ISO/TS 5083:2025

Technical
Specification
ISO/TS 5083
First edition
Road vehicles — Safety for
2025-04
automated driving systems —
Design, verification and validation
Véhicules routiers — Sécurité des systèmes de conduite
automatisée — Conception, vérification et validation
Reference number
All rights reserved.
ISO publications, in their entirety or in fragments, are owned by ISO. They are licensed, not sold, and are subject to the terms and
conditions set forth in the ISO End Customer License Agreement, the License Agreement of the relevant ISO member body, or
those of authorized third-party distributors.
Unless otherwise specified or required for its implementation, no part of this ISO publication may be reproduced, distributed,
modified, or used in any form or by any means, electronic or mechanical, including photocopying, scanning, recording, or posting
on any intranet, internet, or other digital platforms, without the prior written permission of ISO, the relevant ISO member body
or an authorized third-party distributor.
This publication shall not be disclosed to third parties, and its use is strictly limited to the license type and purpose specified in
the applicable license grant. Unauthorized reproduction, distribution, or use beyond the granted license is prohibited and may
result in legal action.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .vi
Introduction .ix
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 7
5 Document overview and motivation . 7
5.1 Purpose .7
5.2 Overall goals of this document .7
5.3 Application of this document .7
5.4 Safety life cycle .8
5.4.1 Purpose .8
5.4.2 General .8
5.5 Description of ADS safety case .8
5.5.1 Purpose .8
5.5.2 General .8
5.5.3 How this document supports a layered structure of an ADS safety case .9
5.5.4 Perspective from the ADS-equipped vehicle .11
5.6 Role of the ADS within safe vehicle operation . 12
5.6.1 Purpose . 12
5.6.2 General . 12
5.6.3 Task dependency of ADS safety . 12
5.6.4 Time dependency of ADS safety. 13
5.6.5 Examples .14
5.7 Application of other standards . 15
5.7.1 Purpose . 15
5.7.2 Classification of standards . 15
5.7.3 Applying the related (safety) standards .16
5.8 Safety principles of ADS .17
5.8.1 Purpose .17
5.8.2 ADS safety principles.17
6 Safety strategy.18
6.1 Defining the ADS feature .18
6.1.1 Objectives .18
6.1.2 Requirements and recommendations .18
6.1.3 Example solution: ADS feature description with capabilities .19
6.2 Defining the risk acceptance criteria . 20
6.2.1 Objectives . 20
6.2.2 Requirements and recommendations . 20
6.2.3 Example solution: Absence of unreasonable risk and risk acceptance criteria .21
6.2.4 Example solution: Selection and use of risk acceptance criteria .21
6.2.5 Example solution: Defining a risk acceptance criterion .21
6.2.6 Example solution: Quantitative risk balance .21
6.2.7 Example solution: A quantitative risk acceptance criterion .21
6.3 Defining safety requirements .21
6.3.1 Objectives .21
6.3.2 Requirements and recommendations .21
6.3.3 Example solution: Quantitative risk acceptance criterion and incident
classification approach . 22
6.3.4 Example solution: Safety capabilities . 22
6.3.5 Example solution: ADS external assumptions with respect to injury risk . 22
7 Safety by design .22

iii
7.1 ADS design . 22
7.1.1 Objectives . 22
7.1.2 Requirements and recommendations . 22
7.1.3 Example solution: A design for adapting tactical decisions to variations in the
operational capabilities . 23
7.1.4 Example solution: Elements defining the design . 23
7.2 ADS external design, prerequisites and assumptions . 23
7.2.1 Objectives . 23
7.2.2 General . 23
7.2.3 Requirements and recommendations . 30
7.2.4 Example solution: Training for users . 30
7.2.5 Example solution: Instructions to first responders .31
7.2.6 Example solution: Organizational aspects of a robo taxi service .31
7.2.7 Example solution: Organizational aspects of an L4 hub-to-hub transport service .31
7.3 ADS verification .31
7.3.1 Objectives .31
7.3.2 General .31
7.3.3 Requirements and recommendations .31
7.3.4 Example solution: Verification of elements .32
7.3.5 Example solution: The layered approach facilitating verification of safety
arguments .32
7.4 Verification and confirmation of aspects external to the ADS .32
7.4.1 Objectives .32
7.4.2 General .32
7.4.3 Requirements and recommendations .32
8 Validation . .33
8.1 Objectives . 33
8.2 General . 33
8.3 Requirements and recommendations . 33
8.4 Example solution: Metrics . 33
8.5 Example solution: Validation through computation of collision rates. 34
8.6 Example solution: Generating evidence for injury risk assumptions external to the ADS . 34
9 Operation of the ADS-equipped vehicle .34
9.1 Objectives . 34
9.2 General . 34
9.2.1 Overview . 34
9.2.2 Field monitoring including data collection . 35
9.2.3 Cybersecurity monitoring related to safety of ADSs . 35
9.2.4 Change management during the operational phase . 35
9.2.5 Inspection, maintenance and repair .37
9.2.6 Management of crashes and incidents .37
9.3 Requirements and recommendations .37
10 Verification and validation requirement considerations .38
10.1 General . 38
10.2 Example solution: Verification and validation . 38
Annex A (informative) Example application of the concepts of this document .39
Annex B (informative) Safety for artificial intelligence (AI) – Application to automated driving
systems .48
Annex C (informative) List of related standards .65
Annex D (informative) Safety principles for ADS .69
Annex E (informative) Safety strategy example solutions .73
Annex F (informative) Safety by design and verification example solutions .98
Annex G (informative) Validation example solutions .129

iv
Annex H (informative) Verification and validation example solutions .136
Bibliography .152

v
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee
has been established has the right to be represented on that committee. International organizations,
governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely
with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of ISO document should be noted. This document was drafted in accordance with the editorial rules of the
ISO/IEC Directives, Part 2 (see www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a)
patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent
rights in respect thereof. As of the date of publication of this document, had not received notice of (a)
patent(s) which may be required to implement this document. However, implementers are cautioned that
this may not represent the latest information, which may be obtained from the patent database available at
www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 22, Road vehicles, Subcommittee SC 32,
Electrical and electronic components and general system aspects.
This first edition cancels and replaces the first edition (ISO/TR 4804:2020), which has been technically
revised.
The main changes are as follows:
— a fully revised scope;
— the inclusion of objectives and requirements for normative clauses of the document;
— a revised presentation of the overarching safety strategy applicable to ADS development (including the
addition of clarifications on assumptions and requirements that are to be allocated externally to the ADS);
— connections to cybersecurity concerns; and
— a revision of annexes with example applications and further considerations of artificial intelligence safety.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.
Licensing and use terms
The ISO publications, as well as any updates and/or corrections, and any intellectual property or other rights
pertaining thereto, are owned by ISO. ISO publications are licensed, not sold. Nothing in this document shall
operate to assign or transfer any intellectual property rights from ISO to the user. The ISO publications are
protected by copyright law, database law, trademark law, unfair competition law, trade secrecy law, or any
other applicable law, as the case may be. Users acknowledge and agree to respect ISO’s intellectual property
rights in the ISO publications.
The use of ISO publications is subject to the terms and conditions of the applicable licensing agreement.

vi
ISO publications are provided under different licensing agreement types (“License Type”) allowing a non-
exclusive, non-transferable, limited, revocable right to use/access the ISO publications for one or more of the
following purposes described below (“Purpose”), which may be internal or external in scope. The applicable
Purpose(s) must be captured in the licensing agreement.
a) License Type:
i. a single registered end-user license (watermarked in the user’s name) for the specified Purpose.
Under this license the user cannot share the ISO Publication with anyone, including on a network;
ii. a network license for the specified Purpose. The network license may be assigned to either unnamed
concurrent end-users or named concurrent end-users within the same organization.
b) Purpose:
i. Internal Purpose: internal use only within user’s organization, including but not limited to own
implementation (“Internal Purpose”).
The scope of permitted internal use is specified at the time of purchase or through subsequent
agreement with ISO, the ISO member body in the user’s country, any other ISO member body or an
authorized third-party distributor, including any applicable internal reproduction rights (such as
internal meetings, internal training programs, preparation of certification services, integration or
illustration in internal manuals, internal training materials, and internal guidance documents). Each
internal use must be explicitly specified in the purchase order, and specific fees and requirements will
apply to each permitted use.
ii. External Purpose: external use, including but not limited to:
— testing services
— inspection services
— certification services
— auditing services
— consulting services
— training services
— software development and other digital platform or software-enabled digital services; and
any other services or activities conducted by the user or users’ organization to third parties, whether
for commercial or non-commercial purposes (“External Purpose”).
The scope of permitted external use is specified at the time of purchase or through subsequent agreement
with ISO, the ISO member body in user’s country, any other ISO member body or an authorized third-
party distributor, including any applicable external reproduction rights (e.g. in publications, products, or
services marketed and sold by user/user’s organization). Each external use must be explicitly specified
in the purchase order, and specific fees and requirements will apply to each permitted use.
Unless users have been granted reproduction rights according to the above provisions, they are not granted
the right to share or sub-license the ISO publications in- or outside their organization for either Purpose. If
users wish to obtain additional reproduction rights for ISO publications or their content, users may contact
ISO or the ISO member body in their country to explore their options.
In case the user or the user’s organization is granted a license for the External Purpose of providing any of
the following services to third parties:
— testing services
— inspection services
— certification services
vii
— auditing services
— consulting services
the user or user’s organization agrees to verify that the third party receiving such services has obtained
a license for its own implementation of the ISO Standard being used from the ISO member body in their
country, any other ISO member body, ISO or an authorized third-party distributor. This verification
obligation shall be included in the applicable license agreement obtained by the user or user’s organization.
The ISO publications shall not be disclosed to third parties, and Users shall use them solely for the purpose
specified in the purchase order and/or applicable licensing agreement. Unauthorized disclosure or use of
ISO publications beyond the licensed purpose is prohibited and may result in legal action.
Use restrictions
Except as provided for in the applicable License Agreement and subject to a separate license by ISO, the ISO
member body in user’s country, any other ISO member body or an authorized third-party distributor, users
are not granted the right to:
— use the ISO Publications for any purpose other than the Purpose;
— grant use or access rights to the ISO Publications beyond the License Type;
— disclose the ISO Publications beyond the intended Purpose and/or License Type;
— sell, lend, lease, reproduce, distribute, import/export or otherwise commercially exploit ISO Publication(s).
In the case of joint standards (such as ISO/IEC standards), this clause shall apply to the respective joint
copyright ownership;
— assign or otherwise transfer ownership of the ISO Publications, in whole or in fragments, to any third party.
Regardless of the License Type or Purpose for which users are granted access and use rights for ISO
publications, users are not permitted to access or use any ISO publications, in whole or in fragments, for
any machine learning and/or artificial intelligence and/or similar purposes, including but not limited to
accessing or using them (i) as training data for large language or similar models, or (ii) for prompting or
otherwise enabling artificial intelligence or similar tools to generate responses. Such use is only permitted
if expressly authorized through a specific license agreement by the ISO member body in the requester’s
country, another ISO member body, or ISO. Requests for such authorization may be considered on a case-
by-case basis to ensure compliance with intellectual property rights. For the avoidance of doubt, you
cannot claim the benefit of copyright exception of Article 4 of the Directive (EU) 2019/790 of the European
Parliament and of the Council of 17 April 2019 on copyright and related rights in the Digital Single Market,
for the purpose of text and data mining on ISO Publications, as ISO hereby opts out of this exception.
If ISO, or the ISO member body in the user’s country, has reasonable doubt that users are not compliant with
these terms, it may request in writing to perform an audit, or have an audit performed by a third-party
auditor, during business hours at user’s premises or via remote access.

viii
Introduction
Automated driving is one of the key emerging technologies for road vehicles, where major goals in deploying
automated driving systems (ADS) include the societal benefits due to broader access to mobility and the
reduction of human driver related crashes. Successful deployment is contingent upon ensuring safety of the
ADS. This document presents guidance and requirements for achieving safety through the ADS development,
including design, verification and validation, as well as operation post deployment.
The successful design and deployment of the ADS can involve a variety of stakeholders, from technology,
component, and subsystem suppliers to system integrators and vehicle OEMs, as well as transportation
service providers and regulatory bodies; this document is intended to be used by all those involved.

ix
Technical Specification ISO/TS 5083:2025(en)
Road vehicles — Safety for automated driving systems —
Design, verification and validation
1 Scope
This document provides guidance for achieving and demonstrating safety of an automated driving system
(ADS) integrated in a road vehicle. The approach is based on safety principles derived from worldwide
applicable publications and top-level safety objectives. It considers safety by design, verification and
validation, and post deployment activities for level 3 and level 4 ADS features defined according to ISO/SAE
[2]
PAS 22736 . In addition, it outlines cybersecurity considerations.
The application of this document is intended for road vehicles, including trucks and buses and excluding
motorcycles and mopeds.
Any ADS or related elements that are in operation, or under development, prior to the publication of this
document are exempted from the application of this document.
NOTE While not covered in this document, safety during development activities is a key consideration.
Development includes activities of design, verification and validation.
2 Normative references
There are no normative references in this document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
3.1 Human-related terms
3.1.1
road user
traffic participant on, or adjacent to, an active roadway
Note 1 to entry: Persons operating an automated driving system (ADS) (3.2) remotely are considered as persons
adjacent to the road.
Note 2 to entry: Figure 1 provides an overview how terms are hierarchically defined, e.g. a driver (3.1.3) is a specific
user (3.1.2).
Figure 1 — Structure of human-related terms
[SOURCE: SAE J3216:2021, 4.13.1, modified — "for the purpose of travelling" has been deleted and the notes
to entry and Figure 1 were added.]
3.1.2
user
ADS user
road user (3.1.1) who has a role with regard to the subject automated driving system (ADS)- (3.2) equipped vehicle
Note 1 to entry: A user can either be a driver (3.1.3), or a passenger (3.1.4), or a fallback-ready user (3.1.5). These roles
do not overlap and may be performed in varying sequences during a given trip. An example can be found in A.6.
3.1.3
driver
user (3.1.2) who performs in real-time part or all of the DDT or the DDT fallback (3.11) to operate a
particular vehicle
EXAMPLE Person with a driving licence who operates the vehicle.
Note 1 to entry: Consistent with Reference [4] the term “operator” can be used instead of driver if the vehicle’s
operation requires special training and authorization.
[SOURCE: ISO/SAE PAS 22736:2021 3.31.1, modified — "To operate" has been added, Note was replaced by
,
Note1 to entry and the example was added.]
3.1.4
passenger
user (3.1.2) in a vehicle who has no role in the operation of that vehicle
EXAMPLE 1 The person seated in the driver’s seat of a vehicle equipped with a level 4 ADS feature (3.3) designed
to automate high-speed vehicle operation on access-controlled freeways is a passenger while this level 4 ADS feature
is engaged. This same person, however, is a driver (3.1.3) before engaging this level 4 ADS feature and again after
disengaging the feature in order to exit the controlled access freeway.
EXAMPLE 2 The users of an L4 automated driving system (ADS)- (3.2) equipped vehicle are passengers whenever
the L4 ADS feature is engaged.
[SOURCE: ISO/SAE PAS 22736:2021 3.31.2, modified — Examples 2 and 3 have been removed, a new example
,
2 has been added.]
3.1.5
fallback-ready user
user (3.1.2) of an engaged level 3 ADS feature (3.3) who is properly qualified and able to operate the vehicle
and is receptive to ADS-issued requests to intervene and to evident DDT performance-relevant system
failures (3.12) in the vehicle compelling him or her to perform the DDT fallback (3.11)
[SOURCE: ISO/SAE PAS 22736:2021 3.31.3, modified — 'of a vehicle equipped' has been deleted after "user"
,
and the notes have also been removed.]
3.1.6
other road user
road user (3.1.1) who has no role with regard to the subject automated driving system (ADS)- (3.2)
equipped vehicle
Note 1 to entry: The other road user can also be a user (3.1.2) of another ADS-equipped vehicle.
Note 2 to entry: Other road users can affect what the subject ADS-equipped vehicle will do, but the subject automated
driving system decides what to do.
3.2
automated driving system
ADS
hardware and software that are collectively capable of performing the entire dynamic driving task(DDT)
(3.10) on a sustained basis, regardless of whether or not it is limited to a specific operational design domain
(ODD) (3.20)
Note 1 to entry: An ADS can consist of on-board and/or off-board elements.
Note 2 to entry: This term is used specifically to describe an L3 or L4 driving automation system.
[SOURCE: ISO/SAE PAS 22736:2021 3.2, modified — Note has been deleted and replaced by Note 1 to entry,
,
Note 2 to entry was previously a modified portion of the definition.]
3.3
ADS feature
ADS (3.2)’s design-specific functionality at a given level of driving automation within a particular operational
design domain (ODD) (3.20), if applicable
EXAMPLE Highway pilot, automated valet parking.
Note 1 to entry: A given ADS can have multiple ADS features, each associated with a particular level of driving
automation and dynamic driving task(DDT) (3.10) specification.
3.4
ADS safety case
structured argument, supported by evidence, that provides a compelling, comprehensible and valid claim
that the automated driving system (ADS)- (3.2) equipped vehicle has been developed to achieve safety (3.24)
for a given ADS feature (3.3) in a given environment
Note 1 to entry: Including intentional and unintentional reasonably foreseeable (3.21) engagement or disengagement
sequences.
Note 2 to entry: Adapted from Reference [5], 13.2.1.
3.5
availability
capability to continue to provide a stated function under given conditions once the function is active
Note 1 to entry: In the context of this document, availability is defined solely referring to the automated driving system
(ADS) (3.2) aspects and does not include human factor aspects.
Note 2 to entry: Adapted from ISO 26262-1:2018, 3.7.

3.6
conflict
situation where the trajectory of one or more road users (3.1.1), other road user (3.1.6) or objects lead to an
incident (3.16)
3.7
crash
situation in which the subject automated driving system (ADS)- (3.2) equipped vehicle has any contact with
at least one other conflict partner either on or off the trafficway, either moving or stationary (fixed or non-
fixed), that is observable or in which kinetic energy is measurably transferred or dissipated
[SOURCE: ISO/TR 21974-1:2018, 3.4, modified — Added "ADS-equipped" and deleted notes to entry.]
3.8
cybersecurity
condition in which assets are sufficiently protected against threat scenarios to the automated driving system
(ADS) (3.2) of road vehicles, their functions and their electrical or electronic components
Note 1 to entry: This can include considerations of malicious modifications to the driving environment.
[SOURCE: ISO/SAE 21434:2021, 3.1.9, modified — "item" was replaced by "ADS" and the Note 1 to entry was
replaced.]
3.9
dual-mode vehicle
automated driving system (ADS)- (3.2) equipped vehicle designed to enable either driverless operation or
operation by an in-vehicle driver
[SOURCE: ISO/SAE PAS 22736:2021, 3.32.2, modified — "under routine/normal operating conditions within
its given ODD", "for complete trips" and Notes were deleted.]
3.10
dynamic driving task
DDT
all of the real-time operational and tactical functions required to operate a vehicle in on-road traffic
Note 1 to entry: This excludes the strategic functions such as trip scheduling and selecting destinations and waypoints,
and includes without limitation:
— lateral vehicle motion control via steering (operational);
— longitudinal vehicle motion control via acceleration and deceleration (operational);
— monitoring the driving environment via object and event detection, recognition, classification, and response
preparation (operational and tactical);
— object and event response execution (operational and tactical);
— manoeuvre planning (tactical); and
— enhancing conspicuity via lighting, signalling or gesturing, etc. (tactical).
[SOURCE: ISO/SAE PAS 22736:2021, 3.10, modified — Note 1 to entry was previously part of the definition
and notes and figures were deleted.]
3.11
DDT fallback
response by the user (3.1.2) to either perform the dynamic driving task(DDT) (3.10) or achieve a minimal risk
condition (MRC) (1) (3.17) after occurrence of DDT performance-relevant system failures (3.12), or (2) upon
operational design domain (ODD) (3.20) exit, or the response by an automated driving system (ADS) (3.2) to
achieve an MRC, given the same circumstances
[SOURCE: ISO/SAE PAS 22736:2021 3.12, modified — Notes, examples and figures were deleted.]
,
3.12
failure
deviation from an intended behaviour of the automated driving system (ADS) (3.2) due to a fault (3.13)
manifestation
[SOURCE: ISO 26262-1:2018, 3.50, modified — "item and element" was replaced by "ADS", "termination of"
was replaced by "deviation from" and Note 1 to entry was deleted.]
3.13
fault
abnormal condition that can cause the automated driving system (ADS) (3.2) to fail
[SOURCE: ISO 26262-1:2018, 3.54, modified — "item and element" was replaced by "ADS" and Notes to entry
were deleted.]
3.14
harm
physical injury or damage to the health of persons
[SOURCE: ISO 26262-1:2018, 3.74]
3.15
HD map
map with high level precision and/or high level of detail mostly used in the context of the automated driving
system (ADS) (3.2) to give the ADS precise information about the road environment
3.16
incident
event that could have caused or actually caused harm (3.14) or property damage, or an anomaly that has the
potential to cause harm or property damage in the future
Note 1 to entry: Incident includes near-miss.
3.17
minimal risk condition
MRC
stable, stopped condition to which a user (3.1.2) or an automated driving system (ADS) (3.2) may bring a
vehicle after performing the DDT fallback (3.11) in order to reduce the risk of an incident (3.16) when a given
trip cannot or should not be continued
Note 1 to entry: The minimal risk condition integrates the meaning of avoidance of unreasonable risk (3.26), according
to the ISO 26262 series.
[SOURCE: ISO/SAE PAS 22736:2021 3.16, modified — "crash" replaced by "incident", notes and were deleted.]
,
3.18
minimal risk manoeuvre
MRM
vehicle movement directed by the automated driving system (ADS) (3.2) or by the fallback-ready user (3.1.5)
during DDT fallback (3.11) to achieve a minimal risk condition (MRC) (3.17)
3.19
object and event detection and response
OEDR
subtasks of the dynamic driving task(DDT) (3.10) that include monitoring the driving environment and
executing an appropriate response to such objects and events
[SOURCE: ISO/SAE PAS 22736:2021 3.19, modified — "(detecting, recognizing, and classifying objects and
,
events and preparing to respond as needed)" and "(i.e., as needed to complete the DDT and/or DDT fallback)".
were deleted.]
3.20
operational design domain
ODD
operating conditions under which an automated driving system (ADS) (3.2) or feature thereof is specifically
designed to function, including, but not limited
...