Andreas Reschka

Stadtpilot: First fully autonomous test drives in urban traffic

The Stadtpilot project aims at autonomous driving on Braunschweigs inner city ring road. For this purpose, an autonomous vehicle called “Leonie” has been developed. In October 2010, after two years of research, “Leonies” abilities were presented in a public demonstration. This vehicle is one of the first worldwide to show the ability of driving autonomously in real urban traffic scenarios. This paper describes the legal issues and the homologation process for driving autonomously in public traffic in Braunschweig, Germany. It also dwells on the Safety Concept, the system architecture and current research activities.

Defining and Substantiating the Terms Scene, Situation, and Scenario for Automated Driving

For the design and test of functional modules of an automated vehicle, it is essential to define interfaces. While interfaces on the perception side, like object lists, point clouds or occupancy grids, are to a certain degree settled already, they are quite vague in the consecutive steps of context modeling and in particular on the side of driving execution. The authors consider the scene as the central interface between perception and behavior planning & control. Within the behavior planning & control block, a situation is a central data container. A scenario is a common approach to substantiate test cases for functional modules and can be used to detail the functional description of a system. However, definitions of these terms are often-at best-vague or even contradictory. This paper will review these definitions and come up with a consistent definition for each term. Moreover, we present an example for the implementation of each of these interfaces.

Ability and skill graphs for system modeling, online monitoring, and decision support for vehicle guidance systems

In this paper, the ability and skill graphs are introduced for modeling vehicle guidance systems in the concept phase of the development process (abilities), for online monitoring of system operation (skills), and to support driving decisions (skill levels) of automated road vehicles and advanced driver assistance systems. Both graphs rely on a decomposition of the human driving task. An ability is the entirety of conditions which are necessary to provide a certain part of the driving task. The ability graph can be developed in parallel to the item definition according to the ISO 26262 standard in the concept phase of the development process and can be used for supporting further development steps. A skill is defined as an abstract representation of a part of the driving task including information about the skills current performance. The skill graph is used to monitor the current system performance during operation and skill levels are input to driving decisions. Abilities and skills cover all aspects of the driving task including environment and self perception, data processing, decision making, and behavior execution. During operation of the developed item, the skill graph is instantiated as a (distributed) software component to process online information for assessing current skill levels. Each skill uses one or more performance metrics, which represent its current performance capability in relation to the maximum (inherent) ability level. The resulting information could replace the monitoring of the system by a human driver and can be used as an input to driving decisions of the vehicle to support appropriate and safe decisions.

A surveillance and safety system based on performance criteria and functional degradation for an autonomous vehicle

Autonomous driving in urban environments is potentially dangerous since a malfunction of vehicle guidance systems can lead to severe situations for passengers inside the autonomous vehicle and other road users. Therefore both, monitoring the current system operation state by a surveillance system, which is able to detect failures of software and hardware modules, and a safety system, which reacts on these failures immediately, is necessary. In this paper an approach based on performance criteria and functional degradation is proposed, which is used in the autonomous vehicle Leonie developed within the Stadtpilot project. The surveillance part of the system collects data from sensors, software modules, hardware, and the vehicle to combine this data with heuristics to performance criteria. Based on these criteria degradation actions are executed to keep the operation of Leonie in a safe state. The safety system can influence driving maneuvers like lane changes and turning maneuvers, modify driving parameters like maximum speed and safe time headway and even force driving maneuvers like emergency stops and controlled stops at the side of the road. Currently, the safety driver onboard of Leonie is the fallback solution in case of a system malfunction. Using the proposed safety system should reduce the number of situations where the safety driver has to take control over the vehicle though.

Safe, dynamic and comfortable longitudinal control for an autonomous vehicle

Driver assistance systems are commonly available in many vehicles. There are systems for safety functions like the Electronic Stability Control, Automatic Traction Control, Anti-lock Brake System and automatic emergency braking. There are also systems for comfort functions like adaptive cruise control with stop and go functionality and combined safety and comfort functions like lane keeping and side-wind assistance. A control system consisting of all of these systems would allow comfortable automatic vehicle guidance on highways. In an urban environment, like in the Stadtpilot project, requirements on driver assistance systems are higher, especially in the case of full autonomous driving. An essential part of an autonomous vehicle control system is a longitudinal controller for acceleration and deceleration of the vehicle. This longitudinal control system has to take care of many more conditions than an assistance system. E.g. it needs to perceive and calculate road and weather conditions with its sensors, which usually is a task a human driver does instinctively. The present paper describes how the autonomous vehicle Leonie is able to adapt its longitudinal control to changing road and weather conditions by calculating a so called Grip Value and gives an outlook how this parameter affects whole vehicle guidance.

Towards Automated Driving: Unmanned Protective Vehicle for Highway Hard Shoulder Road Works

Mobile road works on the hard shoulder of German highways bear an increased accident risk for the crew of the protective vehicle which safeguards road works against moving traffic. The project “Automated Unmanned Protective Vehicle for Highway Hard Shoulder Road Works” aims at the unmanned operation of the protective vehicle in order to reduce this risk. Simultaneously, this means the very first unmanned operation of a vehicle on German roads in public traffic. This contribution introduces the project by pointing out the main objectives and demonstrates the current state of the system design regarding functionality, modes of operation, as well as the functional system architecture. Pivotal for the project, the scientific challenges raised by the unmanned operation - strongly related to the general challenges in the field of automated driving - are presented as well. The results of the project shall serve as a basis to stimulate an advanced discussion about ensuring safety for fully automated vehicles in public traffic operating at higher speeds and in less defined environments. Thus, this contribution aims at contacting the scientific community in an early state of the project.

Hazard analysis and risk assessment for an automated unmanned protective vehicle

For future application of automated vehicles in public traffic, ensuring functional safety is essential. In this context, a hazard analysis and risk assessment is an important input for designing functionally vehicle automation systems. In this contribution, we present a detailed hazard analysis and risk assessment (HARA) according to the ISO 26262 standard for a specific Level 4 application, namely an unmanned protective vehicle operated without human supervision for motorway hard shoulder roadworks.

Identification of potential hazardous events for an Unmanned Protective Vehicle

The project Automated Unmanned Protective Vehicle for Highway Hard Shoulder Road Works (aFAS) aims to develop an unmanned protective vehicle to reduce the risk of injuries due to crashes for road workers. To ensure functional safety during operation in public traffic the system shall be developed following the ISO 26262 standard. After defining the functional range in the item definition, a hazard analysis and risk assessment has to be done. The ISO 26262 standard gives hints how to process this step and demands a systematic way to identify system hazards. Best practice standards provide systematic ways for hazard identification, but lack applicability for automated vehicles due to the high variety and number of different driving situations even with a reduced functional range. This contribution proposes a new method to identify hazardous events for a system with a given functional description. The method utilizes a skill graph as a functional model of the system and an overall definition of a scene for automated vehicles to identify potential hazardous events. An adapted Hazard and Operability Analysis approach is used to identify system malfunctions. A combination of all methods results in operating scenes with potential hazardous events. These can be assessed afterwards towards their criticality. A use case example is taken from the current development phase of the project aFAS.

Conditions for a safe state of automated road vehicles

Abstract The term safe state is not yet defined accurately in the context of automated road vehicles. In this paper we derive several conditions, which are in our opinion important for the discussion of a safe state for automated road vehicles. From an engineering view, several concepts on the classification of automation levels are analyzed and from their results and current research and development approaches a definition of a safe state is proposed. Especially the relation between risk and safety for passengers of automated vehicles and other traffic participants is considered. Several use cases for automated vehicles and events with impact to safety are discussed to identify conditions for a safe state in public traffic, which have to be fulfilled to keep the risk of operating an automated vehicle below a reasonable level.

Specifying a middleware for distributed embedded vehicle control systems

The software of electric / electronic vehicle control systems is static in current series vehicles. Most of the systems do not allow maintenance or functional updates, especially in the field of driver assistance systems. Main causes are the testing effort for a software release and the wide variety of different configurations in different vehicle models. In this paper we take a closer look at the requirements for a middleware which allows such updates, verifies new software versions, and adds reconfiguration mechanisms for singular control units and distributed sets of control units. To derive the requirements we consider the general vehicular context with limitations in space, electric power, processing power, and costs together with four exemplary road vehicle control applications (cruise control, automatic parking, stability control, force feedback), and a full x-by-wire target vehicle for implementing these applications. The analysis of these three different sources of requirements results in desired middleware functionalities and requirements, especially concerning runtime timings and update timings. The requirements cover an update functionality with integrated verification, the exchange of applications on singular control units, and the degradation of functionality by switching between control units.