The safety of a highly automated driving system depends firstly on the specified system behavior including the behavior on functional system boundaries and secondly on the handling of system errors in the sense of deviations of the specification. The proposed safety evaluation considers these two aspects. A specification space is introduced to enable a clear definition and derivation of possible functional system boundaries based on traffic scenarios. A two-staged surveillance concept is presented to handle uncertainties in boundary detection. The method is illustrated by an exemplary derivation of functional system boundaries.     «

The safety of a highly automated driving system depends firstly on the specified system behavior including the behavior on functional system boundaries and secondly on the handling of system errors in the sense of deviations of the specification. The proposed safety evaluation considers these two aspects. A specification space is introduced to enable a clear definition and derivation of possible functional system boundaries based on traffic scenarios. A two-staged surveillance concept is pres...     »