I guess that means I was able to pull the wool over the eyes of all five members of my thesis committee because none of them thought so.
> It entirely depends on your definition of failure.
Well, yeah, of course. So? There is some subset of states of the world that you label "failure". The guarantee is not that the system never enters one of those states, the guarantee is that if the system enters one of those states it never (well, so extremely rarely that it's "never" for all practical purposes) fails to recognize that it has done so. Why do you find that so implausible?
Stated so, that is plausible. However, "it is possible to engineer a system that never fails to detect that it has failed" is not; I claim that any subset of states which is amenable to this level of detectability will exclude some other states that any normal person would also consider to be "failure".
They seem the same to me. In fact, in 27 years you are the first person to voice this concern.
> I claim that any subset of states which is amenable to this level of detectability will exclude some other states that any normal person would also consider to be "failure".
Could be, but that would be a publishable result. So... publish it and then we can discuss.
That is one possible failure mode. But you're right, it's not the only one.
There is an extensive literature on how to detect and correct sensor errors resulting from all kinds of different failure modes.
OTOH, if you say you’ve failed when you haven’t, that’s a false alarm (FA).
In general, there is a trade-off between MD and FA. You can drive MD probability to near-zero, but typically at a cost in FA.
Again in general, you can’t claim that you can drive MD to zero (other than by also driving FA probability to one) without knowing more about the specifics of the problem. Here, that would be the sensors, etc.
In particular, for systems with noisy, continuous data inputs and continuous state spaces -- not even considering real-world messiness -- I would be surprised if you could drive PD to zero without a very high cost in FA probability.
As a humbling example, you cannot do this even for detection of whether a signal is present in Gaussian noise. (I.e., PD = 1 is only achievable with PFA = 1!) PD = 1 is a very high standard in any probabilistic system.
Discrete-input systems can behave differently.
Right, that whole claim about engineering a system that always knows when it’s not working sounds rock solid to me. After all, we can build a human, right?
Not yet. But there's no reason to believe we won't be able to eventually.
i.e: Always report "I'm wrong."
This seems to me to be a clearly incorrect (and self-contradictory) claim. It entirely depends on your definition of failure.
Your analysis seems fine. The big problem is that the "autonomous" driver is using one signal (where are the lines on the edge of the road?) to the near exclusion of all others (is there a large stationary solid object in front of me?)
Maybe Tesla should have hired George Hotz (sp?) if only to write a lightweight sanity-check system that could argue with the main system about whether it was working.