As shown in Figure 26 above, this stage consists of six activities that are performed to define and validate the safe out of context operation for an AS. The artefacts generated from this stage are used to instantiate the out of context operation assurance argument pattern as part of Activity 27. An AS may spend some time operating outside the defined ODM ([B]) whilst still be operating autonomously. This could be unsafe, since autonomous operation is only assured for safety within the defined ODM. There are several situations where operation outside the ODM may occur:
An autonomous road vehicle encounters flash flooding on the road. Such flood conditions are not within the ODM as they cannot be handled safely by the autonomous driving function. Since the flash flood conditions arise suddenly and unexpectedly it is not possible for the vehicle to anticipate and avoid these conditions.
The ODM for an agricultural robot includes rain but not snow as the robot cannot operate safely in snowy conditions. During operation in heavy rain, the low temperature causes the rain to become sleet, followed by a transition to snow. The AS is unclear as to when sleet becomes snow and hence when it has moved outside of the ODM.
It is expected that time spent in autonomous mode outside the ODM should be limited, or indeed transient. Note that one option for dealing with outside ODM operating is to get back within the ODM as soon as possible.