  Ensuring the safety of autonomous vehicles (AVs) is the key requisite for
their acceptance in society. This complexity is the core challenge in formally
proving their safety conditions with AI-based black-box controllers and
surrounding objects under various traffic scenarios. This paper describes our
strategy and experience in modelling, deriving, and proving the safety
conditions of AVs with the Event-B refinement mechanism to reduce complexity.
Our case study targets the state-of-the-art model of goal-aware
responsibility-sensitive safety to argue over interactions with surrounding
vehicles. We also employ the Simplex architecture to involve advanced black-box
AI controllers. Our experience has demonstrated that the refinement mechanism
can be effectively used to gradually develop the complex system over scenario
variations.
