

Deep Neural Networks [DNNs] are being integrated into Automated Driving Systems [ADS] to perform complex perception and control problems. However, DNNs are generally challenging or impossible to interpret for the purpose of functional safety [FuSa] or Safety of the intended functionality [SOTIF] assessment. In contrast, physical models of the driving task are generally much easier to explain and assess than the abstract statistical models encoded in a DNN. In this paper, we present a statistical modelling and evaluation workflow that can be easily explained to FuSa and SOTIF assessors. Our workflow uses Bayesian networks [BN] refining fault trees and a physical model of an ADS in a given scenario. The Dominant Factors [DF] that impact the ADS risk can then be identified based on simulations of the physical model and simulations sampled from the BN. The workflow can evaluate under which conditions a tolerable risk target [TRT] can be achieved. We evaluate our proposed workflow in an example high-frequency traffic scenario, a highway cut-in scenario. We compare two methods to identify and confirm the DF for meeting the TRT. The DF found show that a static operating design domain [ODD] definition is insufficient. In the example, if the sense-plan-act control architecture is extended by a dynamic traffic monitoring protection layer, the TRT can be achieved.