  Ensuring the safety of autonomous vehicles, given the uncertainty in sensing
other road users, is an open problem. Moreover, separate safety specifications
for perception and planning components raise how to assess the overall system
safety. This work provides a probabilistic approach to calculate safety
envelopes under perception uncertainty. The probabilistic envelope definition
is based on a risk threshold. It limits the cumulative probability that the
actual safety envelope in a fully observable environment is larger than an
applied envelope and is solved using iterative worst-case analysis of
envelopes. Our approach extends non-probabilistic envelopes - in this work, the
Responsibility-Sensitive Safety (RSS) - to handle uncertainties. To evaluate
our probabilistic envelope approach, we compare it in a simulated highway
merging scenario against several baseline safety architectures. Our evaluation
shows that our model allows adjusting safety and performance based on a chosen
risk level and the amount of perception uncertainty. We conclude with an
outline of how to formally argue safety under perception uncertainty using our
formulation of envelope violation risk.
