The complexity of the operating environment and required technologies for
highly automated driving is unprecedented. A different type of threat to safe
operation besides the fault-error-failure model by Laprie et al. arises in the
form of performance limitations. We propose a system theoretic approach to
handle these and derive a taxonomy based on uncertainty, i.e. lack of
knowledge, as a root cause. Uncertainty is a threat to the dependability of a
system, as it limits our ability to assess its dependability properties. We
distinguish uncertainties by aleatory (inherent to probabilistic models),
epistemic (lack of model parameter knowledge) and ontological (incompleteness
of models) in order to determine strategies and methods to cope with them.
Analogous to the taxonomy of Laprie et al. we cluster methods into uncertainty
prevention (use of elements with well-known behavior, avoiding architectures
prone to emergent behavior, restriction of operational design domain, etc.),
uncertainty removal (during design time by design of experiment, etc. and after
release by field observation, continuous updates, etc.), uncertainty tolerance
(use of redundant architectures with diverse uncertainties, uncertainty aware
deep learning, etc.) and uncertainty forecasting (estimation of residual
uncertainty, etc.).

提出了一种系统论方法来处理自动驾驶中存在的不确定性威胁，通过对缺乏知识的根本原因进行的不确定性分类（包括触发模型、模型参数缺失和模型不完整性），将方法聚类为不确定性预防、不确定性消除、不确定性容忍和不确定性预测，与 Laprie 等人的分类方法类比。