Fault tree-based Derivation of Safety Requirements for Automated Driving on the Example of cooperative Valet Parking

Developing safe vehicle automation systems is crucial for the commercialization of automated driving. One of the major challenges for the release of fully automated driving is functional safety. Automated driving systems explode in complexity due to an infinite number of occurring scenarios. Thereby, the derivation of safety requirements for complex automated driving functions lacks a categorization to tackle the completeness issue. This work presents a structure for a fault tree-based approach to derive safety requirements from safety goals systematically in compliance with the international standard of functional safety for road vehicles known as ISO 26262. The investigation of the state of the art reveals that a functional safety concept for fully automated valet parking (AVP) has not yet been targeted. The methodology is therefore applied on the example of automated valet parking to elaborate a safety concept which was not yet investigated. Beforehand, the AVP system was split into a manageable amount of relevant functional scenarios to decrease complexity. For each scenario, a Hazard Analysis and Risk Assessment (HARA) was performed. A set of safety goals was elaborated. The approach utilizes a fault tree-based Sense-Plan-Act architecture to achieve a large coverage of possibly derivable safety requirements from safety goals. The sense phase contains the acquisition of sensor data and leads to three uncertainty domains: state, existence, and class uncertainty. The plan segment includes the situation comprehension and action planning. Thereby, the transportation mission can be split into five tasks. The act block represents the execution of the planned trajectory. Longitudinal and lateral vehicle dynamics such as steering, shifting, accelerating, and braking are performed. A violation of a safety goal occurs if at least one of the failure events in the sense-, plan-, and act-phase is present. The methodology is suitable for safety goals which follow the specified Sense-Plan-Act pattern. INTRODUCTION The globally leading cause of death among people aged 15-29 in the year 2012 are road traffic accidents [1]. 94 % of crashes can be tied back to human error [2]. In 2015, the United Nations agreed to global goals for sustainable development. The goal “good health and well-being” concerns road safety in which the number of global deaths and injuries from road traffic accidents shall be halved by 2020. Safe automated systems that intervene in case of a proximate accident and release the driver from the responsibility are required. Thereby, functional safety is one of the major challenges for the release of automated driving [3]. An automated driving function shall be harmless in all operating states. The system shall identify hazards and reach a safe location in which the vehicle is no hazard for other participants. The international standard for functional safety ISO 26262 specifies a systematic procedure for designing functionally safe electrical and electronic systems [4]. ISO 26262 and international standards for other domains are derived from the IEC 61508 [5]. Automated systems from different domains have a common denominator: exploding complexity. A nearly infinite number of possible scenarios has to be tested. The European Union (EU) project ENABLE-S3 focuses on the reduction of today’s costintensive verification and validation process to establish efficient methods for the commercialization of automated cyber-physical systems. Different approaches have to be targeted in order to cope with the increasing complexity regarding the development of safe automated systems.