  With autonomous vehicles (AVs), a major concern is the inability to give
meaningful quantitative assurance of safety, to the extent required by society
- e.g. that an AV must be at least as safe as a good human driver - before that
AV is in extensive use. We demonstrate an approach to achieving more moderate,
but useful, confidence, e.g., confidence of low enough probability of causing
accidents in the early phases of operation. This formalises mathematically the
common approach of operating a system on a limited basis in the hope that
mishap-free operation will confirm one's confidence in its safety and allow
progressively more extensive operation: a process of "bootstrapping" of
confidence. Translating that intuitive approach into theorems shows: (1) that
it is substantially sound in the right circumstances, and could be a good
method for deciding about the early deployment phase for an AV; (2) how much
confidence can be rightly derived from such a "cautious deployment" approach,
so that we can avoid over-optimism; (3) under which conditions our sound
formulas for future confidence are applicable; (4) thus, which analyses of the
concrete situations, and/or constraints on practice, are needed in order to
enjoy the advantages of provably correct confidence in adequate future safety.
