https://www.mdu.se/

Being used in key features, such as sensing and intelligent path planning, Artificial Intelligence (AI) has become an inevitable part of automated vehicles (AVs). However, their usage in the automotive industry always comes with a 'label' that questions their impact on the overall AV safety. This paper focuses on the safe deployment of AI-based AVs. Among the various ways for ensuring the safety of AI-based AVs is to monitor the safe execution of the system responsible for automated driving (i.e., Automated Driving System (ADS)) at runtime (i.e., runtime monitoring). Most of the research done in the past years focused on verifying whether the path or trajectory generated by the ADS does not immediately collide with objects on the road. However, as we will show in this paper, there are other unsafe situations that do not immediately result in a collision but the monitor should check for them. To build our case, we have looked into the National Highway Traffic Safety Administration (NHTSA) database of 5.9 million police-reported light-vehicle accidents and categorized these accidents into five main categories of unsafe vehicle operations. Furthermore, we have performed a high-level evaluation of the runtime monitoring approach proposed in [1], by estimating what percentage of the total population of 5.9 million of unsafe operations the approach would be able to detect. Lastly, we have performed the same evaluation on other existing runtime monitoring approaches to make a basic comparison of their diagnostic capabilities.

Manufacturers of self-driving cars need to significantly improve the safety of their products before the series of such cars are deployed in everyday use. A large number of architecture proposals for Automated Driving Systems (ADS) are aiming at addressing the challenge of safety. These solutions typically define redundancy schemes and quite commonly include self-checking pair structures, e.g., commander/monitor approaches. In such structures, the problem of detecting false positive failures arises, i.e., the monitor may falsely classify the output of the commander as being faulty. In this report we provide details regarding a formal verification of an approach aiming at false positive mitigation in the domain of automated driving. We formalize our proposal in an abstract model an

Mass-produced passenger vehicles are one of the greatest inventions of the 20^th century that significantly changed human lives. Several safety measures such as traffic signs, traffic lights, mandatory driver education, seat belts, airbags, and anti-lock braking systems were introduced throughout the years. Today, a further increase in safety, comfort, and efficiency is being targeted by developing systems with automated driving capabilities. These systems range from those supporting the driver with a particular function (e.g., ensuring vehicle drives with constant speed while keeping a safe distance to other road participants) to taking all driving responsibilities from the driver (i.e., full driving automation). The development and series production of the former has already been accomplished, whereas reaching full driving automation still presents many challenges.

The main reason is the shift of all driving responsibilities, including the responsibility for the overall vehicle safety, from the human driver to a computer-based system responsible for the automated driving functionality (i.e., the Automated Driving System (ADS)). Such a shift makes the ADS highly safety-critical, and the consensus of cross-domain experts is that there is no “silver bullet” for ensuring the required levels of safety. Instead, a set of complementary safety methods are necessary.

In this context, runtime monitoring that continuously verifies the safe operation of the ADS, once deployed on public roads, is a promising complementary approach for ensuring safety. However, the development of a runtime monitoring solution is a challenge on its own. On a conceptual level, the complex and opaque technology used in ADS often makes researchers doubt “what” a runtime monitor should verify and “how” such verification should be performed.

This thesis proposes novel runtime monitoring solutions for verifying the safe operation of ADS. On a conceptual level, a novel Runtime Verification (RV) approach, namely the Safe Driving Envelope- Verification (SDE-V), answers the “what” and “how” of monitoring an ADS. In particular, the SDE-V approach verifies whether the ADS path planner output (i.e., a trajectory) is safe to be executed by the vehicle’s actuators. To perform this verification, the trajectory is checked against the following safety rules: (i) trajectory not leading into collision with obstacles on the road, and (ii) trajectory not leaving the road edge.

Towards realizing the proposed SDE-V concept into an actual solution, additional concepts, methods, and architectural solutions have been developed. Our contributions in this context include : (i) a concept for reducing the false positive rate of SDE-V, (ii) a method for evaluating the quality of runtime monitors by investigating to what extent they can handle faults related to different classes of real accident scenarios, (iii) a modular and scalable fail-operational architecture which enables integration of multiple RV approaches alongside the SDE-V, (iv) estimation of a “forecast horizon” to ensure the timely execution of emergency actions upon an ADS failure detection by SDE-V, and (v) an approach to tackle the out-of-sequence measurement problem in sensor fusion-based ADS. A prototype implementation of SDV-E has been realized on an automotive-grade embedded platform. Based on its promising results, a future industrial implementation Project has been initiated.

Future Automated Driving Systems (ADS) will ultimately take over all driving responsibilities from the driver. This will as well include the overall safety goal of avoiding hazards on the road by exe- cuting automated safety actions (ASA). It is the purpose of this paper to address the general properties of the ASA. One property in particu- lar interest is the forecast horizon that defines how early in advance a hazard has to be identified in order to ensure the execution of an ASA. For the estimation of the forecast horizon, we study the fault-tolerant time interval concept defined by the ISO 26262 and extend it for the use case of fail-operational ADS. We then perform a thorough study on all parameters contributing to the forecast horizon, assign exemplary values for each parameter for a running example, and formalize our work by a set of equations. The set of equations are then applied to two specific driving scenarios, and based on the running example values, the fore- cast horizon is estimated. We conclude our work with a summary of the estimated forecast horizon for each of the specific driving scenarios at different road conditions and the recommended road speed limits.

It is the period of the World's history, where the technological progress reached a level that enables the first steps towards the development of vehicles with automated driving capabilities. The swift response from the significant portion of the industry resulted in a race, the final line set at the introduction of vehicles with full automated driving capabilities.

Vehicles with automated driving capabilities target making driving safer, more comfortable, and economically more efficient by assisting the driver or by taking responsibilities for different driving tasks. While vehicles with assistance and partial automation capabilities are already in series production, the ultimate goal is in the introduction of vehicles with full automated driving capabilities. Reaching this level of automation will require shifting all responsibilities, including the responsibility for the overall vehicle safety, from the human to the computer-based system responsible for the automated driving functionality (i.e., the Automated Driving System (ADS)). Such a shift makes the ADS highly safe-critical, requiring a safety level comparable to an aircraft system.

It is paramount to understand that ensuring such a level of safety is a complex interdisciplinary challenge. Traditional approaches for ensuring safety require the use of fault-tolerance techniques that are unproven when it comes to the automated driving domain. Moreover, existing safety assurance methods (e.g., ISO 26262) suffer from requirements incompleteness in the automated driving context. The use of artificial intelligence-based components in the ADS further complicate the matter due to their non-deterministic behavior. At present, there is no single straightforward solution for these challenges. Instead, the consensus of cross-domain experts is to use a set of complementary safety methods that together are sufficient to ensure the required level of safety.

In the context of that, runtime monitors that verify the safe operation of the ADS during execution, are a promising complementary approach for ensuring safety. However, to develop a runtime monitoring solution for ADS, one has to handle a wide range of challenges. On a conceptual level, the complex and opaque technology used in ADS often make researchers ask the question ``how should ADS be verified in order to judge it is operating safely?".

Once the initial Runtime Verification (RV) concept is developed, researchers and practitioners have to deal with research and engineering challenges encountered during the realization of the RV approaches into an actual runtime monitoring solution for ADS. These challenges range from, estimating different safety parameters of the runtime monitors, finding solutions for different technical problems, to meeting scalability and efficiency requirements.

The focus of this thesis is to propose novel runtime monitoring solutions for verifying the safe operation of ADS. This encompasses (i) defining novel RV approaches explicitly tailored for automated driving, and (ii) developing concepts, methods, and architectures for realizing the RV approaches into an actual runtime monitoring solution for ADS. Contributions to the former include defining two runtime RV approaches, namely the Computer Vision Monitor (CVM) and the Safe Driving Envelope Verification. Contributions to the latter include (i) estimating the sufficient diagnostic test interval of the runtime verification approaches (in particular the CVM), (ii) addressing the out-of-sequence measurement problem in sensor fusion-based ADS, and (iii) developing an architectural solution for improving the scalability and efficiency of the runtime monitoring solution.

Automated vehicles come with promises for higher comfort and safety compared to the standard human-driven vehicles. Various demonstrator vehicles with fully automated driving capabilities have been already presented with success. Yet, there is a large number of technical challenges to be solved until the safety levels comply with those required from safety standards, and most importantly with those for public acceptance. In this paper, we introduce the technical challenges resulting from the need for fault-tolerant capabilities of automated vehicles with no fallback-ready drivers. We then propose a concrete solution to these challenges. This includes a fault-tolerant architecture for automated driving systems. Also, the safety co-pilot, that is a safety mechanism that ensures the coordinated operation of two or more redundant ADS, by means of novel application-specific verification methods. We conclude our work with experimental proof of concept results of the proposed solution.

In this paper, we study the cause of out-of-sequence measurements (OOSM) and their effect on Kalman filter based multi-sensor fusion systems. We explore the current available solutions for handling of OOSM and pinpoint how the absence of precise measurement timestamps does not allow the correct chronological order of sensor measurements. The processing of such, out-of-order measurements, leads to negative-time measurement updates in the sensor fusion process, which in turn leads to a wrong representation of the environment.Furthermore, we present methods for achieving precise measurement timestamps. We explore the suitability of set of communication standards for improving the timestamp precision. In particular we focus on IEEE 802.1AS, IEEE 802.1Qav, Qbv and SAE AS6802 standards that enable deterministic communication over IEEE802.3 standard Ethernet. We present theoretical performance studies and comparison of the said communication standards.