TECHNICAL PAPER

Safety Design of Steering Systems for Autonomous Driving
N. KAIHARA K. KIMURA A. ISHIHARA

H. NAKAMURA

Fail-operational design is the key technology that ensures safety in case of autonomous driving system failure. In
order to extract required issues for such fail-operational design, the steering system was developed as an example
with reference to ISO 26262. In this activity, required issues and safety design case study for autonomous driving
system have been obtained by applying ISO 26262, and the effectiveness of fail-operational design has been
evaluated. This report summarizes the results relating to safety design for autonomous driving systems obtained
through a project commissioned by the Ministry of Economy, Trade and Industry.
Key Words: autonomous driving, functional safety, ISO 26262, fail-operational, steering system

1. Introduction
Currently, technological development relating to CASE
(Connected, Autonomous, Shared & Services, Electric)is accelerating and the reduction of road accidents has
been identified as one of the benefits obtainable throughthe realization of autonomous driving. This is because thenormal principal driving authority would be the system,and there is expectation that the occurrence of accidents
typically caused by humans due to so-called human error,
etc., would be suppressed. However, there is concern
regarding the risk of new types of accidents if this system(especially the electrical and electronic system) fails,
because it would be difficult to continue autonomous
driving. In other words, the establishment of safety design
technology (fail-operational) that can ensure safety bycontinuing function in the event of an autonomous driving
system failure is a key issue that must be addressed.
In response, Japan’s Ministry of Economy, Trade andIndustry (METI) planned a research on fail-operationalcorresponding to autonomous driving as one measureof the “Next Generation Advanced Driver Assistance
System Research and Development and Demonstration
Project” from FY2014 to FY2015, and the “Researchand Development and Demonstration Project for theSocial Implementation of Advanced Autonomous Driving
Systems” from FY2016 to FY2018. As a project assigned
to us from the Japan Automobile Research Institute(JARI), which was entrusted with this theme by METI,JTEKT researched and developed the steering system’ssafety design supporting autonomous driving. Basedon ISO 26262:2011, which is the international standard
for automotive functional safety, this project aims toclarify the issues of safety design/verification evaluation,
indicate the “concepts and method examples” to realize
these issues, and utilize as supporting data for “discussionof standards/criteria”, “development in individualcompanies” and “demonstration projects”.
This paper describes the results of the safety design of
the autonomous driving system obtained in the project
undertaken for METI.

2. Issues of Autonomous Driving Systems
and the Countermeasures Thereof
In this section, we describe typical safety designs andchallenges obtained from development in accordancewith ISO 26262:2011, using the steering system ofautonomous driving as an example. First, the development
flow of Part. 3 to Part. 6 ISO 26262:2011 is shown in
Fig. 1.

*1 This report was prepared based on the report regarding the results of the FY2014/2015 Next Generation Advanced Driver Assistance
System Research and Development and Demonstration Project, report regarding the results of the FY2016 Smart Mobility System
Research, Development and Demonstration Project, and report regarding the results of the FY2017/2018 Research and Development and
Demonstration Project for the Social Implementation of Advanced Autonomous Driving Systems; which are all the accomplishments of
METI’s consigned projects.

JTEKT ENGINEERING JOURNAL English Edition No. 1017E (2020)43Safety Design of Steering Systems for Autonomous DrivingPart. 3 Concept phasePart. 4 Product development at the system level4-11 Release for production

3-5 Item definition
4-5 Initiation of product development at the system level3-6 Initiation of the safety lifecycle

4-10 Functional safety assessment

4-6 Specification of the technical safety requirement

3-7 Hazard analysis and risk assessment

4-9 Safety validation
4-8 Item integration and testing

4-7 System design

3-8 Functional safety concept

Part. 5 Product development at the hardware level

Part. 6 Product development at the software level

5-5 Initiation of product development at the hardware level

6-5 Initiation of product development at the software level

5-6 Specification of hardware safety requirements

6-6 Specification of software safety requirement

5-7 Hardware design

6-7 Software architecture design

5-8 Evaluation of the hardware architecture metrics

6-8 Software unit design and implementation

5-9 Evaluation of the safety goal violations due to random hardware failures

6-9 Software unit and testing

5-10 Hardware integration and testing

6-10 Software integration and testing
6-11 Verification of software safety requirements

Fig. 1 Development flow of ISO 26262:2011 (Part. 3-Part. 6)
Vehicle posture stability
Steering system function transition time
Steering angle input
necessary to avoid deviation from traffic lane（≒vehicle slip angle steady）
Tc
Tb
FTTI
Tr

Ts
State of steering

Failureoccurrence

Steering wheel
position neutral

Ta
Start of deviation from normal trajectory（≒vehicle slip angle 0 deg）

Deviation from traffic lane

Ts ：Time from when failure occurs to when tires/steering wheel are returned to center (set as zero seconds for bench test calculation)
Tr ：Time until vehicle center-of-gravity starts deviating from normal trajectory after the tires/steering wheel are returned to the center by SAT
Ta ：Time from when vehicle center-of-gravity starts deviating from normal trajectory until part of vehicle contacts the white line center
Tb ：Time from when steering angle is inputted until vehicle posture becomes stable again from a state of steering (set to 0.5 s on bench test calculation)

Fig. 2 Status of deviation from traffic lane

2. 1 Concept and Setting of Fault Tolerant TimeInterval (FTTI)In Part 3 of Fig. 1, the Safety Goals (SG) requiredof steering systems were established from behavior inautonomously-driven vehicles as follows.
・Prevent steering failure leading to deviation from traffic
lane during autonomous driving
・Prevent unnecessary steering leading to deviation fromtraffic lane in autonomous driving
Here, “steering failure” refers to stopping of thefunction for automatic steering, and “unnecessary
steering” refers to excessive steering beyond the extent
necessary for automatic steering. To achieve these
Safety Goals, there is a need to formulate Functional
Safety Requirements (FSR) and Technical Safety
Requirements (TSR) to enable the steering system tocontinue functioning in the event of a failure. For suchformulation, it is important to quantitatively express

44

the SGs; in other words, the calculation of “the timefrom the occurrence of the autonomously-driven vehicle
failure until deviation from the traffic lane (FTTI)” and“the timing that should be complied with to continue
the function.” In this section, we show the concept andsettings for these by using steering failure as an exampleof the implementation for this problem.
First, the travelling condition was set to “turning andmaintaining steering on an expressway”. This is basedon the line of thinking that the severity of an accident(the degree of harm) is greater if the deviation from thetraffic lane caused by the failure occurs on an expressway.
In addition, the movement of the vehicle at this time isestablished as “failure occurs during steering, the tireand steering wheel return to the neutral position by Self
Aligning Torque (SAT), the vehicle starts to travel straightand deviates from the traffic lane.” Based on these, Fig. 2
shows the time from failure to deviation from traffic lane

JTEKT ENGINEERING JOURNAL English Edition No. 1017E (2020)Safety Design of Steering Systems for Autonomous DrivingCenter of white line to the right381.75 m

Autonomously-driven vehicle’s front right-side contacts the center ofwhite line to the right = deviation from traffic lane

Center of vehicle’s own lane (radius of curve: R)
380 m

Ta = 23.63 m÷27.78 m/s≒0.85 s(radius of curve: R) + (vehicle horizontal width/2)
380.87 m

Distance travelled from failure occurrence to23.63 m deviation from traffic lane

Autonomously-driven vehicle
Vehicle speed 27.78 m/s (100 km/h)

Fig. 3 Movement of deviation from traffic lane

Table 1 Time until deviation from traffic lane

Place

Expressway

Road conditions
Radius of
Design vehicle
curve, m
speed, km/h
380
100

Width,
m
3.50

Steering
angle, deg

FTTI（Ta＋Tr）
Ta，s

Tr，s

Tb，s

Tc，ms

16.8

0.85

0.14

0.50

490

230

80

3.50

21.9

0.80

0.11

0.50

410

88

50

3.25

40.6

0.67

0.07

0.50

240

and the length of time the steering system must function
to avoid deviation from the traffic lane inferred fromthere.
The Tr of Fig. 2 is calculated from a vehicle motion
equation for a typical two-wheeled model, while Ta isbased on the concept shown in Fig. 3. It should be notedthat Fig. 3 uses an example of turning on an expressway
where the radius of curve is 380 m, and the design vehicle
speed is 100 km/h. In addition, the time the function must
continue in order to avoid lane deviation, Tc, is FTTI (sumof Tr and Ta) minus the time from steering angle input
until the vehicle posture stabilizes (Tb). Table 1 shows
the results of calculating the respective times in relation
to the travelling conditions assumed for expressways andmetropolis expressways complying with the Government
Order on Road Design Standards. Tc being the shortest
time in each of these conditions was set as one of thetargets of safety design for this theme (Tc = 240 ms witha radius of curve 88 m on a metropolitan expressway). In
addition, a steady circle turn was used for the travellingmodel in the calculation. In this way, it is possible toperform detailed design tied to SGs by clarifying SGs
in advance not only in the system safety design forsteering systems, but also other systems equipped on
autonomously-driven vehicles.

JTEKT ENGINEERING JOURNAL English Edition No. 1017E (2020)

2. 2 Fail-operational during Operational Function
FailureThe steering system architecture developed in thistheme is shown in Fig. 4. This is based on the Functional
Safety Requirement (FSR) at the vehicle level needed toachieve the Safety Goals (SG). For example, continued
system functionality upon failure occurrence is possible
by implementing FSRs such as “providing a function to
detect failure of the steering angle control function (mainsystem)” and “continuing to function by providing a
redundant steering angle control function,” on the Safety
Mechanisms (SM) relative to the Intended Functionality(IF) of the steering system architecture. The descriptionof FSR is omitted in this report.
The following is a case study of the issues responding
to autonomous driving with the steering systemarchitecture of Fig. 4. As mentioned in the preceding
paragraph, in order to ensure safety in the event of theautonomous driving system failing, it is necessary tocontinue the function of the steering system until thevehicle deviates from the traffic lane (240 ms or less inthe case of this theme: See Table 1).
For example, if the operational function (main) in
Fig. 4 stops functioning due to a failure, the operational
function (sub) performs control instead of the operational
function (main), thus making it possible to continue thesteering system function and prevent deviation from thetraffic lane. However, if the operational function (sub)takes control instead of the operational function (main),45

Safety Design of Steering Systems for Autonomous Driving

Position detector
CAN bus A
CAN bus B

CAN
I/F
CAN
I/F
CAN
I/F
CAN
I/F

Motor
rotation
angle
sensorCurrent detector
Operational function(main)

Motor drive command

Communication

Switchover
function

Operational function(sub)

Pre-driverPowerelement

Motor
Pre-driverPowerelement

Current detector

Position detector

Position detector

Steering angle sensor

Motor
Two-system
motor

CAN ：Controller Area Network
I/F ：Interface：Intended Functionality：Safety Mechanism

Fig. 4 Steering system architecture

there is a need to implement measures to avoid violationsof SGs. Such violations include “switching after deviationfrom traffic lane” and “vehicle behavior changing
suddenly at the moment of switching from main to sub
causing deviation from traffic lane.” For this theme, inorder to avoid such SG violations, the standby state of theoperational function (sub) during normal times was made“hot standby.” Figure 5 shows the concept of hot standby
implemented in the operational function.
As shown in Fig. 5, the operational function (sub) isconstantly performing operations with the same timing
and control parameters as the operational function (main)even while on standby. In other words, since the mainand sub operational functions are always in the same
control state, the switchover from main to sub can be
performed safely and swiftly, minimizing the impact
on the vehicle. Based on this idea, failure detection tocompletion of switchover is achieved in 10 ms or less inthe actual design of the operational function. The conceptof hot standby for operational function is effective inautonomous driving systems that require high-speed
switching, especially drive motor control systems,
steering systems, and detection, cognition, and judgment
systems.

3. Verification of Autonomous Driving
System Issues
In response to the issues described in the previous
section, we built a prototype product (steering systemprototype controller) that incorporates the steering systemarchitecture shown in Fig. 4. We verified this prototype
through a bench test or using a simulator and actual
vehicle. The verifications discussed in this section werecarried out with reference to Section 8 of ISO 26262-4:
2011 “Item integration and testing”. Table 2 shows thelist of test environments constructed in this theme.

46

Operational function Motor drive command(main)
Pre-driverCommunication
Control parameters
Operational function
(sub)

Power
element

Two-system motor
Motor

Switchover
function
Pre-driverStandby＜Hot standby＞
・Sub operation timing = synchronize with the main・Conforms the internal state of main with subPowerelement

Motor：Intended Functionality：Safety Mechanism：Flow of signal during normal time
：Flow of signal during standby

Fig. 5 Concept of hot stand-by for operational function

3. 1 Verification on a Steering Angle Control
System Bench (Bench Test)
The purpose of bench verification is to evaluate
the implementation and performance of the Safety
Mechanisms (SM) incorporated in the steering systemprototype controller. Using the steering angle control
system bench shown in Table 2, a simulated failure wasinjected into the relevant function of the steering systemprototype controller, and the fault detection and switchingprocedures were evaluated to see if they were working
as designed. The test cases required for evaluation wereprepared with reference to ISO 26262-4:2011 8.4.1 and8.4.3. In this report, in relation to the fail-operationalin the case of operational function failure (the issue
described in Section 2. 2), Fig. 6 and Fig. 7 show the
failure injection method and confirmation results.
Figure 7 shows that, by injecting a simulated failure
into the operational function (main), a failure is detected
and the output of the operational function (main) is
stopped within the function continuation period required
to avoid deviation from traffic lane T c (240 ms), andthe output to the motor (PWM signal) switches to theoperational function (sub). This indicates that the SMs
implemented based on each Safety Requirement arefunctioning as intended. Furthermore, for this theme, we
confirmed that fail-operational existed for not only the

JTEKT ENGINEERING JOURNAL English Edition No. 1017E (2020)Safety Design of Steering Systems for Autonomous Driving

Table 2 List of testing environments
Features of the evaluation environment
Automatic
steering
function

Road load

Surrounding
environment

Vehicle movement

Driving
sovereignty

Steering angle
control system
bench

Controller+ motor

Load motor

−

−

−

Autonomous driving
simulator

Controller+ motor

Load motor +scenario
preparation tool

Scenario
creation tool

Vehicle motion
simulation tool

SystemActual vehicle
evaluation

Controller+ motorActual road load

Actualenvironment

Actual vehicle

System

Evaluation
environment[Safety Mechanism (fail-operational movement)]
Motor drive command switches from operational function (main)
to operational function (sub)[Simulated failure injection method]
・Add failure injection message to CAN
・Add operational result compare error occurrence mechanism to the operational function (main)⇒Compare error occurs when the external trigger from thecomputer is received by the operational function
Failure occurs
CAN bus A
CAN bus B

CAN
I/F
CAN
I/F
CAN
I/F
CAN
I/F

Operational function(main)

Position detector
Current detector

Motor drive command

Communication
Operational
function(sub)

Position detectorPowerelement

Pre-driver

Motor

Switchover
function
Switchover

Motorrotation
angle
sensorPowerelement

Pre-driver

Current detector
Position detector

Steering angle sensor

Motor
Two-system
motor

CAN ：Controller Area Network
I/F ：Interface：Intended Functionality：Safety Mechanism：Flow of signal during normal time

Fig. 6 Fault injection method to the operational function

operational function, but also for all implemented SMs,
however a description of this is omitted in this report.

3. 2 Verification in an Autonomous Driving
Simulator
The purpose of verification in a simulator is to checkthe accuracy of the time from failure to deviation fromtraffic lane calculated in Section 2. 1 (FTTI), andevaluate the impact of the Safety Mechanism (SM)required for fail-operational on the behavior of theautonomously-driven vehicle. These details are describedin Sections 3. 2. 1 and 3. 2. 2 below. First, Fig. 8 shows
the configuration of the autonomous simulator.
As Fig. 8 shows, the scenario creation tool creates thevehicle’s travelling scene and describes vehicle behavior,
while the vehicle motion simulation tool calculates thevehicle motion from the given vehicle control value,vehicle specifications, and road conditions. The integrated

JTEKT ENGINEERING JOURNAL English Edition No. 1017E (2020)

Injection
Simulated failure injection
Delegation of authority(main → sub)Operational function (main)
motor output flag

250 ms＜240 ms

Operational function (sub) starts motor control
Stop
Determination

Failure determination
Motor drive command(main)

Stopped due to failure determination
Continuation of motor drive command

Motor drive command(sub)Time㻘㻌ms

Fig. 7 Fail-operational confirmation result47Safety Design of Steering Systems for Autonomous DrivingSteering control system (steering system hardware)

Motor drive
Load motor
Road reactive unit
Motor drive
torquecurrent
commandIntegrated environment
Scenario creation tool

Steering angle
sensorSteering angle
Encoder

Motor drive
Steering angle current

SteeringcolumnSteering wheel

Steering angle
Reductiongear
Two-system motor
Motor rotation angle sensor
Motorrotation angle

Vehicle motion simulation toolPowersupplySteering angle command (CAN)

Power

Failureinjection Data
Data

Steering system prototype controller

Computer for
integrated environment

Computer for CAN tool

CAN：Controller Area Network

Fig. 8 Diagram of an autonomous simulator

Center of whiteline to the leftSteering angle

Target trajectoryCenter of whiteline to the right
Vehiclecenter-of-gravity：SensorSymbol for distancemeasurement
using sensor

If the white line center or target trajectory is (relative to the vehicle front)on the left: + (positive) value output
on the right: (negative) value output
However, vehicle right side sensor senses the center of white line to the rightSensor on vehicle’s left side senses the center of white line to the left.

Fig. 9 Measurement sensor mounting positions

environment is a collaboration between the two tools
described above, and communication is performed withelements outside of the integrated environment (steeringsystem hardware), thus ultimately simulating a state ofautonomous driving.
Next, we show the sensing method for measuring thedeviation of the autonomously-driven vehicle from traffic
lane. Sensors were added to the vehicle in the scenario
creation tool in a total of five locations; the front left,
front right, back left, back right, and vehicle center-ofgravity in order to make it possible to measure the shortest
distance between the boundary line of the vehicle’s
own lane (hereinafter “white line center”) and the target
trajectory (see Fig. 9 and 10). The sensor attached to theright side of the vehicle senses the distance to the centerof the white line to the right, and the sensor attached to
the left side of the vehicle senses the distance to the centerof the white line to the left. If the object (white line centeror target trajectory) is on the left relative to the front side

48of the vehicle, the sensor outputs a + (positive) value and,
alternatively, if the object is on the right relative to thefront side of the vehicle, the sensor outputs a – (negative)
value. Also, the value is + (positive) when the steering
angle is counterclockwise.

Radius of curve：380 m
Design vehicle speed：100 km/h
Width：3.5 m

Fig. 10 Vehicle behavior confirmation screen

JTEKT ENGINEERING JOURNAL English Edition No. 1017E (2020)Safety Design of Steering Systems for Autonomous Driving

3. 2. 1 FTTI Accuracy Verification

simulating a left turn on a general road verifiable using
the same model was also used for reference evaluation.
Table 4 shows a comparison between the value
calculated in the bench test in Section 2. 1 and the resultof confirmation in a simulator carried out in this section.
Moreover, Fig. 11 is a graph showing some of these result
plotted identically.
From Table 4, when comparing the value calculated
in the bench test and the simulation results, it can be
confirmed that Ta, which has a high contribution to FTTI
(the time until the autonomously-driven vehicle starts todeviate from the normal trajectory until it overlaps thecenter of the white line: See Fig. 2) demonstrates similar
characteristics when it is assumed that the vehicle istravelling on an expressway. This represents the static
behavior of the vehicle assuming that Ta is in a straightdirection, and can be calculated using a simple vehicle
motion equation. In addition, in the expressway where theradius of curve is larger than a general road, the steering
angle in a maintained-steering state is small while driving

This section discusses the results of confirming
the accuracy of the time from the failure occurring todeviation from the traffic lane (FTTI) calculated by the
bench test in Section 2. 1 using the autonomous driving
simulator. As shown in Section 2. 1, the FTTI at the timesteering failure occurs indicates the time from simulated
fault injection during turning and steering to the time
it takes for the vehicle to deviate from the center of thewhite line. The occurrence of steering failure by simulator
was configured to send a stop operation commandfrom the outside to the steering system controller. The
steering system controller that receives the stop operationcommand stops the driving current to the motor, which
in turn eliminates motor torque, resulting in a steering
failure condition during travel. Using this steering failure
generation method, we confirmed the accuracy of the
FTTI calculated in the bench test in addition to thedriving conditions shown in Table 3. Here, in addition
to the expressway condition of Table 1, the condition

Table 3 Autonomous driving conditions (FTTI confirmation)
Road conditions
Radius of
Design vehicle
curve, m
speed, km/h

Place

Expressway

Generalroad

Width, m

380

100

3.50

230

80

3.50

88

50

3.25

15

20

3.50

Travelling
model

Reference
Government Orderon Road DesignStandards
Government Orderon Road DesignStandards
Sangubashi,
Metropolitan
Expressway
Government Orderon Road DesignStandards

R

Table 4 FTTI comparison results

Place

Road conditions
Radius of
Design vehicle
curve, m
speed, km/h
380

Expressway

230
88

General
road

15

100
80
50
20

Width,m

Steering
angle, °

3.50
3.50
3.25
3.50

16.80
21.90
40.60
185.40

FTTI calculation result
Environment

FTTI, s

Ta, s

Tr, s

Bench test

0.99

0.85

0.14

Simulator

1.08

0.85

0.23

Bench test

0.91

0.80

0.11

Simulator

1.06

0.85

0.21

Bench test

0.74

0.67

0.07

Simulator

1.03

0.74

0.29

Bench test

0.59

0.56

0.03

Simulator

1.23

0.99

0.24

Bench test: Bench test calculation result
Simulator: Autonomous driving simulator result

JTEKT ENGINEERING JOURNAL English Edition No. 1017E (2020)49Safety Design of Steering Systems for Autonomous DrivingRadius of curve 380 m
20
Steering angle, °Autonomous driving simulator
Bench test calculation result

Steering failure occurrence

15
10

Neutral position

5
0
5
10
60

61

62

63

64

65

Distance between vehicle and centerof white line to the right, mTime, s0Autonomous driving simulator
Bench test calculation result

0.2
0.4

0.99 s0.6

Deviation from traffic lane

1.08 s

0.8
1
60

61

62

63

64

65

Time, sSteering angle, °Radius of curve 88 m
45
40
35
30
25
20
15
10
5
0
49

Autonomous driving simulator
Bench test calculation result

Steering failure occurrence

Neutral position
50

51

52

53

54

Distance between vehicle and centerof white line to the right, mTime, s00.74 sAutonomous driving simulator
Bench test calculation result

0.2
0.4

Deviation from traffic lane

1.03 s

0.6
0.8
1
49

50

51

52

53

54

Time, sRadius of curve 15 m

Steering angle, °200

Autonomous driving simulator
Bench test calculation result

Steering failure occurrence

150
100
Neutral position

50
0
64

65

66

67

68

69

Distance between vehicle and centerof white line to the right, mTime, s0Autonomous driving simulator
Bench test calculation result

0.59 s0.2
Deviation from traffic lane

0.4

1.23 s

0.6
0.8
64

65

66

67

68

69

Time, sFig. 11 FTTI comparison diagram（excerpt）

50

JTEKT ENGINEERING JOURNAL English Edition No. 1017E (2020)Safety Design of Steering Systems for Autonomous Driving

3. 2. 2 Confirmation of Effect of Fail-operationalon Behavior of an Autonomously-driven
Vehiclein a circular curve, and the time to return the steering
angle to the vicinity of neutral by SAT is short. This is
one of the reasons why correlations appeared in Ta.
On the other hand, as Fig. 11 shows, the result in theautonomous driving simulator assuming a general roadwith a radius of curve 15 m, is that the autonomouslydriven vehicle departs from its own lane before thesteering angle returns to a position in the vicinity ofneutral. Therefore, in conditions where the steering angle
before steering failure is large, such as at low speed, there
is a need to add the interval placed as zero seconds underthe bench test calculation condition (time for steering
angle to reach neutral position by Self Aligning Torque(SAT) from a maintained-steering state). Moreover, it
can be seen that the difference between the FTTI of thebench test calculation result and the autonomous driving
simulator result increases as the vehicle speed decreases
and the steering angle increases.
From the above results, it can be established that FTTI
can be a reference value even in bench test calculations
using a simple formula under conditions assuming
expressway travel, however to widen the vehicle travelling
conditions to the low speed range assuming a generalroad, it would be necessary to confirm using a simulator.

Radius of curve: 380 m

This section describes results of a verification utilizing
an autonomous driving simulator to ascertain the presenceor absence of a Safety Goal (SG) violation (deviationfrom traffic lane) in the period between a fail-operational
operation due to injection of a simulated failure until the
posture of the autonomously-driven vehicle stabilizes.
In regards to the travelling scene for the verification,
the same conditions as Table 3 in Section 3. 2. 1 wereselected, and simulated failures during turning were
injected in each scene. Some of the confirmation results
are shown in Fig. 12. A simulated fault is injected into theoperational function (main), and other injection results
are omitted.
From Fig. 12, the vehicle behavior at the time of failoperational due to failure of the operational function canbe confirmed to not have reached the point of deviationfrom the traffic lane as there is no variation in thetravelling trajectory (the shortest distance between eachof the vehicle’s four corners and the center of the whiteline) before and after the simulated failure injection. As
with the verification results by the steering angle control
system bench in Section 3. 1, this is believed to be

Fail-operational based on failure injection (< 10 ms)

Steering angle, °18
8Steering angle
Steering angle command value

16
6
14
4

No change in steering angle

12
2
10
0
8
6
62

63

64

65

66

67

68

69

70

71

72

Distance between vehicle
and white line to left, m

Time, s1

Front left
Back left

0.95

No change in vehicle behavior

0.9
0.85
0.8
62

63

64

65

66

67

68

69

70

71

72

Distance between vehicle and centerof white line to the right, mTime, s

0.7

Front right
Back right

0.75
0.8

No change in vehicle behavior

0.85
0.9
62

63

64

65

66

67

68

69

70

71

72

Time, sFig. 12 Results of confirming vehicle behavior through fail-operational

JTEKT ENGINEERING JOURNAL English Edition No. 1017E (2020)51

Safety Design of Steering Systems for Autonomous Driving

because the transition from operational function (main) to
operational function (sub) is completed in 10 ms or less,therefore there is no effect on the vehicle behavior.
Thus, by using a simulator, it is possible to easily
simulate autonomous driving scenes, as well as confirm
the behavior of the fail-operational and autonomouslydriven vehicle in the event of a failure with good
reproducibility even in high-risk and severe conditions.
In the future, as the development of autonomous driving
accelerates further, we believe that the examples ofproblem verification shown in this section will be useful.

Autonomous
driving system

Steering systemprototype controller

3. 3 Verification on an Actual Vehicle

52

Steering column

Fig. 13 Actual vehicle for autonomous driving

Distance between vehicle
and white line to left, m

2

Fail-operational based on failure injection (< 10 ms)
No change in vehicle behavior

1.6
1.2
0.8

Front left
Back left

0.4
0
77

77.5

78

78.5

79

Time, sDistance between vehicle and centerof white line to the right, m

Verification on the actual vehicle was carried out fromthe position that it was the final confirmation of the ISO
26262 V-shaped model. The purpose of this verification is
to confirm the effectiveness of each verification methodby comparing the bench test calculation results andthe autonomous driving simulator verification results
described in each section.
The autonomous driving system mounted on theactual vehicle utilizes open source autonomous driving
control software based on a real-time OS (Operating
System) and is equipped with a LiDAR (Light Detection
and Ranging) on its peripheral environment recognition
device so that the vehicle can grasp its own position. In
addition, the steering system is equipped with columntype electric power steering including a steering systemprototype controller with fail-operational, and a motor.
Figure 13 shows the autonomously-driven vehicle usedfor verification.
Measurement of the distance between theautonomously-driven vehicle and the center of the whiteline was performed using a 3D map and the same sensing
as Fig. 9, while travelling conditions were made the sameas the general road condition of Table 3 to match thecomparison conditions with simulation results. Figure 14
shows the results of confirming actual vehicle behavior
when a simulated failure is injected into the operational
function (main), and Fig. 15 shows comparison resultsof the bench test calculated value, autonomous driving
simulator value, and actual car measurement value forthe time from the failure occurring to deviation from thetraffic lane (FTTI).
In Fig. 14, the vehicle behavior at the time of failoperational due to failure of the operational function(main) can be confirmed to not have reached the pointof deviation from the traffic lane as there is no variationin the travelling trajectory before and after the simulated
failure injection. This is roughly consistent with theverification results obtained from the autonomous driving
simulator in Section 3. 2. 2, and the transition from theoperational function (main) to the operational function(sub) is also the same on the actual vehicle as it can be

LiDAR

0

No change in vehicle behavior

0.4
0.8
1.2

Front right
Back right

1.6
2
77

77.5

78

78.5

79

Time, sFig. 14 Results of confirming vehicle behavior throughfail-operational (Actual vehicle evaluation)completed within 10 ms, therefore does not affect vehicle
behavior.
The three portions of Fig. 15 show comparison results.
15 (a) shows a comparison of steering angle command
value and steering angle, (b) shows a comparison of the
distance between the vehicle’s front right and center ofwhite line to the right, and (c) shows a comparison of
the distance between vehicle center-of-gravity and target
trajectory. This is adjusted to suit the graph’s time axis (xaxis) whereby the time of steering failure occurrence iszero seconds.
Figure 15 (b) shows that the time from steering failure
occurrence to the deviation from traffic lane (FTTI)
is close to the results obtained in the actual vehicle
evaluation and autonomous driving simulator. However,if the data before zero seconds before steering failure

JTEKT ENGINEERING JOURNAL English Edition No. 1017E (2020)Safety Design of Steering Systems for Autonomous Driving

350
Steering angle, °300
Steering angle (actual vehicle)
Steering angle command value(actual vehicle)
Steering angle (simulator)
Steering angle command value(simulator)
Steering angle(bench test calculation result)

250
Actualvehicle

200
150
100
50
0
3

Bench test
calculation Autonomous
driving simulator

Steering failure occurs
2

1

0

1

2

3

Time, sDistance between vehicle
and center of white line to the right, m(a) Steering angle command value and steering angle
0
0.2
0.4
0.6
0.8
1
1.2
1.4
1.6
1.8
2
3

Deviation from traffic lane

Bench test
calculation result

Simulator

Actual vehicle

Steering failure occurs
2

1

0

1

2

3

Time, sDistance between vehicle
center-of-gravity and target trajectory, m(b) Distance between vehicle front right and center of white line to the right
2
1.8
1.6
1.4
1.2
1
0.8
0.6
0.4
0.2
0
3

Bench test
calculation result
Actual vehicle
Simulator

Steering failure occurs

2

1

0

1

2

3

Time, s(c) Distance between vehicle center-of-gravity and target trajectory

Fig. 15 Difference due to evaluation environments(FTTI results)

is observed, it is apparent that the distance between thefront right of the vehicle and the center of white line to
the right varies in the respective evaluation environments.
This is because the vehicle slip angle is different during
circular curve travel, and when accuracy is improved, it isnecessary to combine the parameters of the autonomous
driving simulator side.
Figure 15 (c), in contrast to Fig. 15 (b), represents
the vehicle behavior without the influence of vehicle
slip angle. From Fig. 15 (c), it can be construed that,in an actual vehicle, although the distance with thevehicle center-of-gravity before steering failure andthe target trajectory is not consistent and there is room
for improvement, the vehicle behavior after steering
failure occurs shows the same characteristics as thevehicle behavior observed in the autonomous driving

JTEKT ENGINEERING JOURNAL English Edition No. 1017E (2020)

simulator. In other words, it is possible to obtain the samecharacteristics of vehicle trajectory in the simulator andthe actual vehicle. Therefore, when deciding whether to
use a simulator or an actual vehicle, it is desirable to use
the suitable one for the specific application to be verified.
See Section 3. 2 for a comparison between the bench test
calculation result and the simulation result.

4. Conclusion
In this paper, we described case studies of the results ofthe consigned project from Japan’s Ministry of Economy,
Trade and Industry. Section 2, using the steering system
as an example, discussed the concept of time from failure
to deviation from traffic lane (FTTI), a requirement toverify Safety Mechanism (SM) taken from the safety
design and issues relating to autonomous driving systems
extracted from ISO 26262:2011, as well as the benchtest calculated value thereof. In addition, a case study
was provided regarding a safe switching method (hotstandby) in the event of an operational function failure.
Furthermore, in Section 3, in relation to autonomous
driving system issues, we were able to construct
verification environments for bench test, autonomous
driving simulator, and actual vehicle respectively, andconfirm safety design, as well as the effectiveness of eachverification method.
These results are available to the general public throughthe Ministry of Economy, Trade and Industry, and wehope that it will be useful supporting data for individualcompanies and demonstration projects that will startdeveloping autonomous driving technology in the future.

5. Acknowledgements
The results of this research were obtained fromthe FY2014/2015 Next Generation Advanced Driver
Assistance System Research and Development and
Demonstration Project, FY2016 Smart Mobility System
Research, Development and Demonstration Project,
and the FY2017/2018 Research and Development and
Demonstration Project for the Social Implementation ofAdvanced Autonomous Driving Systems. We would liketo express our gratitude to the Japan Automobile ResearchInstitute, a general foundation corporation from whom
we received a great deal of cooperation in conducting thisresearch.

53

Safety Design of Steering Systems for Autonomous Driving

N. KAIHARA*

K. KIMURA*

A. ISHIHARA**

H. NAKAMURA****

Future & Frontier Research Dept., Research &Development Division** S y s t e m s I n n o v a t i o n R & D D e p t . , R e s e a rch &Development Division*** ITS Research Dept., Japan Automobile ResearchInstitute

54

JTEKT ENGINEERING JOURNAL English Edition No. 1017E (2020)