Safety First for Automated Driving I Authors
Total Page:16
File Type:pdf, Size:1020Kb
2019 SAFETY FIRST FOR AUTOMATED DRIVING I AUTHORS Matthew Wood, M.Sc. Dr.-Ing. Christian Knobel Neil Garbacik, M.Sc. [email protected] [email protected] [email protected] Dr. Philipp Robbel Dipl.-Inf. David Boymanns David Smerza, BSAE [email protected] [email protected] Dr. Dalong Li Dr. Michael Maass Dr.-Ing. Matthias Löhning Dr. Adam Timmons Dr. Radboud Duintjer Tebbens Dr. Bernhard Dehlink Marco Bellotti Marc Meijs, M.Sc. Dirk Kaule, M.Sc. Mohamed Harb, M.Sc. Dipl.-Ing. Richard Krüger Jonathon Reach, B.Sc. Dr. Jelena Frtunikj Karl Robinson Dr. Florian Raisch Michael O‘Brien, BS Dipl.-Math. Miriam Gruber [email protected] Jessica Steck, M.Sc. Michael Schöllhorn David Wittmann, M.Sc. Dipl.-Psych. Julia Mejia-Hernandez [email protected] Toshika Srivastava, M.Sc. Dr.-Ing. Mohamed Essayed Dipl.-Ing. Sandro Syguda Dipl.-Ing. Udo Dannebaum Bouzouraa sandro.syguda@continental- [email protected] corporation.com Dipl.-Ing. Pierre Blüher Siyuan Liu, BS, MBA Dr.-Ing. Kamil Klonecki [email protected] Dr. Pierre Schnarz Jack Weast, BS, M.Sc. Yali Wang, MA [email protected] [email protected] Alan Tatourian, BS Dr. Thomas Wiltschko [email protected] Dipl.-Inf. Stefan Pukallus Dr.-Ing. Kai Sedlaczek Dr.-Ing. Bernd Dornieden [email protected] Dr.-Ing. Philipp Schnetter Dr.-Ing. Dipl.-Wirt.Ing. Philipp Themann Dr.-Ing. Thomas Weidner Dr. rer. nat. Peter Schlicht II III ABSTRACT This publication summarizes widely known safety by design and verification and validation (V&V) methods of SAE L3 and L4 automated driving. This summary is required for maximizing the evidence of a positive risk balance of automated driving solutions compared to the average human driving performance. There is already a vast array of publications focusing on only specific subtopics of automated driving. In contrast, this publication promotes a comprehensive approach to safety relevant topics of automated driving and is based on the input of OEMs, tiered suppliers and key technology providers. The objective of this publication is to systematically break down safety principles into safety by design capabilities, elements and architectures and then to summarize the V&V methods in order to demonstrate the positive risk balance. With Level 3 and 4 automated driving systems still under development, this publication represents guidance for potential methods and considerations in the development and V&V. This publication is not intended to serve as a final statement or minimum or maximum guideline or standard for automated driving systems. Instead, the intent of this publication is to contribute to current activities working towards the industry- wide standardization of automated driving. REFERENCED STANDARDS ISO/PAS 21448:2019 Road Vehicles – Safety of the intended functionality (SOTIF) ISO 26262:2018 Road Vehicles – Functional safety ISO/SAE CD 21434 Road Vehicles – Cybersecurity engineering ISO 19157:2013 Geographic information – Data quality ISO/TS 19158:2012 Geographic information – Quality assurance of data supply ISO/TS 16949:2009 Quality management systems – Particular requirements for the application of ISO 9001:2008 for automotive production and relevant service part organizations ISO/IEC 2382-1:1993 Information technology – Vocabulary – Part 1: Fundamental terms ISO/IEC/IEEE 15288:2015 Systems and software engineering – System life cycle processes © Copyright 2019 by Aptiv Services US, LLC; AUDI AG; Bayrische Motoren Werke AG; Beijing Baidu Netcom Science Technology Co., Ltd; Continental Teves AG & Co oHG; Daimler AG; FCA US LLC; HERE Global B.V.; Infineon Technologies AG; Intel; Volkswagen AG. All rights reserved. The document and information contained herein is not a license, either expressly or impliedly, to any intellectual property owned or controlled by any of the authors or developers of this publication, and license to this document and information should not be considered to be have been made available to parties receiving and/or reviewing this document and information. The information contained herein is provided on an “AS IS” basis, and to the maximum extent permitted by applicable law, the authors and developers of this document hereby disclaim all other warranties and conditions, either express, implied or statutory, including but not limited to, any (if any) implied warranties, duties or conditions of merchantability, of fitness for a particular purpose, of accuracy or completeness of responses, of results, of workmanlike effort, of lack of viruses, of lack of negligence. THERE IS NO WARRANTY OR CONDITION OF TITLE, QUIET ENJOYMENT, QUIET POSSESSION, OR NON-INFRINGEMENT. II III Contents 1 INTRODUCTION & MOTIVATION ...................................................................................... 2 1.1 Scope of this Publication ................................................................................................ 2 1.2 Structure of and Development Examples Used in this Publication .................................. 4 1.3 Safety Vision .................................................................................................................. 6 1.3.1 Background ......................................................................................................... 6 1.3.2 The Twelve Principles of Automated Driving ........................................................ 6 2 SYSTEMATICALLY DEVELOPING DEPENDABILITY TO SUPPORT SAFETY BY DESIGN ....................................................................................................................... 12 2.1 Deriving Capabilities of Automated Driving from Dependability Domains ...................... 13 2.1.1 Legal Frameworks for Automated Driving Vehicles ............................................ 13 2.1.2 Applying the Related Safety Standards .............................................................. 14 2.1.3 Safety of the Intended Functionality ................................................................... 17 2.1.4 Functional Safety ............................................................................................... 20 2.1.5 Automotive Cybersecurity .................................................................................. 21 2.1.5.1 Why is Cybersecurity so Important for Safety? ................................... 22 2.1.5.2 Cybersecurity Approach and Measures .............................................. 24 2.1.6 Capabilities of Automated Driving ...................................................................... 27 2.1.6.1 Initial Derivation of Capabilities .......................................................... 27 2.1.6.2 Overview of the Capabilities .............................................................. 30 2.1.7 Minimal Risk Conditions and Minimal Risk Maneuvers ....................................... 34 2.2 Elements for Implementing the Capabilities .................................................................. 36 2.2.1 Implementing the Capabilities ............................................................................ 36 2.2.1.1 FS_1: Determine location ................................................................. 37 2.2.1.2 FS_2: Perceive relevant static and dynamic objects in proximity to the automated vehicle ........................................................................ 38 2.2.1.3 FS_3: Predict the future behavior of relevant objects ......................... 39 2.2.1.4 FS_4: Create a collision-free and lawful driving plan .......................... 40 2.2.1.5 FS_5: Correctly execute and actuate the driving plan ........................ 41 2.2.1.6 FS_6: Communicate and interact with other (vulnerable) road users .... 41 2.2.1.7 FS_7:Determineifspecifiednominalperformanceisnotachieved .... 42 2.2.1.8 FD_1: Ensure controllability for the vehicle operator .......................... 43 2.2.1.9 FD_2: Detect when degraded performance is not available ............... 44 2.2.1.10 FD_3: Ensure safe mode transitions and awareness ......................... 44 2.2.1.11 FD_4:Reacttoinsufficientnominalperformanceandotherfailures via degradation .................................................................................. 45 IV V 2.2.1.12 FD_5: Reduce system performance in the presence of failure for the degraded mode ............................................................................ 46 2.2.1.13 FD_6: Perform degraded mode within reduced system constraints .... 46 2.2.2 Elements ........................................................................................................... 47 2.2.2.1 Environment Perception Sensors ....................................................... 47 2.2.2.2 A-Priori Perception Sensors .............................................................. 48 2.2.2.3 V2X ................................................................................................... 51 2.2.2.4 Sensor Fusion .................................................................................. 51 2.2.2.5 Interpretation and Prediction ............................................................. 52 2.2.2.6 Localization ...................................................................................... 53 2.2.2.7 ADS Mode Manager ......................................................................... 53 2.2.2.8 Egomotion ........................................................................................ 54 2.2.2.9 Drive Planning .................................................................................