自動車安全のためのHMI概念モデル：DESH-G
HMI Abstract Model for Automotive Safety Based on DESH-G

伊藤昌夫

Masao Ito
NIL Software Corp.
21/Oct/2016

株式会社ニルソフトウェア
nil@nil.co.jp

1Abstract▪ Now, it becomes more important that the relationshipbetween the car and the driver, because we have to think
about it partially in the autonomous car era.
▪ There is little industrial experience in this field, especially asfor safety. Because;▪ Most of the driver usually are NOT professional operator(conf. power plant)▪ The circumstances around the car are very complicated(conf. airplane, railway)▪ We propose an approach to design the abstract HMI modelin the concept phase, especially from the viewpoint ofsafety.

22

Relating Works▪ Finding Hazards and Threats▪

Masao Ito: Finding threats with hazards in the concept phase of productdevelopment. In European Conference on Software Process
Improvement, Springer Berlin Heidelberg. pp. 277-284,2014▪ Driver Model▪

Masao Ito: Controllability in ISO 26262 and Driver Model. In European
Conference on Software Process Improvement (pp. 313-321). Springer
International Publishing. pp. 313-321, 2015

▪ Preliminary Architecture▪

Masao Ito, How can we deal with the concept phase in the functionalsafety standard for automobiles ?, in proceedings of Safety-CriticalSystems Symposium 2016 (SSS'16), 2016

All works were mainly for the concpt phase of ISO 26262 (Part 3)33

item ?
• The “item” is not the system inthe meaning of ISO 26262
standard; It is an abstract
object, and a system isgenerated from the item. For
example;– The auto-cruise control
system is an item
– The ACC implemented in
the X type of a car is asystem• As for system, we have many
analyzing methods, but thereis little for the “item”.

Item

Function

SystemComponent

HW-Part/SW-Unit

ISO 26262 Part 10 Fig. 344

DESH-G model▪ DESH-G schema covers the environment, driver and goal aswell as hardware and software.

ES

Software &Hardware

Environment

GGoal
ScenarioHfactors (road, traffic,weather ...)

Activity
Activity

ActionActionTASK_ATASK_ATASK_BTASK_B

Driver

OP_A2
OP_A2
OP_B1
OP_B1

ACTV AACTV Adriver skill
driver state

Operation
Operation
OP_A1
OP_A1

OP_B2
OP_B2
OP_B3
OP_B3
OP_B4
OP_B4

D

DESH-G model555

Task Demand／Driver Capability

Safety vs. Harm Situation as forcontrollability
System Limit
Task Demand@ t = tn+1

S-zoneBreak point for
accident @ t = tn+1

D-zoneHazardous
event
occurred

Task Demand@ t = tndegradationof drivercapability

Driver Capability@ t = tm
Driver Capability@ t = tm+1

Break point for
accident@ t = tn

Variation of Individuals

Task Demand vs. Driver Capability
66

DESH-G interfaces▪ Basic schema[0] S

Ii: Interface for information
provision

GHMIDIiSinformation

Im: Interface for maneuveringImmaneuvering

Is: Interface for sensing theenvironment

IssensingE

Id

Id: Interface for reaching out
to the environment

Hdriving

Interface Schema (basic)
77

7[2] S∿d

DESH-G interfaces▪ In CACC, we have another interface to comunicate withthe other system
Other inteface(Communication channel)[1] S1∿S2
G

D

HMI

G

通信

Ii
informationSS

information

Im

Im

IsIs

maneuveringId

drivingDmaneuvering

sensingEIi

sensing

H

H

Self-CarId

driving

E

Forward-Car

Interface Schema (CACC)
888

[2] S∿dDESH-G interfaces▪ In RPA (Remote Parking Assist), the driver is outside of a car.

The system communicates with the mobile device.
[2] S∿dGDIi

HMIGIiDS

informationIm

Im

maneuvering

デバイス

Issensing

EIddriving

HInterface Schema (RPA)
999

Preliminary Architecture▪ Preliminary architcture comes from the interface with which

we argued like;

Refined Controller
OutputaController
Input
Input
Checker

Composeof threecheckblocksController

OutputChecker

Runtime Checker(Fault Detection) （Transit to safe state）

Error

Meta-architecture w/safety mechanism
101010Discussion
There is a long history of the human computer interaction in thefield of the software system.
Communication Breakdowns▪

False alarm▪

▪

a misconception on the user’s part leads her to findevidence of an error in her actions where none exists.

Garden path▪

a misconception on the user’s part produces an error in
her action with respect to the prescribed procedure, thepresence of which is masked.

Suchman, Lucy: Human-machine reconfigurations: Plans and situated actions. Cambridge University Press (2007)
1111[2] S∿dSample implementing DESH-G
リンク確立時のドライバ
状態および先行車周辺環境Foward-Car
Comm. Link
Driver StateESDCar States andEnvironment

Self-Car

Possible Information isdisplayed without
connection
Rear-Car

Display (via Ii) w/Information from other interface1212

Summary[2] S∿d▪ We identified four interfaces (i.e. Ii, Im, Is, Id) in the DESH-Gmodel. In order to think about the automobile safety,consolidation of those interfaces is important especially inthe concept phase of system development.
▪ This idea also allows us to find the hazards and introduce

the preliminary architecture.
▪ Time duration is important for the driver to make the correct

decision, if the system doesn’t show its plan in an
appropriate manner, driver might be in the state of “falsealarm” or “garden path” especially being in the D-zone.
▪ We can use the finding in the design of HCI of the computer

system when thinking about the HMI of the car.

1313