  In recent years, car makers and tech companies have been racing towards self
driving cars. It seems that the main parameter in this race is who will have
the first car on the road. The goal of this paper is to add to the equation two
additional crucial parameters. The first is standardization of safety assurance
--- what are the minimal requirements that every self-driving car must satisfy,
and how can we verify these requirements. The second parameter is scalability
--- engineering solutions that lead to unleashed costs will not scale to
millions of cars, which will push interest in this field into a niche academic
corner, and drive the entire field into a "winter of autonomous driving". In
the first part of the paper we propose a white-box, interpretable, mathematical
model for safety assurance, which we call Responsibility-Sensitive Safety
(RSS). In the second part we describe a design of a system that adheres to our
safety assurance requirements and is scalable to millions of cars.
