A Modeled Approach for Online Adversarial Test of Operational Vehicle Safety (extended version)
AA Modeled Approach for Online Adversarial Test ofOperational Vehicle Safety
Linda Capito ∗ , Bowen Weng ∗ ,Umit Ozguner , IEEE Life Fellow , Keith Redmill , IEEE Senior Member and SIAM Member
Abstract — The scenario-based testing of operational vehiclesafety presents a set of principal other vehicle (POV) tra-jectories that seek to force the subject vehicle (SV) into acertain safety-critical situation. Current scenarios are mostly(i) statistics-driven: inspired by human driver crash data, (ii)deterministic: POV trajectories are pre-determined and areindependent of SV responses, and (iii) overly simplified: definedover a finite set of actions performed at the abstracted motionplanning level. Such scenario-based testing (i) lacks severityguarantees, (ii) is easy for SV to game the test with intelligentdriving policies, and (iii) is inefficient in producing safety-critical instances with limited and expensive testing effort.In this paper, the authors propose a model-driven onlinefeedback control policy for multiple POVs which propagatesefficient adversarial trajectories while respecting traffic rulesand other concerns formulated as an admissible state-actionspace. The proposed approach is formulated in an anchor-template hierarchy structure, with the template model planninginducing a theoretical SV capturing guarantee under standardassumptions. The planned adversarial trajectory is then trackedby a lower-level controller applied to the full-system or theanchor model. The effectiveness of the proposed methodologyis illustrated through various simulated examples with theSV controlled by either parameterized self-driving policies orhuman drivers.
I. I
NTRODUCTION
A scenario-based evaluation method ”attacks” the testsubject through enforcing it into a safety-critical situationand observes the subject response and testing outcomes. Foroperational vehicle safety evaluation, especially concerningAdvanced Driver Assistance System (ADAS) [1] and Auto-mated Driving Systems (ADS) [2], the design and executionof test scenarios have raised wide attention from the researchcommunity [3], automotive industry, and government sectorsfor policy making [2], [4], [5]. Typically, one first extractsinitialization conditions and vehicle maneuvers inspired bythe statistical observation of human driver crash data. Thescenario is then specified with a given initialization state forall vehicles and a set of pre-determined POV trajectories.Note that the POV trajectory is generated through a series ofhigh-level planning commands and is often independent ofthe SV response. For example, one can refer to Fig. 1a thatshows a Lead Vehicle Lane Change and Braking (LVLCB)scenario [4] for ADAS safety evaluation.The problems of the aforementioned scenario designs arethreefold. First, the current scenarios lack severity guaran- ∗ Equal contribution The authors are with the Department of Electrical and ComputerEngineering at Ohio State University, OH, USA.Corresponding author: Keith Redmill, [email protected] (a) A standard Lead Vehicle LaneChange and Braking (LVLCB)test scenario. (b) Two example trajectories ofSV maneuvers that would ”hack”the standard LVLCB test.(c) An adversarial POV will re-strict the scenario propagation ina safety-critical status and forcethe SV into collisions if it is notresponding appropriately. (d) One option for the SV toavoid collisions from the mod-eled adversarial POV is to per-form extreme evasive maneuversthat are beyond the expectationof the formulation.
Fig. 1: Various variants inspired by the standard LVLCBscenario [4]: inspired by a commonly observed cause ofrear-end accident from human driver crash data, the POVperforms a single lane-change to get in front of the SV,followed by an immediate braking maneuver.tees. The assumption that a scenario extracted as describedabove and brought to a test track will generate similarSV responses, similar safety-critical situations, and simi-lar outcomes ignores the significant differences in sensing,control algorithms, control authority and implementation onthe different SVs being tested. Second, the pre-determinedPOV trajectories defined over simplified action space iseasy for the SV to game the test, especially given thatthe SV is operating with intelligent decision making bothlongitudinally and laterally (e.g., Fig. 1b). Finally, the currentapproach does not create sufficient safety-critical instanceswithin the limited and expensive real-world testing effort.While virtual simulations have provided the opportunityto enhance autonomous vehicle testing efficiency, the sim-to-real gap remains a challenge in general. Furthermore,the simplified action space is incapable of creating agile,dynamic maneuvers, which confines the scenario propagationto relatively simple configurations. This also limits the testingefficiency in both real-world tests and simulations.Inspired by the problems mentioned above, the adversarialadaptive testing scheme has become a natural alternative.Existing approaches mostly focus on learning inspired meth- a r X i v : . [ c s . R O ] S e p ds [6], [7], [8], which typically require the algorithmto interact with a fixed SV driving algorithm for manyiterations. These are sampling inefficient and would onlybe applicable in virtual simulations. Some also seek forguided sampling from an offline-built scenario library [3].The approach resolves the traditional scenario-based testingapproach’s problem by making SV more difficult to game thetest, but the other two problems as mentioned above remainvalid.To address the aforementioned problems of both thetraditional scenario-based testing methods and the adaptiveadversarial testing approaches, the proposed methodology isinspired by investigating the following two questions. • Q1: If we can predict the SV motion trajectory withsufficient accuracy, can we design the POV motion to reacha safety-critical scenario?
In general, if the infinite-time future planning of the SV isperfectly known and the POV is sufficiently capable in termsof its admissible space for control, the POV can guaranteeto capture the SV at least asymptotically. This is achievedby taking the known SV motion trajectory as a motiontracking reference for the POV, which naturally leads to aminimization problem closely related to the Model PredictiveControl (MPC) formulation [9]. • Q2: If the SV motion trajectory is unknown or difficultto predict, can we design the POV motion to arrive at asafety-critical scenario?
The reachability analysis from differential games [10] andoptimal control has answered the above question analytically.In general, the capture of the SV cannot be guaranteed if theSV’s policy is unknown. However, suppose the SV and POVare sufficiently close such that the relative state belongs to themaximal backward reachable set (see equation (6) in [11]).In that case, there exists a feedback control policy for thePOV such that for all possible motion trajectories of the SV,the policy renders a motion trajectory that guarantees thecapturing of the SV. By assigning such a worst-case policyto the POV, one can ensure the generation of a safety-criticalscenario.In practice, one should also factorize the admissible ac-tion constraints, operable domain allowed by traffic rules,and other concerns to propagate a ”reasonable” dangerousscenario. Combining the solutions for the above questions,we propose an online feedback control policy for POVs thatallows rendering adversarial paths without breaking trafficrules or responsibility agreement. The contribution of thiswork is threefold: a) A Modeled Approach : The proposed framework ismodel-driven and induces theoretical guarantees for a certainsafety-critical level of the derived scenario under standardassumptions. b) Adaptive Scenarios : The derived motion trajectoryof each POV varies adaptively based on the SV responsethroughout the propagation of a testing scenario. This createsmore challenging testing instances within the same amount oftesting effort than many of the current ADS testing scenariodesigns [5], [4] where the POV actions are independent of the SV behavior. The proposed adaptive framework actson the POV control level, which also creates agile motiontrajectories that are more difficult for the SV to game thescenario. c) Online Execution : The proposed method formulatesan anchor-template hierarchy control structure [12], with thesimplified template planning naturally leading to a seriesof quadratic programming problems with computationallytractable solutions. This is, to the best of our knowledge,the first introduction of an online path planning algorithmfor POVs which constructs adversarial testing scenarios.Furthermore, we extensively evaluate the proposed frame-work’s performance in a multi-lane straight-segment envi-ronment with parameterized SV driving policies and humandrivers of various levels of aggressiveness. We observe thatthe adaptive framework enforcing the SV into various safety-critical situations. One particularly interesting observation isthat the SV typically remains collision-free if (i) the drivingpolicy is conservatively safe, or (ii) the SV is willing to takeextreme evasive maneuvers that are beyond the expectationof the modeled formulation (see Fig. 1d).The remainder of this paper is organized as follows.Section II introduces the background setting of this work,including the problem formulation. Section III presentsdetails on the proposed method. Section IV explains theexperimental settings and the results analysis and finally,section V presents conclusions and future work.II. P
RELIMINARIES
We present the problem formulation of operational vehiclesafety evaluation through the scenario-based test. We alsorevisit the basics of the anchor-template hierarchy controlframework.
A. Problem formulation
Consider a heterogeneous multi-vehicle system of one sub-ject vehicle (SV) and k principal other vehicles (POVs). Eachvehicle’s motion is subject to a certain ordinary differentialequation in general. Without loss of generality, for the i -thagent ( i ∈ { , . . . , k } ), ˙ s i = f i ( s i , u i , t ) , s i ∈ S i ⊂ R n , u i ∈ U i ⊂ R m . (1)For the remainder of this section, the subscript i is omittedfor general discussions of vehicle motion. We consider thatthe map f : S × U → S is uniformly continuous, boundedand Lipschitz continuous in s for fixed control u . Hence,given a measurable control action u , there exists a uniquetrajectory solving (1) for a given u ∈ U .Let a snapshot σ ∈ S k +1 be the combined states of allvehicles at a time instance [13]. We then have the followingdefinition of a testing scenario : Definition 1.
A scenario is a automaton denoted by a tupleof (cid:104) Σ , Π , f, σ , Λ (cid:105) , where • Σ = S k +1 is the set of snapshots, with each snapshotcontaining one SV and k POVs as specified above. Π is the ”alphabet” of the automaton, in particular, thecontrol action space of all vehicular participants in thescenario, i.e., Π = U k +1 . • f is the motion transition function as defined in (1) . • σ specifies the initial condition. • Λ is the subset of Σ deemed acceptable. The acceptable set of snapshots Λ is mainly concernedwith safety and is defined as follows: Λ = { σ ∈ Σ | (cid:107) p − p j (cid:107) ≥ c, ∀ j ∈ { , . . . , k }} , (2)where p ∈ R denotes the position states and c is referredto as the capture diameter . Note that only the SV safetyis concerned. Correspondingly, the unsafe set of states isobtained as Ω = Σ \ Λ . (3)Given a string of control input, we designate the run ofa scenario be a chronological sequence of snapshots R = { σ i } i =0 ,..,T from initial to final time T .Most of the elements that define a scenario are given, withonly the initial condition σ and the automaton alphabet Π subject to various possibilities of configurations. Given thatSV control is part of the testing subject, only the POV controlactions are of interest for scenario designs. Intuitively, oneseeks to derive a feedback control policy π : Σ × U k → Σ (4)for the group of POVs such that the SV is forced into asufficiently dangerous situation. Although the POV controlis specified through a general class of functions that could bestate-dependent and time-variant, it is worth emphasizing thatthe typical implementation of the POV control in practiceremains fairly simple. POV action trajectories are mostlyindependent of state propagation, as shown in Fig. 1a.In general, the multi-vehicle system is subject to highlynonlinear motion dynamics and complex state-action con-straints. From the model point of view, it remains a challengeto derive agile motion planning algorithms for multiple POVsto cooperate in forcing the SV into dangerous situations. Inthis paper, we consider an anchor-template framework, asintroduced in the following section. B. Anchor-template framework for vehicle motion planning
When a full system model or anchor model is too complexto design an appropriate controller, it is possible to usea simplification or template model that still captures theanchor model’s essential characteristics and properties. Sucha framework has been widely adopted in bipedal locomo-tion [14] and vehicle control [15].A typical template model captures the motion feature ofthe anchor model with lower dimensional state space andsimplified dynamics. In this paper, the complex anchor modelstate is replaced with the simpler template state of discrete-time locally linearized motion equation formulated as s ( t + ∆) = As ( t ) + Bu ( t ) , (5) Fig. 2: Proposed method flowchart under the pairwise inter-active setting with one POV and one SV.with time-step ∆ and system matrices A = v ∆0 0 1 00 0 0 1 , B = ∆˜ v . (6)The state vector s ∈ R for each vehicle consists ofthe Cartesian coordinates of the position p = [ x, y ] , thespeed v and the heading angle φ . For the linearization, aconstant speed ˜ v is also used. The control action includesthe longitudinal and lateral accelerations u = (cid:2) a x , a y (cid:3) T .The model above is adapted from [16], [13] assumingsmall course angles and small changes in speed for locallinearization. Theoretically, the control input u is subject tothe Kamm’s circle [17] induced bounds. The state constraintsare typically determined by speed limits, road topology, andother concerns regarding the admissible operable domainof vehicles. In this paper, we approximate the state-actionconstraints with a linear architecture in the form of G u u ≤ h u and G s s ≤ h s . III. M ETHOD
Fig. 2 presents a general overview of the proposed frame-work. The adversarial scenario propagation starts with aninitial snapshot of the system σ . The test ends if a certaintermination condition is satisfied (e.g., encountering a colli-sion); otherwise, one executes the template-based planningstage. For adversarial motion planning, one first seeks tocreate safety-critical scenarios assuming the SV policy isunknown. If the POV-to-SV distances are not sufficientlysmall, such a worst-case planning algorithm may not beapplicable. One then moves on to the predictive planningstage, where the POV’s adversarial policy is derived based ona certain assumed predicted behavior of the SV. The plannedreference trajectory is then tracked by a lower-level controllersuch as MPC.For the remainder of this section, we introduce the worst-case planning and predictive planning in a pairwise mannerwith one POV and one SV. Without loss of generality, let theubscript denote the adversarial POV and the SV. Finally,we will extend the idea to multiple cooperative POVs. A. Worst-case planning
Intuitively, the worst-case planning stage seeks to de-rive the POV adversarial trajectory without knowing theSV intentions. By the definition of unsafe snapshots Ω asspecified in (3), starting from a safe initial condition σ ∈ Σ at time , if the pair of control strategies ( π ( σ ) , π ( σ )) renders the trajectory converging to Ω at some finite time,we denote such a capture time as T ( π ( σ ) , π ( σ ) , σ ) . Thepairwise SV and POV form a zero-sum game, wherein theSV seeks to maximize T ( · ) and POV seeks to minimize T ( · ) .Correspondingly, we have the minimax optimal feedbackstrategy π ∗ ( σ ) and π ∗ ( σ ) satisfying the saddle condition as T ( π ( σ ) , π ∗ ( σ ) , σ ) ≤ T ∗ ≤ T ( π ∗ ( σ ) , π ( σ ) , σ ) , (7)with T ∗ = T ( π ∗ ( σ ) , π ∗ ( σ ) , σ ) referred to as the minimalcapture time . Theoretically, T ∗ exists if and only if theinitialization condition σ is inside the maximal backwardreachable set [11], i.e., there exists a POV control strategysuch that regardless of the SV responses, one can ensurethe capturing of the SV. In practice, for a general nonlinearsystem, T ∗ can be obtained through a discrete approximationof the Hamilton-Jacobian-Bellman partially differential equa-tion (HJB-PDE) [18]. In this paper, we seek to derive the T ∗ ,if applicable, within a local look-ahead time horizon up to ¯ T seconds. With the simplified template dynamics, one canapproximate T ∗ by iteratively solving a series of minimaxquadratic programming problems as discussed in [13]. Onecan also derive the function of mapping a snapshot to thecorresponding T ∗ offline. Given the minimal capture time T ∗ , we can then formulate the optimal feedback policy forthe POV as ˆ u ∗ = argmin ˆ u max ˆ u (cid:107) p ( T ∗ ) − p ( T ∗ ) (cid:107) (8a)s.t. s i ( t + ∆) = As i ( t ) + Bu i ( t ) , ∀ i ∈ { , } , (8b) G s s i ( t ) ≤ h s , ∀ t ∈ { , . . . , T ∗ − ∆ } , (8c) G u u i ( t ) ≤ h u , ∀ t ∈ { , . . . , T ∗ − ∆ } , (8d) σ (0) = σ . (8e)In practice, the above optimization is solved at each planningstage presenting the current snapshot as the initializationcondition. The instantaneous reference motion trajectory ˆ s is then obtained by propagating the template-model motionfor T ∗ seconds with the sequence of optimal actions ˆ u ∗ .Note that the capturing guarantee at the template-modellevel is subject to some assumed state constraints of (8c)and action constraints (8d) of the SV. That is, the capturingwill undoubtedly fail if the SV is willing to perform extremeevasive maneuvers that are beyond its assumed capability.While such an outcome may be deemed aggressive in termsof passenger comfort and vehicle dynamic stability, it isstill technically a safe choice of action from the operationalsafety perspective. Furthermore, consider that the definitionof safety is induced by the l c . That is, a larger choice of c results in a largermaximal BRS and hence increases the likelihood of derivinga minimal capture time T ∗ . However, a wide choice of c also makes it difficult for a real vehicle-to-vehicle collisionto occur, leading to snapshots that are not sufficiently safety-critical. A more detailed comparison regarding this trade-offwill be presented in Section IV between Fig. 5 and Fig. 6. B. Predictive planning
If the worst-case planning is not applicable (i.e., onecannot find a qualified minimal capture time T ∗ ≤ ¯ T ), thisimplies the current snapshot is not severe enough to enable aguaranteed capturing. We propose to consider an alternativebased on the assumed predictive motion of the SV.Historically, vehicle motion prediction has been stud-ied extensively [19], [20]. The various self-driving algo-rithms that are model-based [21], [22], [23] and learning-inspired [24], [25] are also applicable to serve as the SVmotion predictor. In this paper, we predict the SV motionbased on the steady-state assumption. The traditional steady-state assumption assumes fixed velocity and heading (i.e.control u = ). It is also the fundamental assumptionfor various vehicle safety related methodologies includingTime-to-Collision [26] for safety analysis and human driverbehavior characterization such as gap acceptance [27] andlead-vehicle following distance [28]. In most of the examplespresented in the Section IV, we adopt a modified steady-stateassumption which assumes that the SV is maintaining thecurrent control action up to the assigned time horizon. Letsuch a predictive policy for the SV be ˆ π , one can then takethe predicted motion of the SV as the tracking referencefor the POV. With the running cost and termination costdetermined by Q r ∈ R × and Q f ∈ R × respectively,and considering ˜ s ( t ) = s ( t ) − s ( t ) , we have the followingoptimization problem for the predictive planning: ˆ u ∗ = argmin ˆ u ¯ T − ∆ (cid:88) t =0 (˜ s ( t ) T Q r ˜ s ( t )) + ˜ s ( ¯ T ) T Q f ˜ s ( ¯ T ) (9a)s.t. s ( t + ∆) = As ( t ) + Bu ( t ) , (9b) s ( t + ∆) = As ( t ) + B ˆ π ( s ( t )) , (9c) G s s i ( t ) ≤ h s , ∀ t ∈ { , . . . , T ∗ − ∆ } , (9d) G u u i ( t ) ≤ h u , ∀ t ∈ { , . . . , T ∗ − ∆ } , (9e) σ (0) = σ . (9f)The reference trajectory for the POV is generated followinga similar procedure as discussed in the worst-case planningsection.Finally, an MPC is used as the navigation controller thatallows the POV to follow the reference path obtained fromthe planning stage. It is worth emphasizing that althoughboth MPC for vehicle motion tracking and the template-model based planning rely on a certain linearized motionequation, the two formulations are not necessarily the same.n our case, the template-model adopts the formulationin (6) with the control action specified as accelerations,which are easier to identify through perceivable states withquantifiable constraints. On the other hand, the MPC adoptsthe formulation from [15] with the control action defined asacceleration a and steering wheel angle ω , which is easier toimplement for direct vehicle control tasks. The various state-action constraints deployed in the planning stage as specifiedin (8a) and (9a) are also included in the MPC formulation.Therefore, even if mild discrepancies may occur betweenthe template-model used for planning and the anchor-modeladopted for motion tracking, the constraints remain valid. C. Multi-POVs
With the adversarial pairwise interactive scenario pre-sented through sections above, we are now ready to extendthe framework to work with multiple POVs. In practice,it is overly aggressive to assume that all POVs present inthe snapshot will cooperatively attack the SV. The absolutecooperative POV planning also proposes an extra challengeto the scenario design given none of the POVs are supposedto crash into each other during the scenario propagation.On the other hand, some existing work [13] considersthe partially non-cooperative assumption, which assumesat most one adversarial POV with the rest of the POVscomplying with the SV for collision avoidance. Although thisassumption simplifies the analysis significantly and enablesa pairwise study between the SV and each POV, the partialnon-cooperativeness is still conservative.In this work, we propose a multi-POV scenario generationscheme which allows multiple POVs propagating cooperativesafety-critical scenarios in a controlled manner. This isdone by assigning each POV a dedicated set of state-actionconstraints which ensures the non-interactive motion betweenPOVs. Section IV will present more detailed examples formulti-POV adversarial scenarios propagated with the pro-posed method.IV. E
XPERIMENTAL RESULTS
We illustrate the performance of the proposed approachwith two types of simulations. We first demonstrate theadversarial testing scheme against a series of parameterizedself-driving policies in a customized simulation environment.We then expand the test to human-driven SVs performedin the CARLA simulator [29]. Throughout all simulations,we have ¯ T = 2 for the planning and MPC horizon limit.We also assume an identical admissible action space for allPOVs and the SV with a max x = 0 . , a min x = − . , a max y =1 , a min y = − . Considering the straight-segment environmentwe are studying, the cost matrices in (9a) are defined toemphasize the lateral tracking accuracy satisfying Q r = Q f = diag (1 , , . , . . A. Testing parameterized self-driving policies
The parameterized self-driving policy is a combination ofthe Intelligent Driving Model (IDM) and a set of customizedlane-change heuristics. The IDM formulation is adaptedfrom [30]. The lane change heuristics consist of two stages, decision making and lane-change execution. The lane-changedecision is determined by the current SV velocity andthe lead-lag gap acceptance with parameters adopted fromthe naturalistic behavioral study of [27]. The lane-changeexecution is divided into two parts. The longitudinal velocityis adapted from the IDM model. The lateral motion iscontrolled by a parameterized PD controller subject to yaw-rate constraints. We first present a set of pairwise interactivescenarios with one POV and one SV. We then extend to themulti-POV settings.
1) Pairwise Interactions:
Throughout the pairwise inter-active scenarios presented in this section, we consider thesame initialization condition σ inspired by the standardCrash Imminent Brake (CIB) system test as shown in Fig. 3.Both SV and POV are confined to the three-lane operabledomain, with extra state constraints for restricting the POVto initiate a rear-end collision against the SV within thesame lane. The admissible velocity range is confined to v ∈ [5 , m/s ) . Vehicles are assumed identical with alength of m and a width of m . Lane width is set to . m .The adversarial planning algorithm and all vehicle motioncontrollers are executed at Hz. A scenario terminates at seconds after the initialization, or earlier if a vehicle-to-vehicle collision is detected. Unless stated otherwise, thementioned configurations remain the same for all other ex-amples. Simulation results with various self-driving policiesof different hyper-parameters are shown in Fig. 4, Fig. 5,and Fig. 6. Here it is worth emphasizing the performancecomparison between Fig. 5 and Fig. 6. The SV policy,initialization conditions and state-action constraints are allset identically in both tests with the only difference lyingin the choice of the capture diameter c . In Fig. 5 we usea smaller value of c = 7 . The POV switches from thepredictive planning mode to worst-case planning mode about seconds after the test initialization and the collision occurs . seconds later. On the other hand, in Fig. 6 we take alarger value of c = 12 , which makes it easier to initiate theworst-case planning mode ( seconds earlier than the casein Fig. 5). However, the relatively large capture space makesthe scenario run less severe than the example in Fig. 5 andfails to force a vehicle-to-vehicle collision. Furthermore, notethat the SV performs an abrupt acceleration of . m/s at t = 14 . s during a single lane-change stage to its left. Thisbehavior is significantly outside the expectation as the worst-case planning algorithm assumes the maximum longitudinalacceleration of SV is only . m/s . As we have mentionedFig. 3: The standard Crash Imminent Brake (CIB) systemtesting procedure [5]: the lead-POV brakes and expects theSV to also brake for collision avoidance: both vehicles startwithin the same lane at m/s . a) Vehicle position trajectories.(b) Vehicle velocity (top left), heading angle (top bot-tom), acceleration control (top right), and steering anglecontrol (bottom right). Fig. 4: An adversarial POV persistently blocks an SV fol-lower with a conservative parameterization. (a) Vehicle position trajectories.(b) Vehicle velocity (top left), heading angle (top bot-tom), acceleration control (top right), and steering anglecontrol (bottom right).
Fig. 5: An adversarial POV crashes the SV follower with thecapture diameter set to c = 7 .in Section III, although such an extreme evasive maneuveris deemed aggressive by common sense, it leads the SV toa lower-risk driving status in terms of collision avoidance.Hence, the proposed online adversarial framework succeedsin creating a sufficiently dangerous scenario such that theproper response of SV can be tested.
2) Multi-POV scenario:
We further present three multi-POV scenarios as shown in Fig. 7, Fig. 9, and Fig. 8.Throughout all the examples, each POV is assigned witha unique operable space that does not overlap with otherPOV’s. The capture diameter is set to c = 7 for all examples.Admissible velocity range is modified to v ∈ [12 , m/s ) .The assumed admissible action space for SV and all POV’sare identical during the adversarial trajectory planning stage,but in practice, the SV is often more capable than POV bothlongitudinally and laterally. This is particularly obvious inFig. 7 where the worst-case planning transits back to thepredictive planning stage 7 times for POV1 before the SVcolliding to POV2 from the rear side. Intuitively, one canrefer to Fig. 7c where the SV is performing active single (a) Vehicle position trajectories.(b) Vehicle velocity (top left), heading angle (top bot-tom), acceleration control (top right), and steering anglecontrol (bottom right). Fig. 6: An adversarial POV fails to force the SV followerinto a crash with the capture diameter set to c = 12 . (a) A conceptional plot of the scenario configuration.(b) Vehicle position trajectories.(c) Acceleration control (top row), and steering anglecontrol (bottom row) of the SV and each adversarialPOV. Fig. 7: Two cooperative lead-POVs interact with the SVfollower: SV ends up with a rear-end collision against POV2due to the aggressive choice of lead gap acceptance duringthe single lane-change stage.lane-change and double lane-change maneuvers before thecollision occurs. Fig. 9 and Fig. 8 give two other examplesof how adversarial POV’s can cooperate to enforce safety-critical scenarios.
B. Testing human drivers
The proposed method is also implemented in the CARLAsimulator. We replicate several of the initial test runs in theprevious subsection with similar parameters. Fig. 10 shows atop view in the simulator from the initial condition shown inFig. 3, where the trajectory followed by both the SV (blue) a) A conceptional plot of the scenario configuration.(b) Vehicle position trajectories.(c) Acceleration control (top row), and steering anglecontrol (bottom row) of SV and each adversarial POV.
Fig. 8: Three cooperative POV’s (two lead-POV’s and oneon-coming POV) interact with the SV follower: SV performsa single lane-change to avoid collision against the on-comping POV3, ends up with a rear-end collision againstPOV1.and the POV (red) is shown on-screen. The waypoints fromboth vehicles for a time horizon of 2 seconds are also drawn.Additionally, this implementation allows a human driver totake over the SV control while the POV is dynamicallyreacting to the SV’s actions. It is shown that the predictiveplanning has allowed the POV to react appropriately toprovoke near-collision situations even when the SV’s policyis completely unexpected (human driver).V. C
ONCLUSIONS
This paper presents an online adversarial framework forthe scenario-based testing of operational vehicle safety. Theproposed method generates sufficiently dangerous testingscenarios in an efficient and controlled manner. It is applica-ble for the safety evaluation of human-driven, as well as ADSand ADAS equipped vehicles. Various simulated examplesare also presented to show the empirical effectiveness. Itis of future interest to extend the method to different en-vironment configurations such as intersections, roundabout,and parking-lot. We will also improve the methodology withreal-world experiments in proving ground tests.A
CKNOWLEDGMENT
This work was funded by the United States Departmentof Transportation under award number 69A3551747111 forMobility21: the National University Transportation Centerfor Improving Mobility. (a) A conceptional plot of the scenario configuration(b) Vehicle position trajectories.(c) Acceleration control (top row), and steering anglecontrol (bottom row) of SV and each adversarial POV.
Fig. 9: Two cooperative POV’s interact with the SV mergingfrom a side ramp: SV ends up with a rear-end collisionagainst POV2.Fig. 10: Top view of a pairwise interactive scenario inCARLA, the POV is red and the SV is blue.Any findings, conclusions, or recommendations expressedherein are those of the authors and do not necessarily reflectthe views of the United States Department of Transportation,Carnegie Mellon University, or The Ohio State University.R
EFERENCES[1] A. Paul, R. Chauhan, R. Srivastava, and M. Baruah, “Advanced driverassistance systems,” SAE Technical Paper, Tech. Rep., 2016.[2] E. Thorn, S. C. Kimmel, M. Chaka, B. A. Hamilton et al. , “Aframework for automated driving system testable cases and scenarios,”United States. Department of Transportation. National Highway TrafficSafety, Tech. Rep., 2018.[3] S. Feng, Y. Feng, C. Yu, Y. Zhang, and H. X. Liu, “Testing sce-nario library generation for connected and automated vehicles, parti: Methodology,”
IEEE Transactions on Intelligent TransportationSystems , 2020.[4] “Traffic jam assist (TJA) system confirmation test,” DOT HS 812 759,Tech. Rep., 2019.[5] C. A. M. Partnership, “Crash imminent braking (CIB) first annualreport,” DOT HS 811 340, Tech. Rep., 2010.[6] M. Klischat and M. Althoff, “Generating critical test scenarios forautomated vehicles with evolutionary algorithms,” in . IEEE, 2019, pp. 2352–2358.[7] B. Chen and L. Li, “Adversarial evaluation of autonomous vehicles inlane-change scenarios,” arXiv preprint arXiv:2004.06531 , 2020.8] W. Ding, M. Xu, and D. Zhao, “Learning to collide: An adap-tive safety-critical scenarios generating method,” arXiv preprintarXiv:2003.01197 , 2020.[9] E. F. Camacho and C. B. Alba,
Model predictive control . SpringerScience & Business Media, 2013.[10] Y. Ho, A. Bryson, and S. Baron, “Differential games and optimalpursuit-evasion strategies,”
IEEE Transactions on Automatic Control ,vol. 10, no. 4, pp. 385–389, 1965.[11] I. M. Mitchell, “Comparing forward and backward reachability as toolsfor safety analysis,” in
International Workshop on Hybrid Systems:Computation and Control . Springer, 2007, pp. 428–443.[12] P. Wensing and S. Revzen, “Template models for control,”
BioinspiredLegged Locomotion. Elsevier , pp. 240–266, 2017.[13] B. Weng, S. J. Rao, E. Deosthale, S. Schnelle, and F. Barickman,“Model Predictive Instantaneous Safety Metric for Evaluation of Au-tomated Driving Systems,” in
Proceedings of the 31st IEEE IntelligentVehicles Symposium (IV’20) , June 2020.[14] P.-B. Wieber, “Trajectory free linear model predictive control for stablewalking in the presence of strong perturbations,” in . IEEE, 2006,pp. 137–142.[15] R. Rajamani,
Vehicle dynamics and control . Springer Science &Business Media, 2011.[16] P. Junietz, F. Bonakdar, B. Klamann, and H. Winner, “Criticality metricfor the safety validation of automated driving using model predictivetrajectory optimization,” in . IEEE, 2018, pp. 60–65.[17] S. M. Erlien, “Shared vehicle control using safe driving envelopesfor obstacle avoidance and stability,” Ph.D. dissertation, StanfordUniversity, 2015.[18] O. Bokanowski, N. Forcadel, and H. Zidani, “Reachability and mini-mal times for state constrained nonlinear problems without any con-trollability assumption,”
SIAM Journal on Control and Optimization ,vol. 48, no. 7, pp. 4292–4316, 2010.[19] A. Houenou, P. Bonnifait, V. Cherfaoui, and W. Yao, “Vehicle trajec-tory prediction based on motion model and maneuver recognition,”in . IEEE, 2013, pp. 4363–4369.[20] M. Koschi and M. Althoff, “SPOT: A tool for set-based predictionof traffic participants,” in . IEEE, 2017, pp. 1686–1693.[21] A. Petrovskaya and S. Thrun, “Model based vehicle tracking forautonomous driving in urban environments,”
Proceedings of robotics:science and systems IV, Zurich, Switzerland , vol. 34, 2008.[22] L. Capito, K. Redmill, and U. Ozguner, “Optical flow based visualpotential field for autonomous driving,”
Proceedings of the 31st IEEEIntelligent Vehicles Symposium (IV’20) , June 2020.[23] J. Park, A. Kurt, and U. Ozguner, “A game theoretic approach tocontroller design for cyber-physical systems: collision avoidance,” in . IEEE Computer Society, 2013, pp. 254–254.[24] M. Bojarski, D. Del Testa, D. Dworakowski, B. Firner, B. Flepp,P. Goyal, L. D. Jackel, M. Monfort, U. Muller, J. Zhang et al. , “End toend learning for self-driving cars,” arXiv preprint arXiv:1604.07316 ,2016.[25] E. Yurtsever, L. Capito, K. Redmill, and U. Ozguner, “Integrating deepreinforcement learning with model-based path planners for automateddriving,”
Proceedings of the 31st IEEE Intelligent Vehicles Symposium(IV’20) , June 2020.[26] D. N. Lee, “A theory of visual control of braking based on informationabout time-to-collision,”
Perception , vol. 5, no. 4, pp. 437–459, 1976.[27] M. Yang, X. Wang, and M. Quddus, “Examining lane change gapacceptance, duration and impact using naturalistic driving data,”
Trans-portation research part C: emerging technologies , vol. 104, pp. 317–331, 2019.[28] D. Swaroop and K. Rajagopal, “A review of constant time headwaypolicy for automatic vehicle following,” in
ITSC 2001. 2001 IEEEIntelligent Transportation Systems. Proceedings (Cat. No. 01TH8585) .IEEE, 2001, pp. 65–69.[29] A. Dosovitskiy, G. Ros, F. Codevilla, A. Lopez, and V. Koltun,“CARLA: An open urban driving simulator,” arXiv preprintarXiv:1711.03938 , 2017.[30] M. Liebner, M. Baumann, F. Klanner, and C. Stiller, “Driver intentinference at urban intersections using the intelligent driver model,” in2012 IEEE Intelligent Vehicles Symposium