Architectural Safety Perspectives & Considerations Regarding the AIbased AV Domain Controller Providing safety assurance for Automated Vehicle (AV) domain controllers which also complies with the growing list of functional safety standards is a challenging task. Compliance with these norms requires several steps during the safety lifecycle. A system definition is followed by the allocation of functional objectives to architectural elements. The safety analysis then includes the identification of safety goals and respective Automotive Safety Integrity Level (ASIL  injury risk) assessments as required by the desired automation level. Finally, safety mechanisms are included to provide necessary fault coverage and ensure that safe modes and states are reached in the presence of system faults. The focus of this paper is to provide a methodical definition process of a hypothetical AV domain controller architecture. Our proposed process includes an assortment of typical functional objectives and attributes consistent with the Operational Design Domain (ODD) at automation levels 3, 4 and 5. The intent of this paper will be to ensure that the safety goals and requirements are completely and correctly stated at the start of the development process and then propagated accurately to the final design and implementation without omission.

Towards ResponsibilitySensitive Safety of Automated Vehicles with Reachable Set Analysis One of the most critical, unsolved challenges for the introduction of automated vehicles is safety verification of planned trajectories. The most promising concepts approaching this topic are worstcase occupancy predictions based on reachable set analysis and the definition of ResponsibilitySensitive Safety (RSS) that formalizes dangerous situations and proper responses. Worstcase predictions result in overconservative behavior while the RSS approach makes strong assumptions w.r.t. lateral and longitudinal behavior. Our contribution is a first step in bringing both worlds together, to benefit from respective advantages. First, we define RSSmotivated safestates for merge and crossing scenarios, that ensure absolute safety towards leading vehicles, appropriate time gaps towards following vehicles in merging lanes and minimum clearance time of conflict zones with crossing lanes. We then show how to integrate these safety constraints in a trajectory and behavior planner using reachable sets and finally illustrate its usefulness in various simulative evaluations.