Modern Automated Driving Systems (ADS) rely on fragmented safety measures to handle faults and make driving decisions . To eradicate lethal road accidents, safety engineering has to expand beyond contemporary automotive design practices and patterns . We present a holistic safety concept unifying advanced safety measures for handling multiple-point faults and fault-free hazardous situations associated with system performance limitations. Noteworthy, we illustrate how our safety mechanism mitigates triple-point faults, which are often beyond the focus of the safety community. Furthermore, on top of handling faults in the ADS, our design can effectively react to its own faults. To reduce specification errors, we developed an executable model of the safety concept in the formal specification language mCRL2. The behavior of the model is governed by a four-mode degradation policy controlling distributed processors, redundant communication networks, and virtual machines. To keep the vehicle as safe as possible our degradation policy can reduce driving comfort or ADS availability using additional low-cost driving channels. We formalized five safety requirements in the modal mu-calculus and proved them against our mCRL2 model, which is intractable to accomplish exhaustively using traditional road tests or simulation techniques. In conclusion, our formally proven safety concept defines a holistic design pattern for ADS minimizing road fatalities .
Modern Automated Driving (AD) systems rely on safety measures to handle faults and to bring vehicle to a safe state . To eradicate lethal road accidents, car manufacturers are constantly introducing new perception as well as control systems. Contemporary automotive design and safety engineering best practices are suitable for analyzing system components in isolation, whereas today's highly complex and interdependent AD systems require novel approach to ensure resilience to multi-point failures . We present a holistic safety concept unifying advanced safety measures for handling multiple-point faults . Our proposed approach enables designers to focus on more pressing issues such as handling fault-free hazardous behavior associated with system performance limitations. To verify our approach, we developed an executable model of the safety concept in the formal specification language mCRL2. The model behavior is governed by a four-mode degradation policy controlling distributed processors, redundant communication networks, and virtual machines. To keep the vehicle as safe as possible our degradation policy can reduce driving comfort or AD system's availability using additional low-cost driving channels. We formalized five safety requirements in the modal mu-calculus and proved them against our mCRL2 model, which is intractable to accomplish exhaustively using traditional road tests or simulation techniques. In conclusion, our formally proven safety concept defines a holistic design pattern for designing AD systems .
R
Systems (ADS) rely on fragmented
(AD) systems rely on
R
make driving decisions
to bring vehicle to a safe state
R
safety engineering has to expand beyond contemporary automotive design practices and patterns
car manufacturers are constantly introducing new perception as well as control systems. Contemporary automotive design and safety engineering best practices are suitable for analyzing system components in isolation, whereas today's highly complex and interdependent AD systems require novel approach to ensure resilience to multi-point failures
R
and
. Our proposed approach enables designers to focus on more pressing issues such as handling
R
situations
behavior
R
Noteworthy, we illustrate how our safety mechanism mitigates triple-point faults, which are often beyond the focus of the safety community. Furthermore, on top of handling faults in the ADS, our design can effectively react to its own faults. To reduce specification errors,
To verify our approach,
R
behavior of the model
model behavior
R
ADS
AD system's
R
ADS minimizing road fatalities
designing AD systems