ISO/TR TECHNICAL REPORT 4804 First edition 2020-12 Road vehicles Safety and cybersecurity for automated driving systems - Design, verification and validation Vehicules routiers-Securité et cybersécurite pour les systemes de conduiteautomatiséeConception,vérification etvalidation Referencenumber IS0/TR4804:2020(E) [So @ISO 2020 Copyright Intemational Organization for Standardization IS0/TR4804:2020(E) COPYRIGHTPROTECTEDDOCUMENT @IS02020 All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting below or Iso's memberbody in the country ofthe requester. ISO copyright office CP 40i:Ch.de Blandonnet 8 CH-1214 Vernier, Geneva Phone: +41 22 749 0111 Email: [email protected] Website: www.iso.org Published in Switzerland Copyrigh ilhlmafinal Organization fce Standardzation IS0 2020-All rights reserved IS0/TR4804:2020(E) Contents Page Foreword ..V Introduction. ..i. 1 Scope. 2 Normative references 3 Terms and definitions 4 General approach and overview ..11 4.1 ..11 Introductionandmotivation 4.2 Overview ofthis document. ..11 4.3 Structure anddevelopmentexamples used inthis document ..12 4.4 ..13 Safetyvision 4.4.1 Background. .13 4.4.2 Positive risk balance and avoidance of unreasonable risk ..14 4.4.3 Principles of safetyand cybersecurityfor automated driving .14 Systematicallydevelopingdependabilitytosupportsafetybydesign ..17 5 5.1 General ..17 5.2 Deriving capabilities of automated driving from dependability domains ..18 5.2.1 Applying the related safety standards ..18 5.2.2 ISO/PAS21448-Safetyof the intendedfunctionality .19 5.2.3 IS026262 series-Functional safety .19 5.2.4 IS0/SAE21434-Automotivecybersecurity 20 5.2.5 Capabilities of automated driving 21 5.2.6 Minimal risk conditions and minimal risk manoeuvres. .25 5.3 Elementsfor implementingthecapabilities .27 5.3.1 Implementingthecapabilities .27 5.3.2 Elements ..33 5.3.3 Generic logical architecture ..45 6 Verification and validation ..48 .48 6.1 General 6.2 The scope and main steps ofverification and validationfor automated driving systems..49 6.3 Keychallengesforverification andvalidation ofSAEL3and SAEL4automated driving systems. .50 6.3.1 Challenge1:Statisticaldemonstration of avoidanceofunreasonablerisk and a positive risk balance without driver interaction. .51 6.3.2 Challenge 2: System safety with driver interaction (especially in takeover manoeuvres) .51 6.3.3 Challenge3:Consideration of scenarios currently notknown. .51 6.3.4 Challenge 4: Validation of various system configurations and variants 51 6.3.5 Challenge 5: Validation of (sub)systems that are based on machine learning. .51 6.4 Verification and validation approachfor automated driving systems. .51 Definingtest goals and objectives (why and how well) .52 6.4.1 6.4.2 Test design techniques (how). .52 6.4.3 Testplatforms (where) 53 6.4.4 Test strategies in response to the key challenges. 53 6.5 Quantity and quality of testing. .57 6.5.1 Equivalence classes and scenario-based testing .58 6.6 Simulation .58 6.6.1 Types of simulation. .60 6.6.2 Simulation scenario generation. 61 6.6.3 Validating simulation .61 6.6.4 Further applications of simulation. 62 6.7 Verification and validation of elements.. .62 6.7.1 A-prioriinformationandperception (map) .63 iii Copyrigh Intemational ogS22rAlh rights reserved