 26262 in the Age of Autonomous Vehicles: Enhancing Controllability through Transferability and Predictability
The ISO 26262 standard defines functional safety for road vehicles through risk assessments based on Severity, Exposure, and Controllability, grounded in a human-driven vehicle paradigm. In the context of autonomous vehicles (AVs), the absence of a human driver necessitates revisiting these principles. This paper decomposes the Controllability placeholder into two auditable evidence dimensions of ISO 26262 by introducing two measurable sub-concepts: Transferability and Predictability. Transferability extends Controllability to capture AV systems' ability to hand off control to dedicated fallback safety mechanisms, while Predictability captures how easily external agents can anticipate AV behavior. Predictability is formally defined from human-robot interaction-inspired principles, and a mathematical framework is provided to quantify it. A designed-versus-achievable gap is introduced to distinguish architectural fallback claims from scene-conditioned achievable fallback capability. The proposed metrics align with ISO 26262 and ISO/PAS 21448 (SOTIF), rendering fallback and interaction claims falsifiable and traceable across ODD slices. These dimensions complement rather than replace existing standards, and the enhancements preserve the structure of ISO 26262 while extending its applicability to driverless automated systems operating at SAE Levels 4 and 5.