https://www.mdu.se/

Manufacturers of self-driving cars need to significantly improve the safety of their products before the series of such cars are deployed in everyday use. A large number of architecture proposals for Automated Driving Systems (ADS) are aiming at addressing the challenge of safety. These solutions typically define redundancy schemes and quite commonly include self-checking pair structures, e.g., commander/monitor approaches. In such structures, the problem of detecting false positive failures arises, i.e., the monitor may falsely classify the output of the commander as being faulty. In this report we provide details regarding a formal verification of an approach aiming at false positive mitigation in the domain of automated driving. We formalize our proposal in an abstract model an

Automated vehicles come with promises for higher comfort and safety compared to the standard human-driven vehicles. Various demonstrator vehicles with fully automated driving capabilities have been already presented with success. Yet, there is a large number of technical challenges to be solved until the safety levels comply with those required from safety standards, and most importantly with those for public acceptance. In this paper, we introduce the technical challenges resulting from the need for fault-tolerant capabilities of automated vehicles with no fallback-ready drivers. We then propose a concrete solution to these challenges. This includes a fault-tolerant architecture for automated driving systems. Also, the safety co-pilot, that is a safety mechanism that ensures the coordinated operation of two or more redundant ADS, by means of novel application-specific verification methods. We conclude our work with experimental proof of concept results of the proposed solution.

In this paper, we study the cause of out-of-sequence measurements (OOSM) and their effect on Kalman filter based multi-sensor fusion systems. We explore the current available solutions for handling of OOSM and pinpoint how the absence of precise measurement timestamps does not allow the correct chronological order of sensor measurements. The processing of such, out-of-order measurements, leads to negative-time measurement updates in the sensor fusion process, which in turn leads to a wrong representation of the environment.Furthermore, we present methods for achieving precise measurement timestamps. We explore the suitability of set of communication standards for improving the timestamp precision. In particular we focus on IEEE 802.1AS, IEEE 802.1Qav, Qbv and SAE AS6802 standards that enable deterministic communication over IEEE802.3 standard Ethernet. We present theoretical performance studies and comparison of the said communication standards.

Future Automated Driving Systems (ADS) will ultimately take over all driving responsibilities from the driver. This will as well include the overall safety goal of avoiding hazards on the road by exe- cuting automated safety actions (ASA). It is the purpose of this paper to address the general properties of the ASA. One property in particu- lar interest is the forecast horizon that defines how early in advance a hazard has to be identified in order to ensure the execution of an ASA. For the estimation of the forecast horizon, we study the fault-tolerant time interval concept defined by the ISO 26262 and extend it for the use case of fail-operational ADS. We then perform a thorough study on all parameters contributing to the forecast horizon, assign exemplary values for each parameter for a running example, and formalize our work by a set of equations. The set of equations are then applied to two specific driving scenarios, and based on the running example values, the fore- cast horizon is estimated. We conclude our work with a summary of the estimated forecast horizon for each of the specific driving scenarios at different road conditions and the recommended road speed limits.

Being used in key features, such as sensing and intelligent path planning, Artificial Intelligence (AI) has become an inevitable part of automated vehicles (AVs). However, their usage in the automotive industry always comes with a 'label' that questions their impact on the overall AV safety. This paper focuses on the safe deployment of AI-based AVs. Among the various ways for ensuring the safety of AI-based AVs is to monitor the safe execution of the system responsible for automated driving (i.e., Automated Driving System (ADS)) at runtime (i.e., runtime monitoring). Most of the research done in the past years focused on verifying whether the path or trajectory generated by the ADS does not immediately collide with objects on the road. However, as we will show in this paper, there are other unsafe situations that do not immediately result in a collision but the monitor should check for them. To build our case, we have looked into the National Highway Traffic Safety Administration (NHTSA) database of 5.9 million police-reported light-vehicle accidents and categorized these accidents into five main categories of unsafe vehicle operations. Furthermore, we have performed a high-level evaluation of the runtime monitoring approach proposed in [1], by estimating what percentage of the total population of 5.9 million of unsafe operations the approach would be able to detect. Lastly, we have performed the same evaluation on other existing runtime monitoring approaches to make a basic comparison of their diagnostic capabilities.