本文节选分享由Aptiv，Audi，Baidu，BMW，Continental，Fiat Chrysler Automobiles，HERE，Infineon，Intel，Volkswagen和Daimler2019年7月联合发布的《Safety First for Automated Driving》 白皮书。

该白皮书基于以下12个原则，介绍了开发和验证自动驾驶系统的基本步骤和参考指南。

• Safe Operation: How the system reacts if critical components become unstable or cease functioning

• Safety Layer: The system recognizing its limits and minimizes risk in returning control to the driver

• Operational Design Domain (ODD): The operating conditions in which the system is designed to function

• Behavior in Traffic: The system behavior needs to be easy to understand and predictable for surrounding road users

• User Responsibility: The user’s state must be suitable for a takeover procedure

• Vehicle-Initiated Handover: If the driver does not comply with a takeover request, the automated driving system must perform a maneuver to minimize risk

• Driver-Initiated Handover: Activating and deactivating the automated driving system shall require an explicit driver’s intent

• Effects of Automation: Overall evaluation of system safety shall take automation effects on the driver into account

• Safety Assessment: Verification and validation shall be used to ensure that the safety goals are met

• Data Recording: When an event or incident is recognized, automated vehicles shall record relevant data in a manner that complies with applicable privacy laws

• Security: Steps shall be taken to protect the automated driving system from security threats

• Passive Safety: Vehicle layout shall accommodate changes to crash scenarios brought about by vehicle automation

本文节选自该报告的2.1章节。该章节介绍了自动驾驶的需求背景，以及保证自动驾驶安全性的性能（capabilities）要求，包括：

• FS_1 Determine location

• FS_2 Perceive relevant objects

• FS_3 Predict the future behavior of relevant objects

• FS_4 Create a collision-free and lawful driving plan

• FS_5 Correctly execute the driving plan

• FS_6 Communicate and interact with other (vulnerable) road users

• FS_7 Determine if specifi ed nominal performance is not achieved

• FD_1 Ensure controllability for the vehicle operator

• FD_2 Detect when degraded performance is not available

• FD_3 Ensure safe mode transitions and awareness

• FD_4 React to insuffi cient nominal performance and other failures

• FD_5 Reduce system performance in the presence of failures

• FD_6 Perform degraded mode within reduced system constraints

以下为引用，共计20页。