Torben Stolte

Towards Automated Driving: Unmanned Protective Vehicle for Highway Hard Shoulder Road Works

Mobile road works on the hard shoulder of German highways bear an increased accident risk for the crew of the protective vehicle which safeguards road works against moving traffic. The project “Automated Unmanned Protective Vehicle for Highway Hard Shoulder Road Works” aims at the unmanned operation of the protective vehicle in order to reduce this risk. Simultaneously, this means the very first unmanned operation of a vehicle on German roads in public traffic. This contribution introduces the project by pointing out the main objectives and demonstrates the current state of the system design regarding functionality, modes of operation, as well as the functional system architecture. Pivotal for the project, the scientific challenges raised by the unmanned operation - strongly related to the general challenges in the field of automated driving - are presented as well. The results of the project shall serve as a basis to stimulate an advanced discussion about ensuring safety for fully automated vehicles in public traffic operating at higher speeds and in less defined environments. Thus, this contribution aims at contacting the scientific community in an early state of the project.

Hazard analysis and risk assessment for an automated unmanned protective vehicle

For future application of automated vehicles in public traffic, ensuring functional safety is essential. In this context, a hazard analysis and risk assessment is an important input for designing functionally vehicle automation systems. In this contribution, we present a detailed hazard analysis and risk assessment (HARA) according to the ISO 26262 standard for a specific Level 4 application, namely an unmanned protective vehicle operated without human supervision for motorway hard shoulder roadworks.

Identification of potential hazardous events for an Unmanned Protective Vehicle

The project Automated Unmanned Protective Vehicle for Highway Hard Shoulder Road Works (aFAS) aims to develop an unmanned protective vehicle to reduce the risk of injuries due to crashes for road workers. To ensure functional safety during operation in public traffic the system shall be developed following the ISO 26262 standard. After defining the functional range in the item definition, a hazard analysis and risk assessment has to be done. The ISO 26262 standard gives hints how to process this step and demands a systematic way to identify system hazards. Best practice standards provide systematic ways for hazard identification, but lack applicability for automated vehicles due to the high variety and number of different driving situations even with a reduced functional range. This contribution proposes a new method to identify hazardous events for a system with a given functional description. The method utilizes a skill graph as a functional model of the system and an overall definition of a scene for automated vehicles to identify potential hazardous events. An adapted Hazard and Operability Analysis approach is used to identify system malfunctions. A combination of all methods results in operating scenes with potential hazardous events. These can be assessed afterwards towards their criticality. A use case example is taken from the current development phase of the project aFAS.

Specifying a middleware for distributed embedded vehicle control systems

The software of electric / electronic vehicle control systems is static in current series vehicles. Most of the systems do not allow maintenance or functional updates, especially in the field of driver assistance systems. Main causes are the testing effort for a software release and the wide variety of different configurations in different vehicle models. In this paper we take a closer look at the requirements for a middleware which allows such updates, verifies new software versions, and adds reconfiguration mechanisms for singular control units and distributed sets of control units. To derive the requirements we consider the general vehicular context with limitations in space, electric power, processing power, and costs together with four exemplary road vehicle control applications (cruise control, automatic parking, stability control, force feedback), and a full x-by-wire target vehicle for implementing these applications. The analysis of these three different sources of requirements results in desired middleware functionalities and requirements, especially concerning runtime timings and update timings. The requirements cover an update functionality with integrated verification, the exchange of applications on singular control units, and the degradation of functionality by switching between control units.

Safety goals and functional safety requirements for actuation systems of automated vehicles

Increasing automation of vehicle guidance is one of the major trends in the automotive industry. Some auto makers have announced that automated vehicles will be deployed in public traffic by the end of this decade (level 4 in sense of the definition of SAE, level 5 later). Until then, one central challenge is ensuring functional safety of automated vehicles. Still, it is not clear how safety concepts for automated vehicles can be designed appropriately. This affects all parts of vehicle automation systems: environment perception, decision making, and actuation. In this contribution we derive safety goals and functional safety requirements according to ISO 26262 for actuation systems of automated vehicles systematically, following a systems theory based approach. The findings summarize elaborate measures to be implemented in actuation systems of automated vehicles when operated without human supervision.

Model predictive control based trajectory generation for autonomous vehicles — An architectural approach

Research in the field of automated driving has created promising results in the last years. Some research groups have shown perception systems which are able to capture even complicated urban scenarios in great detail. Yet, what is often missing are general-purpose path-or trajectory planners which are not designed for a specific purpose. In this paper we look at path- and trajectory planning from an architectural point of view and show how model predictive frameworks can contribute to generalized path- and trajectory generation approaches for generating safe trajectories even in cases of system failures.

On Bringing Object-Oriented Software Metrics into the Model-Based World – Verifying ISO 26262 Compliance in Simulink

For ensuring functional safety of electrical/electronic systems, it is necessary to exclude malfunctions from hardware and software as well as from the interaction of both. In today’s passenger vehicles, more and more safety critical functionalities are implemented in software. Thus, its importance for functional safety increases. The dominating safety standard for the automotive domain (ISO 26262) considers the software part and defines requirements for safety critical software. However, applying and fulfilling the standard is a major problem in industry. In this context, the paper presents a novel metric-based approach to evaluate dataflow-oriented software architectures used in many model-driven processes regarding the fulfillment of requirements defined by ISO 26262 (in particular part 6). The core idea is to derive metrics for model-based software from already existing, well-performing metrics elaborated for other programming paradigms. To link metrics to requirements fulfillment of ISO 26262, we briefly sketch the factor-criteria-metrics paradigm for this problem. Technically, this paper presents a generic meta-model for dataflow systems, which is used to define the metrics. We implemented this meta-model and the metrics as a prototype for Matlab Simulink. As examples, two models of a 400 kW full Drive-by-Wire experimental vehicle with all-wheel-steering, all-wheel-drive, and electro-mechanical brakes are analyzed using this prototype.

Ensuring functional safety by networking systems from different domains, illustrated by the example of an electromechanical brake

The customer’s demand for novel functionalities in modern vehicles requires reconsidering the traditional architecture of vehicle electronics and the continuous further development of individual systems. Especially, driver assistance and safety systems lead to increasing functional complexity and demand powerful actuators to intervene into vehicle handling. These trends increasingly cause by-Wire systems to invade critical components as the steering or braking system. While supporting the achievement of functional goals driven by the application, these systems come along with challenges in terms of functional safety if cost objectives have to be met.