Zoox has published the safety case framework it uses to clear its robotaxis for driverless operation, built around a single primary metric: the estimated rate of Collision, Injury, and Fatality (CIF) events, measured in miles per event. The company’s stated target is to be significantly safer than a human driver within its defined Operational Design Domain (ODD). The safety case framework aggregates residual risk across three domains — autonomy behavior, robot platform, and operations — into one system-level estimate that Zoox says must meet or exceed its targets before any safety-relevant software release, hardware change, or operations revision is cleared.
Highlights
- CIF is the primary risk metric, combining three severity levels — collision, injury (MAIS1+), and fatality — with a likelihood dimension expressed in miles per event.
- The human benchmark draws on four federal data sets: NHTSA’s Crash Report Sampling System and Fatality Analysis Reporting System, FHWA’s Strategic Highway Research Program, and FHWA’s annual vehicle miles traveled estimates.
- Three domains roll into one estimate — autonomy behavior safety, robot platform safety, and operational safety, each quantified separately and then aggregated.
- Safety clearance is a formal gate, applied before every safety-relevant software release, hardware change, or operations revision.
What Does the Safety Case Measure?
CIF accounts for harm to any party involved in a collision, including Zoox vehicle occupants, vulnerable road users such as pedestrians, cyclists, and motorcyclists, and the occupants of other vehicles. The severity dimension breaks into three levels — collision, injury at MAIS1+, and fatality — with MAIS1+ defined by the Association for the Advancement of Automotive Medicine as Maximum Abbreviated Injury Scale level 1 or higher. The likelihood dimension captures how often events are predicted to occur at each severity level. Zoox says the estimate draws on both simulation and real-world driving data, and that a combined figure across all three domains is confirmed at each safety clearance before deployment.
The company acknowledges limits to the approach. A severity and likelihood metric alone does not cover rare collision-avoidance scenarios and is not a substitute for established standards such as ISO 26262, so Zoox maintains additional metric categories: a dedicated collision-avoidance test set, rules-of-the-road metrics, near-miss tracking, and operational safety measures. On the collision-avoidance set, the robotaxi must perform on par with or better than nominal human drivers in simulation to be considered passing.
How Is the Human Benchmark Built?
Zoox evaluates published historic human driving collision data, then parses it to account for risk differences across road speeds — 25 mph versus 55 mph, for example — and for the mix of road-speed segments inside its target ODD. Logged mileage and events from the Zoox test fleet are also used to validate the benchmark. The company describes this as grounding its internal targets in real-world human data rather than an abstract threshold.
Autonomy Behavior Safety
The autonomy stack is assessed on perception of the environment, prediction of other road users’ behavior, and planning of trajectories that follow the rules of the road, delivered through five integrated software functions: localization, perception, prediction, planning, and control. A separate collision-checking layer runs an independent check of the primary system’s planned trajectory using its own perception and algorithms, determining whether that trajectory is safe to execute or whether it should intervene.
Validation combines synthetic simulation pipelines — which use optimization techniques to search driving scenarios for conditions where a simulated collision is most likely, then generate refined variations of high-risk cases — with log-based simulation that replays fleet driving data through the latest software stack using machine-learning sampling to prioritize rare and safety-critical events. Simulation results are weighted by real-world fleet exposure data. Closed-course structured testing covers perception-sensitive scenarios that are hard to reproduce in synthetic simulation and rare in driving logs, an approach Zoox has described previously in its work on edge case testing. Software is then driven and qualified in retrofitted test vehicles with human drivers monitoring behavior before driverless clearance is approved.
Robot Platform Safety
For the vehicle platform, Zoox follows the ISO 26262 functional safety process. A structured HARA identifies platform hazards and their severity; safety goals are defined and assigned an Automotive Safety Integrity Level, then captured in functional and technical safety concepts that translate into requirements across sensors, compute, actuator controllers, and firmware.
Three analyses evaluate the design against those requirements. Failure Modes, Effects, and Diagnostic Analysis quantifies hardware architectural metrics against ASIL requirements given known faults and diagnostic coverage. Fault Tree Analysis evaluates how well redundancy and onboard safety monitors cover single-point faults. Dedicated fail-operational and fail-safe analyses define the steps the platform takes to reach a safe state after a fault. Verification runs through software-in-the-loop and hardware-in-the-loop fault-injection testing plus closed-course on-vehicle testing.
Although Zoox has been exempted from portions of certain Federal Motor Vehicle Safety Standards, the company says the robotaxi is tested and verified to meet or exceed the performance requirements in applicable FMVSS, and that it designs systems to satisfy the safety purpose of standards it is exempt from — treating its sensor clearing system, for instance, the way a conventional windshield wiping system would be treated.
How Does TeleGuidance Factor Into Risk?
Operational safety centers on the tools and workflows used by Zoox’s TeleGuidance tacticians, remote support staff who provide high-level assistance when a robotaxi encounters a complex situation and asks for help. Tacticians do not drive the vehicle. They offer guidance such as approving or suggesting an alternate route, and the robotaxi remains fully responsible for all driving decisions.
Zoox applies STPA and historical operational learnings to identify potential causes of risk in those tools, then uses the resulting risk scenarios to inform interface design and to build tactician training and evaluation scenarios. The risk quantification methodology accounts for both human error and tool malfunction within TeleGuidance, and those estimates feed directly into the CIF model.
Continuous fleet monitoring closes the loop. Real-world findings drive software improvements, additional operator training, and procedural adjustments. If an event or a series of repeated events generates an unanticipated safety risk above an acceptable level, Zoox says it may restrict, pause, or ground operations while implementing mitigations.
