Safety First for Automated Driving I Authors
Total Page:16
File Type:pdf, Size:1020Kb
2019 SAFETY FIRST FOR AUTOMATED DRIVING I AUTHORS APTIV BMW FCA Matthew Wood, M.Sc. Dr.-Ing. Christian Knobel Neil Garbacik, M.Sc. [email protected] [email protected] [email protected] Dr. Philipp Robbel Dipl.-Inf. David Boymanns David Smerza, BSAE [email protected] [email protected] Dr. Dalong Li Dr. Michael Maass Dr.-Ing. Matthias Löhning Dr. Adam Timmons Dr. Radboud Duintjer Tebbens Dr. Bernhard Dehlink Marco Bellotti Marc Meijs, M.Sc. Dirk Kaule, M.Sc. Mohamed Harb, M.Sc. Dipl.-Ing. Richard Krüger HERE Jonathon Reach, B.Sc. Dr. Jelena Frtunikj Michael O‘Brien, BS Karl Robinson Dr. Florian Raisch [email protected] Dipl.-Math. Miriam Gruber Michael Schöllhorn AUDI Jessica Steck, M.Sc. David Wittmann, M.Sc. Dipl.-Psych. Julia Mejia-Hernandez INFINEON [email protected] Dipl.-Ing. Udo Dannebaum Toshika Srivastava, M.Sc. CONTINENTAL [email protected] Dr.-Ing. Mohamed Essayed Dipl.-Ing. Sandro Syguda Bouzouraa sandro.syguda@continental- INTEL corporation.com Jack Weast, BS, M.Sc. BAIDU Dipl.-Ing. Pierre Blüher [email protected] Siyuan Liu, BS, MBA Dr.-Ing. Kamil Klonecki Alan Tatourian, BS [email protected] Dr. Pierre Schnarz Yali Wang, MA VOLKSWAGEN [email protected] DAIMLER Dr.-Ing. Bernd Dornieden Dr. Thomas Wiltschko [email protected] [email protected] Dr.-Ing. Philipp Schnetter Dipl.-Inf. Stefan Pukallus Dr.-Ing. Dipl.-Wirt.Ing. Philipp Dr.-Ing. Kai Sedlaczek Themann Dr.-Ing. Thomas Weidner Dr. rer. nat. Peter Schlicht II III ABSTRACT This publication summarizes widely known safety by design and verification and validation (V&V) methods of SAE L3 and L4 automated driving. This summary is required for maximizing the evidence of a positive risk balance of automated driving solutions compared to the average human driving performance. There is already a vast array of publications focusing on only specific subtopics of automated driving. In contrast, this publication is a comprehensive approach to safety relevant topics of automated driving and is based on the input of OEMs, tiered suppliers and key technology providers. The approach of this publication is to systematically break down safety principles into safety by design capabilities, elements and architectures and then to summarize the V&V methods in order to demonstrate the positive risk balance. This publication is intended to contribute to current activities working towards the industry-wide standardization of automated driving. REFERENCED STANDARDS ISO/PAS 21448:2019 Road Vehicles – Safety of the intended functionality (SOTIF) ISO 26262:2018 Road Vehicles – Functional safety ISO/SAE CD 21434 Road Vehicles – Cybersecurity engineering ISO 19157:2013 Geographic information – Data quality ISO/TS 19158:2012 Geographic information – Quality assurance of data supply ISO/TS 16949:2009 Quality management systems – Particular requirements for the application of ISO 9001:2008 for automotive production and relevant service part organizations ISO/IEC 2382-1:1993 Information technology – Vocabulary – Part 1: Fundamental terms ISO/IEC/IEEE 15288:2015 Systems and software engineering – System life cycle processes © Copyright 2019 by Aptiv Services US, LLC; AUDI AG; Bayrische Motoren Werke AG; Beijing Baidu Netcom Science Technology Co., Ltd; Continental Teves AG & Co oHG; Daimler AG; FCA US LLC; HERE Global B.V.; Infineon Technologies AG; Intel; Volkswagen AG. All rights reserved. The document and information contained herein is not a license, either expressly or impliedly, to any intellectual property owned or controlled by any of the authors or developers of this publication, and license to this document and information should not be considered to be have been made available to parties receiving and/or reviewing this document and information. The information contained herein is provided on an “AS IS” basis, and to the maximum extent permitted by applicable law, the authors and developers of this document hereby disclaim all other warranties and conditions, either express, implied or statutory, including but not limited to, any (if any) implied warranties, duties or conditions of merchantability, of fitness for a particular purpose, of accuracy or completeness of responses, of results, of workmanlike effort, of lack of viruses, of lack of negligence. THERE IS NO WARRANTY OR CONDITION OF TITLE, QUIET ENJOYMENT, QUIET POSSESSION, OR NON-INFRINGEMENT. II III Contents 1 INTRODUCTION & MOTIVATION ...................................................................................... 2 1.1 Scope of this Publication ................................................................................................ 2 1.2 Structure of and Development Examples Used in this Publication .................................. 4 1.3 Safety Vision .................................................................................................................. 6 1.3.1 Background ......................................................................................................... 6 1.3.2 The Twelve Principles of Automated Driving ........................................................ 6 2 SYSTEMATICALLY DEVELOPING DEPENDABILITY TO SUPPORT SAFETY BY DESIGN ....................................................................................................................... 12 2.1 Deriving Capabilities of Automated Driving from Dependability Domains ...................... 13 2.1.1 Legal Frameworks for Automated Driving Vehicles ............................................ 13 2.1.2 Applying the Related Safety Standards .............................................................. 14 2.1.3 Safety of the Intended Functionality ................................................................... 17 2.1.4 Functional Safety ............................................................................................... 20 2.1.5 Automotive Cybersecurity .................................................................................. 21 2.1.5.1 Why is Cybersecurity so Important for Safety? ................................... 22 2.1.5.2 Cybersecurity Approach and Measures .............................................. 24 2.1.6 Capabilities of Automated Driving ...................................................................... 27 2.1.6.1 Initial Derivation of Capabilities .......................................................... 27 2.1.6.2 Overview of the Capabilities .............................................................. 30 2.1.7 Minimal Risk Conditions and Minimal Risk Maneuvers ....................................... 34 2.2 Elements for Implementing the Capabilities .................................................................. 36 2.2.1 Implementing the Capabilities ............................................................................ 36 2.2.1.1 FS_1: Determine location ................................................................. 37 2.2.1.2 FS_2: Perceive relevant static and dynamic objects in proximity to the automated vehicle ........................................................................ 38 2.2.1.3 FS_3: Predict the future behavior of relevant objects ......................... 39 2.2.1.4 FS_4: Create a collision-free and lawful driving plan .......................... 40 2.2.1.5 FS_5: Correctly execute and actuate the driving plan ........................ 41 2.2.1.6 FS_6: Communicate and interact with other (vulnerable) road users .... 41 2.2.1.7 FS_7:Determineifspecifiednominalperformanceisnotachieved .... 42 2.2.1.8 FD_1: Ensure controllability for the vehicle operator .......................... 43 2.2.1.9 FD_2: Detect when degraded performance is not available ............... 44 2.2.1.10 FD_3: Ensure safe mode transitions and awareness ......................... 44 2.2.1.11 FD_4:Reacttoinsufficientnominalperformanceandotherfailures via degradation .................................................................................. 45 IV V 2.2.1.12 FD_5: Reduce system performance in the presence of failure for the degraded mode ............................................................................ 46 2.2.1.13 FD_6: Perform degraded mode within reduced system constraints .... 46 2.2.2 Elements ........................................................................................................... 47 2.2.2.1 Environment Perception Sensors ....................................................... 47 2.2.2.2 A-Priori Perception Sensors .............................................................. 48 2.2.2.3 V2X ................................................................................................... 51 2.2.2.4 Sensor Fusion .................................................................................. 51 2.2.2.5 Interpretation and Prediction ............................................................. 52 2.2.2.6 Localization ...................................................................................... 53 2.2.2.7 ADS Mode Manager ......................................................................... 53 2.2.2.8 Egomotion ........................................................................................ 54 2.2.2.9 Drive Planning .................................................................................. 55 2.2.2.10 TrafficRules ....................................................................................... 56 2.2.2.11 Motion Control .................................................................................. 56 2.2.2.12 Motion