Back in 2014, the Society of Automotive Engineers (SAE) set out six vehicle automation levels, known as J3016, and today is widely accepted as the standard across the industry¹. The classification is based on the division of the driving task between the automatic system and the human driver, rather than on safety requirements. At a time in which Level 3 systems are being introduced to the market, it is imperative that we specify the minimal requirements for a system design which ensures safety when emergency maneuvers might be required. The rapid evolution of self-driving technologies necessitates agreed-upon minimum requirements to avoid putting the entire industry in peril. We would like to propose a methodology for setting those minimal requirements.

We will start with some basic technical definitions and terminology taken from SAE J3016. The operation of driving a car on public roads is referred to as Dynamic Driving Task (DDT) which consists of the perception system (understanding the surrounding environment of the vehicle), a driving policy system (deciding what actions to take next) and vehicle control. The next useful term is Operational Design Domain (ODD) which establishes the envelope of system operation — the scenarios in which the vehicle is able to operate. The ODD may contain any number of usage constraints from the type of roads on which the system can operate (highway, rural, arterial, urban), the kind of maneuvers permitted (straight through junction, protected turns, unprotected turns, etc.), the permitted speed (do not exceed 60km/h for example), limiting constraints by other road users (requirement to have a lead vehicle, for example), weather conditions, and so forth.

Based on the terminology so far, the SAE J3016 document distinguishes between vehicles with some self-driving capabilities to systems which can fully perform the driving task autonomously:

A system is called Automated Driving System (ADS) if it is capable of performing the entire DDT within its ODD. In particular, Levels 3–5 are ADSs while Levels 0–2 are not.²

Meaning that in Levels 0–2, the system is not fully capable of performing the DDT and thus is not considered an ADS, and hence, the driver must be prepared to take control instantaneously. In contrast, in Levels 3–5, the vehicle is responsible to perform the entire DDT, including autonomously handling situations which call for an immediate response, like emergency braking or steering maneuvers. The only difference between Level 3 and Levels 4–5 is that in the former, after several seconds³, the system may ask the human driver to take control and perform what J3016 refers to as “DDT fallback”, while in Levels 4–5 the system should also be capable to perform the “DDT fallback”. That is to say that for L3 the human driver is essentially the fallback in case the ADS is no longer capable to perform the full DDT; whereas the system must provide its own fallback for L4–5.

The exact definition of “DDT fallback” can be found in the J3016 document. For the purpose of this document, the important element is not the “DDT fallback” itself, but the definition of an instantaneous reaction to emergency situations. Since in Level 3 the take-over by the human driver is not instantaneous, it follows that from the perspective of required emergency maneuvers, Levels 3–5 are all the same. In other words, the first observation that we make is that from a system design perspective, Level 3 should handle immediate response of the vehicle autonomously at the same performance level as L4–5. This is true because a take-over request that gives the human driver a few seconds to react does not actually simplify the system design, because during those few seconds anything can happen.

The second observation is that the system design complexity of an ADS is not necessarily tied to the complexity of the ODD. In other words, a simple ODD does not necessarily translate into a simple ADS system design. Many practitioners in the field assume a monotonic relationship between complexity of system design and ODD by viewing Level 3 as a “simpler” problem to solve than Level 4.

The following example is relevant to both observations. Consider an ADS operating in a very simple ODD, say “stay in lane” on highway roads where the ODD excludes lane change maneuvers and is limited to highway roads. Clearly, there are emergency maneuvers which necessitate the ADS stepping outside the designated ODD. For example, in the figure below, car c_r (light blue) is following another car c_f (dark blue), and suddenly c_f makes a last-minute swerve to evade a stationary car (red). The car c_r does not have sufficient distance to avoid the crash by braking, and thus needs to make an evasive maneuver by changing lanes, similar to what a human would do.

If c_r is the ADS, then obviously it must maneuver outside the designated ODD. Failing to do so (sticking to the designated ODD) is an example of a “failure by design” on the part of the ADS because a human driver could have avoided the crash while the ADS did not. Moreover, the ADS does not have a grace period of few seconds to transfer the DDT to the human driver. As mentioned above: in few seconds anything can happen.

This example highlights the notion that once the driver is not responsible for the immediate response of the vehicle, then the system design must be as complex as an ADS with a full-blown ODD. In other words, from a system design perspective, we should expect the same system complexity for an ODD that stays-in-lane and an ODD that performs lane changes. This is not currently the case in L3 systems on their way to market.

Next, we take the insights above and propose a principled methodology for setting the minimal requirements for system design, as a function of ODD, when the ADS is responsible for the immediate response — Levels 3–5.

Methodology for Setting the Requirements for the Safety of Autonomous Vehicles

The engineering process of an Autonomous Driving System involves a perception system (understanding the surrounding environment of the vehicle) and a driving policy system (deciding what actions to do next). In recent years we have introduced Mobileye’s Responsibility-Sensitive-Safety (RSS) model⁴ which covers the driving policy system. Hence, in this document we focus on failures due to errors of the perception system. We distinguish between two sources of errors:

• “Failure by design”: this means that the perception system has a certain ODD, and outside of it the system is likely to fail. For example, consider the example above of a system that is designed to keep the car in its current lane without the ability to perform lane changes. Suppose that such a system only contains forward-facing sensors and does not contain surround sensors with sufficient resolution to support a lane change in congested traffic. Although the ODD is technically supported by this sensor configuration, such a system cannot perform an evasive maneuver in an emergency that involves steering to another lane at the proficiency level of a human driver. As a result, failing to perform an emergency maneuver is considered to be a “failure by design”.
• “Black Swans”: the perception can make a mistake within the boundaries of its ODD. For example, a system which is designed to detect vehicles might miss a vehicle occasionally. The designers of the system cannot know in advance that a specific vehicle would be missed by the system. They can only give statistical guarantees on failure cases. We use the term Mean-Time-Between-Failures (MTBF) for the average time the system can operate without having a “black swan” failure. The MTBF is the inverse of the probability of failure.

Our proposal is the following: An ADS, as defined by J3016 (Levels 3–5), must autonomously handle situations which call for an immediate response. Therefore, an ADS must be equipped with a sensory configuration and functional validation so that:

1. While operating within its ODD, it must have an MTBF of “Black Swan” events at, or above, human crash statistics⁵.
2. Whenever an immediate response is necessary, the system must not have “failures by design” — that is, it must be able to properly respond to safety-critical events, including evasive maneuvers which take the system outside of its ODD, at, or above, human-level capabilities.

For the first requirement, since human crash statistics are known, the system should be validated statistically to have a sufficiently high MTBF. As for validating no failures-by-design, this can be addressed through a crash typology⁶ study or using the formal model of RSS (for example, the proper response for an evasive maneuver which complies with RSS can be found in Definition 12 of the paper⁷).

In summary, we propose that the coupling between level of automation, ODD, and system design follow the principles below:

1. From a safety perspective, the level of driver attentiveness is binary- either the human driver has responsibility for the immediate response, or the robotic driver has it. The responsibility “hand-shake” of Level 3 in the J3016 classification should have no real bearing on safety elements of the system design.
2. The ODD axis is independent of who is responsible for the immediate response.
3. Regardless of the ODD, the immediate response (of the robotic driver) should handle crash avoidance maneuvers at least at a human level. Failure to do so constitutes a “failure by design”.
4. Sensor configuration, system design and functional validation should be free of failures-by-design and reach an MTBF of Black Swans of at least the level of human crash statistics.

Without agreed upon principles like these, we are in danger of deploying systems which do not truly promote safer roads. By following these principles in the design of automated vehicles of all levels, industry practitioners will be building and deploying systems which are safer by definition, and which promote the industry as a whole.

[1] Level 0–2: no automation, longitudinal (ACC) and/or Lateral (LKA) — driver responsible and should be prepared to take control instantaneously; Level 3: take-over request time (say, 10s); Level 4: driver is never asked to take-over but operational design domain (ODD) is limited; Level 5: same as Level 4 but with unlimited ODD.

[2] Sections 3.2 and 3.8 in the SAE J3016 document.

[3] Realistically, a human driver with “eyes-off” needs between 5 to 10 seconds to understand the scene and react.

[4] https://www.mobileye.com/responsibility-sensitive-safety/

[5] NHTSA’s recent data indicates human drivers experience a crash once every ~500,000 miles. https://crashstats.nhtsa.dot.gov/Api/Public/ViewPublication/813060

[6] https://www.nhtsa.gov/sites/nhtsa.dot.gov/files/pre-crash_scenario_typology-final_pdf_version_5-2-07.pdf

[7] https://arxiv.org/abs/1708.06374

At the Consumer Electronics Show in January, we presented an unedited 25 minute-long video of a Mobileye self-driving car navigating the busy streets of Jerusalem. The video was published, first and foremost, for the sake of promoting transparency. We wanted to demonstrate the exceptional capabilities of our technology, but more importantly, to show the world how autonomous vehicles (AVs) operate so that society will come to trust them.

Continuing this effort, we are introducing today a new 40-minute unedited video of a drive comprising a small section from 160 miles of Jerusalem streets we use for our AV development. We chose to follow the drive with a drone to properly provide context for the decision-making logic of the robotic agent, and the only intervention during the drive was to replace the drone’s battery after 20 minutes or so. We have also added narration to explain where and how our technology is handling the wide variety of situations encountered during the drive. The full-length clip is inserted below and a number of short sections from the drive are highlighted at the end of this editorial.

The clip also provides an opportunity to articulate our approach to AV development — which as far as we know is unique and stands out among the various actors in the AV industry. The problem we aim to solve is scale. The true promise of AVs can only materialize at scale — first as a means for ride-sharing via robo-shuttles and later as passenger cars offered to consumers. The challenges to support AVs at scale center around cost, proliferation of HD-maps, and Safety. The point I would like to make here is that Safety must dictate the software and hardware architecture in ways that are not obvious.

Back in 2017, we published our safety concept, which was based on two observations. The first is that accidents caused by lapses of judgment in the decision-making process (e.g., when merging into traffic) can be effectively eliminated by clarifying, in a formal manner, what it means to be “careful” when planning maneuvers, and this ultimately defines the balance between safety and usefulness. Our Responsibility Sensitive Safety model establishes metric parameters around the assumptions that drivers make (like “right of way given, not taken”) in order to make safe decisions. These parameters are established in cooperation with regulatory bodies and standards organizations. Then, the RSS model assumes the worst-case scenario within the boundaries of the agreed upon assumptions, of what other road users will do thus removing the need to make predictions about behaviors of other road users. The RSS theory proves that if AVs follow the assumptions and actions prescribed by the theory, then the decision-making brain of the AV will never cause an accident. Since then, RSS has been promoted across the globe with great traction. For instance, in late 2019 the IEEE enacted a new workgroup chaired by Intel to develop a standard — IEEE 2846 — for AV decision making. Members of the group represent, by and large, the AV industry as a whole. This to me is a greatly reassuring sign that through industry-wide cooperation we can achieve a critical milestone that will elevate the entire industry and allow us to move forward.

The second observation in the paper we published had a profound effect on our system architecture. Assuming that the decision-making process of the robotic driver is taken care of (through RSS for example), we are still left with the possibility that a glitch in the perception system will cause an accident. The perception system is based on cameras, radars and lidars with software that interprets the sensors’ raw data into an “environmental model” — especially of the position and speed of other road users. There is always a chance, even if infinitesimally small, that the perception system will miss the existence, or miscalculate measurements, of a pertinent object (whether a road user or an inanimate obstacle) and cause an accident.

To appreciate what we are dealing with let’s do a simple “back of the envelope” calculation. The number of miles driven in the US is about 3.2 trillion annually and the number of accidents with injuries is about 6 million. Assuming an average speed of 10 mph we have a mean-time-between-failures (MTBF) of 50,000 hours of driving. Assume we design our AV with an MTBF of 10x, 100x, or 1000x better than human MTBF (note that we have ruled out being “as good as humans”, we know we must be better). Consider deploying 100,000 robotic cars to serve as robo-shuttles at scale. This number is consistent with figures raised by players in the ride-hailing space as necessary to support a few dozen cities. Assume each robo-shuttle drives on average five hours a day. So, with a 10x MTBF design we should expect an accident every day, with a 100x design an accident every week, and with a 1000x an accident every quarter. From the societal point of view, if all cars on the road were 10x better on MTBF it would be a huge achievement, but from the perspective of an operator of a fleet, an accident occurring every day is an unbearable result both financially and publicly. Clearly, a lower bound of 1000x on MTBF is a must (and even then, an accident per quarter is still nerve-wracking) if AV-at-Scale is the goal. An MTBF of 1000x translates to 50 million hours of driving which is roughly 500 million miles. Even collecting this amount of data for the purpose of validating the MTBF claim is unwieldy, not to mention developing a perception system that can satisfy such an MTBF to begin with.

All the above is the context for our choice of system architecture. To achieve such an ambitious MTBF for the perception system necessitates introducing redundancies — specifically system redundancies, as opposed to sensor redundancies within the system. This is like having both iOS and Android smartphones in my pocket and asking myself: What is the probability that they both crash simultaneously? By all likelihood it is the product of the probabilities that each device crashes on its own. Likewise, in the AV world, if we will build a complete end-to-end AV capability-based only on cameras, and then build a completely independent capability using radars/lidars we will have two separate redundant sub-systems. Just like with the two smartphones, the probability of both systems experiencing perception failure at the same time drops dramatically. This is very different from how other players in the AV space handle perception who have been focusing on sensor fusion. It is much more difficult to build a camera-only AV than to build an AV fusing all sensors’ data simultaneously. Cameras are notoriously difficult to handle because the access to depth (range) is indirect and is based on cues such as perspective, shading, motion and geometry. The details on how we built the camera-only AV system is articulated in the talk I gave at CES (starting at the 12-minute mark).

This brings me back to the clip we are introducing today. It shows the performance of our camera-only subsystem. There is no radar nor lidar in the car you see in the clip. The car is powered by eight long-range cameras and four parking cameras that are fed into a compute system based on just two EyeQ5s. The car needs to balance agility with safety and does so using the RSS framework. The streets of Jerusalem are notoriously challenging as other road users tend to be very assertive adding significant challenge on the decision-making module of the robotic driver.

We will continue sharing progress and insights of our journey towards AV-at-Scale. Stay tuned for more updates.

Professor Amnon Shashua is a senior vice president at Intel Corporation and president and chief executive officer of Mobileye, an Intel company.

Given the latest statistics, we predict that with a proper differential social distancing placing different guidelines on the low-risk group compared to the high-risk group one could maintain a working economy without quarantine and save a factor of 5 on mortality while not flooding the health system.

Amnon Shashua, Shai Shalev-Shwartz

Both authors are affiliated with the Hebrew University of Jerusalem.

In previous papers, we introduced a mixed-population SEIR model [7] that is aimed at predicting the expectation on the number of critical ICU beds needed to contain the peak of the outburst while in [6] we provided tight concentration bounds on the number of critical ICU beds. The underlying insight was that the population should be divided differentially into a low and high-risk group where the low-risk (people under the age of 65 without co-morbidities) would be subject to social distancing of a relatively ”generous” basic reproduction rate (we assumed R0=1.4) while the high-risk group is under a more strict distancing with an R0=0.7 amongst themselves while observing a tight barrier between the two groups with an allowed ”leakage” of around 2% of the low-risk group infecting individuals from the high-risk group. When the model was fitted to the Israeli data the result was, under worst-case assumptions, an expectation of around 20 critical ICU beds per 100,000 inhabitants.

In this paper, we integrate all we learned to date from our model and from recent data to articulate a strategy of how to live with COVID-19 for the foreseeable future. By and large, there are two rival concepts (or strategies) of a post-lockdown phase. Both concepts acknowledge that the root of the problem is with the high-risk (vulnerable) group — both in terms of flooding the health system and mortality, but they handle the problem very differently. Both concepts are problematic in their own way and the challenge is to choose the less disruptive between the two:

1. In order to protect the vulnerable, ”flatten the curve” so that very few are infected over the entire population and thereby very few will have a chance to infect the vulnerable amongst us. The tools available (besides a full-blown lockdown) are testing, contact-tracing, and isolation of those infected and those who were in close contact with them. This approach requires a very efficient cycle of large scale testing and accurate contact tracing technologies applied at scale. The weaknesses of this approach are twofold. First, is the high percentage of asymptomatic cases — as much as 50% or even higher [4, 5] — which inevitably has a detrimental epidemiological effect on the ability to flatten the curve. Second, is the (unknown) degree of cooperation from the public — especially from the low-risk group who might prefer to ”lay low” rather than risking tight oversight and perhaps lack of control of what the state will do with them during their sickness period.
2. Focus on the vulnerable. The idea is to identify the vulnerable (age cut-off and co-morbidities) and have them observe strict social distancing (for their own protection) while receiving assistance from the state. The weakness of this approach is whether it is at all practical to observe a differential social-distancing regime and whether the toll of strict social distancing is too much to bear over an extended period of time.

In the remainder of this paper, we wish to drill-down further on the 2nd concept of a differentiable social distancing. Summarizing what we know so far from the Israeli and worldwide data would be useful to articulate the magnitude of the difference between the the low and high risk groups:

• In Israel, out of 200 deaths, only 1 is from the low-risk group. Let's assume that the probability to die if one is infected, is between 100 to 200 times larger for members of the high-risk group compared to the low-risk group.
• In Israel, as of April 7, 2020, there were 115 on respiratory systems out of which 19 were from the low-risk group. On average, the probability to require a critical ICU bed (if one is infected) is 6 times larger for members of the high-risk group.
• From available data in Stockholm and Geneva, the probability to die, if infected, is around 0.5%. As of April 22, 2020, there have been approximately 1,000 deaths in Stockholm, and authorities believe that 20% of the population have been infected [1]. Given that the population size of Stockholm is around 1 million, we arrive at the probability of 0.5%. Approximately the same day in Geneva there has been 191 deaths and a Serological test conducted by the Geneva University Hospital [3] concluded there were 27,000 people infected indicating a mortality of 0.7%.
• Mortality is affected by the median age of the population (30 in Israel, 41 in Sweden, 43 in Switzerland), distribution of chronic pre-existing conditions and various anecdotal factors like BCG vaccination during childhood [2].

Lets assume that the size of the low-risk population in Israel is 7 million (out of 9 million) and let p be the probability to die for members of the low-risk group. Given the above, let 100 <= z <= 200 where z · p be the probability to die for members of the high-risk group, then

from which we deduce that 0.01% <= p <= 0.02% and z · p = 2.2%. In other words, the mortality of 0.5% over the entire population is divided extremely unevenly between the low and high-risk groups. It is as if we are faced with two diseases, one mild affecting one group of the population and the other is ferocious affecting a different group of the population.

All of this underscores the most fundamental principle of managing the next phase of living with COVID-19 which is ”protect the Vulnerable population” by all means possible because there lie the high mortality and the risk of flooding the health system. Below is a list of steps one can take in protecting the vulnerable while maintaining reasonable (but strict) social distancing:

1. Identify the high-risk group. This is based on an age cut-off and list of chronic pre-existing conditions. For example, In Israel on April 7, 2020, there were 148 COVID-19 patients treated in ICU (out of which 115 on respiratory systems). The leading pre-existing conditions at the time were Hypertension (30%), Diabetes (30%), Heart conditions (13%), and Obesity (BMI above 35, 7%). Age cut-off and pre-existing conditions are most likely country (or state) specific. The criteria should be set in a way that is concise and clear to the public. Most likely multiple chronic pre-existing conditions should be part of the cut-off rather than a single pre-existing condition.
2. Protect retirement homes. In Sweden, for example, 50% of mortality was from residents of retirement homes. The number of staff members that closely interact on a daily basis with each resident should be minimized. In Sweden, it used to be as much as 5 different people before authorities began aggregating duties to reduce the exposure. Staff members should be tested on a daily basis (not to wait for the appearance of symptoms). Visitations and interactions should follow strict physical distancing, masks of facial shield visors, and surface de-contamination post-visit.
3. The state should issue a special ID card for the population at risk. People holding the card would be entitled to special consideration in public places such as the right to not stand in line (payment and standing in line will be handled by shop staff members), strict physical distancing and de-contamination of surfaces when interacting with staff members (shops etc.), single person workspaces at work, etc.
4. People of the high-risk group would be entitled to work from home or, if that is not possible, to receive a paid leave of absence from the state until the crisis is over.
5. Careful monitoring of the number of high-risk individuals on respiratory systems in order to calibrate the enforcement or tightening of guidelines of physical distancing. In [7] we propose separate graphs of respiratory system use over time for the two populations based on physical distancing assumptions.

As mentioned in [7], the low-risk group would be subject to social distancing but the kind that does not disrupt economic activities — we were assuming a basic reproduction rate R0=1.4 (which means that on average an infected person infects 1.4 individuals). The number of critical ICU beds necessary for containing the peak of the outburst is manageable according to [7] and the mortality at the end of the cycle (when 50% of the low-risk group have been infected) would be between 0.005% to 0.01% of the low-risk population. As for mortality of the high-risk group, under the assumption we made in [7] where 2% of the low-risk population infect individuals of the high-risk and they go on and infect 0.7 other people from the high-risk group (presumably from the same household), then a rule of thumb (assuming that households for the high-risk group are a cluster of infection) would be the following: let X stand for the size of the low-risk population, then the number of infected people from the high-risk group would approximate 0.017X with a mortality figure of 0:0004X. The overall mortality, under the differential social distancing scheme, would be around 0.05% of the size of the low-risk group. This figure should be compared to the 0.5% mortality (of those infected) from current statistics — which amounts to 0.25% assuming 50% infection. Therefore, with a proper differentiable social distancing one can save a factor of 5 on mortality while not flooding the health system. Important to note, that the majority of mortality is coming from 2% of the low-risk population infecting the high-risk. This is, of course, avoidable if the high-risk population is placed under quarantine — but given the potentially long period required to sustain COVID-19 until a vaccine is ready, that could be not practical.

Naturally, every death is a tragedy and we have no intention of downplaying the loss of life. It is a matter of every society to make its own balance between expected loss of life due to COVID-19 and those due to other factors (that could result in alternative solutions for COVID-19). Predicting mortality is not a rewarding exercise but in order to chart the path forward and weigh different strategies the calculations around the capacity of the health system and overall mortality must be transparent. So far, we have not seen this level of transparency with alternative solutions.

References

[1] H. to Ellyatt. Sweden resisted a lockdown, and its capital Stockholm is expected to reach herd immunity in weeks. CNBC, 2020.

[2] P. C. et al. Supplements to COVID-19 confirmed cases prediction this version. April 15, 2020.

[3] G. U. Hospital. Covid-19 seroprevalence: First estimate of the prevalence of anti-sars-cov-2 igg antibodies in the geneva population, 2020.

[4] T. John. Iceland lab’s testing suggests 50% of coronavirus cases have no symptoms. CNN, 2020.

[5] D. Karedes. CDC reviewing stunning universal testing results from Boston homeless shelter. April 15, 2020.

[6] S. Shalev-Shwartz and A. Shashua. Can we contain COVID-19 without locking-down the economy? CBMM Memo 104, Massachusetts Institute of Technology, 2020. can also be found on Medium

[7] S. Shalev-Shwartz and A. Shashua. An exit strategy from the COVID-19 lockdown based on risk-sensitive resource allocation. CBMM Memo 106, Massachusetts Institute of Technology, 2020. Can also be found on Medium

Amnon Shashua, Shai Shalev-Shwartz

Introduction

The COVID-19 outbreak toolbox contains available, inexpensive and unlimited measures such as social distancing, hygiene and the use of facial masks. On the other hand, there are “finite resources”, the use of which is limited, such as PCR testing, technological systems for “closing the circuit” for detecting and quarantining infected persons through contact-tracing technologies, and quality epidemiological surveillance for quarantining people who have come into contact with verified infected individuals.

These limited resources are inherently expensive and are based on assumptions that only experience over time can calibrate. For example, the “closing the circuit” system is heavily affected by the percentage of asymptomatic infected persons (those who are contagious but will be invisible to the system) and on the extent of civil cooperation which likely might be compromised over time (complacency among the low-risk population and failure to report symptoms). Thus, under certain conditions such as 50% asymptomatic subjects and a low percentage of cooperation, the effectiveness of containment will be low and may even lead to a new outbreak.

The key question in the proposed strategy is how to divide available resources in a way that ensures complete control, over time, until vaccination is obtained, while allowing the economy to continue undisturbed.

The principle proposed is to focus on the part of the population which is sensitive to ”leakage” that is, leakage in the containment of the spread for whatever reason which will lead to flooding of the health system and from there to high mortality rates. Israeli data shows that 84% of those on ventilators have a pre-existing condition (most common: hypertension, diabetes, cardiac) or are over 65 years of age, i.e. a high-risk population. Accordingly:

1. It is desirable to focus most of the expensive resources to the benefit of the high-risk population.
2. However, it is necessary to determine whether leakage in the containment of the spread among the low-risk population will lead to flooding of the health system.

The main innovation in this document is the argument that using the available and unlimited resources of social distancing, hygiene rules, and masks can protect the low-risk population while ensuring that the health system is not flooded. Furthermore, we extend the SEIR model to account for mixed high and low-risk populations with different degrees of containment.

Guidelines

In a paper [3], the mathematical foundations for bounding the capacity of the health system (i.e., number of respiratory systems) using concentration bounds were developed using statistical confidence intervals and assuming that there is data on the percentage of carriers among the low-risk population by a random sample. In this document, we will use existing data (without the need for a survey) to make a ”back of the envelope” calculation (without confidence intervals) of the maximum number of critical ICU beds (i.e., people on respiratory systems) required to contain the peak of the outbreak from the low-risk population, given an exponential spread of R_0= 1.4 according to the SEIR model (a detailed description of the model deferred to Appendix A). That is, an infected person infects on average 1.4 people. We chose to set the ”basic reproduction number” R_0 to 1.4 as it is in the low range of R_0reported in the literature [2]. The reason for taking the low-range of R_0 is that we would consider releasing the low-risk population from quarantine under social-distancing guidelines, hygiene, facial masks and restrictions of gatherings above certain thresholds. Later on, we will tackle the problem of modeling potential leakage from the low-risk population to the high-risk population.

The graph below shows the percentage of infectious persons according to the SEIR model (see captions for details). As can be seen, the curve has a “bell-shape”, and the largest load on the health system will happen at the peak of the curve. For R_0 = 1.4, at the peak of the curve we have 1.78% infectious persons. Multiplying this by the probability of an infected person from the low-risk population needing a ventilator, and by the ratio between the average ventilation time (11 days) and average infection time (2.9), we can obtain the percentage of the low-risk population that will need a ventilator at the peak of the outburst.

The probability of needing ventilation can be calculated from existing data: As of 7th April, 2020, there were 19 ventilated infected persons in Israel from the low-risk population (out of a total of 116). Ten days earlier, there were around 5,000 verified infected persons. Clearly, a lower bound on the number of infected persons would be twice the number of verified infected persons due to the fact that around 50% of infected people are without symptoms [1]. Furthermore, a recent survey in Austria [4] found that the true number of infected persons is two to five times the number of verified infected persons. Taking the worst case of a factor of two, suppose the true number of infected individuals was 10,000. From the analysis of the age distribution of infected persons, one may conclude that 15% are over 65. Suppose there is another 10% of infected persons below the age of 65 but with acute background diseases. Therefore, in the absence of data with a confidence interval from a representative survey, we discern from existing information that: Probability of ventilation in low-risk population ≈ 19/7500 = 0.0025. Note that the probability of requiring ventilation given infected is a fixed number (to a particular population) regardless of the time the estimation was made.

The size of the low-risk population is approximately 7 million people (8.8 million minus 1.2 million over 65 minus 600,000 people with acute background diseases).

The number of ventilated at the peak of the outbreak is therefore

It is not inevitable that the actual number of infected persons is significantly greater than factor two of verified infected. As mentioned above, according to the Austrian survey, the factor can reach as much as five times, i.e., the number of those on ventilators at the peak of the outbreak will range from 472 to 1,181. Thus, even with the worst-case assumptions, preparation for ≈1200 ventilated infected persons may be easily arranged considering the ability of the existing healthcare system and procurement mechanisms in Israel.

In addition, it is easy to see that the “leakage” of the spread of the disease in the low-risk population does not translate into an unmanageable increase in the number of those on ventilators. For example, suppose the basic reproduction number R_0 is 1.5 (“leakage” from 1.4), then, according to the SEIR model, the number of needed ventilators will increase to about 1,600.

It is important to note that accurate data and estimates can be obtained by a sample survey that will almost certainly alleviate the worst-case assumptions adopted in estimating the true number of infected persons in relation to the verified infected persons.

The conclusion from which operative measures can be derived is that the sensitivity to leakage in the low-risk population is dramatically lower than the sensitivity to leakage in the high-risk population. Moreover, the State of Israel will be able to prepare for the maximum number of ventilated patients under the worst-case assumptions adopted.

Extending SEIR Model to Handle Cross-Groups Leakage

So far, we have ignored the high-risk population. In reality, however, there will be some leakage from infectious people in the low-risk population to the high-risk population and leakages among the high-risk population. In Appendix B we generalize the SEIR model so that it will take into account a division to two populations. This is modeled by four values of the basic reproduction number: R_0l,l ;R_0l,h ; R_0h,l ; R_0h,h, representing low-to-low, low-to-high, high-to-low, and high-to-high infections.

As above, we set R_0l,l = 1.4 which represents the spread of the virus among the low-risk population to an infected person infecting (on average) 1.4 persons. The leakage from low to high groups, R_0l,h is assumed to be small because both populations understand the risks and we set it to 0.02 (meaning that on average 50 infected people from the low group will infect one person from the high group). For example, in Israel people are told ”stay away from your grandparents” and this, by and large, is being self-imposed across the country. The leakage from high to low is not material to our model but for the sake of symmetry, we set it to R_0h,l = 0.02 as well. What remains is to set reasonable expectations to the possible leakage among the high-risk population. Given that (i) the population is under stricter social distancing, and (ii) by and large the group is heavily tilted towards senior citizen ages where the percentage of single-person household is heightened, then it is reasonably to assume that R_0h,h < 1 and we set it to 0.7. The results are displayed in Figure 2 showing that the added number of critical ICU beds (on top of the 1181 for the low-risk group) stands on 872 (under pessimistic assumptions).

Taken together, taking into accounts leaks between the two risk groups and among the high-risk group, with a worst-case assumption of factor 2 between the validated positives and true positives, the total number of critical ICU beds needed at the peak of the outbreak stands on 2,053 — which translates to 20 critical beds per 100,000 inhabitants.

Operative Measures

The operative proposal does not change the basket of means and resources but rather their focus. Due to the low sensitivity to leakage in the low risk population, the lockdown upon that population may be released subject to social distancing guidelines, hygiene rules and masks. At the same time, it will be possible to restore the economy and the education system to routine, while the retail, leisure and restaurant sectors may be restored subject to restrictions. The high tolerance to leakage allows for great flexibility in the “dosage” of lockdown release.

At the same time, the high-risk population will be managed according to stricter social distancing guidelines, with ”closing the circuit” resources directed primarily at this population and those treating them (nursing homes, hospitals, etc.). Among this population, the leakage sensitivity is high (with a risk of flooding the health system) and therefore, it is desirable that the expensive and limited resources be diverted in greater measure to the prevention of leakage in the spread of the virus among high-risk individuals. By monitoring the seriously ill in this population, one may control the level of intensity of the guidelines and social distancing rules.

As for mortality, it is important to note that, by segregation according to risk groups as suggested here, total mortality across the general population will be lower compared to methods that apply across the general population. The alternative is an ongoing lockdown, or ongoing rounds of lockdown and release depending on the effectiveness of ”closing the circuit” among the entire population. As mentioned, the success of ”closing the circuit” critically relies on the cooperation of the population and it is safer to assume that those who in the high-risk group would be more cooperative in reporting symptoms as soon as they arise.

A back-of-the-envelope estimation of mortality of the low-risk group (which under this proposal are consciously subjected to the risk of infection), to date there is zero mortality among the low-risk group in Israel. Given that there were 19 individuals using ventilators a lower-bound on the probability of mortality is 1/19 the probability to require a ventilator, i.e., 0.0025/19 = 0.00013 which is 0.013% of the low-risk population. Given R_0 = 1.4 the total number of people infected (over a period of roughly 200 days) is around 50% (see Figure 4 right-most panel). This translates to a figure of 455 under the worst case assumption of factor 2 between the validated positives and true positives (if the factor is larger, say factor 5, then the mortality figure would be 182). For the sake of calibration, the annual mortality in Israel due to traffic accidents stands around 350.

Appendix A: The SEIR model

The Susceptible-Exposed-Infected-Recovered (SEIR) model is a simple compartmental mathematical model of infectious disease. In this model, the total population is divided into S susceptible persons (people that did not get the disease yet), E exposed persons (people that has been exposed but are still not ill), I infected persons (people that has been infected and can infect others), and R recovered persons (people that may be recovered/dead/or still be sick, but are not infectious any more). The total population size is the sum N = S + E + I + R. Every day, the relative sizes of the different compartments change. We denote by S[t], E[t], I[t], R[t] the number of persons in each compartment on day t. The update of the sizes is according to the following rules:

• Let τᵢ be the average number of days a person can infect others. Recall that in our model, the Recovered compartment includes people that can no longer infect others (either because they recovered, or because they died, or because they are still sick but are no longer infectious). Therefore, every day, a fraction of 1/τᵢ of the Infected compartment is moved to the Recovered compartment. This yields:

• Let τₑ be the average number of days from the moment a person is exposed to the virus until he becomes infectious. Then, every day, a fraction of 1/τₑ of the Exposed compartment is moved to the Infected compartment. This yields:

• The basic reporduction number, denoted R_0, is the average number of persons an infected person will expose in total, if he will just meet persons from the S compartment. The probability to meet a person, particularly from the S compartment on day t, is S[t]/N. Therefore, the total number of persons an infected person will expose on day t is R_0·S[t]/N. Spreading this over τi days of infection, we get that on every day, each person from the I compartment exposes R_0 · (S[t]/N) · (1/τᵢ) persons. It follows that:

• and,

To get some intuition, the graphs below depict the values of S[t]/N, E[t]/N, I[t]/N, R[t]/N, where we set τᵢ=2.9, τₑ = 5, R_0 = 3.0.

As can be seen, the Susceptible compartment monotonically decreasing and the Recovered compartment is monotonically increasing. The Infected and Exposed compartments have a “bell-shape”, where initially they are growing fast and then they decay fast. The basic reproduction number, R_0, determines the “flatness” of the bell-shape: what is the height at the peak and on which day we arrive at the peak. The basic reproduction number also determines the size of the Recovered compartment at the end of the pandemic (how many people got sick sometime in the past and are now either recovered or died). The graphs below depict the height of the peak, day at the peak, and the recovered compartment at the end of the pandemic, as a function of R_0.

The SIR model: In the pure SIR model, there are only three compartments: Susceptible, Infected, and Recovered. The formulas are similar

The derivative (change) of I[t] is I[t + 1]-I[t] = (R_0S[t]/(Nτi)-(1/τi)) I[t]. When the derivative of I[t] equals to zero, we reached the peak of the pandemic, and from there on, the number of infected persons will decrease over time. Based on the above expression, this will happen when S[t]/N=1=R₀. Denoting the portion of the population which is not susceptible by φ[t] := 1 — S[t]/N, then we obtain that the peak of the pandemic is when φ[t] = 1–(1/R_0). Note that this formula is incorrect for the SEIR model. And, in any case, we do not need to rely on the formula as we are simulating the entire dynamic.

Appendix B: A SEIR model with a division to High and Low-Risk Populations

We now describe a variant of the SEIR model, in which there are two populations: those of high risk and those of low risk. As in the SEIR model, each sub-population is divided into the four compartments of Susceptible, Exposed, Infectious, and Recovered. We denote the 8 compartments at time t by Sˡ[t], Eˡ[t], Iˡ[t], Rˡ[t], Sʰ[t], Eʰ[t], Iʰ[t], Rʰ[t], where the upper script l or h designates low or high risk groups. We assume mild social distancing within the low-risk group and strict social distancing between the low and high risk groups as well as within the high risk group. This is modeled by four values of the basic reproduction number: R_0l,l ; R_0l,h ; R_0h,l ; R_0h,h, representing low-to-low, low-to-high, high-to-low, and high-to-high infections. The update equations for Iˡ, Iʰ, Rˡ, Rʰ are similar to the vanilla SEIR model. As to the move from suspects to exposed: each person in Iˡ potentially infects R_0l,l/τi persons in one day if he happens to meet someone from Sˡ (which will happen with probability Sˡ/Nˡ where Nˡ is the size of the low-risk population), and in addition, potentially infects R_0l,h/τi persons in one day if he happens to meet someone from Sʰ (with probability Sʰ/Nʰ). Similarly for each person in Ih. This gives the following difference equations:

Figure 2 (top) shows the percentage and number of infected cases for the two populations. The parameters we used are where we set τi = 2.9; τe = 5, R_0l,l = 1.4, R_0h,h = 0.7, R_0l,h = R_0h,l = 0.02, Nˡ = 7,000,000, Nʰ = 2,000,000. The rationale for the parameters is that the low-risk group has mild social distancing measures while the high-risk group has strict social distancing measures, and in particular, any contact between the two groups must be with significant protection (masks, gloves, etc.).

References

[1] T. John. Iceland lab’s testing suggests 50% of coronavirus cases have no symptoms. https://edition.cnn.com/2020/04/01/europe/iceland-testing-coronavirus-intl/index.html.
[2] Q. Li, X. Guan, P. Wu, X. Wang, L. Zhou, Y. Tong, R. Ren, K. S. Leung, E. H. Lau, J. Y. Wong, et al. Early transmission dynamics in wuhan, china, of novel coronavirus–infected pneumonia. New England Journal of Medicine, 2020.
[3] A. Shashua and S. Shalev-Shwartz. Can we contain covid-19 without locking-down the economy? CBMM Memo 104, Massachusetts Institute of Technology, 2020.

[4] COVID-19 Prevalence, SORA, April 10, 2020. https://www.sora.at/uploads/media/Austria_COVID19_Prevalence_BMBWF_SORA_20200410_EN_Version.pdf

The authors wish to thank the faculty members of the computer science department of the Hebrew University, as well as to Prof. Peter Bartlett, Prof. Nir Friedman, Prof. Katrina Ligett, Prof. Nati Srebro, Prof. Herve Bercovier, and Dr. Renana Eitan for comments and feedback on earlier drafts of this paper.

In this article, we present an analysis of a risk-based selective quarantine model where the population is divided into low and high-risk groups. The high-risk group is quarantined until the low-risk group achieves herd-immunity. We tackle the question of whether this model is safe, in the sense that the health system can contain the number of low-risk people that require severe ICU care (such as life support systems).

Introduction

One could consider three models for handling the spread of Covid-19.

1. Risk-based selective Quarantine: Divide the population into two groups, low-risk and high-risk. Quarantine the high-risk and gradually release the low-risk population to achieve a managed herd immunity of that population. The managed phase is designed to allow the health system to cope with the expected number of severe cases. Given the herd immunity of the low-risk group, we can gradually release the high-risk population. The question is how to manage the release from quarantine of the low and high-risk populations in a way that will not overwhelm the health system.
2. Containment-based selective quarantine: Find all the positive cases and put them in quarantine. This requires an estimation of [t0,t1] the “contagious time interval” per age group, then given this time interval one could recursively isolate all the individuals at risk from a person that is carrying the virus using “contact tracing”. Another tool is predictive testing using contact-tracing to identify people with many contacts with other people and perform tests on them.
3. Countrywide (or region-wide) lock-down until the spread of the virus is under control. The lock-down could take anywhere from weeks to months. This is the safest route but does not prevent a “second wave” from occurring.

Models 2,3 could work in tandem and have been tried in China and Singapore. Model 3 is currently the default model around the globe and naturally has a tremendous crippling impact on the economy. In the remainder of this article, we derive some tools for analyzing the viability of the risk-based model. Specifically, what level of sampling and confidence level can be obtained to make sure that the health system can contain the model?

The Risk-based Selective Quarantine Model: How do we Know Whether it is Safe?

Consider a plausible definition of a high-risk group based on a cut-off age and certain pre-existing conditions. For the sake of concreteness, assume the cut-off age is 67+ which represents the retired segment of society. The low-risk group is the remainder of society which is released to their daily routine while following certain distancing protocols that are aimed at slowing the spread, while keeping the economy un-disrupted to a large degree, but ultimately reaching a herd immunity level. At that point it is safe to gradually release the high-risk group from quarantine. The question is how do we guarantee that the health system will not be overwhelmed during the spread of the virus in the low-risk group?

Let b be the number of severe cases, e.g., those that require an intensive care unit (ICU) or specifically respiratory systems, that the health system can handle, say b = 600 for a country of the size of Israel¹. Let m_d be the number of low-risk people that will develop severe symptoms and will require an ICU assuming we will adopt the risk-based selective model. Then, the model is “safe” if b > m_d. Our goal is to derive an upper bound on m_d, so that we’ll be able to ensure that b > m_d. Let m be the size of the low-risk group and let ν be the probability that a person that comes from the low-risk group will develop severe symptoms, assuming the person is currently sick. Then,

So, to ensure that b > m_d we will require that ν < b/m.
Before we continue, we note that fully understanding the dynamics of the spread of the virus and the dynamic of the development of the disease (for the sake of knowing when we will need ICUs and for how long) is very challenging and will probably require much more research and time. What we propose here is a worst-case analysis. The idea is to adopt a pessimistic view and show that even under this pessimistic view, the health system is not likely to collapse. We already made a pessimistic assumption since we did not take into account the fact that not all of the low-risk population will get sick, and even those that will get sick will not get sick at the same time and will not need an ICU at the same time.

Continuing our derivation, let p* be the current, unknown, percentage of positive cases among the low-risk population and let k be the number of severe cases among the low-risk population from today until one week from now. Assuming that people that are positive cases will either develop severe symptoms within a week or will never develop severe symptoms, then we can estimate ν as follows:

Note that again we are taking a worst-case view. Maybe some of the severe cases in a week’s time will be due to people that are not infected today but will get infected tomorrow. This is even likely when the pandemic grows at an exponential rate. Next, we turn the approximation into inequalities by deriving an upper bound on ν using a measure concentration inequality. While it is possible to rely on generic measure concentration bounds (e.g. Chernoff’s bound or Bernstein’s inequality [2, 3]), we rely on tighter bounds specific for the Binomial family due to [5].

Lemma 1 Fix some δ ∈(0,1) and for every integer k let k̃(k, δ) be the minimal integer such that k > k̃ + 1 and

where Φ is the cumulative distribution of a normal distribution. Assuming that p*m > k̃, we have that, with a probability of at least 1 — δ,

The proof of the lemma follows directly from Lemma 3 in the appendix. As an example, if we take δ = 0.05 and k=15 then k̃=24. To show the tightness of this bound, observe that for a Binomial variable Sn ∼ Binomial(p, n), where in our case n = p*m and p = k̃ /n, we have that (Sn — pn)/(pn(1 — p))^0.5 behaves like a normal variable when n→∞. Therefore, if we want a confidence level of δ = 0.05, then at the limit, we need that (k — k̃)/√k̃ ≈ -1.65 (because Φ(-1.65) = 0.05). This will happen when:

The graph below shows, as a function of k, the minimal value of k̃ that guarantees δ ≤ 0.05 according to Lemma 1, compared to the right-hand side of the above equation. As can be seen, the two curves are very close to each other.

Getting back to our derivation, based on Lemma 1, we can upper bound m_d (with a probability of at least 1 — δ) by

since even if all of the young population will get the virus, the number of severe cases will be the right-hand side of the above equation. Of course, in reality we expect m_d to be much smaller than the above, both because not all of the young population will get the virus and because not all the severe people will be sick at the same time. Nevertheless, as mentioned previously we adopt a worst-case analysis.

Next, we turn to derive a lower bound on p*. To do this, we will sample n persons, uniformly at random from the low-risk population, and will derive a lower bound on p* based on the number of people that came out positive. In particular,

Lemma 2 Fix some δ ∈(0,1) and integer n, and for every integer r let r̃ be the maximal integer such that r — 1 > r̃ > 1 and

where Φ is the cumulative distribution of a normal distribution and D(p, c) = c log(c/p)+(1 — c) log((1 — c)/(1-p)). Let n be a sample size, let p*∈ (0, 1), and let r be the number of positive cases we found in the sample. Then, with a probability of at least 1 — δ we have that p* > r̃/n .

The proof of the lemma follows directly from Lemma 4 in the appendix. All in all, we obtain that (with probability of at least 1–2δ),

The health system will be able to treat all of these severely sick people if b>m_d, so a sufficient requirement is that

To get some intuition on the effect of the sample size n, suppose that we set δ=0.05, and suppose that p* = 0.02.
The graph below shows our lower bound as a function of n.

We see that when n = 1000 we lose a factor of 2.3, and when n = 5000 we lose a factor of 1.25.

Discussion and Implications

In the event a risk-based quarantine approach would be contemplated by decision-makers, the purpose of this document is to provide decision-makers a formal and tight bounds to investigate whether the health system can cope with the number of severe cases that would reach ICU. Embedded in the reasoning is the idea of selective quarantine (based on age groups and existing pre-conditions, but could be any other criteria) where the ”high-risk” group (the one we suspect will have a high rate of severe cases) is quarantined and the other is allowed to spread the virus under certain distancing protocols. The underlying premise is that a full population-wide quarantine is not a solution in itself — it is merely a step to buy time followed by a more managed (non brute-force) approach. The managed phase underlying our thinking is to create herd immunity of the low-risk group in a controlled manner while keeping the economy going. It is all about keeping the health system in check and not overwhelming its capacity to handle severe cases. The question we ask in this document is whether we can estimate in advance, through sampling, that the number of severe cases arising from the low-risk group would not overwhelm the system?

Taking Israel as a case study, as of March 30, k = 15 (out of 74 severe cases in ICU). As of today, there is no scientific estimation of p* only indications. The graph below depicts our bound as a function of p*, ranging from 0.02 to 0.1, when we fix δ = 0.05, k = 15, and n = 5000. We also depict the values of k̃/p*, which will be the bound (for b the number of critical beds) had we known p*, and the value of k/p*, which is the approximation of m_d based on expectations.

Worth noting that the bound is fairly tight (for n = 5000) comparing m_d with k̃/p* (i.e., plugging in the correct p* rather than the lower-bound r̃/n). We also see that the range of m_d is from around 1,500 to 400 which translates to 15 to 4 critical ICU beds per 100,000 inhabitants. Given that Israel has, in normal periods, 6 beds per 100,000 inhabitants, the additional beds is something that Israel can reasonably handle. Talks are to go up to 50 critical beds during this crisis — therefore, the analysis indicates that releasing the low-risk group to achieve herd immunity is not unreasonable.

Some additional points worth mentioning. The random variable k could be a very useful indicator to decide on what constitutes the high-risk group. What age cut-off and what preexisting conditions to include. At any given time, we would want the definition of the high-risk group to create a small value of k (as the capacity b monotonically increases with k). For example, in our case study, we decided on a cut-off age of 67 and looked among the 74 severe cases for those without any pre-existing conditions. In order to avoid over-fitting this kind of study should be done with data preferably coming from other countries.

Another point worth mentioning is that the risk-based quarantine model is not only beneficial form the point of view of economical sustainability. Among other selective quarantine ideas (like based on geography or contact-tracing isolating the infected and those around them) the risk-based approach has better chances of reducing the overall mortality rate. The reason is that the highest mortality is with the high-risk group which in this model is isolated.
When the high-risk group is released from isolation they would be facing a largely immune population thus naturally facing a very slow spread of infection with a good chance to whither the storm until a cure or vaccine is available. In all other selective quarantine models the high and low risk are equally susceptible to be infected so that even if the health system is not overwhelmed still the mortality of the high-risk group is likely to be higher than the risk-based model.

Yet another point worth mentioning is that we focused on what is ”safe” for the health system in the sense of how to estimate the number of severe cases that would be low enough not to overwhelm the ICUs. We ignored the fact that some severe cases could end up in the mortality statistics even when given proper care. In fact, there are two probabilities to estimate (i) the probability of being in the ”severe” category among the low-risk group, and (ii) the probability of mortality given proper care. We have bounded the former and ignored the latter. The reason for doing so is that the latter is beyond the scope of this paper because it is essentially a moral tradeoff between ”safety” and ”usefulness” that is employed in every aspect of society. For example, society does not put a lockdown on passenger car use in order to significantly reduce car accidents even though such a lockdown will save lives. Likewise, governments do not allocate infinite budgets for the health system even though there is a correlation between increased investments and saving lives.

As a final remark, going out of quarantine is a choice, not an obligation. This is no different than people that are afraid of flights and decide not to go on an airplane. Families can decide to stay quarantined either as an extra safety measure or if some members of the family are from the high-risk group while the others are from the low-risk group.

Appendix A- Proofs

The proofs rely on the analysis given in [4], and in particular, on the following theorem due to [5].

Theorem 1 Let Sn ∼ Binomial(n, p), where p ∈(0, 1) and n > 0, then for k ∈ {1,….., n — 2} we have

where Φ is the cumulative distribution function of a standard normal variable and D(p, c) = c log(c/p) + (1 — c) log((1 — c)/(1 — p)) is the KL divergence.

Lemma 3 Let k, k̃ be two integers such that k > k̃ + 1 and let δ ∈ (0, 1) be such that

where Φ is the cumulative distribution of a normal distribution. Let n > k̃ be an integer and let p ∈ (0, 1). Suppose that Sn ∼ Binomial(n, p). Let a null hypothesis be that p ≥ k̃/n . Then, if Sn ≤ k, we can reject the null hypothesis with a probability of at least 1 — δ.

Proof If p < k̃/n there is nothing to prove, so let us assume that p ≥ k̃/n , and observe that the extreme case is when p =k̃/n. Note that in this case we also have that np > k + 1, and therefore by Theorem 1,

Denote f(k) = k̃ — (k + 1) and observe:

Let’s analyze the function h(k, n). For a fixed k, we show that h(k, n) monotonically decreases when n increases:

where we used log(1 + x) ≤ x for x > -1.

Therefore,

which concludes our proof.

Lemma 4 Let r, r̃, n be three integers such that n > r, r̃ ≥ 1 and r > r̃ + 1, and let δ ∈ (0, 1) be such that

where Φ is the cumulative distribution of a normal distribution and D(p, c) = c log(c/p)+(1 — c) log((1 — c)/(1-p)). Suppose that Sn ∼ Binomial(n, p). Let a null hypothesis be that p ≤ r̃/n. Then, we can reject the null hypothesis with
probability of at least 1 — δ if Sn ≥ r.

Proof If p > r̃/n there is nothing to prove, so let us assume that p ≤ r̃/n, and observe that the extreme case is when p = r̃/n. By Theorem 1 we have

which concludes our proof.

Appendix B- Estimating p∗ from pooled tests

A pooled test is obtained by taking a sample from T persons, mixing all of these samples, and searching for traces of the virus. If the pooled test is positive, it means that at least 1 of the persons is positive. The reduction below shows how to utilize pooled tests.

Let ϕ* be the probability that for a random pool of size T we will have ST ≥ 1, where ST is the number of positive cases in the pool. Note that by definition of the pool test, it ends up positive if and only if ST ≥ 1. Observe that

Hence, if ϕ* ≥ ϕ̃ we have that

Rearranging terms, we obtain that p*≥ p̃. In other words, to show that p*≥ p̃ it suffices to show that ϕ* ≥ ϕ̃.
The gain from the pool is clearly observed if p̃T ≪1. In this case, using the approximation 1−x ≈e⁻ˣ we have that ϕ̃≈p̃T. Hence, the number of pooled tests we need is roughly T times less than the number of regular tests we need, in order to show the same conclusions on p*.

References and footnotes

[1]Israel has around 6 critical beds per 100,000 inhabitants.

[2] S. N. Bernstein. On a modification of chebyshev’s inequality and of the error formula of laplace. Annals Science Institute Sav. Ukraine, Sect. Math. 1, 1924.

[3]S. Shalev-Shwartz and S. Ben-David. Understanding machine learning: From theory to algorithms. Cambridge university press, 2014.

[4]M. Short. Improved inequalities for the poisson and binomial distribution and upper tail quantile functions. ISRN Probability and Statistics, 2013, 2013.

[5]A. M. Zubkov and A. A. Serov. A complete proof of universal inequalities for the distribution function of the binomial law. Theory of Probability & Its Applications, 57(3):539–544, 2013.