  Automated Driving (AD) systems have the potential to increase safety, comfort
and energy efficiency. Recently, major automotive companies have started
testing and validating AD systems (ADS) on public roads. Nevertheless, the
commercial deployment and wide adoption of ADS have been moderate, partially
due to system functional insufficiencies (FI) that undermine passenger safety
and lead to hazardous situations on the road. FIs are defined in ISO 21448
Safety Of The Intended Functionality (SOTIF). FIs are insufficiencies in
sensors, actuators and algorithm implementations, including neural networks and
probabilistic calculations. Examples of FIs in ADS include inaccurate
ego-vehicle localization on the road, incorrect prediction of a cyclist
maneuver, unreliable detection of a pedestrian, etc.
  The main goal of our study is to formulate a generic architectural design
pattern, which is compatible with existing methods and ADS, to improve FI
mitigation and enable faster commercial deployment of ADS. First, we studied
the 2021 autonomous vehicles disengagement reports published by the California
Department of Motor Vehicles (DMV). The data clearly show that disengagements
are five times more often caused by FIs rather than by system faults. We then
made a comprehensive list of insufficiencies and their characteristics by
analyzing over 10 hours of publicly available road test videos. In particular,
we identified insufficiency types in four major categories: world model, motion
plan, traffic rule, and operational design domain. The insufficiency
characterization helps making the SOTIF analyses of triggering conditions more
systematic and comprehensive.
  Based on our FI characterization, simulation experiments and literature
survey, we define a novel generic architectural design pattern Daruma to
dynamically select the channel that is least likely to have a FI at the moment.
