Abstract. Vehicle safety depends on (a) the range of identified hazards and (b) the operational situations for which mitigations of these hazards are acceptably decreasing risk. Moreover, with an increasing degree of autonomy, risk ownership is likely to increase for vendors towards regulatory certification. Hence, highly automated vehicles have to be equipped with verified controllers capable of reliably identifying and mitigating hazards in all possible operational situations. To this end, available methods for the design and verification of automated vehicle controllers have to be supported by models for hazard analysis and mitigation. In this paper, we describe (1) a framework for the analysis and design of planners (i.e., high-level controllers) capable of run-time hazard identification and mitigation, (2) an incremental algorithm for constructing planning models from hazard analysis, and (3) an exemplary application to the design of a fail-operational controller based on a given control system architecture. Our approach equips the safety engineer with concepts and steps to (2a) elaborate scenarios of endangerment and (2b) design operational strategies for mitigating such scenarios. Keywords: risk analysis, hazard mitigation, safe state, controller design, autonomous vehicle, automotive system, modeling, planning 1 Challenges, Background, and Contribution Automated and autonomous vehicles (AV) are responsible for avoiding mishaps and even for mitigating hazardous situations in as many operational situations as possible. Hence, AVs are examples of systems where the identification (2a) and mitigation (2b) of hazards have to be highly automated. This circumstance makes these systems even more complex and difficult to design. Thus, safety engineers require specific models and methods for risk analysis and mitigation. As an example, we consider manned road vehicles in road traffic with an autopilot (AP) feature. Such vehicles are able to automatically conduct a ride only given some valid target and minimizing human intervention. The following AV-level (S)afety (G)oal specifies the problem we want to focus on in this paper: The AV can always reach a safest possible state σ wrt. the hazards identified and present in a specific operational situation os . Background. Adopted from [4,9], we give a brief overview of terms used in this paper: We perceive a mishap as an event of harm, injury, damage, or loss. A hazard (or hazardous state) is an event that can lead to a mishap. We consider hazards to be factorable. Hence, a hazard can play the role of a causal factor of another hazard or a mishap. We denote causal factors, hazards, and mishaps-i.e., the elements of a causal (event) chain-by the term safety risk (risk state or risk for short). We perceive the part of a causal chain increasing risk as an endangerment scenario, and the part of a causal chain decreasing risk as a mitigation strategy. Table 1 exemplifies different endangerment scenarios and how these can be mitigated using corresponding strategies. Mitigation strategies can be seen as specific system-level safety requirements implemented by a given control system architecture. We assume that a control system architecture consists of features deployed on sensors, actuators, and software components running on networked computing units (cf. Fig. 4a ). By traditional driver assistance (TDA), we refer to driver assistance features already in the field, e.g. adaptive cruise control (ACC) and lane keeping assistance (LKA). We distinguish between the domains vehicle, driver, and road environment. For highly and fully automated driving, not all domains have to be considered. For example, in full automation (e.g. level 5 in [12] ), the vehicle has to operate under all road and environmental conditions manageable by a human driver and therefore a driver does not have to be taken into account.
Moreover, the authors introduced a framework for the analysis and design of high level controllers capable of run-time hazard identification and mitigation REF .
From Hazard Analysis to Hazard Mitigation Planning: The Automated Driving Case
Barrett C., Davies M., Kahsai T. (eds) NASA Formal Methods. LNCS, vol 10227. Springer
Computer Science