EN   EN 
 
 
 EUROPEAN  
COMMISSION   
Brussels, XXX   
[…](2022) XXX  draft  
ANNEXES 1 to 4  
 
ANNEXES  
to the  
Commission Implementing Regulation (EU) .../... of XXX  
laying down rules for the application of Regulation (EU) 2019/2144 of the European 
Parliament and of the Council as regards uniform procedures and technical 
specifications for the type -approval of fully automated vehicles with regard to their 
automated dri ving system (ADS)     
     
       
       
             
 EN 1  EN ANNEX 1 
 
Information document for EU type-approval  of fully  automated  vehicles  with  regard  to 
their  automated  driving  system  
 
MODEL  
 
Information document No … relating to the EU type -approval of a type of a fully automated 
vehicle with regard to the automated driving  system  (ADS ). 
The following  information  shall  be supplied  in triplicate  and include  a list of contents.  Any 
drawings  or pictures  shall  be supplied  in appropriate  scale  and in sufficient  detail  on size A4 
or on a folder  of A4 format.  Photographs,  if any, shall  show  sufficient  detail.  
 
0. GENERAL  
0.1. Make  (trade  name  of manufacturer):  
0.2. Type:  
0.2.1.  Commercial  name(s)  (if available):   
0.2.2  For multi -stage approved vehicles, type -approval  information of the 
base/previous stage vehicle, list the information for each stage. (This can be 
done with a matrix)  
 Type:  
 Variant(s):  
 Version(s):  
 Number of the type -approval certificate including extension number …  
0.3. Means  of identification  of type,  if marked  on the vehicle  / component  / separate  
technical  unit: 
0.3.1.  Location  of that marking:  
0.4. Categor y of vehicle:  
0.5. Company  name  and address  of manufacturer:  
0.5.1  For multi -stage approved vehicles, company  name and address of the 
manufacturer of the base/previous stage(s) vehicle: …  
0.6 Location and method of attachment of statutory plates and location of vehicle 
identification number: …  EN 2  EN 0.6.1. On the chassis: …  
0.6.2.  On the bodywork: …  
0.8. Name(s)  and address(es)  of assembly  plant(s):  
0.9. Name  and address  of the manufacturer’s  representative  (if any):  
17. AUTOMATED DRIVING SYSTEM  (ADS)  
17.1. General ADS description  
17.1.1. Operational Design Domain  / Boundary conditions   
17.1.2. Basic Performance (e.g. Object and Event Detection and Response , planning,  
etc)  
17.2. Description of the functions of the ADS   
17.2.1. Main ADS  Functions (functional architecture)   
17.2.1.1.  Vehicle -internal  functions  
17.2.1.2.  Vehicle -external functions (e.g. backend , off -board infrastructure needed , 
operational measures needed ) 
17.3. Overview of the major components of the ADS  
17.3.1. Control Units  
17.3.2. Sensors  and installation of the sensors on the vehicle  
17.3.3. Actuators  
17.3.4.  Maps and positioning  
17.3.5. Other Hardware  
17.4. ADS layout and schematics  
17.4.1. Schematic system layout (e.g. block diagram)  
17.4.2. List and schematic overview of interconnections  
17.5. Specifications  
17.5.1. Specifications in Normal operation  
17.5.2. Specifications in emergency  operation  
17.5.3. Acceptance Criteria  
17.5.4 Demonstration of Compliance  EN 3  EN 17.6. Safety Concept   
17.6. 1. Manufacturer Statement that the vehicle is free from unreasonable risks  
17.6. 2. Outline of the software architecture (e.g. block diagram)   
17.6. 3. Means by which the realization of ADS logic is determined  
17.6. 4. General explanation of the main design provisions built into the ADS so as to 
generate safe operation under fault conditions, under operational disturbances 
and the occurrence of conditions that would exceed the ODD  
17.6.5  General description of failure handling main principles, fall -back level strategy 
including risk mitigation strategy (minimum risk manoeuvre)  
17.6. 6. Conditions for triggering a request to the on -board operator or the remote 
intervention operator  
17.6. 7. Human Machine Inter action concept with vehicle occupants, on -board operator 
and remote intervention operator  including protection against simple 
unauthorized activation/operation and Interventions    
17.7.  Verification and Validation by the manufacturer of the performance 
requirements including the OEDR, the HMI, the respect of traffic rules and the 
conclusion that that the system is designed in such a way that it is free from 
unreasonable risks for the driver, vehicle occupants and other road users  
17.7.1.  Description of the adopted approach  
17.7.2.  Selection of nominal , critical and failure scenarios  
17.7.3.  Description of the used methods and tools (software, laboratory, others) and 
summary of the credibility assessment  
17.7.4.  Description of the result s 
17.7.5.  Uncertainty of the results  
17.7.6.  Interpretation of the results  
17.7.7.  Manufacturer’s declaration:  
 The manufacturer(s) ............................................................. affirm(s) that the 
ADS is free of unreasonable safety risks to the vehicle occupants and other road 
users . 
17.8.  ADS data elements  
17.8.1.  Type of Data stored  
17.8.2.  Storage location  EN 4  EN 17.8.3.  Recorded occurrences and data elements  
17.8.4.  Means to ensure data security and data protection  
17.8.5.  Means to access the data  
17.9.  Cyber security and software updates  
17.9. 1. Cyber Security Type Approval Number :  
17.9.2.  Number of the Certificate of Compliance for Cyber -Security  
17.9.3.  Software Update Type approval number  
17.9.4.  Number of the Certificate of Compliance for Software -Update  
17.9. 4. Software Identification of the ADS:  
17.9. 4.1. Information on how to read the R xSWIN or software version(s) in case the 
RxSWIN is not held on the vehicle . 
17.9. 4.2. If applicable, list the relevant parameters that will allow the identification of 
those vehicles  that can be updated with the software represented by the 
RxSWIN under item 17.9. 4.1. 
17.10.  Operating manual (to be annexed to the information document)  
17.10.1.  Functional description of the ADS and e xpected role of the owner, transport 
service operator, on board operator, remote intervention operator, etc.  
17.10. 2. Technical measures for safe operation (e.g. description of the necessary off 
board infrastructure, timing , frequency and template of maintenance 
operations) ; 
17.10.3.  Operational and environment restrictions  
17.10.4.  Operational measures (e.g. if on-board operator or remote intervention operator 
needed)  
17.10.5.  Instructions in case of failures and ADS request (safety measures by vehicle 
occupants, transport service operator, on board operator and remote intervention 
operator and public authorities to be taken in the event of malfunctioning of the 
operation)  
17.11.  Means to enable a periodical technical inspection  
 List of Figures / Tables  
Acronyms  
Annex I - Simulation Handbook  
Annex II – Operating Manual  
_______________________  
Explanatory  note EN 5  EN This information  document  comprises  the information  relevant  for the automated  driving  system  
and shall  be completed  in accordance  with the template  laid down  in Annex  I to Commission  
Implementing  Regulation  (EU)  2020/683.  
 EN 6  EN ANNEX 2 
Performance requirements  
1. DDT  under nominal traffic scenarios.  
1.1. The ADS shall be capable of performing the entire DDT.  
1.1.1. The capability of the ADS to perform the entire DDT shall be determined in 
the context of the ODD of the ADS.  
1.1.2. As part of the DDT, the ADS shall be able to:  
(a) operate at safe speeds and respect speed limitations applicable to the 
vehicle;  
(b) maintain appropriate distances from other road users by controlling the 
longitudinal and lateral motion of the vehicle;  
(c) adapt its behaviour to the surrounding traffic conditions (e.g., by avoiding 
disruption to the flow of traffic) in an appropriate safety oriented way.  
(d) adapt its behaviour in line with safety risks an give  the highest priority to 
the protection of human life)  
(e) activate the relevant vehicle systems when necessary and applicable ( e.g. 
popening doors, activate wipers in case of rain, heating system, list to be 
completed? etc.)  
1.1.3. The system shall demonstrate anticipatory behaviour in interaction with other 
road user(s), in order to ensure stable, low -dynamic, longitudinal behaviour 
and risk minimising behaviour when critical situations could become 
imminent, e.g. with unobstructed and obstructed pedestrians or cyclist or with 
other vehicles crossing or cutting -in in front of the ADS . 
1.1.4. The requirements related to the entire DDT shall be fulfilled in the reverse 
direction as well, if the reverse  gear is required by or declared in the ODD  
1.2 The ADS shall detect and respond appropriately to objects and events relevant 
for the DDT  within the ODD . 
Objects and events might include, but are not limited, to:  
(a)motor vehicles and other road user such as motorcycles, bicycles, pedestrians, 
and obstacles (e.g. debris, lost cargo)  
(a) road accidents  
(b) traffic congestions  
(c) road works  
(d) road safety officers and law enforcement agents.  
(e) emergency vehicles.  
(f) traffic signs, road markings  
(g) environmental conditions (e.g. lower speed due to rain, snow).  
1.3. The ADS shall comply with traffic rules of the country of operation  EN 7  EN 1.3.1. The ADS shall interact safely with other road users in accordance with traffic 
rules, such as via:  
(a) signalling manoeuvre intentions.  
(b) using the audible warning device where appropriate.  
(c) interacting safely with road safety officers / law enforcement agents , road 
maintenance workers, emergency service personnel, road inspectors, etc.  
(d) for dual mode vehicles, the ADS status (manual driving mode or fully 
automated driving mode) shall be recognizable for Road safety officers / law 
enforcement agents  
1.3.2. In the absence of specific traffic rules, vehicles with ADS inten ded to carry 
standing or unrestrained vehicle occupants shall not exceed a combined 
horizontal acceleration of 2.4 m/s2 (in absolute value and calculated as the 
combination of lateral and longitudinal acceleration), and shall not exceed an 
acceleration rat e of change of 5 m/s3. 
Depending on the factors influencing the risk to occupants and other road 
users, it might be appropriate to exceed these limits , such as emergency 
operations . 
2. DDT  under  critical  traffic  scenarios  (emergency  operation).  
2.1 The ADS shall be able to perform the DDT for all reasonably foreseeable 
critical traffic scenarios in the ODD.  
2.1.1. The ADS shall be able to detect the risk of collision with other road users , or a 
suddenly appearing obstacle (debris, lost load) and shall be able to 
automatically perform appropriate emergency operation (braking, evasive 
steering) to avoid collisions and minimize risks to safety of the vehicle 
occupants and other road users.  
2.1.2. If a collision can be safely avoided without causing another one, it shall be 
avoided  by the ADS . 
2.1.2.1 In the event of an unavoidable alternative risk to human life, the ADS shall not 
provide for any weighting on the basis of personal characteristics  of humans .  
2.1.2.2 The protection of other human life outside the fully automated vehicle shall not 
be subordinated to the protection of human life inside the fully automated 
vehicle .  
2.1.5. After the evasive manoeuvre the vehicle shall aim at resuming a stable motion  
as soon as technically possible . 
2.1.6. The signal to activate the hazard warning lights shall be generated 
automatically in accordance with traffic rules. If the fully automated vehicle  
automatically drives off again, the signal to deactivate the hazard warning EN 8  EN lights shall be generated automatically.  
2.1.7. Pursuant to a traffic accident, the ADS shall aim to stop the fully automated 
vehicle  and aim to perform  a Minimum  Risk Manoeuvre  to reach  the Minimum  
Risk Condition.  ADS resuming normal operation shall not be possible until the 
safe operational state of the fully automated vehicle s has been confirmed by 
self-checks of the ADS or/and the on - board operator (if applicable ) or the 
remote intervention operator  (if applicable ). 
3. DDT  at ODD  boundaries  
3.1. The ADS  shall  recognize  its ODD  conditions  and boundaries  of the ODD.  
3.1.1. The ADS  shall  be able to determine  if the conditions  for ADS  activation  are 
met. 
3.1.2. The ADS  shall  detect  and respond  when  one or more  ODD  conditions  are not 
or no longer  fulfilled.  
3.1.3. The ADS  shall  be able to anticipate  exits  from  the ODD   
3.1.4. The ODD  conditions  and boundaries  shall  be established  by the manufacturer.  
3.1.4.1.  The ODD  conditions  to be recognized  by the ADS  shall  include:  
(a) precipitation  (rain,  snow)  
(b) time of day  
(c) Light intensity,  including  the case of the use of lighting  devices  
(d) Fog, mist 
(e) Road  and lane markings  
(f) Geographical  area (if applicable)  
3.1.5. When  the ADS  reaches  the ODD  boundaries , it shall  perform  a Minimum  Risk 
Manoeuvre  to reach  a Minimum  Risk Condition  and shall  warn  the 
operator/remote  operator  accordingly  (if available). . 
4. DDT  under  failure  scenarios  
4.1. The ADS  shall  detect  and respond  to ADS  or/and  vehicle  malfunctionin g 
behaviour  
4.1.1. The ADS  shall  perform  self-diagnosis  of faults  and failures.  
4.1.2. The ADS  shall  evaluate  its ability  to fulfil  the entire  DDT.  
4.1.2.1.  The ADS  shall  respond  safely  to a fault/failure  in the ADS  that does not 
significantly  compromise  ADS  performance.   
4.1.2.2.  The ADS  shall  execute  a safe fall-back  response  to achieve  a MRC  in the event  
of a failure  of the ADS  and/or  other  vehicle  system  that prevents  the ADS  from  
performing  the DDT  
4.1.2.3.  The ADS  shall  immediately  upon  detection,  signal  major  failures  and resulting  
operational  status  to vehicle  occupants,  the on-board  operator  (if available ) or EN 9  EN the remote  intervention  operator  (if relevant),  as well as to other  road users  in 
accordance  with traffic  rules  (e.g. activation  of the hazard  warning  lights)  
4.1.2.4.  If failures  are affecting  the braking  or steering  performance  of the vehicle,  the 
MRM  shall  be carried  out with consideration  for the remaining  performance.  
5. Minimum  risk manoeuvre  (MRM)  and Minimum  Risk  Condition  (MRC)  
5.1. During the MRM,  the fully automated  vehicle  with the ADS  shall  be slowed  
down,  with an aim of achieving a decelerat ion demand not greater than 4.0 
m/s2, to a full standstill in the safest possible place  taking  into account  
surrounding  traffic  and road infrastructure.  Higher deceleration demand values 
are permitted in case of a severe ADS or severe fully automated vehicle  failure.  
5.2. The ADS  shall  signal  its intention  to place  the fully automated  vehicle  in an 
MRC  to fully  automated  vehicle  occupants  as well as to other  road users  in 
accordance  with traffic  rules  (e.g.,  by hazard  warning  lights)  
5.3. The fully automated vehicle  shall only leave the minimum risk condition after 
the confirmation by self -checks of the ADS or/and by the on -board operator (if 
applicable ) or remote intervention operator (if applicable ) that the cause(s) of 
the MRM  is not present anymore.  
6. Human  machine  interaction  for vehicles  transporting  vehicle  occupants   
6.1. Wherever needed for safe operation and with regard to safety hazards, 
adequate information shall be given to the fully automated vehicle  occupants.  
6.2. If a remote  intervention  operator  is part of the ADS  safety  concept,  the fully  
automated  vehicle  shall  provide  means  for vehicle  occupants  to call a remote 
intervention operator through an audio-visual  interface  in the fully automated 
vehicle . Unambiguous  signs  shall  be used for the audio -visual interface  (e.g. 
ISO 7010 E004 )  
6.3. The ADS  shall  provide  means  to allow  vehicle  occupants  to request  a 
minimum  risk manoeuvre  to the ADS.  In case of emergency : 
(a) for vehicles  equipped  with automatically  operated  doors,  the unlocking of 
the doors shall be conducted automatically  when it safe to do so ,  
(b) a mean shall be given to passengers to exit a vehicle at standstill (opening 
the door s or via an emergency exit).  
6.4. If a remote  intervention  operator  is part of the ADS  safety  concept,  the vehicle  
equipped  with an ADS  shall  provide  means  for visual  surveillance  (e.g. 
cameras  in accordance with chapter 6 of  ISO16505:2019 ) of the occupant  
space  inside  the vehicle  and in the surrounding  of the vehicle  to allow  the 
remote  intervention  operator  to assess  the situation  inside  and outside  of the 
vehicle.  
6.5. If a remote  intervention  operator  is part of the ADS  safety  concept,  it shall be 
possible for the  remote intervention operator to open the power operated 
service door remotely.  
7. Functional  and operational  safety   EN 10  EN 7.1. The manufacturer  shall  demonstrate  that an acceptable  consideration  of 
functional  and operational  safety  for the ADS  has been  done  during  the design  
and development  processes  of the ADS.  The measures  put in place  by the 
manufacturer  shall  ensure  that the fully  automated  vehicle  is free of 
unreasonable  safety  risks  to vehicle  occupants  and other  road users  during  the 
vehicle  lifetime  when  compared  with comparable  transport  services  and 
situations  within  the operational  domain . 
7.1.1 The manufacturer  shall  define  the acceptance  criteria  from  which  the validation  
targets  of the ADS  are derived  to evaluate  the residual  risk taking  into account  
existing  accident  data1, data on performances  from  competent  and carefully  
driven  manual  vehicles  and technology  state-of-the-art.  
7.2. The manufacturer shall manage the safety and continued compliance of the 
ADS over lifetime (wear and tear of components especially for sensors, new 
traffic scenarios, etc.).  
8. Cyber security and software management systems  
8.1. The ADS shall be protected from unauthorized access in accordance with UN 
Regulation No. 1552.  
8.2. The ADS shall support software updates. The effectiveness of the software 
update procedures and processes concerning the ADS shall be demonstrated by 
compliance with UN  Regulation No . 1563.  
8.2.1  As specified in the Software Update and Software Update Management System 
Regulation, for the purpose of ensuring the software of the System can be 
identified, an R  [PO: this Regulation] ]SWIN shall be used. The R [this regulation] SWIN 
may be held on the vehicle or, if R [this regulation] SWIN is not held on the vehicle, 
the manufa cturer shall declare the software version(s) of the vehicle or single 
ECUs with the connection to the relevant type approvals to the type-approval 
authority . 
8.2.2  The vehicle manufacturer shall provide the following information in the 
informatio n document:  
(a) The R [PO: this regulation] SWIN;  
(b) How to read the R [PO: this regulation] SWIN or software version(s) in case 
the R [PO: this regulation] SWIN is not held on the vehicle.  
8.2.3.  The vehicle manufacturer may provide in the information document a list of 
the relevant parameters that will allow the identification of those vehicles that 
can be updated with the software represented by the R [PO: this regulation] SWIN. The 
information provided shall be declared by the vehicle manufacturer and may 
not be verified by an Approval Authority.  
                                                 
1 For instance based on current accident data on buses, coaches trucks and cars , an indicative aggregated 
acceptance criteria of 10^ -7 fatalities per hour of operation  could  be considered for market introduction 
of ADSs for comparable  transport services and situations. The manufacturer may use other metrics and 
method provided it can demonstrate that it leads to an equivalent level of safety.  
 
2 OJ L 82, 9.3.2021, p. 30  
3 OJ L 82, 9.3.2021, p. 60  EN 11  EN 8.2.4.  The vehicle manufacturer may obtain a new vehicle type-approval for the 
purpose o f differentiating software versions intended to be used on vehicles 
already registered in the market from the software versions that are used on 
new vehicles. This may cover the situations where type approval regulations 
are updated, or hardware changes ar e made to vehicles in series production. In 
agreement with the testing agency, duplication of tests shall be avoided where 
possible.  
9. ADS data requirements and specific data elements for event data recorder 
for fully automated vehicles  
9.1. The ADS shall record the following o ccurrences whenever  the ADS  is 
activated : 
9.1.1. Activation/  re-initialisation  of the ADS  (if applicable)  
9.1.2. Deactivation  of the ADS  (if applicable)  
9.1.3. Request  sent by the ADS  to the Remote  Intervention  Operator  (if applicable ) 
9.1.4. Request/Input  send by the Remot e intervention  operator  (if applicable)  
9.1.5. Start of Emergency Operation  
9.1.6. End of Emergency Operation  
9.1.7. Involved in a detected collision  
9.1.8. Event Data Recorder (EDR) trigger input  
9.1.9. Minimum Risk Manoeuvre engagement by the ADS  
9.1.10. Minimum Risk Condition reached by the fully automated vehicle  
9.1.11. ADS failure  (Description)  
9.2. ADS Data elements  
9.2.1. For each occurrence listed in point 9 .1., the following data elements shall be 
recorded in a clearly identifiable way:  
9.2.2. The recorded occurrence flag  
9.2.3. Reason for the occurrence, as appropriate,  
9.2.4. Date ( resolution : yyyy/mm/dd);  EN 12  EN 9.2.5.  Position (GPS coordinates)  
9.2.6. Timestamp:  
(a) resolution: hh/mm/ss timezone e.g. 12:59:59 UTC  
(b) accuracy: +/ - 1.0 second.  
9.3. For each recorded  occurrence, the RXSWIN, or the software versions, 
indicating the software that was present at the time when the event occurred, 
shall be clearly identifiable.  
9.4. A single timestamp may be allowed for multiple elements recorded 
simultaneously within the  timing resolution of the specific data elements. If 
more than one element is recorded with the same timestamp, the information 
from the individual elements shall indicate the chronological order.  
9.5 Data availability  
9.5.1. The ADS data elements shall be available subject to requirements specified in 
the Union or national law.  
9.5.2. Once the storage limits are achieved, existing data shall only be overwritten 
following a first in first out procedure with the principle of respecting the 
relevant requirements for data availability.  
 Documented evidence regarding the storage capacity shall be provided by the 
manufacturer.  
9.5.3. For vehicles of category M1 and N 1 The data shall be retrievable even after an 
impact of a severity level set by UN Regulations Nos.  944, 955 or 1376.  
9.5.4. For vehicles of categories M2, M 3, N2 and N 3, the data elements listed in point 
9.2. shall be retrievable even after an impact. To demonstrate that capability, 
the following applies:  
 Either:  
(a) (a) After a mechanical shock applicable to on -board data storage devices, if 
any, at a severity level as specified in the component test of Annex 9C of the 
03 series of amendment to UN Regulation No. 1007, and  
(b) (b) On-board data storage device(s)  shall be mounted in the vehicle 
cab/passenger compartment or in a position of sufficient structural integrity to 
protect against physical damage that would prevent the retrieval of data . This 
shall be demonstrated to the technical service together with appropriate 
documentation (e.g. calculations or simulations);  
Or,  
(c)  (c) The manufacturer demonstrates fulfilling the requirements of point  9.5.3. 
(e.g. for M 2 / N2 vehicles derived from M 1 / N1).  
                                                 
4 OJ L 392, 5.11.2021, p. 1.  
5 OJ L 392, 5.11.2021, p. 62.  
6 OJ L 392, 5.11.2021, p. 130.  
7 OJ L 449, 15.12.2021, p. 1.  EN 13  EN 9.5.5. If the main on -board vehicle power supply is not available, it shall still be 
possible to retrieve all data recorded.  
9.5.6. Data stored shall be easily readable in a standardized way via the use of an 
electronic communication interface, at least through the standard interface 
(OBD port).  
9.6 Specific data elements for event data recorder for fully automated vehicles  
9.6.1. For vehicles fitted with an Event Data Recorders in accordance with Article 6 
of Regulation (EU) 2019/2144, it shall be possible to retrieve through the 
standard interface (OBD port) the ADS data elements as referred to in point s 
9.2.1. and 9.2.2. recorded  for at least the last 30 seconds before the last setting 
of the occurrence flag “Event Data Recorder (EDR) trigger input”, alongside 
the data elements specified in UN Regulation 1608, Annex 4 (EDR data).  
9.6.1 In the absence of any occurrence referred to in point  10.2. within the last 30 
seconds before the last setting of the occurrence flag “Event Data Recorder 
(EDR) trigger input”, it shall be possible to retrieve, alongside the EDR data, 
the data element corr esponding to the last occurrences within the same power 
cycle referred to in point s 9.1.1. and 9.1.2., as a minimum.  
9.6.2 The data elements retrieved in accordance with point  9.6.1. or 90.6.2. shall not 
include the date and the timestamp or any other information allowing for 
identification of the vehicle, its user or owner. Instead the time stamp shall be 
replaced with information representing the time difference between the 
occurrence flag “Event Data Recorder (EDR) trigger input” and the occurrence 
flag of the respective ADS data element.  
9.8 Instructions from the manufacturer shall be provided on how to access the data.  
9.9. Protection against manipulation  
9.9.1. It shall be ensured that there is adequate protection against manipulation (e.g. 
data erasure) of stored data such as anti -tampering design  
10. Manual  driving  for the purpose  of maintenance  or to take over  after  a 
minimum  risk manoeuvre . 
10.1. If manual driving is possible for the purpose of maintenance or to take over 
after a minimum risk mano euvre is provided in the fully automated vehicle , the 
vehicle shall be provided with means to enable a person driving the vehicle to 
perform the driving task safely in accordance with the safety concept of the 
manufacturer.  Except in case of failure, the ADS shall continue to perform 
OEDR, detect an obstacle (e.g. vehicles, pedestrian) in the manoeuvring area 
and shall support the driver in bringing the vehicle immediately to a stop to 
avoid a collision.  
10.2. If manual driving control is limited to 6 km/h, it is not necessary for the driver 
to stay within the vehicle with an ADS. The control can be performed via a 
remote control located in the vicinity of the vehicle  provided that the vehicles 
                                                 
8 OJ L 265, 26.7.2021, p. 3  EN 14  EN stays in the direct line of  sight of the operator . The maximum distance over 
which control is possible by a remote control shall not exceed 10 metres.  
10.3. If, in manual driving, the vehicle  is intended to be controlled at speeds higher 
than 6 km/h, the vehicle shall be considere d as dual mode vehicle and  shall 
comply with Annex II, Part I, Appendix 1 of Regulation (EU) 2018/858 . 
11. Oper ating  manual  
11.1. The manufacturer shall draw up an operating manual. The purpose of the 
operating manual is to ensure the safe operation of the fully automated vehicle  
by means of detailed instructions to the owner, vehicle occupants, transport 
service operator, on -board operator, remote intervention operator and any 
relevant national authorities.  
When the fully automated vehicle includes the possibility of manual driving for 
emergency cases or for the purpose of maintenance or similar cases , it shall 
also covered by the operating manual.  
11.2. The operating manual shall include the functional description of the ADS.  
11.3. The operating manual shall include the necessary technical measures (e.g. 
checks and maintenance works of vehicle and off -board infrastructure, 
transport and physical infrastructure requirements), operational restrictions 
(e.g. speed limit, dedicated lane , physical separation with upcoming traffic ), 
environmental conditions (e.g. no snow) and operational measures (e.g. on -
board operator or remote intervention operator needed) to be met to ensure 
safety during the fully automated vehicle  operation.  
11.4. The operatin g manual shall describe the instructions for vehicle occupants, 
transport service operator, on board operator (where applicable) and remote 
intervention operator (where applicable) and public authorities in case of 
failures and ADS request.  
11.5. The operating manual shall contain rules to ensure proper performance of 
maintenance, overall tests and further  examinations.   
11.6. The Operatin g Manual shall be submitted to the  type-approval authority 
together with the application for a type approval  and shall be annexed to the 
type-approval certificate.  
11.7. The Operatin g Manual shall be made available  to the owner and,  where 
applicable, to the vehicle transport service operator, on -board operator , remote 
intervention operator  and any relevant national authorities . 
12. Provisions  for periodic  roadworthiness  tests  
12.1. For the purpose of periodic roadworthiness tests, it shall be possible to verify 
the  following features of the ADS  
(a) Its correct operational status, by visible observation of the failure warning 
signal status following the activation of the vehicle master control switch and 
any bulb check. Where the failure warning signal is displayed in a common 
space (the area on w hich two or more information functions/symbols may be EN 15  EN displayed, but not simultaneously), it must be checked first that the common 
space must be observed to be functional prior to the failure warning signal 
status check;  
(b) Its correct functionality and the software integrity, by the use of an 
electronic vehicle interface, such as the one laid down in point I . (14) of Annex 
III of Directive 2014/45/EU of the European Pa rliament and of the Council9 , 
where the technical characteristics of the vehicle allow for it and the necessary 
data is made available. Manufacturers shall ensure to make available the 
technical information for the use of the electronic vehicle interface in 
accordance with Article 6  of Commission Implementing Regulation (EU) 
2019/62110.  
 
                                                 
9 Directive 2014/45/EU of the European Parliament and of the Council of 3 April 2014 on periodic 
roadworthiness tests for motor vehicles and their trailers and repealing Directive 2009/40/EC (OJ L 
127, 29.4.2014, p. 51).  
10 Commission Implem enting Regulation (EU) 2019/621 of 17 April 2019 on the technical information 
necessary for roadworthiness testing of the items to be tested, on the use of the recommended test 
methods, and establishing detailed rules concerning the data format and the pro cedures for accessing the 
relevant technical information (OJ L 108, 23.4.2019, p. 5).  EN 16  EN ANNEX 3 
COMPLIANCE ASSESSMENT   
The overall compliance assessment of the ADS is based on : 
- Part 1: The consideration  of the most relevant scenarios for the ODD   
-Part 2: The assessment of the ADS design concept and the audit of the manufacturer safety 
management system .  
-Part 3: The tests  of the most relevant traffic scenarios . 
-Part 4: The credibility assessment for using virtual toolchain to validate ADS  
-Part 5: The in-service reporting to demonstrate the safety performance in the field .  
Any requirement in Annex 2  may be checked by means of tests performed by the type-
approval authority (or its technical service).  
PART 1: TRAFFIC SCENARIOS TO CONSIDER  
1. Minimum set of sce narios  
1.1. Scenarios and parameters listed in point 1  shall be used, when these scenarios are 
relevant for the ODD of the ADS.  
 
If the manufacturer  deviates  from  the parameters  proposed  in point  1, the safety  
erformance  metrics  and inherent  assumptions  used by the manufacturer  shall  be 
documented  in the documentation  package . The safety  performance  metrics  and 
inherent  assumptions  chosen  shall  demons trate that the fully automated  vehicle  is 
free of unreasonable  safety  risks. The validity  of such safety  performance  metrics  
and inherent  assumptions  shall  be supported  by in-service  monitoring  data.   
1.3. Parameters  to be used for the lane change  scenario s by the fully  automated  
vehicle  
1.3.1.  The scenarios  and parameters,  with regard  to lane change,  shall  be applied  as 
11specified  in UN Regulation  No.157 . 
1.4. Parameters  to be used for the turning  and crossing  scenario  by the fully  
automated  vehicle . 
1.4.1.  The following  requirements  shall  be taken  into account  with regard  to interaction  
with other  road users  involved  in the movement  when  turning  and crossing  (see 
Figure  1). 
1.4.2. In the case of merging  with privileged  traffic  during  turning  with and without  
crossing  the opposite  traffic  direction,  it must  be ensured  that the TTC  of the 
approaching  privileged  traffic  in the target  road (case  (a) in Figure  1) never  falls 
below  the threshold  𝑇𝑇𝐶𝑑𝑦𝑛 defined  as: 
𝑇𝑇𝐶𝑑𝑦𝑛=ሺ𝑣𝑒+𝑣𝑎ሻ
2∙𝛽+𝜌 
With:  
𝑣𝑒 equal  to the speed  of the fully  automated  vehicle  
                                                 
11 OJ L 82, 9.3.2021, p. 75.  EN 17  EN 𝑣𝑎 equal  to the speed  of the privileged  approaching  traffic  
𝛽 equal  to 3 m/s2 being  the maximum  admissi ble deceleration  for the privileged  
approaching  traffic . 
 
𝜌 equal  to 1.5s being  the reaction  time of the privileged  approaching   
1.4.3. In the case of the turning  manoeuvre  crosses  the opposite  traffic  direction,  when  
considering  oncoming  traffic, it must  be ensured  — in addition  to the distance  
from  the approaching  privileged  traffic  in the target  road — that the TTC  of the 
privileged  crossing  traffic  to the fictitious  collision  point  (point  of intersection  of 
the trajectories,  case (b) in Figure 1) never  falls below  the threshold  𝑇𝑇𝐶𝑖𝑛𝑡 
defined  as: 
𝑇𝑇𝐶𝑖𝑛𝑡=𝑣𝑐
2∙𝛽+𝜌 
With:  
𝑣𝑐 equal  to the speed  of the privileged  conflicting  traffic  
𝛽 equal  to 3 m/s2 being  the maximum  admissible  deceleration  for the privileged  
crossing  traffic .  
𝜌 equal  to 1.5s being  the reaction  time of the privileged  crossing  traffic  
 
The same  applies  to cross  with privileged  traffic  (case  (c) in Figure  1): The TTC  
of privileged  traffic to the imaginary  collision  point  (point  of intersection  of the 
trajectories)  shall  never  fall below  the threshold  𝑇𝑇𝐶𝑖𝑛𝑡 defined  in the present  
point  
 
 
Figure  1: Visualization  of the distances  during  turning  and crossings.  Case  (a): 
Distance  to the approaching  privil eged  traffic  in the target  lane during  turning -in. 
Case  (b): Additional  distance  to reverse  opposite  traffic  to be observed  when  
turning  by crossing  the opposite  traffic  direction  as a result  of reverse  traffic.  
Case  (c): distance  to the privileged  crossin g traffic  to be respected  when  crossing.   
1.5. Parameters  to be used for the emergency  manoeuvre  scenario s by the fully  
automated  vehicle  (DDT  under  critical  scenarios)  
EN 18  EN 1.5.1. The ADS  shall  avoid  a collision  with a leading  vehicle  which  decelerates  up to its 
full braking  performance  provided  that there  was no cut-in by another  vehicle.   
1.5.2.  Collisions  with cutting  in vehicles,  pedestrians  and cyclists  which  travel  in the 
same  direction,  as well as pedestrians  who can start jaywalking  shall  be avoided  
at least within  the conditions  determined  by the following  equation.   
𝑇𝑇𝐶𝑐𝑢𝑡−𝑖𝑛≥𝑣𝑟𝑒𝑙
2∙𝛽+𝜌+1
2𝜏 
With:  
𝑇𝑇𝐶𝑐𝑢𝑡−𝑖𝑛 being  the time to-collision  at the moment  of the cut-in of the vehicle  or 
cyclist  by more  than 30 cm in the lane of the fully  automated  vehicle . 
𝑣𝑟𝑒𝑙 being  the relative  speed  in meters  per second  [m/s]  between  the fully  
automated  vehicle  and the cutting -in vehicle  (positive  if the ADS  is faster  than 
the cutting -in vehicle).  
𝛽 being  the maximum  deceleration  of the fully  automated  vehicle  and assumed  to 
be equal  to  
2.4 m/s2 for fully  automated  vehicle s transporting  standing  or not fastened  vehicle  
occupants;  
6 m/s2 for other  fully  automated  vehicle s. 
𝜌 being  the time required  by the fully  automated  vehicle  to initiate  an emergency  
braking  and assumed  to be equal  to 0.1 s  
𝜏 being  the time to reach  the maximum  deceleration  𝛽 and assumed  to be equal  to  
0.12 s for fully  automated  vehicle s transporting  standing  or not fastened  vehicle  
occupants;  
0.3 s for other  fully  automated  vehicle s 
The compliance  with this equation  is required  only for road users  cutting  in, and 
only if the inserting  road users  were  visible  at least 0,72 seconds  before  cut-in: 
This results  in a required  collision  avoidance  when  another  road user enters  ego 
lane above  the following  TTC  values  (for example  shown  for speeds  in 10 km/h  
steps).  These  requirements  shall  be met independently  of environmental  
conditions.  
 
𝑣𝑟𝑒𝑙[km/h]  𝑇𝑇𝐶𝑐𝑢𝑡−𝑖𝑛 [s] for vehicles  
with standing  or 
unfastened  vehicle  
occupants  𝑇𝑇𝐶𝑐𝑢𝑡−𝑖𝑛 [s] for other  
vehicles  
10 0,74 0,48 
20 1,32 0,71 
30 1,9 0,94 
40 2,47 1,18 
50 3,05 1,41 
60 3,63 1,64 
If a lane change  with a lower  TTC  is carried  out to the lane of the fully automated  
vehicle , it can no longer  be assumed  that there  will be no collision  avoidance.  The 
control  strategy  of the ADS  may change  between  collision  avoidance  and 
mitigation  only if the manufacturer  can demonstrate  that this increases  the safety  
of the vehicle  occupants  and the other  road users  (e.g. by prioritizing  braking  over 
an alternative  manoeuvre).  EN 19  EN 1.5.3.  The ADS  shall  avoid  a collision  with a crossing  pedestrian  or a cyclist  in front  of 
the vehicle.  
1.5.3.1.  Urban  and rural  driving  conditions  
1.5.3.1.1.  The ADS  shall  avoid  a collision,  up to a speed  of 60 km/h,  with an unobstructed  
pedestrian  crossing  with a lateral  speed  component  of not more  than 5 km/h  or an 
unobstructed  cyclist crossing  with a lateral  speed  component  of not more  than 15 
km/h  in front  of the vehicle.  This shall  be ensured  independently  from  the specific  
manoeuvre  the ADS  is undertaking.   
1.5.3.1.2.  In the case the pedestrian  or the cyclist  proceed  with higher  speed  than the 
aforementioned  values  and the ADS  can no longer  avoid  collision,  the control  
strategy  of the ADS  may change  between  collision  avoidance  and mitigation  only 
if the manufacturer  can demonstrate  that this increases  the safety  of the vehicle  
occupants  and the other  road users  (e.g. by prioritizing  braking  over an alternative  
manoeuvre ). 
1.5.3.1.3.  The ADS  shall  mitigate  a collision  with an obstructed  pedestrian  or cyclist  
crossing  in front of the vehicle  by reducing  its speed  at impact  by at least 20 km/h.  
This shall  be ensured  independently  from  the specific  manoeuvre  the ADS  is 
undertaking.  
1.5.3.1.4.  For the purpose of demonstrating fulfilment of the previous requirements re lated 
to crossing of pedestrians and cyclists in front of the vehicle, test and assessment 
scenarios developed under the European New Car Assessment Programme (Euro 
NCAP) may be taken as guidance.  
1.5.3.2.  Motorway driving conditions  
1.5.3.2.1.  The relevant scenarios, with regard to pedestrian crossing, shall be applied as 
specified in UN Regulation No.157.  
1.5.3.2.2.  In the case the pedestrian  crosses  with parameter  values  outside  the boundaries  
specified  in UN Regulation  157 and the ADS  can no longer  avoid  collision , the 
control  strategy  of the ADS  may change  between  collision  avoidance  and 
mitiga tion only if the manufacturer  can demonstrate  that this increases  the safety  
of the vehicle  occupants  and the other  road users  (e.g. by prioritizing  braking  over 
an alternative  manoeuvre).  
1.6 Parameters  to be used for Hub to Hub fully  automated  vehicles  
1.6.1.  Operation  on motorway  
1.6.1.  The relevant  scenarios,  with regard  to operation  speed  and automatic  lane change,  
shall  be applied  as specified  in UN Regulation  No.157.  
1.6.2.  Motorway  entry  
 The fully automated  vehicle  shall  be able to safely  enter  the motorway  by 
adapting  the speed  to the traffic  flow,  and activate  the relevant  direction  indicator  
according  to the traffic  rules.  EN 20  EN The direction  indicator  shall  be deactivated  once  the vehicle  has performed  the 
lane change  manoeuver.  The parameters  used in the lane change  scenario  shall  be 
applied.  
1.6.3.  Motorway  exit 
 The fully  automated  vehicle  shall  be able to anticipate  the targeted  motorway  exit 
by driving  on the adjacent  lane to the exit lane and shall  not unnecessarily  
decelerate  before  the LCM  into the exit lane starts.  
The fully  automated  vehicle  shall  apply the direction  indicator  in accordance  with 
the traffic  rules,  and perform  the LCM  into the exit lane without  undue  delay .  
The direction  indicator  shall  be deactivated  once  the LCM  has been  completed  in 
compliance  with the traffic  rules  in the country  of operation . 
1.6.4.  Passing  a toll station  
 Depending  on the ODD,  the fully automated  vehicle  shall  be able to select  the 
proper  passing  gate,  and adapt  its speed  to that permitted  limits  within  the toll 
area while  considering  the traffic  flow.  
1.6.5.  Operation  on other  road types  than motorway s 
 Depending  on the ODD,  the relevant  scenario  defined  in point s 1.3. to 1.5 above  
shall  be applied . 
1.7. Parameters  to be used for Automated  valet  parking   
1.7.1.  Depending  on the ODD,  the relevant  scenario s defined  in point s 1.3. to 1.5 above  
shall  be applied . The parameters  to be used for these  scenario s may need  to be 
adapted  to take into account  of the limited  driving  speed and the general lack of 
visibility that may occur in a parking  area. Speci al attention shall be given to the 
avoidance of collision with pedestrians and in particular with children  and prams.  
2. Scenarios  not covered  by point  1. 
2.1. Scenarios that are not listed in point 1 shall be generated to cover reasonably 
forese eable critical situations, including failures and traffic hazards within the 
operational design domain.  
2.2. When ADS capabilities depend on remote capabilities, scenarios shall include 
failures and traffic hazards stemming from the corresponding remote capabilities.  
2.3. The method to generate scenarios that are not listed in Section 1, shall follow the 
principles set in Appendix 1 to Part 1 of this Annex.  
2.3. The method used by the manufactu rer to generate scenarios that are not listed in 
point 1 shall be documented in the documentation package to be provided for the 
ADS assessment.  
 
Appendix 1  to Part 1 of Annex 3  EN 21  EN Principles to be followed to derive scenarios relevant for the ODD of the 
ADS  
 
 
1. Scenarios shall be derived from the the ODD of the fully automated vehicle .  
2. Generation and Classification  of scenarios  
 From a qualitative perspective, scenarios can be classified into Nominal / Critical 
/ Failure and correspond to normal or emergency operation. For each of these 
categories, a data -based approach and a knowledge -based approach can be used 
to generate corres ponding traffic scenarios. A knowledge -based  approach utilizes 
expert  knowledge to identify hazardous events systematical ly and create 
scenarios. A data -based  approach utilizes the available data to identify and 
classify occurring scenarios.  
2.1. Nominal Scenarios  
 A series of analytical frameworks can help the manufacturer to derive additional 
nominal scenarios to ensure coverage for the specific application. These 
frameworks are divided into:  
2.1.1.  ODD analysis  
 An ODD may consist of scenery elements  (e.g., physical infrastructure), 
environmental conditions, dynamic elements (e.g., traffic, vulnerable road users) 
and operational constraints to the specific ADS application. The aim of this 
analysis is to identify the characteristics of the ODD, allocat e properties and 
define interactions between the objects. Here the effect of ODD on the behaviour 
competencies is explored. An example of the analysis is given in Table 1.  
 Table 1 – Dynamic elements and their properties  
EN 22  EN  
2.1.2.  OEDR Analysis: Behaviour  competency identification  
 Once the objects and relevant properties have been identified, it is possible to 
map the appropriate ADS response. The ADS response is modelled on applicable 
functional requirements and by applying the performance requirements of this 
regulation and the traffic rules  of the country of operat ion. 
The outcome of the OEDR analysis is also a set of competences that can be 
mapped to the behavioural competences applicable to the ODD, to ensure 
compliance with the relevant regulatory and legal requirements. Table 2 provides 
a qualitative example of a matching event – response.  
The combination of objects, events, and their potential interaction, as a function 
of the ODD, constitute the set of nominal scenarios pe rtinent to the ADS under 
analysis. The identification of nominal scenarios is not limited to traffic 
conditions but also covers environmental conditions, human factors, connectivity 
and miscommunication. As parameters (assumptions) for the events are yet t o be 
defined, the nominal scenarios derived from the application of the analysis are to 
be considered in their functional and logical abstraction layer.  
 Table 2 – Behaviour competences for given events  
 
2.2. Critical scenarios  
 Critical scenarios can be derived by either considering edge -case assumptions on 
nominal traffic scenarios (data -based) or applying standardised methods 
(knowledge -based) for the evaluation of operational insufficiencies (see example 
of methods in point 3. 4.5. of Part 2) . The identification of critical scenarios is not 
EN 23  EN limited to traffic conditions but also covers environmental conditions, human 
factors, connectivity and miscommunication. Critical scenarios correspond to 
emergency operation of the ADS.  
2.2.3.  Failure scenarios  
 These scenarios aim to assess the response of the ADS to a failure. Different 
methods are available in literature ( see example of methods in point  3.5.5. of Part 
2).  
For each of the behaviour failures and consequential effects identified, the 
manufacturer shall put in place relevant strategies when developing the ADS (i.e., 
fail-safe).  
When applying the failure scenarios, the objective is to assess the ability of the 
ADS to comply with requirements derived for safety -critical situations, including 
for example “The ADS shall manage safety -critical driving situations” and “The 
ADS shall sa fely manage failure modes” and their respective sub -requirements.  
2.2.4.  Assumptions: Logical to concrete scenarios  
 To ensure that the scenarios identified in the previous point s are ready to be 
assessed through the application of simulations or physical testing, the 
manufacturer to coherently parametrize them by applying assumptions.  
 The manufacturer shall provide evidence support ing the assumptions made  such 
as data collection campaigns performed during the development phase, real -world 
accidentology and realistic driving behaviour evaluations, amongst others.   
  EN 24  EN PART 2: ASSESSMENT OF THE ADS SAFETY CONCEPT  AND A UDIT  OF THE 
MANUFACTURER SAFETY MANAGEMENT SYSTEM   
1. General  
1.1. The type-approval authority granting the type-approval or the technical 
service acting on its behalf shall verify through targeted spot checks and tests, 
in particular as specified in part 3 of this annex, that the safety argumentation 
provided by the documentation complies with the requirements of Annex 2  
and that the design and processes described in documentation are actually 
implemented by the manufacturer.  
1.2. While based on the provided documentation, evidence s for the audit of  the 
safety management system and the  assessment of the ADS safety concept 
carried out to the satisfaction of the type-approval authority in accordance 
with this Regulation, the residual level of safety risk of the type-approved  
ADS is deemed to be accepta ble for the entry into service of the vehicle type, 
the overall ADS safety during the ADS lifetime in accordance with the 
requirements of this regulation remains the responsibility of the manufacturer 
requesting the type -approval.  
2. Definitions  
For the purposes of this annex,  
2.1. “safety  concept ” means  a description of the measures designed into the ADS , 
so that the fully  automated  vehicle  operates  for the scenarios and e vents  
relevant to the ODD in such a way that it is free of unreasonable  safety  risks  
to the vehicle  occupants  and other  road users  under  faults  (functional  safety)  
and non-fault conditions  (operational  safety) . The possibility  of a fall-back  to 
partial  operation  or even  to a back -up system  for vital ADS  functions  shall  be 
a part of the safety  concept.  
2.2. “units ” means the smallest divisions of system components which will be 
considered in this annex,  since these combinations of components will be 
treated as single entities for purposes of identification, analysis or 
replacement.  
2.3. “transmission links” means the means used for int er-connecting distributed 
units for the purpose of conveying signals, operating data or an energy 
supply. This equipment is generally electrical but may, in some part, be 
mechanical, pneumatic or hydraulic.  
2.4. "range of control" means  an output variable and defines the range over which 
the system is likely to exercise control.  
2.5. “boundary  of functiona l operation”  means  the boundaries  of the external  
physical  limits  within  which  the ADS  is able to perform  the dynamic  driving  
tasks.  
3. Documentation on the ADS  
3.1. Requirements  EN 25  EN  The manufacturer shall provide a documentation package which gives access 
to the basic design of the ADS  and the means by which it is linked to other 
vehicle systems or by which it directly controls output variables  as well as 
off-board hardware/software  and remote capabilities .  
 The function(s) of the ADS , including the control strategies, and the safety 
concept, as laid down by the manufacturer, shall be explained.  
 Documentation shall be brief, yet provide evidence that the design and 
development has had the benefit of expertise from all the ADS fields which 
are involved.  
 For periodic technical inspections, the documentation shall describe how the 
current operational status of the ADS  can be checked.  
 The type-approval authority shall assess the documentation package which 
shall show that the ADS:  
 (a) Is designed and was developed to operate in such a way that it is free 
from unreasonable risks for a vehicle occupants and other road users within 
the declared ODD and boundaries;  
 (b) fulfils the performance requirements of  Annex 2  of this Regulation;  
 (c) Was developed according to the development process/method 
declared by the manufacturer and that this includes at least the steps listed in 
point  3.54. 
3.1.1.  Documentation shall be made available in three parts:  
 (a) Application for type approval: The information document which is 
submitted to the type-approval authority at the time of type approval 
application shall contain brief information on the items listed in Annex I. It 
will become part of the type-approval.  
 (b) The formal documentation package for the type-approval, containing 
the material listed in this section 3. (with the exception of that of point  3.5.5.) 
which shall be supplied to the type-approval authority for the purpose of 
conducting the ADS type -approval . This documentation package shall be 
used by the type-approval authority as the basic reference for t he verification 
process set out in point  4. of this annex. The type-approval authority shall 
ensure that this documentation package remains available for a period 
determined of at least 10 years counted from the time when production of the 
vehicle type is definitely discontinued.  
 (c) Additional confidential material and analysis data (intellectual 
property) of point  3.5.5. which shall be retained by the manufacturer, but 
made open for inspection (e.g. on -site in the engineering facilities of the 
manufacturer) at the time of the ADS type -approval . The manufacturer shall 
ensure that this material and analysis data remains av ailable for a period of 10 
years counted from the time when production of the vehicle type is definitely 
discontinued.  
 EN 26  EN 3.2. General description of the ADS  
3.2.1.  A description shall be provided which gives a simple explanation of the 
operational characteristics of the ADS and ADS features.  
3.2.2.  The description shall include :  
3.2.2.1  the Operational Design Domain such as maximum speed of operation , road 
type(e.g. dedicated lane) , countr y(ies) /areas  of operation , road conditions  and 
environmental conditions required (e.g. no snow) , etc.)/ Boundary conditions  
3.2.2.2  Basic Performance (e.g. Object and Event Detection and Response , off board 
infrastructure needed during operation ) 
3.2.2.3.  Interaction with other road users  
3.2.2.4.  Main conditions for Minimum risk manoeuvres.  
3.2.2.5.  Interaction concept with vehicle occupants, the on board operator  (if 
applicable ) and the remote intervention operator ( if applicable ). 
3.2.2.6.  The means to activate  or deactivate the ADS by the on-board operator (if 
relevant) or the remote intervention operator (if relevant), vehicle occupants 
(if relevant) or other road users (if relevant).  
3.2.2.7.  Operational measures (e.g. on -board operator or remote intervention operator 
needed) to be met to ensure safety during the fully automated vehicle  
operation.  
3.3. Description of the functions of  the ADS  
 A description shall be provided which gives an explanation of all the 
functions including control strategies to ensure robust and safe operation of 
the ADS  and the methods employed to perform the dynamic driving tasks 
within the ODD, and the boundaries und er which the automated driving 
system is designed to operate, including a description on how this is ensured.   
 Any enabled or disabled automated driving functions for which the hardware 
and software are present in the vehicle at the time of production, shall be 
declared and are subject to the requirements of this annex as well as Annex 2 
of this Regulation , prior t o their use in the vehicle. The manufacturer shall 
also document the data processing in case of continuous learning algorithms 
are implemented.  
3.3.1.  A list of all input and sensed variables shall be provided and the working 
range of these defined, along  with a description of how each variable affects 
the ADS behaviour.  
3.3.2.  A list of all output variables which are controlled by the ADS  shall be 
provided and an explanation given, in each case, of whether the control is 
direct or via another vehicle system. The range over which the ADS is likely 
to exercise control on each such variable shall be defined.  EN 27  EN 3.3.3.  Limits defining the bounda ries of functional operation including ODD -limits 
shall be stated where appropriate to ADS performance.  
3.3.4.  The Human Machine interface (HMI) concept with the vehicle occupants/on -
board operator/remote intervention operator (if any) when ODD limits are  
approached and then reached shall be explained including the list of types of 
situations in which the ADS will generate a support request to the on board 
operator/remote intervention operator  (if applicable ), the way the request is 
performed, the procedur e that handles a failed request, the Minimum Risk 
Manoeuvre. Signals and information given to the on-board operator/remote 
intervention operator, vehicle occupants and other road users in each of the 
above aspects shall also be described.  
3.4. ADS layout and schematics  
3.4.1. Inventory of components.  
 A list shall be provided, collating all the units of the ADS  and mentioning the 
other vehicle systems as well as  off-board hardware /software and remote 
capabilities which are needed to achieve specified performance of the ADS to 
be approved according to its ODD . 
 An outline schematic showing these units in combination, shall be provided 
with both the equipment distribution and the interconnections made clear.  
 This outline shall include:  
 (a) Perception and objects detection including mapping and positioning  
 (b) Characterization of Decision -making  
 (d) The ADS  data elements . 
 (e) links and interface with other vehicle systems, off -board 
hardware/software and remote capabilities  
3.4.2. Functions of the units  
 The function of each unit of the ADS  shall be outlined and the signals linking 
it with other units or with other vehicle systems shall be shown. It shall 
include off board systems supporting the ADS and other vehicle systems. 
This may be provided by a labelled block diagram or other schemati c, or by a 
description aided by such a diagram.  
3.4.3. Interconnections within the ADS  shall be shown by a circuit diagram for the 
electric transmission links, by a piping diagram for pneumatic or hydraulic 
transmission equipment and by a simplified diagrammatic layout for 
mechanical linkages. The transmission links both to and from other s ystems 
shall also be shown.  EN 28  EN 3.4.4. There shall be a clear correspondence between transmission links and the 
signals carried between Units. Priorities of signals on multiplexed data paths 
shall be stated wherever priority may be an issue affecting performa nce or 
safety.  
3.4.5. Identification of units  
3.4.5.1.  Each unit shall be clearly and unambiguously identifiable (e.g.  by marking 
for hardware, and by marking or software output for software content) to 
provide corresponding hardware and documentation association. Where 
software version can be changed without requiring replacement of the 
marking or component, the software identification must be by software 
output only.  
3.4.5.2.  Where functions are combined within a single unit or indeed within a single 
computer, but shown in multiple blocks in the block diagr am for clarity and 
ease of explanation, only a single hardware identification marking shall be 
used. The manufacturer shall, by the use of this identification, affirm that the 
equipment supplied conforms to the corresponding document.  
3.4.5.3.  The identification defines the hardware and software version and, where the 
latter changes such as to alter the function of the unit as far as this Regulation 
is concerned, this identification shall also be changed.  
3.4.6. Installation of sensing system compo nents  
 The manufacturer shall provide information regarding the installation options 
that will be employed for the individual components that comprise the 
sensing system. These options shall include, but are not limited to, the 
location of the component in/on the vehicle, the material(s) surrounding the 
component, the dimensioning and geometry of the material surrounding the 
component, and the surface finish of the materials surrounding the 
component, once installed in the vehicle. The information shall a lso include 
installation specifications that are critical to the ADS’s performance, e.g. 
tolerances on installation angle.  
 Changes to the individual components of the sensing system, or the 
installation options, shall be notified to the Type -approval aut hority and be 
subject to further assessment.  
3.5. Safety concept of the manufacturer and validation of the safety concept by 
the manufacturer  
3.5.1. The manufacturer shall provide a statement which affirms that the “ADS” is 
free from unreasonable risks for the vehicle occupants and other road users.  
3.5.2. In respect of software employed in the ADS , the outline architecture shall be 
explained and the design methods and tools used shall be identified (see 
3.5.1). The manufacturer shall show evidence of the means by which they 
determined the realization of the ADS logic, during the design and 
development process.  EN 29  EN 3.5.3. The manufacturer shall provide the type-approval authority with an 
explanation of the design provisions built into the ADS  so as to ensure 
functional and operational safety. Possible design provisions in the ADS  are 
for example:  
 (a) Fall-back to operation using a partial system.  
 (b) Redundancy with a separate system.  
 (c) Diversity of systems performing the same function . 
 
(d)       Removal or limitation of the automated driving function(s).  
3.5.3.1. If the chosen provision selects a partial performance mode of operation under 
certain fault conditions (e.g. in case of severe failures), then these conditions 
shall be stated (e.g. type of failure) and the resulting limits of effectiveness 
defined (e.g. initiation of a minimum risk manoeuvre immediately) as well as 
the warning strategy to the operator/remote operator, occupants and other 
road users (when applicable).  
3.5.3.2. If the chosen design provision selects a second (back -up) or diverse means to 
realise the performance affected by the fault , the principles of the change -
over mechanism, the logic and level of redundancy and any built -in  checking 
features shall be  explained and the resulting limits of  effectiveness defined.  
3.5.3.3. If the chosen design provision selects the removal of the automated driving 
function (s), this shall be done in compliance with the relevant provisions of 
this regulation. All the corresponding output control signals associated with 
this function shall be inhibited.  
3.5.4. The manufacturer shall also provide the Type Approval Authority with an 
explanation of the operational safety measures to be put in place for the safe 
operation of the ADS such as an on -board operator or a remote intervention 
operator, supporting off -board  infrastructure, transport and physical 
infrastructure requirements, maintenance measures, etc.  
3.5.5. The documentation shall be supported, by an analysis which shows, how the 
ADS will behave to mitigate or avoid hazards which can have a bearing on 
the safety of vehicle occupants and other road users.  
3.5.5.1. The chosen analytical approach(es) shall be established and maintained by 
the manufacturer and shall be made open for inspection by the Type 
Approval Authority at the time of the type approval and afterwards.  
3.5.5.2. The Type Approval Authority shall pe rform an assessment of the application 
of the analytical approach(es):  
 (a) Inspection of the safety approach at the concept level.  
This approach shall be based on a Hazard analysis / Risk assessment 
appropriate to system safety.  
 (b) Inspection of the safety approach at the ADS level including a top 
down (from possible hazard to design) and bottom up approach (from design 
to possible hazards). The safety approach may be based on a Failure Mode EN 30  EN and Effect Analysis (FMEA), a Fault Tree Analysis (FTA) and a System -
Theoretic Process Analysis (STPA) or any similar process appropriate to 
system functional and operational safety.  
 (c) Inspection of the validation/verification plans and results including 
appropriate acceptance criteria. This shall include valid ation testing 
appropriate for validation, for example, Hardware in the Loop (HIL) testing, 
vehicle on -road operational testing, testing with real end users, or any other 
testing appropriate for validation/verification. Results of validation and 
verificatio n may be assessed by analysing coverage of the different tests and 
setting coverage minimal thresholds for various metrics.  
3.5.5.3. The documentation shall confirm that at least each of the following items is 
covered where applicable under (a) -(c): 
 (i) Issues linked to interactions with other vehicle systems (e.g. braking, 
steering);  
 (ii) Failures of the automated driving system and system risk mitigation 
reactions;  
 (iii) Situations within the ODD when a system may create unreasonable 
safety risks f or the vehicle occupants and other road users due to operational 
disturbances (e.g. lack of or wrong comprehension of the vehicle 
environment, lack of understanding of the reaction from the operator/remote 
operator, vehicle occupants or other road users, i nadequate control, 
challenging scenarios)  
 (iv) Identification of the relevant scenarios within the boundary conditions 
and management method used to select scenarios and validation tool chosen.  
 (v) Decision making process resulting in the performance of the dynamic 
driving tasks (e.g. emergency manoeuvres), for the interaction with other 
road users and in compliance with national traffic rules  
 (vi) Reasonably foreseeable misuse by the vehicle occupants/other road 
users, mistakes or misunderstanding by the operator/remote 
operator/occupants/other road users (e.g. unintentional override) and 
intentional tampering of the ADS.  
 (viii)  Cybersecurity threats on the safety of the ADS (to be covered by  the 
analysis done in accordance with  UN Regulation No 1 55 on Cyber Security 
and Cyber Security Management System).  
 (viii)  Operational safety issues: problems with the supporting off -board 
infrastructure,  problem with the remote intervention operator, loss of  
connectivity, lack of maintenance, etc.  
3.5.5.4. The assessment by the type-approval authority shall consist of spot checks to 
establish that argumentation supporting the safety concept is understandable 
and logical and implemented in the different functions of the ADS. The 
assessment shall also check th at validation plans are robust enough to 
demonstrate safety (e.g. reasonable coverage of chosen scenarios testing by 
the validation tool chosen) and have been properly completed.  EN 31  EN 3.5.5.4.1
. It shall demonstrate that the operation of fully automated vehicl e is free from 
unreasonable risks for the vehicle occupants and other road users in the 
operational design domain, i.e. through:  
 (a) an overall validation target (i.e. overall validation acceptance  criteria ) 
supported by validation results, demonstrating that the entry into service of 
the ADS will overall not increase the level of risk for the vehicle occupants 
and other road users compared to a manually driven vehicles  ; and  
 (b) A scenario specific approac h (i.e. scenario based validation 
acceptance criteria) showing that the ADS will overall not increase the level 
of risk for the vehicle occupants and other road users compared to a manually 
driven vehicles for each of the safety relevant scenarios;  
3.5.5.5. The Type Approval Authority shall perform or shall require performing tests 
as specified in point  4. of this Annex to verify the safety concept.  
3.5.5.6. This documentation shall itemize the parameters being monitored and shall 
set out, for each fai lure condition of the type defined in point  3.5.4. of this 
annex, the warning signal to be given to the operator/remote operator/vehicle 
occupants/other road users and/or to service/technical inspection personnel.  
3.5.5.7. This documentation shall also describe the measures in place to ensure the 
ADS  is free from unreasonable risks for the vehicle occupants, and other road 
users  when the performance of the ADS  is affected by environmental 
conditions e.g. climatic, temperatur e, dust ingress, water ingress, ice packing, 
inclement weather.  
4. Verification and tests  
 Taking into account the results of the analysis of the manufacturer’s 
documentation package, the type -approval authority shall request the tests to 
be performed or  witnessed by the Technical Service to check specific points 
arisen from the assessment.  
4.1. The functional operation of the ADS, as laid out in the documents required in 
point 3., shall be tested as follows:  
4.1.1.  Verification of the function of the ADS  
 The type -approval authority shall verify the ADS under non -failure 
conditions by testing on a track a number of selected functions, as deemed 
necessary by the type approval authority, from those described by the 
manufacturer, and by checking the overall behaviour of the ADS in real 
driving conditions including the compliance with traffic rules.  
 These tests shall include scenarios whereby the ADS is overridden by the 
remote intervention operator (if applicable).  
 These tests can be based on test scenarios listed in Part 3 and/or on additional 
scenarios not covered by part 3.  
4.1.1.1.  The test results shall correspond with the description, including the control 
strategies, provided by the manufacturer in point 3.2 . and shall comply with EN 32  EN the performance requirements of this regulation.  
4.1.2.  Verification of the ADS safety concept  
 The reaction of the ADS shall be checked under the influence of a faults in 
any individual unit by applying corresponding output signals to electrical 
units or mechanical elements in order to simulate the effects of internal 
failure within the unit. The type -approval authority shall conduct or witness 
this check for at least one individual unit, but shall not check the reaction of 
the ADS to multiple simultaneous failures of individual units.  
 The type -approval authority shall verify that these tests include aspects that 
may have an impact on vehicle controllability and user information (HMI 
aspects e.g. interaction with the operator/remote operator).  
4.1.2.1.  The type -approval authorities shall also check a number of scenarios that are 
critical for the Object and Event Detection and Response (OEDR) and 
characterization of the decision -making and HMI functions of the ADS (e.g . 
object difficult to detect, when the ADS reaches the ODD boundaries, traffic 
disturbance scenarios, connectivity issue, problem with off board systems, 
remote capabilities issues e.g. the absence of the remote intervention 
operator) as defined in this re gulation.  
4.1.2.2.  The verification results shall correspond with the documented summary of 
the hazard analysis, to a level of overall effect such that the safety concept 
and execution are confirmed as being adequate and in compliance with the 
requirements of this regulation.  
4.2. Simulation tool and mathematical models for verification of the safety 
concept may be used in accordance with Annex VIII to Regulation (EU) 
2018/858, in particular for scenarios that are difficult on a test track or i n real 
driving conditions. ADS Manufacturers shall provide demonstration of the 
scope of the simulation tool, its validity for the scenario concerned as well as 
the validation performed for the simulation tool chain (correlation of the 
outcome with physica l tests). For the purpose of demonstrating the validity of 
the simulation tool chain, the principles of Part 4 of this Annex shall apply.  
Simulation shall not be a substitute for physical tests in Part 3 of this Annex.  
5. Safety management system (SMS)  
5.1. In respect of the ADS, the manufacturer shall demonstrate to the type -
approval authority in terms of a safety management sy stem (SMS) that 
effective processes, methodologies, training and tools are in place, up to date 
and being followed within the org anization to manage the safety and 
continued compliance throughout the ADS lifecycle.  
5.2. The design and development process shall be established and documented 
including safety management system, requirements management, 
requirements’ implementation, testing, failure tracking, remedy and release  
5.3. The manufacturer shall ensure effective communication channels between 
manufacturer departments responsible for functional/operational safety, EN 33  EN cybersecurity and any other relevant disciplines related to t he achievement of 
vehicle safety.  
5.4. The manufacturer shall have processes aimed at collecting vehicle data, and 
data from other sources to monitor to analyse safety -relevant 
incidents/accidents caused by the engaged automated driving system. The 
manufacturer shall report to type-approval aut horities, market surveillance 
authorities and the Commission  the relevant occurrences in accordance with 
part 5 of this Annex.  
5.5. The manufacturer shall have processes to manage potential safety -relevant 
gaps post -registration and to update the vehicles  if necessary.  
5.6. The manufacturer shall demonstrate that periodic independent internal 
process audits (e.g. every 2 years) are carried out to ensure that the processes 
established in accordance with points  5.1 to 5.5. are implemented 
consistently.  
5.7. Manufacturers shall put in place suitable arrangements (e.g. contractual 
arrangements, clear interfaces, quality management system) with suppliers to 
ensure that the supplier safety management system comply with the 
requirements of points 5.1. (except  for vehicle related aspects like 
“operation” and “decommissioning”),  5.2, 5.3 and  5.6.  
5.8. Certificate of Compliance for Safety Management System  
5.8.1.  An application for a Certificate of Compliance for Safety Management 
System shall be submitted by  the manufacturer or by their duly accredited 
representative to the type -approval authority.  
5.8.2.  It shall be accompanied by the undermentioned documents in triplicate, and 
by the following particular:  
(a) Documents describing the Safety Management Syst em. 
(b) A signed Declaration of Compliance of the SMS with all the requirements 
for safety management according to this Regulation, using the model as 
defined in Appendix 3 to this Annex.  
5.8.3.  When this audit of the SMS has been satisfactorily completed  and in receipt 
of a signed declaration from the manufacturer according to the model as 
defined in Appendix 3, a certificate named Certificate of Compliance for 
SMS as described in Appendix 4 (hereinafter the Certificate of Compliance 
for SMS) shall be gra nted to the manufacturer.  
5.8.4.  The Certificate of Compliance for SMS shall remain valid for a maximum of 
three years from the date of deliverance of the certificate unless it is 
withdrawn.  
5.8.5.  The type -approval authority may at any time verify that the requirements for 
the Certificate of Compliance for SMS continue to be met. The type -approval EN 34  EN authority shall withdraw the Certificate of Compliance for SMS if major non -
conformities in the compliance with the requirements laid down in this 
Regulation a re discovered and not immediately addressed.  
5.8.6.  The manufacturer shall inform the type-approval authority or its Technical 
Service of any change that will affect the relevance of the Certificate of 
Compliance for SMS. After consultation with the manuf acturer, the type -
approval authority or its Technical Service shall decide whether new checks 
are necessary.  
5.8.7.  In due time, the manufacturer shall apply for a new or for the extension of the 
existing Certificate of Compliance for SMS. The type -approv al authority 
shall, subject to a positive audit, issue a new Certificate of Compliance for 
SMS or extend its validity for a further period of three years. The type -
approval authority shall verify that the SMS continue to comply with the 
requirements of thi s Regulation. The type -approval authority shall issue a 
new certificate in cases where changes have been brought to the attention of 
the type -approval authority or its Technical Service and the changes have 
been positively re -assessed.  
5.8.8.  The expiry o r withdrawal of the manufacturer’s Certificate of Compliance for 
SMS shall be considered, with regard to the vehicle types to which the SMS 
concerned was relevant, as modification of approval, which may include the 
withdrawal of the approval if the conditi ons for granting the approval are not 
met anymore.  
6. Reporting provision  
6.1. The reporting of the safety assessment of the ADS safety concept as well as 
the audit of the safety management system of the manufacturer shall be 
performed in such a manner that allows traceability, e.g. versions of 
documents inspected are coded and listed in the records of the Technical 
Service.  
6.2. An example of a possible layout for the report on the assessment of the ADS 
safety concept from the Technical Service to the type-approval authority is 
given in Appendix 1 to this part. The listed items in this Appendix are 
outlined as minimum set of items which need to be covered.  
6.3. The granting type -approval authority shall issue a safety assessment report to 
be annexed to the type -approval certificate based on the documentation 
provided by the manufacturer, the report of the assessment of the ADS safety 
concept by the technical serv ice and on the outcomes of the verification and 
test campaigns performed in accordance with Part 3 of this Annex. An 
example of a possible layout for the assessment form from the Technical 
Service to the type -approval authority is given in Appendix 4.  
7. Competence of the auditors/assessors  EN 35  EN 7.1. The assessment of the ADS safety concept and the audit of the safety 
management system under this part shall only be conducted by 
assessors /auditors  with the technical and administrative knowledge necessary 
for such purposes. They shall in particular be competent as auditor/assessor 
for ISO 26262 -2018 (Functional Safety - Road Vehicles), and ISO/PAS 
21448 (Safety of the Intended Functionality of road vehicles); and shall be 
able to make the necessary link with cybersecurity aspects in accordance with 
UN Regulation No 155 and ISO/SAE 21434). This competence shall be 
demonstrated by appropriate qualifications or other equivalent training 
records.  
  EN 36  EN Appendix  1 to Part 2 of Annex  3 
Model for the  assessment report of the ADS safety concept  
 Safet y assessment report No:  
1. Identification . 
1.1. Vehicle make:  
1.2 Vehicle Type  
1.3 Means of identification of vehicle type if marked on the vehicle:  
1.4. Location of that marking:  
1.5. Manufacturer’s name and address:  
1.6. If applicable, name and address of manufacturer’s representative:  
1.7. Manufacturer’s formal documentation package:  
 Documentation reference No:  
 Date of original issue:  
 Date of latest update:  
2. Assessment method  
2.1. Description of the assessment processes and methodologies  
2.2. Acceptability criteria  
3. Results of the review of the documentation package  
3.1 Review of the  ADS description .  
3.2.. Review of Manufacturer’s safety concept  and the manufacturer analysis . 
3.3. Review of the Verification and Validation performed by the manufacturer  
3.4 Review of the methods and tools (software, laboratory, others) and the credibility 
assessment  EN 37  EN 3.5. Review of ADS data requirements and specific data elements for event data 
recorder for fully automated vehicles  
3.6. Checks  of the Cyber Security and Software Updates certificates  are covering he 
ADS.  
3.7. Review of the information provided in the Operating Manual  
3.8. Review of the provisions for the periodic roadworthiness tests of the ADS:  
3.9. Review of additional information not included in the Information Document  
4. Verification of ADS functions under non -failure conditions (referred to in point 
4.1.1. of Annex 3 Part 2 to Regulation (EU) …/…(1) [PO: this Regulation] ) 
4.1. Rationale for the  selection of test scenarios  
4.2. Selected test scenarios  
4.3. Test reports  
4.3.1.  Test No. (add as many as the tests performed)  
4.3.1.1.  Objectives of the test  
4.3.1.2.  Test conditions  
4.3.1.3.  Measured quantities and measuring devices  
4.3.1.4  Acceptability criteria  
4.3.1.5.  Test results  
4.3.1.6.  Comparison with the manufacturer’s supplied documentation  
5. Verification of ADS safety concept under single failure (referred to in point 4.1.2. 
of Annex 3 Part 2 to Regulation (EU) …/…(1) [PO: this  Regulation])  
5.1. Rationale for the selection of test scenarios  
5.2. Selected test scenarios  
5.3. Test reports  
5.3.1.  Test No. (add as many as the tests performed)  EN 38  EN 5.3.1.1.  Objectives of the test  
5.3.1.2.  Test conditions  
5.3.1.3.  Measured quantities and measuring devices  
5.3.1.4  Acceptability criteria  
5.3.1.5.  Test results  
5.3.1.6.  Comparison with the manufacturer’s supplied documentation  
3.10 Safety management system certificate (shall be appended to this test report)  
3.11.  Date of the assessment  
3.12.  Final judgement on the safety assessment outcome  
3.13. This assessment has been carried out and the results reported in accordance with 
Commission Implementing Regulation (EU) …/…(1) [PO: this Regulation ]  
 Technical Service carrying out the assessment  
Signed: .......................................   Date: ........................................  
3.14. Comments:  
___________   
(1) [PO:  insert  full title and OJ reference.]   EN 39  EN Appendix 2 to Part 2 of Annex 3  
Model of the ADS assessment results to be annexed to the type -approval 
certificate  
1. Identification.  
1.1. Vehicle make  
1.2 Vehicle Type  
1.3 Means of identification of vehicle type if marked on the vehicle:  
1.4. Location of that marking:  
1.5. Manufacturer’s name and address:  
1.6. If applicable, name and address of manufacturer’s representative:  
1.7. Manufacturer’s formal documentation package:  
 Documentation reference No:  
 Date of original issue:  
 Date of latest update:  
2. Assessment method  
2.1. Description of the assessment processes and methodologies  
2.2. Acceptability criteria  
3. Verification of ADS functions under non -failure conditions (referred to in point 
4.1.1. of Annex 3 Part 2 to Regulation (EU) …/…(1) [PO: this Regulation] ) 
3.1. Rationale for the selection of test scenarios  
3.2. Selected test scenarios  
4. Verification of ADS safety concept under single failure (referred to in point 4.1.2. 
of Annex 3 Part 2 to Regulation (EU) …/…(1) [PO: this Regulation] ) 
4.1. Rationale for the selection of test scenarios  EN 40  EN 4.2. Selected test scenarios  
5. Assessment results  
5.1. Results of the review of the Information Document  
5.2. Results of the verification of ADS functions under non -failure conditions  
5.3. Results of the verification of ADS safety concept under single failure  
5.4. Results of the assessment of the Safety Management System  
5.5. Results of the verification of provisions for the periodic roadworthiness tests  
6. Final judgement on the safety  assessment outcome  
 
  EN 41  EN Appendix 3 to Part 2 of Annex 3  
 
Model of Manufacturer’s Declaration of Compliance for SMS  
Manufacturer’s declaration of compliance with the requirements for the Safety 
Management System  
Manufacturer Name:   
Manufacturer Address:   
…………………..( Manufacturer Name ) attests that the necessary processes to comply with the requirements for 
the Safety Management System laid down in Regulation (EU) 2022 /XXX [PO: this regulation ] are 
installed and will be maintained.  
Done at: …………………… ( place ) 
Date:    
Name of the signatory:   
Function of the signatory:   
  
(Stamp and signature of the manufacturer’s representative ) 
   EN 42  EN Appendix 4 to Part 2 of Annex 3  
Model of Certificate of Compliance for SMS  
Certificate of Compliance for  
Safety Management System  
With Regulation (EU) 2022/XXX [PO: this regulation]  
Certificate Number [ Reference number ] 
[……. Approval Authority ] 
Certifies that  
Manufacturer: ............................................................................................................... .................................  
Address of the manufacturer:   
complies with the provisions of Regulation (EU) 2022/XXX (this re gulation)   
Checks have been performed on:   
by (name and address of the type-approval a uthority or Technical Service):   
Number of report:..........................  
The certificate is valid until [….. Date ] 
Done at […… Place ] 
On [……. Date ] 
[…………. Signature ] 
Attachments: description of the Safety Management System by the manufacturer.  
  EN 43  EN PART 3: TESTS  
1. General provisions  
Pass- and fail -criteria to assess ADS safety shall be based on the requirements set 
out in Annex 2  and the scenario described in Part 1 of this annex. The requirements 
are defined in such a way that the pass/fail criteria can be derived not only for a 
specific set of test parameters, but also for all safety -relevant combinations of 
parameters that may occur in the operating conditions covered by the type approval 
and the specified operating range (e.g., speed range, longitudinal and transverse 
acceleration range, radii of curvature, brightness,  number of lanes). For conditions 
not tested and may occur within the defined ODD of the system, the manufacturer 
shall demonstrate as part of the assessment  described in part 2 to the satisfaction of 
the type approval authority, that the vehicle is safely  controlled.  
These tests shall confirm the minimum performance requirements described in 
Annex 2 and the functionality of the ADS and the safety concept of the 
manufacturer as described in Part 2 of this Annex.  Test results shall be documented 
and reported  in accordance with point 6 of part 2 of this annex.  
2 Test site 
The test site shall  comprise  characteristics (example: friction value) that 
correspond to the specified ODD of the ADS. The ADS shall also be tested on -
road in ac cordance with the applicable law of the Member State granting the type -
approval  and provided that tests can be carried out safely and without any risk to 
other road users . 
3. Environmental  conditions  
Tests shall be carried out under different environmental conditions, within the 
limits of the defined ODD for the ADS. For environmental conditions not tested 
that may occur within the defined ODD, the manufacturer shall demonstrate as part 
of the assessme nt to the satisfaction of the type -approval authority that the vehicle 
is safely controlled.  
In order to test the requirements for failure of functions, self -testing of the ADS 
and initiation and implementation of a minimal risk manoeuvre, errors may be 
artificially induced  and the vehicle may be artificially brought into situations where  
it reaches the limits of the defined operating range (e.g., environmental conditions).  
4. System  modifications  for testing  purposes  
If ADS  modifications  are required  in order  to allow testing,  e.g. road type 
assessment  criteria  or road type information  (map  data),  it shall  be ensured  that 
these  modifications  don’t  have  an effect  on the test results.  These  modifications  
shall  in principle  be documented  and annexed  to the test report . The description  
and the evidence  of influence  (if any) of these  modifications  shall  be documented  
and annexed  to the test report.  
5. Vehicle  conditions  
5.1. Test mass  
The subject vehicle shall be tested  with any permissible vehicle load . No load EN 44  EN alteration shall be made once the test procedure has begun. The manufacturer shall 
demonstrate, through the use of documentation, that the ADS  works at all load 
conditions.  
5.2. The subject  vehicle  shall  be tested  at the tyre pressure  recommended  by the 
manufacturer.  
5.3. It shall be verified, that the condition of the system is according to the intended 
testing purpose (e.g. in a fault -free condition or with the specific faults to be 
tested).  
6. Test tools  
In addition to real vehicles, state -of-the-art test tools may be used to carry out the 
tests, replacing real vehicles and other road users (e.g., soft targets, mobile 
platforms, etc.). The replacement test tools shall comply with the characteristics 
releva nt for sensory performance assessment, real vehicles and other traffic 
participants. Tests shall not be carried out in such a way as to endanger the 
personnel involved and significant damage of the vehicle under test must be 
avoided where other means of va lidation are available.  
7 Test parameter  variation  
The manufacturer shall declare the system boundaries to the type -approval 
authority. The type -approval authority shall define diffe rent combinations of test 
parameters (e.g. present speed of the vehicle, type and offset of target, curvature of 
lane, etc.) in order to test the ADS. The selected test cases shall provide sufficient 
test coverage for all scenarios, test parameters and env ironmental influences. 
Adequate robustness of the perceptions systems for the ADS  against input/sensor 
data malfunction and adverse environmental conditions shall be demonstrated.  
Test parameters selected by the type -approval authority shall be recorded in  a test 
report in such a manner that allows traceability and repeatability of the test setup.  
8. Tests  scenarios  to assess  the performance  of the ADS  on a test track  (point s 8.1., 
8.2., 8.5, 8.6, 8.7, 8.8, 8.9.) and on-road (8.3., 8.4., 8.10 .)  
The scenarios included in the following point s have to be considered a minimum 
set of tests. At the request of the type approval authority, additional scenarios that 
are part of the ODD can b e executed. If a scenario described in point  8 of this 
annex does not belong to the ODD of the vehicle under test, it shall not be taken 
into consideration.  
Depending on the ODD, test scenarios shall be selected as part of the type approval 
test. The selection of the test scenarios shall be made in accordance with Part 1 of 
this annex. Type -approval testing may be carried out on the basis of simulations, 
manoeuvres on the test track and driving tests on real road traffic. However, it may 
not be based solely on computer simulations  and at the time of type approval, the 
type-approval authority shall conduct or shall witness at least the following tests to 
assess the behaviour of the ADS.  
8.1. Lane  keeping  EN 45  EN The test shall  demonstrate  that the vehicle with  an ADS does not leave its lane and 
maintains  a stable  motion  inside  its lane across  the speed  range  and different  
curvatures  within  its system  boundaries.  
8.1.1  The test shall  be based on the ODD of the ADS  and shall be executed  at least : 
a) With  a minimum  test duration  of 5 minutes;  
b) With  a passenger  car target  as well as a Power  Two Wheler  (PTW)  target  as 
the other  vehicle;  
c) With  a lead vehicle  swerving  in the lane;  and 
d) With  another  vehicle  driving  close  beside  in the adjacent  lane.  
8.2. Lane  changing  manoeuvre  (LCM)  
The tests shall  demonstrate  that the vehicles with an ADS does not cause  an 
unreasonable  risk to safety  of the vehicle  occupants  and other  road users  during  a 
Lane  Change  Procedure,  and that the ADS  is able to assess  the criticality  of the 
situation  before  starting  the Lane  Change  Manoeuvre  (LCM)  throughout  the entire 
operational  speed  range.  These  tests are only required  if the vehicle equipped with 
an ADS  is capable  of performing  lane changes  either  during  a Minimal  Risk 
Manoeuvre  or during  regular  operation.  
8.2.1.  The following  tests shall  be executed:  
a) With  the vehicle with an ADS  performing  lane change  to the adjacent  
(target)  lane;  
b) Merging  at lane end; 
c) Merging  into an occupied  lane.  
8.2.2.  The tests shall  be executed  at least:  
a) With  different  vehicles,  including  a PTW  approaching  from  the rear; 
b) In a scenario  where  a lane changing  manoeuvre  in regular  operation  is 
possible  to be executed;  
c) In a scenario  where  a lane changing  manoeuvre  in regular  operation  is not 
possible  due to a vehicle  approaching  from  the rear; 
d) With  an equally  fast vehicle  following  behind  in the adjacent  lane,  
preventing  a lane change;  
e) With  a vehicle  driving  beside  in the adjacent  lane preventing  a lane change;  
f) In a scenario  where  a LCM  during  a minimal  risk manoeuvre  is possible  
and executed;  
g) In a scenario where the fully automated vehicle  reacts to another vehicle 
that starts changing into th e same space within the target lane, to avoid a 
potential risk of collision.  
8.3. Response  to different  road geometries  
These  tests shall  ensure,  that the vehicle with an ADS detects  and adapts  to a 
variation  of different  road geometries  which  can occur  within  the intended  ODD  
across  its whole  speed  range.  
8.3.1.  The test shall  be executed  at least with the list of scenarios  below  based  on the EN 46  EN ODD  of the ADS:  
a) T-junctions  (3-way intersections)  with and without  traffic  lights,  with 
different  rights  of way;  
b) Crossroads  (4 or more  way intersections)  with and without  traffic  lights,  
with different  rights  of way;  
c) Roundabouts.  
8.3.2.  Each  test shall  be executed  at least:  
a) Without  a lead vehicle;  
b) With  a passenger  car target  as well as a PTW  target  as the lead vehicle  / 
other  vehicle;  
d) Without  and with approaching  or passing  vehicles.  
8.4. Response  to national  traffic  rules  and road infrastructure  
These  tests shall  ensure  that the vehicle equipped with an ADS  complies  with 
national  traffic  rules  as well as adapts  to a variation  of permanent  and temporary  
changes  of the road infrastructure  (e.g. road construction  sites)  in the entire  speed  
range.  
8.4.1.  The tests shall  be executed  at least with the list of scenarios  below  that are relevant 
for the ODD  of the ADS : 
a) Different  speed  limit  signs,  so that the ADS  has to change  its speed  
according  to the indicated  values;  
b) Signal  lights  and/or  stop instructed  by a road safety officer / enforcement 
agents  with situations  of going  straight,  turning  left and right;  
c) Pedestrian  and cyclist  crossings  with and without  pedestrians /cyclist  
approaching  / on the road.  
d) Temporary  modifications:  e.g., road maintenance  operations  indicated  by 
traffic  signs,  cones  and other  signalization,  access  restrictions.  
e) Motorway  entry,  exit and toll stations.  
8.4.2.  Each  test shall  be executed  at least:  
a) Without  a lead vehicle;  
f) With  a passenger  car target  as well as a PTW  target  as the lead vehicle  / 
other  vehicle.  
8.5. Collision  avoidance:  Avoid  a collision  with road users  or objects  blocking  the lane 
The test shall  demonstrate  that the vehicle equipped with an ADS  avoids  a 
collision  with a stationary  vehicle,  road user or fully  or partially  blocked  lane up to 
the maximum  specified  speed  of the ADS.  
8.5.1.  This test shall  be executed  at least with the following  scenarios , where  relevant  in 
the ODD : 
a) With  a stationary  passenger  car target;  
b) With  a stationary  PTW  target;  
c) With  a stationary  pedestrian  target;  
d) With  a pedestrian  target  crossing  the lane with a speed  of 5 km/h,  also in EN 47  EN the presence  of other  objects  relevant in the ODD (e.g. a ball, a shopping  
bag, etc.);  
e) With a pedestrian target moving within and p artially occupying the lane of 
the ADS and following the same or the opposite direction of the ADS with 
a speed of up to 5 km/h;  
f) With a pedestrian target swerving in the same lane of the ADS;  
g) With a cyclist  target crossing the lane with a speed of 15 km/h ; 
h) With a cyclist target which  travelling  in the same  direction  with a speed of 
15 km/h  
i) With  a target  representing  a blocked  lane;  
j) With  a target  partially  within  the lane;  
k) With one or more different types of unpassable objects relevant in the ODD 
(e.g., a dustbin, a fallen bicycle or scooter, a fallen traffic sign, a stationary 
or moving ball, etc.);  
l) With  multiple  consecutive  obstacles  blocking  the lane relevant  in the ODD  
(e.g.,  in the following  order:  ego-vehicle  -motorcycle  - car); 
m) On a curved  section  of road.  
8.6. Avoid  emergency  braking  before  a passable  object  in the lane. A “passable  object”  
is such an object,  that may be rolled  over without  causing  an unreasonable  risk to 
the vehicle  occupants  or other  road users . 
The test shall  demonstrate  that vehicle with an ADS is not is not initiating an 
Emergency Braking with a deceleration demand greater than 5 m/s2 due to a 
passable object in the lane relevant for the ODD (e.g., a manhole lid or a small 
branch)  up to the maximum specified speed of the ADS.  
8.6.1.  This test shall  be executed  at least with the following  scenarios , where  relevant  in 
the ODD:  
a) Without  a lead vehicle;  
b) With  a passenger  car target  as well as a PTW  target  as the lead vehicle  / 
other  vehicle.  
8.7. Following  a lead vehicle  
The test shall  demonstrate  that the vehicle equipped with an ADS  is able to 
maintain  and restore  a stable motion and a safety  distance  to a vehicle  in front  and 
is able to avoid  a collision  with a lead vehicle  which  decelerates  up to its maximum  
deceleration.  
8.7.1.  This test shall  be executed  at least with the following  scenarios , where  relevant  in 
the ODD:  
a) Across  the entire  speed  range  of the vehicle with an ADS ; 
b) Using  a passenger  car target  as well as a PTW  target  as lead vehicle,  
provided  standardized  PTW  targets  suitable  to safely  perform  the test are 
available;  
c) For constant  and varying  lead vehicle  veloc ities (realistic  speed  profile) ; 
d) For straight  and curved  sections  of road;  
e) For different  lateral  positions  of lead vehicle  in the lane;  
f) With  a deceleration  of the lead vehicle  of at least 6 m/s2 mean  fully  EN 48  EN developed  deceleration  until standstill.  
8.8. Lane  change  of another  vehicle  into lane (cut-in) 
The test shall  demonstrate  that the vehicl e with an ADS is capable  of avoiding  a 
collision  with a vehicle  or other  road user cutting  into the lane of the vehicle 
equipped with an ADS  up to a certain  criticality  of the cut-in manoeuvre.  
8.8.1.  The criticality  of the cut-in manoeuvre  shall  be determined  according  to the 
provisions introduced in point  1.3.1. of Annex 3, Part 1 and depending on the 
distance between  the rear-most  point  of the cutting  in vehicle  and front -most  point  
of the vehicle with an ADS . 
8.8.2.  The test shall  be executed  at least with the following  scenarios,  where  relevant  for 
the ODD: 
a) With  different  TTC,  distance  and relative  velocity  values  of the cut-in 
manoeuvre,  covering  types  of cut-in scenarios  in which  a collision  can be 
avoided  and those  in which  a collision  cannot  be avoided;  
b) With  cutting -in vehicles  travelling  at constant  longitudinal  speed,  
accelerating  and decelerating;  
c) With  different  lateral  velocities,  lateral  accelerations  of the cut-in vehicle;  
d) With  passenger  car as well as PTW  targets  as the cutting -in vehicle,  
provided  standardized  PTW  targets  suitable  to safely  perform  the test are 
available.  
8.9. Stationary  obstacle  after lane change  of the lead vehicle  (cut-out) 
The test shall  demonstrate  that the vehicle equipped with an ADS is capable  of 
avoiding  a collision  with a stationary  vehicle,  road user or blocked  lane that 
becomes  visible  after a preceding  vehicle  avoided  a collision  by an evasive  
manoeuvre.  The test shall be based on the requirements set out in Annex 2 and 
scenario parameters in part I of this annex. For conditions not tested that may occur 
within the defined operating range of the vehicle, the manufacturer shall 
demonstrate as part of the assessment  described in Annex 3, Part 2  to the 
satisfaction of the relevant authorities that the vehicle is safely controlled.  
8.9.1.  The test shall  be executed  at least with the following  scenarios,  where  relevant  for 
the ODD : 
a) With  a stationary  passenger  car target  centred  in lane;  
b) With  a powered  two-wheeler  target  centred  in lane;  
c) With  a stationary  pedestrian  target  centred  in lane;  
d) With  a target  representing  a blocked  lane centred  in lane;  
e) With  multiple  consecutive  obstacles  blocking  the lane (e.g. in the following  
order:  ego-vehicle  – lane change  vehicle  – motorcycle  – car). 
8.10.  Parking  
The test shall  demonstrate  that the fully  automated  vehicle  is able to park to 
different  parking  space s and parking  layouts  under  different  conditions;  and during  
the parking  manoeuvre  it is not causing  damage  to the surrounding  objects,  road 
users  and itself.  EN 49  EN 8.10.1.  The test shall  be executed  at least with the following  scenarios,  where  relevant  for 
the ODD : 
(a) With  parking  spaces  parallel  and perpendicular  to the road;  
(b) On even  and slant  surfaces;  
(c) With  other  vehicles  in the surrounding  parking  spaces,  including  PTWs  and 
bicycles;  
(d) Parking  to parking  spaces with different  geometrical  dimensions;  
(e) On different  road slope  angles;  
(f) With  another  vehicle  cutting  in to the parking  space  during  the parking  
manoeuvre.  
8.11.  Navigating in a parking lot  
The test shall demonstrate that the ADS is able to handle the low driving speed and 
the general lack of visibility that may occur in a parking.  
8.11.1.  The test shall  be executed  at least with the following  scenarios,  where  relevant  for 
the ODD : 
a) With an initially obstructed pedestrian target crossing the path of the ADS 
with a speed of 5 km/h.  
b) With a vehicle driving out of a parking place in front of the ADS.  
c) With a stationary obstacle in the path of the ADS.  
d) With different paths, where the infrastructure is obstructing the field of 
view.  
e) With a small  obstacle on the floor after a ramp obstructed by other objects 
in the path of the ADS.  
8.12.  Specific  scenarios  for motorway  
8.12.1.  Motorway entry  
The test shall demonstrate that the ADS is able to safely enter the motorway.  
8.12.1.1.  The test shall  be executed  at least with the following  scenarios,  where  relevant  for 
the ODD : 
a) With different vehicles, including a PTW approaching from the rear;  
b) With vehicles approaching with different speed from the rear;  
c) With a platoon of vehicles driving beside in the adjacent lane.  
8.12.2.  Motorway exit  
The test shall  demonstrate  that the ADS  is able to safely  exit the motorway.  
8.12.2.1.  The test shall  be executed  at least with the following  scenarios,  where  relevant  for 
the ODD : 
a) Without a lead vehicle;  
b) With a passenger car target as well as a PTW target as the lead vehicle / 
other vehicle.  
c) With other vehicle(s) or obstacle(s) blocking the motorway exit.  
8.12.3.  Toll station  
The test shall  demonstrate  that the ADS  is able to select  the proper  passing  gate,  
and adapt  its speed  to that permitted  within  the toll area.  
8.12.3.1.  The test shall  be executed  at least with the following  scenarios,  where  relevant  for 
the ODD : EN 50  EN a) With and without a lead vehicle;  
b) With other vehicles  blocking the passing gate(s);  
c) With closed and opened passing gates.  
d) With different permitted speeds in the toll area.  
8.13.  For dual mode vehicles, transition between the manual driving mode and the fully 
automated mode.  
The test shall  demonstrate  that the ADS  takes  over the DDT  in a safe manner  and 
only when  the vehicle  is standstill.  
8.13.1.  The test shall  be executed  at least with the following  scenarios,  where  relevant  for 
the ODD : 
a) With  and without  human  driver  present  in the vehicle;  
b) With  open  and closed  vehicle  doors;  
c) With  and without  obstacles  around  the vehicle,   
d) Inside  and outside  of the dedicated  transition  area,  if applicable  
8.13.2.  The test shall  be executed  at least with the following  scenarios,  where  relevant  for 
the ODD : 
a) In a situation  where  transition  is possible  and executed;  
b) In a situation  where  transition  is not possible  to be executed.  
  EN 51  EN PART 4: PRINCIPLES FOR CREDIBILITY ASSESSMENT FOR USING VIRTUAL 
TOOLCHAIN IN ADS VALIDATION  
1. General  
1.1. The credibility  can be achieved  by investigating  and assessing  five properties   of 
Modelling  and Simulation  (M&S ):  
(a) Capability  – what  the M&S  can do, and what  are the risks  associated;  
(b) Accuracy  – how well M&S  does reproduce  the target  data;  
(c) Correctness  – how sound  & robust  are M&S  data and algorithms;  
(d) Usability  – what  training  and experience  is neede d and what  quality  of the 
process  applied  to it. 
(e) Fit for Purpose  – how suitable  the M&S  is for the ODD  and ADS  
assessment.  
1.2.. At the same time,  the credibility  assessment  framework  shall  be general  enough  to 
be used for different  M&S  types  and applications.  However,  the goal is 
complicated  by the broad  differences  across  ADS  features  and the variety  of M&S  
types  and applications.  These  considerations  lead to introduce  a (risk-
based/informed)  credibility  assessment  framework  relevant  and appropriate  to all 
M&S  applications.   
1.3. The credibility  assessment  framework  provides  a general  description  of the main  
aspects  considered  for assessing  the credibility  of an M&S  solution  together  with 
guidelines  of the role played  by third  parties  assessors  in the validation  process  
with respect  to credibility.  Concerning  the latter  point,  the type-approval  authority  
shall  investigate  the produced  documentation  supporting  credibility  at the 
assessment  phase,  whereas  the actual  validation  tests occur  once  the manufacturer  
has developed  the integrated  simulation  systems.  
1.2.5.  Ultimate ly, the outcome  of the current  credibility  assessment  shall  define  the 
envelope  in which  the virtual  tool can be used to support  the ADS  assessment.  
1.3. The requirements  of this part are there fore intended  to demonstrate  the credibility  
of any simulation  model  or virtual  toolchain  for its use in ADS  validation.  
2. Definitions  
For the purpose  of this annex  
2.1. “Abstracti on” is the process  of selecting  the essential  aspects  of a source  system  or 
referent  system  to be represented  in a model  or simulation,  while  ignoring  those  
aspects  not relevant.  Any modelling  abstraction  carries  with it the assumption  that 
shall  not signi ficantly  affect  the intended  uses of the simulation  tool. 
2.2. “Closed  Loop  Testing”  means  a virtual  environment  that does take the actions  of 
the element -in-the loop into account.  Simulated  objects  respond  to the actions  of 
the system  (e.g. system  interacting  with a traffic  model).  
2.3. “Deterministic”  is a term describing  a system  whose  time evolution  can be 
predicted  exactly  and a given  set of input  stimuli  will always  produce  the same  
output.   EN 52  EN 2.4. “Driver -In-the-Loop  (DIL)”  is typically  conducted  in a driving  simulator  used for 
testing  the human –automation  interaction  design.  DIL has components  for the 
driver  to operate  and communicate  with the virtual  environment.  
2.5. “Hardware -In-the-Loop  (HIL)”  involves  the final hardware  of a specific  vehicle  
sub-system  running  the final software  with input  and output  connected  to a 
simulation  environment  to perform  virtual  testing.  HIL testing  provides  a way of 
replicating  sensors,  actuators  and mechanical  components  in a way that connects  
all the I/O of the Electronic  Control  Units  (ECU)  being  tested,  long before  the final 
system  is integrated . 
2.6. “Model”  is a description  or representation  of a system,  entity,  phenomenon,  or 
process.  
2.7. “Model  calibration”  is the process  of adjusting  numerical  or modelling  parameters  
in the model  to improve  agreement  with a referent.  
2.8. “Model  Parameter”  are numerical  values  used to support  characterizing  a system  
functionality.  A model  parameter  has a value  that cannot  be observed  directly  in 
the real world  but that must  be inferred  from  data collected  in the real world  (in the 
model  calibration  phase).  
2.9. “Model -In-the-Loop  (MIL)”  is an approach  which  allows  quick  algorithmic  
development  without  involving  dedicated  hardware.  Usually,  this level  of 
development  involves  high-level  abstraction  software  frameworks  running  on 
general -purpose  computing  systems.  
2.10.  “Open  Loop  Testing”  means  a virtual  environment  that does not take the actions  of 
the element -in-the loop into account  (e.g. system  interacting  with a recorded  traffic  
situation).  
2.11.  “Probabilistic”  is a term pertaining  to non-deterministic  events,  the outcomes  of 
which  are described  by a measure  of likelihood.  
2.12.  “Proving  Ground  or test-track”  is a physical  testing  facility  closed  to the traffic  
where  the performance  of an ADS  can be investigated  on the real vehicle.  Traffic  
agents  can be introduced  via sensor  stimulation  or via dummy  devic es positioned  
on the track.  
2.13.  “Sensor  Stimulation”  is a technique  whereby  artificially  generated  signals  are 
provided  to the element  under  testing  in order  to trigger  it to produce  the result 
required  for verification  of the real world,  training,  maintenance,  or for research  
and development.  
2.14.  “Simulati on” is the imitation  of the operation  of a real-world  process  or system  
over time.  
2.15.  “Simulation  model”  is a model  whose  input  variables  vary over time.  
2.16.  “Simulation  toolchain”  is a combination  of simulation  tools  that are used to support  
the validation  of an ADS.  
2.17.  “Software -In-the-Loop  (SIL)”  is where  the implementation  of the developed  model  
will be evaluated  on general -purpose  computing  systems.  This step can use a 
complete  software  implementation  very close  to the final one. SIL testing  is used to EN 53  EN describe  a test methodol ogy, where  executable  code  such as algorithms  (or even  an 
entire  controller  strategy),  is tested  within  a modelling  environment  that can help 
prove  or test the software.  
2.18.  “Stochastic”  mean s a process  involving  or containing  a random  variable  or 
variables.  Pertaining  to chance  or probability.  
2.19.  “Validation  of the simulation  model”  is the process  of determining  the degree  to 
which  a simulation  model  is an accurate  representation  of the real world  from  the 
perspective  of the intended  uses of the tool. 
2.20.  “Vehicle -In-the-Loop  (VIL)”  is a fusion  environment  of a real testing  vehicle  in 
the real-world  and a virtual  environment.  It can reflect  vehicle  dynami cs at the 
same  level  as the real-world  and it can be operated  on a vehicle  test bed or on a test 
track.  
2.21.  “Verification  of the simulation  model”  is the process  of determining  the extent  to 
which  a simulation  model  or a virtual  testing  tool is compliant  with its 
requirements  and specifications  as detailed  in its conceptual  models,  mathematical  
models,  or other  constructs.  
2.22.  “Virtual  testing”  is the process  of testing  a system  using  one or more  simulation  
models.  
3. Components  of the credibility  assessment  framework  and related  documentation  
requirements  
3.1. The Credibility  Assessment  framework  introduces  a way to assess  and report  the 
credibility  of M&S  based  on quality  assurance  criteria  that allow  indicating  the 
levels  of confidence  in results.  In other  words , the credibility  is established  by 
evaluating  the following  M&S  influencing  factors  that are considered  as main  
contributors  for M&S  properties  and therefore  for the overall  M&S  credibility:  (a) 
M&S  management,  (b) team’s  experience  and expertise,  (c) M&S  analysis  and 
description,  (d) data/input  pedigree,  and (e) verification,  validation,  uncertainty  
characterization.  Each  of these  factors  indicates  the level  of quality  achieved  by 
M&S,  and the comparison  between  the obtained  levels  and the required  levels  
leads  to consider  the M&S  credible  and fitness  to use for virtual  testing.  A 
graphical  representation  of the relationship  among  the components  of the 
credibility  assessment  framework  is reported  in the next figure.  EN 54  EN  
3.2. Models  and Simulation  Management.  
3.2.1.  The M&S  lifecycle  is a dynamic  process  with frequent  releases  that shall  be 
monitored  and documented.  Management  activities  shall  be established  to support  
the M&S  in a work  product  management  fashion.  Relevant  information  on the 
following  aspects shall  be provided.  
3.2.2.  The M&S  management  process  shall:  
(a) Describe  the modifications  within  the releases,  
(b) Designate  the corresponding  software  (e.g.,  specific  software  product  and 
version)  and hardware  arrangement  (e.g., XiL configuration),  
(c) Record  the internal  review  processes  that accepted  the new releases,  
(d) Be supported  throughout  the full duration  of the virtual  model  utilization  
3.2.3.  Release  management.  
3.2.3.1.  Any M&S  toolchain’s  version  used to release  data for certification  purposes  shall  
be stored.  The virtual  models  constituting  the testing  toolchain  shall  be 
documented  in terms  of the corresponding  validation  methods  and acceptance  
thresholds  to support  the overall  credibility  of the toolchain.  The developer  shall  
enforce  a method  to trace generated  data to the corresponding  M&S  version.  
3.2.3.2.  Quality  check  of virtual  data.  Data  completeness,  accuracy,  and consistency  shall  
be ensured  throughout  the releases  and lifetime  of an M&S  toolchain  to support  the 
verification  and validation  procedures.  
3.2.4.  Team's  Experience  and Expertise.  
3.2.4.1.  Even  though  Experience  and Expertise  (E&E)  are already  covered  in a general  
sense  within  the organization,  it is important  to establish  the basis  for confidenc e 
on the specific  experience  and expertise  for M&S  activities.  
3.2.4.2.  In fact, the credibility  of M&S  depends  not only on the quality  of the simulation  
models  but also on the E&E  of the perso nnel involved  in the validation  and usage  
EN 55  EN of the M&S.  For instance,  a proper  understanding  of the limitations  and validation  
domain  will prevent  from  possible  misuse  of M&S  or from  misinterpretation  of its 
results.  
3.2.4.3.  In this perspective,  it is important  to establish  the basis  for the manufacturer’s  
confidence  on the experience  and expertise  of: 
(a) The Teams  that will validate  the simulation  toolchain  and, 
(b) The Teams  that will use the validated  simulation  for the execution  of virtual  
testing  with the purpose  of validating  the ADS.  
3.2.4.4.  A proper  management  of the team’s  E&E  increases  the level  of confidence  on the 
credibility  of M&S  and its outcomes  by ensuring  that the human  factors  behind  the 
M&S  are taken  into consideration  and any possible  human  component  risk is 
controlled  as expected  in any suitable  Management  System  
3.2.4.5.  If the manufacturer's  tool chain  incorporates  or relies  upon  inputs  from  
organizations  or products  outside  of the manufacturer's  own team,  the 
manufacturer  will include  an explanation  of measures  it has taken  to support  its 
confidence  in the quality  and integrit y of those  inputs.  
3.2.4.6.  Team’s  Experience  and Expertise  include  two levels.  
3.2.4.6.1.  Organizational  level  
The credibility  is established  by setting  up processes  and procedures  to identify  and 
maintain  skills,  knowledge,  and experience  to perform  M&S  activities.  The 
following  processes  shall  be established,  maintained  and documented:   
(i) Process  to identify  and evaluate  the individual’s  competence  and skills;  
(ii) Process  for training  competent  personnel  to perform  M&S -related  duties  
3.2.4.6.2.  Team  level  
Once  a M&S  has been  finalized,  its credibility  is mainly  dictated  by the skills  and 
knowledge  of the individual/team  that will validate  the M&S  Toolchain  and will 
use the M&S  for the validation  of ADS.  The credibility  is established  by 
documenting  that these  Teams  have  received  adequate  training  to fulfil  their duties.  
The manufacturer  shall  then:  
(i) Provide  the basis  for the manufacturer’s  confidence  in the Experience  and 
Expertise  of the individual/team  that validates  the M&S  Toolchain.  
(ii) Provide  the basis  for the manufacturer’s  confidence  in the Experience  and 
Expertise  of the individual/team  that uses the simulation  to execute  virtual  testing  
with the purpose  of validating  the ADS.  
The manufacturer’s  demonstrat ion of how it applies  the principles  of ISO 9001  or a 
similar  best practice  or standard  with regard  to the competence  of its M+S  
organization  and the individuals  in that organization  will provide  the necessary  
basis  for this determination.   The type-approval  authority  may not substitute  its 
judgment  for that of the manufacturer  with regard  to the experienc e and expertise  
of the organization  or its members.  
3.2.5.  Data/Inp ut pedigree  
3.2.5.1.  The data/input  pedigree  contains  a record  of traceability  from  the manufacturer’s  
data used in the validation  of the M&S.  EN 56  EN 3.2.5.2.  Description  of the data used for the M&S  
(a) The manufacturer  shall  document  the data used to validate  the model  and 
note important  quality  characteristics;  
(b) The manufacturer  shall  provide  documentation  showing  that the data used 
to validate  the models  covers  the intended  functionalities  the toolchain  aims  at 
virtualizing;  
(c) The manufacturer  shall  document  the calibration  procedures  employed  to 
fit the virtual  models’  parameters  on the collected  input  data.  
3.2.5.3.  Effect  of the data qualit y (e.g. data coverage,  signal  to noise  ratio,  and sensors’  
uncertainty/bias/sampling  rate) on model  parameters  uncertainty  
The quality  of the data used to develop  the model  will have  an impact  on model  
parameters’  estimation  and calibration.  Uncertainty  in model  parameters  will be 
another  important  aspect  in the final uncertainty  analysis.  
3.2.6.  Data/Out put pedigree  
3.2.6.1.  The data/output  pedigree  contains  a record  of the M&S  outputs  used for the ADS  
validation.  
3.2.6.2.  Description  of the data generated  by the M&S  
(a) The manufacturer  shall  provide  information  on any data and scenarios  used 
for virtual  testing  toolchain  validation.   
(b) The manufacturer  shall  document  the exported  data and note important  
quality  characteristics.  
(c) The manufacturer  shall  trace  a M&S  output  to the corresponding  simulation  
setup  
3.2.6.3.  Effect  of the data quality  M&S  credibility  
(a) The M&S  output  data shall  be sufficiently  wide  to ensure  the correct  
execution  of the validatio n computation.  The data shall  sufficiently  reflect  the 
ODD  relevant  to the virtual  assessment  of the ADS.   
(b) The output  data shall  allow  consistency/sanity  check  of the virtual  models  
via possibly  exploiting  redundant  information  
3.2.6.4.  Managing  stochastic  models  
(a) Stochastic  models  shall  be characterized  in terms  of their variance  
(b) Stochastic  models  shall  be ensured  the possibility  of deterministic  re-
execution  
3.3. M&S  analysis  and description  
3.3.1.  The M&S  analysis  and description  aim to define  the whole  M&S  and identify  the 
parameter  space  that can be assessed  via virtual  testing.  It defines  the scope  and 
limitations  of the models  and toolchain  and the uncertainty  sources  that can affect  
its results.  
3.3.2.  General description  
3.3.2.1.  manufa cturer  shall  provide  a description  of the complete  toolchain  along  with how 
the simulation  data will be used to support  the ADS  validation  strategy  EN 57  EN 3.3.2.2.  The manufacturer  shall  provide  a clear description  of the test objective  
3.3.3.  Assumptions,  known  limitations  and uncertainty  sources  
3.3.3.1.  The manufacturer  shall  motivate  the modelling  assumptions  which  guided  the 
design  of the M&S  toolchain  
3.3.3.2.  The manufacturer  shall  provide  evidence  on: 
(i) How  the manufacturer -defined  assumptions  play a role in defining  the 
limitations  of the toolchain;  
(ii) The level  of fidelity  required  for the simulation  models  
3.3.3.3.  The manufacturer  shall  provide  justification  that the tolerance  for sim-real 
correlation  is acceptable  for the test objective  
3.3.3.4.  Finally,  this section  shall  include  information  about  the source s of uncertainty  in 
the model.  This will represent  an important  input  to final uncertainty  analysis,  
which  will define  how the model  outputs  can be affected  by the different  sources  of 
uncertainty  of the model  used.  
3.3.4.  Scope  (how  the M&S  is used in the ADS  validation)  
3.3.4.1.  The credibility  of virtual  tool shall  be enforced  by a clearly  defined  scope  of 
utilization  the developed  models.  
3.3.4.2.  The matured  M&S  shall  allow  a virtualization  of the physical  phenomena  to a 
degree  of accuracy  which  matches  the fidelity  level  required  for certification.  Thus,  
the M&S  will act as a “virtual  proving  ground”  for ADS  testing.  
3.3.4.3.  Simula tion models  need  dedicated  scenarios  and metrics  for validation.  The 
scenario  selection  used for validation  shall  be sufficient  such that there  is 
confidence  that the toolchain  will perform  in the same  manner  in those  scenarios  
outside  of the validation  scope. 
3.3.4.4.  Manufacturers  shall  provide  a list of validation  scenarios  together  with the 
corresponding  parameters’  limitation.  
3.3.4.5.  ODD  analysis  is a crucial  input  to derive  requirements,  scope,  effects  that the M&S  
must  consider  in order  to support  ADS  validation.  
3.3.4.6.  Parame ters generated  for the scenarios  will define  extrinsic  and intrinsic  data for 
the toolchain  and the simulation  models.  
3.3.5.  Criticality  assessment  
3.3.5.1.  The simulation  models  and the simulation  tools  used in the overall  tool-chain  shall  
be investigated  in terms  of their responsibility  in case of a safety  error  in the final 
product.  The proposed  approach  for criticality  analysis  is derived  from  ISO 26262,  
which  requires  qualification  for some  of the tools  used in the development  process.  
3.3.5.2.  In order  to derive  how critical  the simulated  data is, the criticality  assessment  
considers  the following  parameters:  
(a) The consequences  on human  safety  e.g. severity  classes  in ISO 26262.  EN 58  EN (b) The degree  in whic h the simulated  results  influence’s  the ADS  
3.3.5. 3. From  the perspective  of the criticality  assessment,  the three  possible  cases  for 
assessment  are: 
(a) Those  models  or tools  that fall within  the red boxes  are clear  candidates  for 
fully  following  the credib ility assessment;  
(b) Those  models  or tools  that fall within  the yellow  boxes  may or may not be 
candidates  for fully  following  the credibility  assessment  at the discretion  of the 
type-approval  authority;  
(c) Those  models  or tools  that fall within  the green  boxes  are not required  to 
follow  the credibility  assessment.  
3.4. Verification  
3.4.1.  The verification  of an M&S  deals  with the analysis  of the correct  implementation  
of the conceptual/mathematical  models  building  up the M&S  toolchain.  The 
verification  contri butes  to the M&S’s  credibility  via providing  assurance  that the 
M&S  will not exhibit  unrealistic  behaviour  for a set of input  which  cannot  be 
tested.  The procedure  is grounded  on a multi -step approach  which  includes  code  
verification,  calculation  verification  and sensitivity  analysis.  
3.4.2.  Code verification  
3.4.2.1.  Code  verification  is concerned  with the execution  of test demonstrating  that no 
numerical/logical  flaws  affect  the virtual  models  
3.4.2.2.  The manufacturer  shall  document  the execution  of proper  code  verification  
techniques,  e.g. static/dynamic  code  verification,  convergence  analysis  and 
comparison  with exact  solutions  if applicable  
3.4.2.3.  The manufacturer  shall  provide  documentation  showing  that the exploration  in the 
domain  of the input  parameters  was sufficiently  wide  to identify  parameters’  
combination  for which  the M&S  shows  unstable  or unrealistic  behaviour . 
Coverage  metrics  of parameters  combinations  may be used to demonstrate  the 
required  exploration  of the models  behaviours.  
3.4.2.4.  The manufacturer  shall  adopt  sanity/consistency  checking  procedures  whenever  
data allows.  
3.4.3.  Calculation  verification  
3.4.3.1.  Calculation  verification  deals  with the estimation  of numerical  errors  affecting  the 
M&S  
3.4.3.2.  The manufacturer  shall  document  numerical  error  estimates  (e.g. discretization  
error,  rounding  error,  iterative  procedures  convergence);  
3.4.3.3.  The numerical  errors  shall  be kept sufficiently  bounded  to not affect  validation.  
3.4.4.  Sensitiv ity analysis  EN 59  EN 3.4.4.1.  Sensitivity  analysis  aims  at quantifying  how model  output  values  are affected  by 
changes  in the model  input  values  and thus pointing  out the parameters  having  the 
greatest  impact  on the simulation  model  results.  The sensitivity  study  also affords  
determining  the extent  to which  the simulation  model  satisfies  the validation  
thresholds  when  it is subjected  to small  variations  of the parameters,  thus it plays  a 
fundamental  role to support  the credibility  of the simulation  results.  
3.4.4.2.  The manufacturer  shall  provide  supporting  documentation  demonstrating  that the 
most  critical  parameters  influencing  the simulation  output  have  been  identified  by 
means  of sensitivity  analysis  techniques  such as by applying  a perturbation  of the 
model’s  parameters;  
3.4.4 .3. The manufacturer  shall  demonstrate  that robust  calibration  procedures  have  been  
adopted  while  identifying  and calibrating  the most  critical  parameters  to the end of 
increasing  the credibility  of the developed  toolchain.  
3.4.4.4.  Ultimately,  the sensitivity  analysis  results  will also help defining  the inputs  and 
parameters  whose  uncertainty  characterization  needs  particular  attention  in order  to 
properly  define  the uncertainty  of the simulation  results.  
3.4.5.  Validation  
3.4.5.1.  The quantitative  process  of determining  the degree  to which  a model  or a 
simulation  is an accurate  representation  of the real world  from  the perspective  of 
the intended  uses of the M&S.  It requires  the selection  and definition  of several  
elements.  
3.4.5.2.  Measures  of Performance  (metrics)  
3.4.5.2.1.  The Measures  of Performance  are the metrics  used to compare  the simulation  
model  with the real world.  Measures  of Performance  are defined  during  the M&S  
analysis.  
3.4.5.2.2.  Metrics  for validation  may include:  
(i) Discrete  value  analysis  e.g. detection  rate, firing  rate;  
(ii) Time  evolution  e.g. positions,  speeds,  acceleration;   
(iii) Flow  of actions  based  analysis  e.g. distance/speed  calculations,  TTC  
calculation,  brake  initiation.  
3.4.5.3.  Goodness  of Fit measures  
3.4.5.3.1.  The analytical  frameworks  used to compare  real world  and simulation  metrics.  
They  are generally  Key Performance  Indicators  (KPIs)  indicating  the statisti cal 
comparability  between  two sets of data.   
3.4.5.3.2.  The validation  shall  show  that these  KPIs  are met. 
3.4.5.4.  Valida tion methodology  
3.4.5.4.1.  The manufacturer  shall  define  the logical  scenarios  used for virtual  testing  
toolchain  validation.  They  shall  be able to cover  to the maximum  possible  extent  
the ODD  of virtual  testing  for ADS  validation  EN 60  EN 3.4.5.4.2.  The exact  methodology  depends  on the structure  and purpose  of the toolchain.  The 
validation  may consist  of one or more  of the following:  
(i) Validate  Subsystem  models  e.g. environment  model  (road  network,  weather  
conditions,  road user interaction),  sensor  models  (Radio  Detection  And Ranging  
(RADAR),  Light  Detection  And Ranging  (LiDARs),  Camera),  vehicle  model 
(steering,  braking,  powertrain);  
(ii) Validate  vehicle  system  (vehicle  dynamics  model  togeth er with the 
environment  model);  
(iii) Validate  sensor  system  (sensor  model  together  with the environment  
model);  
(iv) Validate  integrated  system  (sensor  model  + environment  model  with 
influences  form  vehicle  model).  
3.4.5.5.  Accura cy requirement  
3.4.5.5.1.  Requirement  for the correlation  threshold  is defined  during  the M&S  analysis.  The 
validation  shall  show  that these  KPIs  are met. e.g. using  the correlation  
methodologi es as defined  in Annex  2. 
3.4.5.6.  Validation  scope  (what  part of the toolchain  to be validated)  
3.4.5.6.1.  A toolchain  consists  of multiple  tools,  and each tool will use a number  of models.  
The validation  scope  includes  all tools  and the relevant  models  subject  to 
validation.  
3.4.5.7.  Internal  validat ion results  
3.4.5.7.1.  The documentation  shall  not only provide  evidence  of the simulation  model  
validation  but also used to obtain  sufficient  information  related  to the processes  
and products  that provide  overall  credibility  of the toolchain  used.  
3.4.5.7.2.  Documentation/results  may be carried  over from  previous  credibility  assessments.  
3.4.5.8.  Independent  Validation  of Results  
3.4.5.8.1.  The type-approval  authority  shall  assessment  the documentation  provided  by the 
manufacturer  and may carry  out physical  tests of the complete  integrated  tool 
3.4.5.9.  Uncertainty  characterisation  
3.4.5.9.1.  This section  is concerned  with characterizing  the expected  variability  of the virtual  
toolchain  results.  The assessment  shall  be made  up of two phases.  In a first phase  
the information  collected  in the M&S  Analysis  and Description  and the Data/Input  
Pedigree  sections  are used to charac terise  the uncertainty  in the input  data,  in the 
model  parameters  and in the modelling  structure.  Then,  by propagating  all the 
uncertainties  through  the virtual  toolchain,  the uncertainty  in the model  results  is 
quantified.  Depending  on the uncertainty  in the model  results,  proper  safety  
margins  will need  to be introduced  by the manufacturer  in the use of virtual  testing  
for ADS  validation.  EN 61  EN 3.4.5.9.2.  Characterization  of the uncertainty  in the input  data 
The manufacturer  shall  demonstrate  to have  opportunely  estimated  critical  model’s  
inputs  by means  of robust  techniques  such as providing  multiple  repetitions  for the 
assessment  of the quantity;  
3.4.5.9.3.  Characterization  of the uncerta inty in the model  parameters  (following  calibration)  
The manufacturer  shall  demonstrate  that critical model’s  parameters  that cannot  be 
estimated  identically  are characterized  by means  of a distribution  and/or  
confidence  intervals;  
3.4.5.9.4.  Char acterization  of the uncertainty  in the M&S  structure  
The manufacturer  shall  provide  evidence  that the modelling  assumptions  are given  
a quantitative  characterization  of the generated  uncertainty  (e.g. comparing  the 
output  of different  modelling  approaches  whenever  possible);  
3.4.5.9.5.  Characterization  of aleatory  vs. epistemic  uncertainty:  
The manufacturer  shall  aim to distinguish  between  the aleatory  component  of the 
uncertainty  (which  can only be estimated  but not reduced)  and the epistemic  
uncertainty  deriving  from  the lack of knowledge  in the virtualization  of the process  
(that can instead  be reduced).  
4. Documentatio n structure  
4.1. This section  defines  how the aforementioned  information  will be collected  and 
organized  in the documentation  provided  by the manufacturer  to the relevant  
authority.  
4.2. The manufacturer  shall  produce  a document  (a “simulation  handbook”)  structured  
after the present  outline  providing  evidence  for the topics  presented;  
4.3. The documentation  shall  be delivered  together  with the corresponding  release  of 
the M&S  and related  produced  data;  
4.4. The manufacturer  shall  provid e clear  reference  that allows  tracing  the 
documentation  to the corresponding  M&S/data;  
4.5. The docume ntation  shall  be maintained  throughout  the whole  lifecycle  of the M&S  
utilization.  The type-approval  authority  may assess  the manufacturer  through  
assessment  of their documentation  and/or  by conducting  physical  tests.  
  EN 62  EN PART 5: IN-SERVICE REPORTI NG  
1. Definitions  
 For the purpose of this annex,  
1.1. ‘Occurrence’ refers to safety -related situation involving a vehicle equipped with an 
automated driving system.  
1.2. “Non -critical Occurrence” means an occurrence involving an operational 
interruption, defect, fault or other circumstance that has or may ha ve influenced 
ADS safety and that has not resulted in an accident or serious incident. This 
category includes for example minor incidents, safety degradation not preventing 
normal operation, emergency/complex manoeuvres to prevent a collision, and 
more gen erally all occurrences relevant to the safety performance of the ADS on -
road (like interaction with remote operator, etc.).  
1.3. "Critical Occurrence" means each occurrence in which the ADS is engaged at the 
time of a collision event and because of which:  
(a) at least one person suffers an i njury that requires medical assistance as a result 
of being in the vehicle or being involved in the event;  
(b) the fully automated vehicle, other vehicles or stationary objects sustain a 
physical damage that exceeds a certain threshold or any vehicle invol ved in the 
event experiences an airbag deployment.  
2. Notification s and r eporting by the manufacturer  
2.1. The manufacturer immediately  notify  critical occurrences to the type -approval 
authorities, market surveillance authorities and the Commission.   
2.2. The manufacturer shall report within one month any short -term occurrences, as 
described in Appendix 1, which need s to be remedied by the manufacturer to the 
type-approval authorities, market surveillance authorities and the Commission.  
2.3. The manufacturer shall report  every year to the type -approval authority that 
granted the approval  on the  occurrences listed in Appendix I. The report shall 
provide evidence of the ADS performance on safety relevant occurrences in the 
field. In particular, it shall demonstrate that:  
(a) no inconsistencies are detected compared to the ADS safety performance 
assessed prior to market introduction;  
(b) the ADS respects the performance requirements set by this Regulation;  
(c) any newly discovered significant ADS safety performance issues have been 
adequately addressed and how . 
The granting type -approval authority shall share this information with type-
approval authorities, market surveillance authorities and the Commission.  EN 63  EN 2.4. Type -approval authorities, market surveillance authorities and the Commission 
may request the manufacturer su pporting data used to elaborate the information 
provided into the in-service  reporting and notifications . These data shall be 
exchanged by means of an agreed data exchange file.  
2.5. Any pre -processing of data should be notified to the granting type -approval 
authority in the in-service Data Report.  
  EN 64  EN Appendix  1 to Part 5 
List of occurrences for in -service reporting  
The occurrences have been subdivided in to four categories, based on their relevance to the 
DDT, to the interaction with fully automated vehicle users, and to ADS technical conditions. 
For each occurrence, its relevance to the short -term and/or periodic reporting has been flagged 
in the table be low. 
Periodic reporting of occurrences is expected to be submitted in the form of aggregated data 
(per hour of operation or driven km) for ADS -vehicle type and related to ADS operation (i.e. 
when ADS is activated).  
OCCURRENCE  SHORT -TERM  
REPORTING  
(1 month  PERIODIC 
REPORTING  
(1 year)  
1. Occurrences related to the ADS performance of the DDT, such as  
1.a. Safety critical occurrences known to the 
ADS manufacturer or OEM  X X 
1.b. Occurrences related to ADS operation 
outside its ODD  X X 
1.c. Occurrences related to ADS failure to 
achieve a minimal risk condition when necessary  X X 
1.d. Communication -related occurrences  (where 
connectivity is relevant to the ADS safety 
concept)   X 
1.e. Cybersecurity -related occurrences   X 
1.f. Interaction with remote operator (if 
applicable ) related to major ADS or vehicle 
failures     X 
2. Occurrences related to ADS interaction with fully automated vehicle  users, such as:  
2.a. User -related occurrences  (e.g. user errors, 
misuse, misuse prevention)   X 
3. Occurrences related to ADS technical conditions, including maintenance and repair:  
3.a. Occurrences related ADS failure  resulting in 
a request to intervene  to the operator or the 
remote intervention op erator   X 
3.b. Maintenance and repair problems   X 
3.c. Occurrences related to unauthorized  X EN 65  EN modifications  (i.e. tampering)  
4. Occurrences related to the identification of 
new safety -relevant scenarios  X  
(if modifications 
made by 
manufacturer to 
address a newly 
identified and 
significant ADS 
safety issue 
involving an 
unreasonable risk, 
including 
description of any 
previously 
unanticipated 
scenarios.)  X 
 
 EN 66  EN ANNEX  4 
EU TYPE -APPROVAL CERTIFICATE (VEHICLE SYSTEM)  
 
Communication  concerning  granting  / extension  / refusal  / withdrawal  (1) of type-approval  of 
a type of vehicle  with regard  to its automated  driving  system  (ADS)  in accordance with the 
requirements  laid down  in Commission  Implementing  Regulati on (EU)  …/…(2) [PO: this 
Regulation] , as last amended  by Regulation  (EU)  No …/…  
Number  of the EU type-approval  certificate:   
Reason  for extension  / refusal  / withdrawal  (1):  
 
SECTION I  
0.1. Make (trade name of manufacturer):  
0.2. Type:  
0.2.1.  Commercial name(s) (if available):  
0.3. Means of identification of type, if marked on the vehicle:  
0.3.1.  Location of that marking:  
0.4. Category of vehicle:  
0.5. Name and address of manufacturer:  
0.8. Name(s) and address(es) of assembly plant(s):  
0.9. Name and address of the manufacturer's representative (if any):  
 
SECTION II  
1. Additional information (where applicable): see Addendum.  
2. Technical service responsible for carrying out the tests:  
3. Date of test report:  
4. Number of test report:  
5. Remarks (if any): see Addendum.  
6. Place:  
7. Date:  
8. Signature:  
___________________  
(1) Delete where not applicable.  EN 67  EN (2) [PO:  insert  full title and OJ reference.]  
 
Addendum  
to EU type -approval certificate number  
6. Description and/or drawing of the ADS including:  
6.1. ODD, system boundaries and s pecified maximum speed of the ADS declared by the 
manufacturer:  
6.2. Description of the main functions of the ADS  
6.2.1.  Vehicle -internal functions  
6.2.2  Vehicle -external functions (e.g. backend, off -board infrastructure needed, operational 
measures needed)  
6.3  Sensing system (incl. components):  
6.4. Installation  of the ADS sensing system:  
6.5. Software Identification of the ADS:  
7. Written description and/or drawing of the ADS human supervision  
7.1. Remote operator and remote intervention on the ADS  
7.2. Means to activate, deactivate of the ADS  
7.3. Monitoring in the inside of the vehicle  
7.4. Any system limitations due to environmental or road conditions  
8.  Written description and/or drawing of the information given to vehicle occupan ts and 
other road users  
8.1. System status:  
8.2. Request to the on -board operator/remote intervention operator:  
8.3. Minimum Risk Manoeuvre:   
8.4. Emergency Manoeuvre:  
9. ADS data elements  
9.1. ADS data elements verified after the tests performed in accordance with Annex 3 part 3:  
9.2. Documentation concerning data retrievability, data integrity self -check and p rotection 
against manipulation of stored data verified: yes/no  
10. Cyber Security  and Software updates  
10.1.  Cyber Security Type Approval Number:  EN 68  EN 10.2.  Software Update Type approval number:  
11. Assessment  on functional and operational safety aspects of the automated driving system  
11.1.  Manufacturers document reference for the assessment  (including version number):  
11.2.  Information document  
12. Technical Service responsible for conducting approval tests  
12.2.  Date of the test report issued by that service  
12.3 (Reference) Number of the report issued by that service  
12. Annexes  
 Addendum  1: Information  document  for automated  driving  systems  (refer  to Annex  I- to 
Regulation  XX).”  
Addendum  2:  Member  States  and specific  areas  where  the vehicle  manufacturer  has 
declared  that the ADS  had been  assessed  to comply  with local  traffic  rules.” 
List of documents  in the approval  file deposited  at the administration  services  having 
delivered  the approval  and which  can be obtained  upon  request.  
Addendum  3: ADS  Asse ssment  report/test  results  by the granting  type Approval  
Authority.  
Addemdum  4 : Certificate of Compliance for SMS  EN 69  EN