Siemens PLM Software

Understanding the moveto intended functionality
in autonomy
Executive summary
The autonomous revolution is disrupting the automotive market and bringing new opportunities to a range of actors, from automotive and techcompanies to local and national governments. However, major challenges
loom, including the certification of the safety of cars that increasingly
think and act for themselves, even as they are more connected than everto the internet. This paper briefly surveys the responses to these challenges from the global technical and regulatory communities. The paper
was prepared for a September 2018 workshop convened by the Centre ofExcellence for Testing and Research of Autonomous Vehicles – Nanyang
Technological University (CETRAN), the Singapore Manufacturing
Federation – Standards Development Organisation (SMF-SDO) and theLand Transport Authority of Singapore (LTA).
Joseph Dailey
Global Functional Safety Manager, Mentor product suite
Gwen Van Vught
Director of the Mobility Center, TASS International, a Siemens Business
Ajinkya Bhave
Engineering Manager, Siemens Industry Software
www.siemens.com/simcenter

White paper | Understanding the move to intended functionality in autonomy

Vehicles are famously morphing from purely mechanicalhorseless carriages to software-driven computers onwheels. As electronics have taken on an outsized role indesigning and building cars, the engineering community has responded as it always does, by adopting standards, including ISO 26262, 21448, 21434 and J3061.
All of these are regular fare in articles and op-eds in theindustry trade press. “With specs like ISO 26262,...a big
burden goes onto you developers to show that what
you’ve created is safe,” wrote Bryon Moyer, in an August27, 2018 article in Electronic Engineering Journal, ineffect summarizing the demands of most standards
grappling with autonomy.
For the uninitiated, here is a brief summary of thesestandards.
ISO 26262, which covers the functional safety of vehicle
electrical and electronic systems, dates to November
2011. The standard covers all parts of the product lifecycle, from requirements management and planning
through manufacturing and testing. It also has transformed organizational safety cultures, which now often
require that everyone from company president to line
engineer participate in ISO 26262 training. While itdefines how to conduct critical analysis and helps

establish engineering best practices, ISO 26262 of late
has run into challenges thanks to the rise of nondeterministic, artificial intelligence (AI) systems. In suchsystems, with underlying algorithms that teach themselves, the straight-through line from input (such asvehicle sensor data) to output (like a given driving
decision), is broken – a major hurdle to the if/then-type
testing at the heart of ISO 26262 and indeed mostengineering testing practices.
Other standards relevant to autonomy concern cybersecurity, a major topic for all connected devices. The
global cost of cybercrime is now $600 billion annuallyor 0.8 percent of global GDP, according to cybersecurity
firm McAfee. In announcing the Mcity Threat
Identification Model in early 2018, University ofMichigan mechanical engineering professor Huei Pengsaid: “Without robust, fool-proof cybersecurity forautonomous vehicles, systems and infrastructure, aviable mass market for these vehicles simply won’t
come into being.”
The standards to watch here are J3061, a guidebook ofbest practices from SAE International published in 2012,
and the in-development ISO/SAE 21434, which will
include a list of specifications and requirements for

The ideal remains to approach fully autonomous Level 5 driving that ishands-free in all scenarios.

Siemens PLM Software2White paper | Understanding the move to intended functionality in autonomy

3URGXFWLRQGHYHORSPHQW$GYDQFHGGHYHORSPHQW,WHPGHILQLWLRQ)XQFWLRQDODQG
V\VWHP
VSHFLILFDWLRQ)XQFWLRQDOGHVFULSWLRQ

2(06\VWHPGHVFULSWLRQ
+$5$
7$5$

5HVLGXDOULVNHYDOXDWLRQ627,)YDOLGDWLRQ9HKLFOHHYDOXDWHXQNQRZQ YDOLGDWLRQWHVW
XVHFDVHV627,)+$5$627,)ULVN
LGHQWLILFDWLRQ
DQGHYDOXDWLRQ+D]DUGRXVXVH
FDVH
LGHQWLILFDWLRQV LVQ&R)XQFWLRQDOVDIHW\DQG
VHFXUHFRQFHSW627,)
IXQFWLRQDO
FRQFHSWPLWLJDWLRQYHULILFDWLRQ

6\VWHPYDOLGDWLRQ627,)YHULILFDWLRQ
DQG
HYDOXDWH
LQWHJUDWLRQWHVWNQRZQXVHFDVHVFKF\WHQ

7HFKQLFDOVDIHW\ )XQFWLRQDOLPSURYHPHQWVWR
DQG
UHGXFHULVN
VHFXUHFRQFHSWVHFN

7LHU)XQFWLRQDOVDIHW\DQGVHFXUHDVVHVVPHQW627,)9DQG9VWUDWHJ\+DUGZDUHDQGVRIWZDUHGHYHORSPHQW627,),62SURFHVV,62SURFHVV,62SURFHVV

7LHUV+DUGZDUHDQGVRIWZDUHYHULILFDWLRQDQGTXDOLILFDWLRQ+DUGZDUHDQGVRIWZDUHLPSOHPHQWDWLRQ

How the SOTIF ISO 21448 might enhance the v-cycle of hardware andsoftware development and verification.

cybersecurity components and interfaces, and govern
activities such as engineering, production, operation,
maintenance and even decommissioning of connectedcomponents. A final version is expected in late 2019.
A major question today is how to combine existing best
design practices and simultaneously adopt new design
and testing techniques required to build ever moreadvanced autonomous vehicles. One response to thisquestion is ISO 21448, currently under development.
ISO 21448 attempts to outline how to deal with Safetyof the Intended Functionality (SOTIF) of the electronicguts of self-driving cars. The standards committee istrying to cast a wide net – the better to deal with all theelectrical and mechanical systems coming from anincreasingly diverse supply chain. The standard will
outline a long list of scenes, scenarios and triggers thatin some combination invoke a human and AI response“behind the wheel.” It is very much a work in progressand even when the standard is eventually published,ISO 21448 won’t answer all or even most of the safety
questions about AI-powered vehicles. However, it will

Siemens PLM Software

provide a defined roadmap to get to a Level 2autonomy.
Of course, the ideal remains to approach fully autonomous Level 5 driving that is hands-free in all scenarios.
Getting there requires innovation at each stage of theproduct lifecycle, from concept to design to manufacturing to testing. And most of all, its hinges on establishing trust with the public at large that a vehicle cantruly think and react like a human – or rather, that avehicle can respond 10 to 100 times better than ahuman in all circumstances.
Implications of AI
The quest for full AI control may well redefine who sits
atop the auto industry. “Automakers always owned the‘secret sauce’ of the vehicle,” says Tom Mayor, Industrial
Manufacturing Strategy Practice Leader at KPMG, in a
November 2016 report. “But with deep learning, somebody else has it, and for car companies to control thealgorithms driving the vehicle, they will need the people
who design them. The problem is, deep learning specialists are not exactly flocking to the auto industry.”

3White paper | Understanding the move to intended functionality in autonomy

Indeed, talent is the new arms race, for startups, global
companies and even governments. The reality is there
are precious few people capable of building advanced
AI systems. In the auto industry, the major effort today
is how to combine deep reinforcement learning systems, AI and real-world data in closed-loop simulations.
For now, this is about creating a list of discrete, smallscale scenarios and responses by hand, then runningthese through a neural network, which learns the correct response. Once this learning is complete, the network can be given more complicated scenarios requiring more sophisticated decision-making.

events. At Siemens and elsewhere, researchers are not
only extracting data into scenario databases, but also
starting to perform statistical analysis of parameters to
begin testing these unknown scenarios in a disciplined,
mathematical way. Completing such a testing regime
on test tracks and public roadways would take many
billions of miles and likely permanently forestall thedevelopment of truly hands-free driving.

“Automakers always owned the ‘secret sauce’of the vehicle. But with deep learning, somebody else has it, and for car companies toEventually, the goal is to go beyond vehicle subsystem
control the algorithms driving the vehicle,
and full-vehicle simulation to bring in even city-scaledata, which is possible given the ongoing effort tothey will need the people who design them.
instrument and digitize everything. The algorithms can
The problem is, deep learning specialists
be optimized for this more robust dataset, corresponding both in closer detail and at a larger scales to the real are not exactly flocking to the autoworld. Then the systems will get smarter still by tweakindustry.”ing parameters of all this real-world data to begin simulating and learning about unexpected corner-case

Tom Mayor, Industrial Manufacturing Strategy Practice Leader at KPMG

Singapore at night. The city-state made news in summer 2018 for building
a dedicated town for testing self-driving buses. Today’s wide-open regulatory environment presents an opportunity for many jurisdictions andcountries, but this will not last long.

Siemens PLM Software4

White paper | Understanding the move to intended functionality in autonomy

Screenshot from the 2018 Siemens on-demand webinar, “Designing autonomous vehicles for series production.” See https://youtu.be/fdifp6G38ak.

Even in the most optimistic scenarios, roadways with
Level 5 autonomous vehicles in large numbers are still
far in the future. The likely reality will be a decades-longinterregnum where humans and machines share thedriving task. The AI-to-human handoff is fraught, though
the outlines of the new mode of driving are alreadyapparent today. AI will drive the vehicle until encountering a situation beyond its ken, then will give control to
the human driver, maybe after a deterministic safety
layer slows down the vehicle and pulls over to the sideof the road. This is good news from the testing point ofview, as the rigid if/then safety layer conforms nicely tothe traditional verification approach in automotive,
which has proven remarkably effective through theyears in boosting vehicle safety. Look for methodologies
that comprehend this reality – AI systems switching to ahighly deterministic mode that executes a safe action
when specific safety scenarios are encountered.
Regulations (or lack thereof)
How will the industry certify the safety of these systems
to governments? This is a huge topic today. Just because
a company reports some combination of millions ofactual and billions of simulated miles, that doesn’t

Siemens PLM Software

guarantee the safety of their vehicles. It seems inevitable that there will be varying requirements for confined operational design domains (ODDs). And each setof these requirements likely will require loads of dataaround disengagements, much as are reported today in
the California DMV’s disengagement reports, which are
pored over by the press. Part of such a hypotheticalrequirement could be that the system is not deemedsafe if it exceeds one disengagement per 10,000 miles
in a given ODD. In the California data, currently Waymo
has the lowest rate at 0.18 disengagement per thousand
miles, while the next closest is Cruise Automation at 0.8
disengagements per thousand miles.
The disengagement data is just one example of how theindustry is attempting to regulate itself while innovating, a dance unfolding against a backdrop of uncertain
but sure-to-come government regulations. One of thesignal issues in recent years was the 2016 decision ofthe U.S. National Highway Traffic Safety Administration
to declare that the computers controlling an autonomous vehicle are the same as a human driver. The
announcement generated headlines globally and also
perhaps created more questions than it answered.

5White paper | Understanding the move to intended functionality in autonomy

Notably, it was an endorsement, explicit or otherwise,of Google’s proposal to create a human-out-of-the-loop
self-driving car without controls like a steering wheel,
brake or accelerator.

“At this point, researchers admit that they do
not completely understand how the deeplearning networks make decisions.”
John Markoff, New York Times science and technology reporterIn covering the story, veteran New York Times scienceand technology reporter John Markoff outlined theongoing uncertainty, which if anything is more pronounced today, due to ongoing advances of hardware
and software technology:
The legal challenges that artificial intelligence willpose have become more complex as technology
has advanced. It was once fashionable to say thatthe machines would only do exactly what they
were programmed to do. And if the human programmer made an error, such as misplacing adecimal point, that would be expressed in someincorrect behavior on the machine’s part.
However, recent progress in artificial intelligencehas largely been made with so-called deep learning algorithms. This is a branch of machine learning that is based on software composed of multiple processing layers, each with its own complex
structure. The programs are “trained” by exposing
them to large data sets. They are then able toperform humanlike tasks, such as categorizing
visual objects and understanding speech.

learned the reality of the new systems. Even one unnecessary death is too many, though inevitably lives will belost as new forms of vehicle automation take hold.
Given the current data on vehicle accidents globally(1.3 million deaths annually, and as many as 50 million
people injured or permanently disabled), the key isremembering the potential to save vastly more lives.
As autonomous development continues apace, safety is
everyone’s utmost concern. Ongoing work to bring
multiple standards together must account for the eventual ascendance of nondeterministic AI algorithms thatin the near term will be buttressed by highly deterministic (and thus more easily verified) safety layers. And yes,
eventually the industry will be constrained by mandatory government regulations. At present, today’s wideopen regulatory environment presents an opportunity
for many jurisdictions and countries, but this will notlast long. Playing an outsized role in spurring development of what will be one of the most transformativetechnologies of the last 100 years means chip- to cityand even country-scale considerations for everyone,engineers and government officials alike.
As complexity mounts, so do the stakes for carmakers
and their suppliers to bring functionally safe hardware
and software components together across a productlifecycle and supply chain. Despite the promise ofautonomy, no population (and thus no government),
will accept even the perception of an unsafe self-drivingcar, let alone the reality of one.

At this point, researchers admit that they do notcompletely understand how the deep learning
networks make decisions.
Governments, and indeed all of us, should keep in mind
lessons from the airline industry, which has moved toalmost complete fly-by-wire systems. When automation
appeared on the horizon in aerospace, there was aconcerted effort to certify as much as possible about thenew systems. Safety eventually did improve, yet along
the way there were many near-misses and a handful ofwell-publicized crashes as everyone, engineers to pilots,

References

Siemens report (July 2018), “Cities in the Driving Seat Connected andAutonomous Vehicles in Urban Development,” https://sie.ag/2Mb29VT
Rosenberger, Peter (July 9, 2018), “Singapore: The world’s smartest nation
by 2030?,” The Magazine (a Siemens publication), https://sie.ag/2NUxIEV
Lauzun, Dave (June 28, 2018), “Designing Autonomous Vehicles for Series
Production: On-demand webinar,” https://youtu.be/fdifp6G38ak
Goncalves, Manny (November 22, 2016). “Deep Learning & Autonomy Will
Accelerate The Birth Of A New $1 Trillion Autonomous Mobility Services
Market: KPMG Report” (Press release.) KPMG http://bit.ly/2Qamj5j
Markoff, John (February 10, 2016), “Google Car Exposes Regulatory Divideon Computers as Drivers,” New York Times (https://nyti.ms/1XjkX5u)

Siemens PLM Software

6Siemens PLM Software
Headquarters
Granite Park One
5800 Granite Parkway
Suite 600
Plano, TX 75024
USA+1 972 987 3000
Americas
Granite Park One
5800 Granite Parkway
Suite 600
Plano, TX 75024
USA+1 314 264 8499

About Siemens PLM Software
Siemens PLM Software, a business unit of the Siemens
Digital Factory Division, is a leading global provider ofsoftware solutions to drive the digital transformation ofindustry, creating new opportunities for manufacturers
to realize innovation. With headquarters in Plano, Texas,
and over 140,000 customers worldwide, Siemens PLM
Software works with companies of all sizes to transformthe way ideas come to life, the way products are realized, and the way products and assets in operation areused and understood. For more information on Siemens
PLM Software products and services, visit
www.siemens.com/plm.

EuropeStephenson House
Sir William Siemens Square
Frimley, Camberley
Surrey, GU16 8QD+44 (0) 1276 413200
Asia-Pacific
Unit 901-902, 9/F
Tower B, Manulife Financial Centre
223-231 Wai Yip Street, Kwun Tong
Kowloon, Hong Kong+852 2230 3333

www.siemens.com/plm© 2018 Siemens Product Lifecycle Management Software Inc. Siemens and the Siemens logo
are registered trademarks of Siemens AG. Femap, HEEDS, Simcenter 3D and Teamcenter are
trademarks or registered trademarks of Siemens Product Lifecycle Management Software Inc.
or its subsidiaries in the United States and in other countries. Simcenter, Simcenter Amesim,
LMS Samtech Samcef, LMS Samcef Caesam, Simcenter SCADAS, Simcenter Testxpress,
Simcenter Soundbrush, Simcenter Sound Camera, Simcenter Testlab and LMS Virtual.Lab are
trademarks or registered trademarks of Siemens Industry Software NV or any of its affiliates.
Simcenter STAR-CCM+ and STAR-CD are trademarks or registered trademarks of Siemens
Industry Software Computational Dynamics Ltd. This document contains information that isproprietary to Mentor Graphics Corporation and may be duplicated in whole or in part by theoriginal recipient for internal business purposes only, provided that this entire notice appears
in all copies. In accepting this document, the recipient agrees to make every reasonable effort
to prevent unauthorized use of this information. All other trademarks, registered trademarks
or service marks belong to their respective holders.
73863-A7 9/18 C7