# Autonomous Driving--A Crash Explained in Detail
## 6 Software Explanation Failure in Detail
### Safety System Failure  
The most important part of the safety system was placed in the vehicle controller [31] in submodule five of the TUM software. It is described in more detail in Figure 8. The control of the vehicle was split into path-matching and low-level control parts. The path was tracked using a PD-like controller with a velocity-based gain scheduling. The low-level curvature controller was a P-controller with a feed-forward term and outputted a steering angle request. The low-level-velocity controller consisted of a P-controller, a disturbance estimator, and a feed-forward term. It outputted an overall traction force which was eventually converted to torque requests for the electrical motors of the car. In addition to the race trajectory, an emergency trajectory was provided by the behavior planner in every time-step. It had an identical path as the race trajectory but a much longer foresight horizon and a modified velocity profile. The latter decelerated the car as fast as possible to a standstill. The main intention was to cover network and planning software failures. However, the mechanism failed due to two reasons:  
1. The emergency gg-diagram was also scaled with the scaling factor. 2. The controller switched too late to the emergency trajectory. The scaling of the emergency gg-diagram was originally not implemented when we first programmed this software part. However, during the previous race event in Monteblanco, Spain we suffered a problem when driving shortly behind another car in the so called \"follow mode\". Hereby, the emergency gg-diagram was used to calculate a velocity profile which stops closely behind the position where the car in front would stop if it fully braked. This was used later in the software to determine the currently required minimum distance to the car in front. Put simply, the velocity profile ran into infeasibility when the software shortly switched from the normal part of the follow mode velocity profile (which was scaled by the scaling factor) into the emergency part of the follow mode velocity profile (which was originally unscaled) and back again into the scaled part while approaching a corner. The problem was similar to the problem in Modena but in a completely different environment. As a quick fix we decided to also scale the emergency gg-diagram when we were in Monteblanco. However, we did not track the issue and therefore introduced one of the problems into the software. However, this would not have made a huge difference because of the second problem: The vehicle controller [31] switched too late from race to emergency trajectory. This switching was done based on the following safety checks:  
* Behavior planner communication timeout \(\geq 300\) ms.
* Non-critical sensor fusion failure (fusing IMU, wheel-speed and velocity sensor information). * Vehicle sliding based on a chassis side slip threshold. * Maximum lateral control error of 3 m for longer than 300 ms. In addition, the software performed a \"hard stop\" (i.e., it applies full brake pressure) if one of the following conditions was fulfilled:  
* Communication loss to the low-level ECU. * Driving on the emergency trajectory without coming to a standstill for more than 5 s.  
The controller switched to emergency as soon as the car reached a lateral control error of 3 m which happened right before the apex of corner one before leaving the track into the gravel (Figure 9). Figure 8: Low-level control architecture. At this point is was already too late to brake the car down to a standstill even with a 1.0 scaling factor. Neither the race trajectory nor the emergency trajectory applied any further deceleration (because the algorithm assumed that the tires' friction capacity was already exploited). Therefore, the velocity controller did not see a reason to slow down the car (Figure 9). To sum it up, the Modena crash was an accumulation of coincidences together with some design weaknesses of the software. The crash did not happen because the vehicle or the engineers overestimated the physical limit.