Autonomous Vehicles Meet the Physical World: RSS, Variability,
  Uncertainty, and Proving Safety (Expanded Version)
  The Responsibility-Sensitive Safety (RSS) model offers provable safety for
vehicle behaviors such as minimum safe following distance. However, handling
worst-case variability and uncertainty may significantly lower vehicle
permissiveness, and in some situations safety cannot be guaranteed. Digging
deeper into Newtonian mechanics, we identify complications that result from
considering vehicle status, road geometry and environmental parameters. An
especially challenging situation occurs if these parameters change during the
course of a collision avoidance maneuver such as hard braking. As part of our
analysis, we expand the original RSS following distance equation to account for
edge cases involving potential collisions mid-way through a braking process. We
additionally propose a Micro-Operational Design Domain ({\mu}ODD) approach to
subdividing the operational space as a way of improving permissiveness.
Confining probabilistic aspects of safety to {\mu}ODD transitions permits
proving safety (when possible) under the assumption that the system has
transitioned to the correct {\mu}ODD for the situation. Each {\mu}ODD can
additionally be used to encode system fault responses, take credit for advisory
information (e.g., from vehicle-to-vehicle communication), and anticipate
likely emergent situations.
