Zoox published the risk framework that gates each safety-relevant software release

Zoox published its safety case framework on August 12, setting out how the company decides whether a build of its robotaxi software is allowed to reach the road.

The company said the framework assessed risk across three domains within a target operational design domain: autonomy behavior safety, robot platform safety, and operational safety. It described a formal gate, which it called safety clearance, that brings the three together. Before any safety-relevant software release, hardware change or operations revision, Zoox said, the safety case is updated and the combined quantified risk across all three domains is confirmed against the company’s targets.

The primary metric is the rate of potential collision, injury and fatality events, which Zoox abbreviates to CIF and measures in miles per event. Injury is counted at the MAIS1+ threshold. The company said the metric accounted for harm to any party in a collision, including Zoox occupants, the occupants of other vehicles, and vulnerable road users such as pedestrians, cyclists and motorcyclists.

Targets are set against a human benchmark rather than in the abstract. Zoox said it built that benchmark from published human driving data, naming NHTSA’s Crash Report Sampling System and Fatality Analysis Reporting System, and the Federal Highway Administration’s Strategic Highway Research Program and its annual vehicle miles traveled estimates, then parsed the data by road speed to match the mix of road segments in its target domain. Logged mileage from the Zoox test fleet is used to validate the benchmark.

For hazard analysis the company named System-Theoretic Process Analysis, failure modes and effects analysis, fault tree analysis, and hazard and risk analysis, and said these drove architectural decisions such as redundancy and fault-monitoring strategies.

Source: Zoox, August 12, 2026.