Tech.AD. 5-6 March, 2018 Berlin Safety for Self-driving Safety for Cars Self-driving Cars -Challenges and Some Solutions -Challenges and Some Solutions Author: Håkan Sivencrona, PhD Functional Jonas Nilsson, Safety Expert, PhD Tech Lead ADAS/AD Functional Safety, Presented Autonomous by: Amer Nezirovic, Drive PhD, Radar Systems Expert Page 1
Outline I. What s Zenuity? II. Some definitions III. The challenge of going (truly) autonomous IV. What are the building blocks for a safe self-driving car? V. Does a self-driving car really need to choose whom to kill? VI. How do we avoid driving a billion miles? Acknowledgements Page 2
What s Zenuity? First time a leading premium car maker has joined forces with a tier one supplier to develop new advanced driver assist systems (ADAS) and autonomous driving (AD) technologies. Automotive Safety is part of both companies DNA with a broad range of expertise and experience. This DNA and the economic power combined with the new spirit of Zenuity is unique. Safety Experience Resource Power SPIRIT EXPERTISE COMMITMENT Page 3
Joint Venture Scope We bring intelligence into AD Systems Cloud Real-time HD Maps l Connected Safety Functions Sensor Sensing Sensor Fusion Decision & Control Vehicle Control Actuator Base Tech Software l HW Design l System Design l Technical Safety Concepts System Page 4
Self-driving cars are coming... SAE Level 0-2 SAE Level 3 SAE Level 4 SAE Level 5 PAGE 5
SAE Driving Automation Levels Which levels are possible to realize? Level Name Dynamic Driving Task (DDT) DDT Fallback Operational Lat/Long Motion Ctrl Object Response 0 No driving automation Driver Driver Driver N/A 1 Driver assistance Driver & System Driver Driver Limited 2 Partial driving automation System Driver Driver Limited 3 Conditional driving automation System System Fallbackready user Design Domain (ODD) Limited 4 High driving automation System System System Limited 5 Full driving automation System System System Unlimited PAGE 6
Vehicle Speed The Race to Autonomy Highway Pilot Supervised Autopilot Lane Keep Assist Traffic Jam Pilot Platooning Robotaxi Adaptive Cruise Control Autobrake Complexity PAGE 7
The Challenge Driver out of the loop Self-driving vehicles must be able to handle all situations (and prove that it can!) This puts unique requirements on the vehicle, its sensor, actuators and electrical architecture. PAGE 8
What is required for unsupervised automation? Overall safety requirement: - Fewer caused accidents (by some margin) than human driver Topic 1/Frequency Market Road fatalities 148 million km (3.7 million hours) U.S. Air fatalities 50 billion passenger km (100 million passenger hours) U.K. Rail fatalities 2.5 billion passenger km (40 million passenger hours) U.K. False AEB 0.5 million km (10 000 hours) Global Safety Driver interventions (High Score 2018) 20 000 km (700 hours) CA PAGE 9
A Truly Interdisciplinary Challenge Computer Vision Friction Estimation Solid State Lidar Connectivity Environment Perception Sensor Fusion High Defintion Maps Deep Learning Dead Reckoning GPU Surroundings Ethernet Decision Hierarchy End-2-End Learning Decision- Making Model Predictive Control Precautionary Safety Planned Path Robust Control Brake Blending Vehicle Control Dual-coil Steering Motor Hybrid Powertrains Vehicle State Estimation Steer-by- Braking y.. [x y] T x d What about (Functional) safety? PAGE 10
From ADAS to AD Fundamental change for safety concepts Supervised (Most ADAS) Safety Responible Not Safety Responsible Perception Decision Action Unsupervised (AD) Perception Decision Action PAGE 11
Who s driving? Two drivers means new hazards: Mode confusion Do driver and car agree on who is in control? Unfair transitions Is driver/car capable of taking control? Stuck in transition Does refusal to handover degrade driver performance? Misuse Does driver provoke the system? Robust procedure for handover! PAGE 12
Impacts on architecture Self-driving vehicles require: Perception Decision Action Redundant sensing Redundant high-end control units Redundant brake system Vision Radar Sensor Fusion 1 Decision & Control 1 Vehicle Dynamics 1 Brake Control 1 Brake Control 2 Brake Brake Brake Redundant steering Redundant communication Clustered power distribution Lidar Ultrasonic Sensor Fusion 2 Decision & Control 2 Vehicle Dynamics 2 Steering Control 1 Steering Control 2 Brake Power steering Safety critical HMI Cloud Power steering PAGE 13
AD Fallback Strategy Handover to Driver? Decreasing frequency Degraded Mode Driving Autopilot Safe stop Blind safe stop Backup path Normal path PAGE 14
Safety Concepts Who is responsible for what? HARA Safety Goal Elements on all levels must argue safety FSC Environment Perception Surroundings Confidence Decision- Making Planned Path Capability Vehicle Control Executed Path TSC Sensor 1 Sensor 2 Sensor n AD-Brain Vehicle Control Unit Power Steering Primary Brake Secondary Brake PAGE 15
Safety Concept Responsibility of Environment Perception Environment Perception Surroundings Confidence Decision- Making Planned Path Capability Vehicle Control Executed Path Functional requirement: Report view of surroundings Safety-critical requirement: Don t be over-confident PAGE 16
Safety-critical Sensing Even covering reasonable situations is challenging PAGE 17
Safety-critical Sensing Example: Required forward range for different vehicle speeds No missed objects leading to fatalities in several million hours! Longer ranges needed to drive nicely! 30 km/h 10 m 70 km/h 50 m 120 km/h 140 m PAGE 18
Safety Concept Responsibility of Decision-Making Environment Perception Surroundings Confidence Decision- Making Planned Path Capability Vehicle Control Executed Path Safety-critical requirement: Drive within your limits! PAGE 19
The easy solution Don t move! Its safe! PAGE 20
Safety first, but there are also other requirements Drive from point A to B, and do it fast! Act socially, don t disturb other road users Make the ride smooth and comfortable PAGE 21
Can t we just mimic experienced drivers? No humans and machines have different abilities Machines are consistent Humans easily adapt to new situations PAGE 22
Will (safe) self-driving cars drive like humans? Yes! A human that: + Is never tired or distracted + Has 360 degree vision + Can see through e.g. fog, smoke Sometimes sees ghost objects Is not very great a reading clues in the environment (yet) PAGE 23
What does it mean to take precaution? Precaution is a measure taken in advance to prevent something dangerous, unpleasant, or inconvenient from happening Anticipate what ifs Take measures to ensure that the they can be dealt with, should they turn out to be real PAGE 24
What is Precautionary Safety for AD? Know your limitations Sensing Vehicle Control Plan ahead Keep enough margins to deal with what ifs Perform evasive actions Deal with critical events PAGE 25
What can happen if no precautions are taken? PAGE 26
Decision-Making & the Trolley Problem Solution: Drive with precaution! PAGE 27
Human Solution to Trolley Problem Strategical Tactical Operational PAGE 28
Autopilot Solution to Trolley Problem Strategical Strategical Tactical Operational Tactical Operational Operational PAGE 29
Summary: Trolley problem solution Safe design of Autopilot A. Safe = Acceptable (very, very low) accident rate B. Safety by precautionary driving, thus avoiding critical situations C. Autopilot will always avoid/mitigate if possible Consequences for Trolley Problem 1. Low accident rate Lower trolley situation rate 2. In very unlikely trolley situation Autopilot behaviour is a consequence of safe design. Example: Trolley situation: A parachutist lands in vehicle path and a group of pedestrians are on the side of the road. Safe design leads to: I. IF Evasive path safe Evasive maneuver II. ELSE Collision mitigation by braking PAGE 30
Why don t we prove safety only by data? Infeasible to verify by driving billions of kilometers! PAGE 31
Traditional methods are unfeasible Kalra, Nidhi and Susan M. Paddock. Driving to Safety: How Many Miles of Driving Would It Take to Demonstrate Autonomous Vehicle Reliability?. Santa Monica, CA: RAND Corporation, 2016. PAGE 32
V&V strategy Safety verification of All major subsystems for All relavant scenarios Scenario DB Environment Perception Surroundings Decision- Making Planned Path Vehicle Control Traffic/Test track with Ground Truth Traffic/Test track with Ground Truth Resimulation Augmented/Virtual Data Formal methods Closed-loop simulation PAGE 33
Critical Situations in Simulations PAGE 34
Take-aways Driver-out-of-the-loop is a big change... (Safe) autopilot must drive with precaution We should focus on avoiding accidents, not the trolley problem V&V by merely driving is infeasible PAGE 35
Thank you for your attention!