Before revision:  Noteworthy, we illustrate how our safety mechanism mitigates triple-point faults, which are often beyond the focus of the safety community. Furthermore, on top of handling faults in the ADS, our design can effectively react to its own faults. To reduce specification errors, we developed an executable model of the safety concept in the formal specification language mCRL2.
After revision:  To verify our approach, we developed an executable model of the safety concept in the formal specification language mCRL2.