Architecting Safety Supervisors for High Levels of Automated Driving

Abstract

The complexity of automated driving poses challenges for providing safety assurance. Focusing on the architecting of an Autonomous Driving Intelligence (ADI), i.e. the computational intelligence, sensors and communication needed for high levels of automated driving, we investigate so called safety supervisors that complement the nominal functionality. We present a problem formulation and a functional architecture of a fault-tolerant ADI that encompasses a nominal and a safety supervisor channel. We then discuss the sources of hazardous events, the division of responsibilities among the channels, and when the supervisor should take over. We conclude with identified directions for further work.

Supporting Safe Decision Making Through Holistic System-Level Representations & Monitoring -- A Summary and Taxonomy of Self-Representation Concepts for Automated Vehicles

“…The approach presented by Trngren et al [6] does not make this clear distinction between the managed element and the MAPE-K loop. The system consists of three MAPE-K loops in a nominal and a supervisor channel.…”

“…Furthermore, the adaptation of MAPE-K-like structures to automated vehicle systems has e.g. been proposed by [4] and [6]: Partially motivated by propositions made in [9,10,21], Carr [4] tailors a MAPE-K-loop toward runtime safety assurance for automated vehicles. Following Kephart and Chess [26], the loop resides in parallel to those components of the vehicle automation system, which implement the actual automated driving functionality.…”

“…The supervisor channel includes two MAPE-K loops, one of which monitors the nominal channel and one which is a degraded version of the nominal channel. Knowledge is represented in the form of safety constraints in the knowledge base of the supervisor channel and provide an explicit analysis module, which is responsible for switching between nominal and degraded functionality [6].…”

“…3) Other Recent Approaches: Other recent publications also suggest explicit monitoring of Operational Design Domains (ODDs) [5] or the definition of system-level "factors" to trigger graceful degradation in case of malfunctioning system parts [32]. Conceptwise, this is closely related to representing safety constraints in a monitoring element, as proposed by [6].…”

“…Existing system-level monitoring approaches range from systems relying on redundant processing paths [6] to more holistic monitoring approaches, which aim at capability-conforming system behavior [7][8][9]. A more recent holistic concept in this respect is self-awareness for automated vehicles [4,10] which strongly relies on the explicit representation of knowledge about the system itself.…”