  Developing safe autonomous driving systems is a major scientific and
technical challenge. Existing AI-based end-to-end solutions do not offer the
necessary safety guarantees, while traditional systems engineering approaches
are defeated by the complexity of the problem. Currently, there is an
increasing interest in hybrid design solutions, integrating machine learning
components, when necessary, while using model-based components for goal
management and planning.
  We study a method for building safe by design autonomous driving systems,
based on the assumption that the capability to drive boils down to the
coordinated execution of a given set of driving operations. The assumption is
substantiated by a compositionality result considering that autopilots are
dynamic systems receiving a small number of types of vistas as input, each
vista defining a free space in its neighborhood. It is shown that safe driving
for each type of vista in the corresponding free space, implies safe driving
for any possible scenario under some easy-to-check conditions concerning the
transition between vistas. The designed autopilot comprises distinct control
policies one per type of vista, articulated in two consecutive phases. The
first phase consists of carefully managing a potentially risky situation by
virtually reducing speed, while the second phase consists of exiting the
situation by accelerating.
  The autopilots designed use for their predictions simple functions
characterizing the acceleration and deceleration capabilities of the vehicles.
They cover the main driving operations, including entering a main road,
overtaking, crossing intersections protected by traffic lights or signals, and
driving on freeways. The results presented reinforce the case for hybrid
solutions that incorporate mathematically elegant and robust decision methods
that are safe by design.
