STPA Applied to Automotive
Automated Parking Assist
Massachusetts Institute ofTechnology

APA Collaboration withGeneral Motors

John ThomasCharles A. Green

Megan FranceMark A. Vernacchia
Padma Sundaram
Joseph D’Ambrosio

AUTOMATED PARKING ASSISTENGINEERING FOR HUMANS - MIT STAMP WORKSHOP 20162

CONTROL LOOP

3Leveson, 2012

CONTROL LOOP

Existing systemstheoretic controller
model Generic Not specific tohumans

4Leveson, 2012

HUMAN CONTROL MODEL
Human Controller
Control
Actions

Inputs5

HUMAN CONTROL MODEL
Human Controller
Control
Actions

Process Model
Process states

Devisecontrol
actions

Process behaviors

PM Update

InputsEnvironment

6

NEW PROCESS Identify UCAs

 Identify Process Model variables
 Identify Process Model Flaws
 Identify flaws in Process Model Updates

 Identify unsafe decisions (Control Action Selections)
Human Controller

ControlActions

Process Model
Process states

Devise controlactions

Process behaviors

PM Update

InputsEnvironment
7

NEW PROCESS Identify UCAs

 Identify Process Model variables
 Identify Process Model Flaws
 Identify flaws in Process Model Updates

 Identify unsafe decisions (Control Action Selections)

8

UNSAFE CONTROL ACTIONS
Not Provided

Brake

ProvidedToo early, toolate, out oforder

Stopped toosoon, applied
too long

UCA-1: Driver
does notbrake whenauto-parking
and computer
doesn’t react
to an obstacle

Driver
APAVehicle
9

NEW PROCESS Identify UCAs


UCA-1: Driver does not brake when auto-parking
and computer doesn’t react to an obstacle

 Identify Process Model variablesPM-1: APA is enabled/disabled

PM-2: APA computer reacting appropriately/inappropriately

PM-3: Obstacle on collision path

 Identify Process Model Flaws

 Identify flaws in Process Model Updates
 Identify unsafe Control Action Selections

11

NEW PROCESS Identify UCAs


UCA-1: Driver does not brake when auto-parking
and computer doesn’t react to an obstacle

 Identify Process Model variablesPM-1: APA is enabled/disabled

PM-2: APA computer reacting appropriately/inappropriately

PM-3: Obstacle on collision path

 Identify Process Model Flaws

 Identify flaws in Process Model Updates
 Identify unsafe Control Action Selections

12

NEW PROCESS Identify UCAs


UCA-1: Driver does not brake when auto-parking
and computer doesn’t react to an obstacle

 Identify Process Model variablesPM-1: APA is enabled/disabled

PM-2: APA computer reacting appropriately/inappropriately

PM-3: Obstacle on collision path

 Identify Process Model Flaws

 Identify flaws in Process Model Updates
 Identify unsafe Control Action Selections

13

NEW PROCESS Identify UCAs


UCA-1: Driver does not brake when auto-parking
and computer doesn’t react to an obstacle

 Identify Process Model variablesPM-1: APA is enabled/disabled

PM-2: APA computer reacting appropriately/inappropriately

PM-3: Obstacle on collision path

 Identify Process Model Flaws

 Identify flaws in Process Model Updates
 Identify unsafe Control Action Selections
Human Controller
Control
Actions

Devisecontrolactions

Process Model
Processstates
Processbehaviors
Environment

InputsPM Update14

NEW PROCESS

Identify UCAs



Identify Process Model variables

Process Model
Process states

PM-1: APA is enabled/disabled

PM-2: APA computer reacting appropriately/inappropriately

PM-3: Obstacle on collision path

Identify Process Model Flaws



Identify unsafe decisions (Control Action Selections)

Identify inadequate Process Model Updates

Type of PM flaw

Process behaviors
Environment

ExamplesIncorrect beliefs about processstate (including modes)
Incorrect beliefs about process
behaviors
Incorrect beliefs aboutenvironment
15

NEW PROCESS

Identify UCAs



Identify Process Model variables

Process Model
Process states

PM-1: APA is enabled/disabled

PM-2: APA computer reacting appropriately/inappropriately

PM-3: Obstacle on collision path

Identify Process Model Flaws



Identify unsafe decisions (Control Action Selections)

Identify inadequate Process Model Updates

Process behaviors
Environment

Type of PM flaw

ExamplesIncorrect beliefs about processstate (including modes)

Driver thinks APA is enabled when APA is reallydisabled (PM-1)

Incorrect beliefs about process
behaviors
Incorrect beliefs aboutenvironment
16

NEW PROCESS

Identify UCAs



Identify Process Model variables

Process Model
Process states

PM-1: APA is enabled/disabled

PM-2: APA computer reacting appropriately/inappropriately

PM-3: Obstacle on collision path

Identify Process Model Flaws



Identify unsafe decisions (Control Action Selections)

Identify inadequate Process Model Updates

Process behaviors
Environment

Type of PM flaw

ExamplesIncorrect beliefs about processstate (including modes)

Driver thinks APA is enabled when APA is reallydisabled

Incorrect beliefs about processbehaviors

Driver thinks APA is reacting properly and willbrake automatically

Incorrect beliefs aboutenvironment
17

NEW PROCESS

Identify UCAs



Identify Process Model variables

Process ModelProcess states

PM-1: APA is enabled/disabled

PM-2: APA computer reacting appropriately/inappropriately

PM-3: Obstacle on collision path

Identify Process Model Flaws



Identify unsafe decisions (Control Action Selections)Identify inadequate Process Model Updates

Process behaviors
Environment

Type of PM flaw

ExamplesIncorrect beliefs about processstate (including modes)

Driver thinks APA is enabled when APA is reallydisabled

Incorrect beliefs about process
behaviors

Driver thinks APA is reacting properly and willbrake automatically

Incorrect beliefs aboutenvironment

Driver thinks there is no obstacle when there isone
Driver knows there is an obstacle but doesn’t
18know it’s on a collision path

NEW PROCESS Identifying Process Model Flaws


Incorrect beliefs about process state

Automatic mode changes

Previous commands ignoredPhases of operation

Process behaviors

Consider perceived effect of control actions,behavior in other modes, past experiences, etc.

Environment

Incorrect beliefs about environmentProcess states

Incorrect beliefs about Process behaviors
Process Model

Consider changes to environment, similar past environments, etc.

“Known Unknown” and “Unknown Unknowns”
Believes there is a pedestrian in the wayBelieves there is no pedestrianBelieves they don’t know if there is a pedestrian (may trigger a check)Consider inadequate feedback, driver may know something changed but doesn’t know
the new state, etc.

Providing guidance to ensure coverage

19

NEW PROCESS Identify UCAs


UCA-1: Driver does not brake when auto-parking
and computer doesn’t react to an obstacle

 Identify Process Model variablesPM-1: APA is enabled/disabled

PM-2: APA computer reacting appropriately/inappropriately

PM-3: Obstacle on collision path

 Identify Process Model Flaws

 Identify flaws in Process Model Updates
 Identify unsafe Control Action Selections
Human Controller
ControlActions

Devisecontrolactions

Process Model
Processstates
Process
behaviors
Environment

InputsPM Update20

NEW PROCESS

Driver does not brakewhen auto-parking
and computer doesn’treact to an obstacle(UCA-1)
Human Controller

Control
Actions

Driver thinks
APA is enabled
when APA isreally disabled(PM-1)

Consider:1. Automatic mode changes
2. Previous cmds ignored
3. Phases of operation
4. Etc.

Process ModelProcess states
Devise control
actions

Process behaviors

PM Update

InputsEnvironment

21

NEW PROCESS

Driver does not brakewhen auto-parking
and computer doesn’treact to an obstacle(UCA-1)
Human Controller

Control
Actions

Driver thinks
APA is enabled
when APA isreally disabled(PM-1)

APA automaticallydisabled itself but
driver didn’t noticethe change

Process Model

Process states
Devise control
actions

Process behaviors

PM Update

InputsEnvironment

22

NEW PROCESS

Driver does not brakewhen auto-parking
and computer doesn’treact to an obstacle(UCA-1)
Human Controller

Control
Actions

Driver thinks
APA is enabled
when APA isreally disabled(PM-1)

APA automaticallydisabled itself, driver
noticed the change but
didn’t understand it

Process Model

Process states
Devise controlactions

Process behaviors

PM UpdateInputs

Environment

23

NEW PROCESS Identify UCAs


UCA-1: Driver does not brake for an obstacle when
computer does not react appropriately to the obstacle

 Identify Process Model variablesPM-1: APA reacting appropriately/inappropriately

PM-2: Obstacle on collision path

 Identify Process Model Flaws
 Identify flaws in Process Model Updates
 Identify unsafe Control Action Selections
Human Controller
ControlActions

Process Model

Process states
Devisecontrolactions

Processbehaviors
Environment

InputsPM Update24

NEW PROCESS Identify unsafe Control Action Selections

Driver does notbrake when
auto-parking
and computer
doesn’t react toan obstacle(UCA-1)
Human Controller
Control
Actions

Driver knows APA is on
Driver knows APA hasn’t reacted yet
Driver knows there is an obstacle in theway
Process Model
Process states

Devise control
actions

Process behaviors

PM Update

InputsEnvironment
25

NEW PROCESS Identify unsafe Control Action Selections

Driver does notbrake when
Maybe driver does
auto-parking
not know they canand computer
doesn’t react to control brake with
APA onan obstacle(UCA-1)
Human Controller

Driver knows APA is on
Driver knows APA hasn’t reacted yet
Driver knows there is an obstacle in theway

Process Model

Control
Actions

Process states
Devise control
actions

Process behaviors

PM Update

InputsEnvironment
26

NEW PROCESS Identify unsafe Control Action Selections

Driver does notbrake when
Maybe driverauto-parking
decides to disableand computer
APA insteaddoesn’t react toan obstacle(UCA-1)
Human Controller

Driver knows APA is on
Driver knows APA hasn’t reacted yet
Driver knows there is an obstacle in theway

Process ModelControl
Actions

Process states
Devise control
actions

Process behaviors

PM Update

InputsEnvironment
27

NEW PROCESS Identify unsafe Control Action Selections

Driver does notbrake when
Driver may still
auto-parking
be waiting forand computer
APA to act
doesn’t react toan obstacle(UCA-1)
Human Controller

Driver knows APA is on
Driver knows APA hasn’t reacted yet
Driver knows there is an obstacle in theway

Process Model

Control
Actions

Process states
Devise control
actions

Process behaviors

PM UpdateInputs

Environment
28

NEW PROCESS Identify unsafe Control Action Selections
Consider whether the driver is aware they can control XConsider alternative driver controls/actions

Driver does not Consider other driver goals
brake when
Driver knows APA is on
auto-parking
Driver knows APA hasn’t reacted yet
and computer
Driver knows there is an obstacle in thedoesn’t react toway
an obstacle(UCA-1)
Human Controller
Process Model

Goals

Control
Actions

Process states
Devise control
actions

Process behaviors

PM Update

InputsEnvironment
29

NEW PROCESS Identify UCAs

 Identify Process Model variables
 Identify Process Model Flaws
 Identify flaws in Process Model Updates

 Identify unsafe decisions (Control Action Selections)
Human Controller

Control
Actions

Process Model
Process states

Devise control
actions

Process behaviors

PM Update

InputsEnvironment30

AUTOMATED PARKING
Features of each system considered for this analysis:

Steering

Braking
Shifting andAcceleration
Object andEventDetection
and Response

Level 0*Level 1

Level 2aLevel 2bLevel 3

No DrivingAutomation“Driver
Assistance”“PartialAutomation”“PartialAutomation”“ConditionalAutomation”-------

*System numbering is consistent with SAE definitions for levels of automation, while “a” and “b”
indicate different implementations which are classified within the same SAE level.
31

AUTOMATED PARKING
Level 1

Level 2aLevel 2bLevel 3

“DriverAssistance”“PartialAutomation”“PartialAutomation”“ConditionalAutomation”

5

1328

28

Driver UCAs

APA
Computer
UCAs

Total

AUTOMATED PARKING
Level 1

Level 2aLevel 2bLevel 3

“DriverAssistance”“PartialAutomation”“PartialAutomation”“ConditionalAutomation”

Driver UCAs

42413844

APA
Computer
UCAs

5132828Total

AUTOMATED PARKING

Driver UCAs

Level 1

Level 2aLevel 2bLevel 3

“DriverAssistance”“PartialAutomation”“PartialAutomation”“ConditionalAutomation”

35 in common
4241

32 in common
38
44
30 in common

APA
Computer
UCAs

5 in common
528 in common
1328

28

13 in common

Total

40 in common
47
54

60 in common
66
72
43 in common

Level 1

Level 2aLevel 2bLevel 3

Driver UCAs

42413844

APA Computer
UCAs

5132828Total

47546672CONCLUSIONSNew human engineering extension strengths:
 Provides additional guidance for engineers tounderstand and anticipate human interactions

 Can help suggest solutions, not just problems
 Can be used earlier in design process thandetailed simulations or prototypes

37