Compositional and Contract-Based Verification for Autonomous Driving on Road Networks

Abstract

Recent advances in autonomous driving have raised the problem of safety to the forefront and incentivized research into establishing safety guarantees. In this paper, we propose a safety verification framework as a safety standard for driving controllers with full or shared autonomy based on compositional and contract-based principles. Our framework enables us to synthesize safety guarantees over entire road networks by first building a library of locally verified models, and then composing local models together to verify the entire network. Composition is achieved using assumeguarantee contracts that are synthesized concurrently during verification. Thus, we can reuse local models within and across networks, add additional models to cover local road geometries without re-verifying the entire library, and perform all computations in a parallel and distributed way, which enables computational tractability. Furthermore, we employ controller contracts such that any controller satisfying them can be certified safe. We demonstrate the practical effectiveness of our framework by certifying controllers over parts of the Manhattan road network.

Compositional safety rules for inter-triggering hybrid automata

“…Our self-safety and responsibility rules utilize this structure to provide sufficient conditions for global safety. In comparison, existing compositional frameworks, such as [5,9,14,17,19,22,23,25], that give sufficient conditions for global safety allow agents' dynamics to be coupled but do not allow for triggering actions. • We note that our approach can be extended to guarantee safety for settings in which individual systems may have communication delays or sensor noise by leveraging recent advances in invariant set computation [10,12,15,29] for systems with these imperfections.…”

“…On the other extreme, one can analyze agents individually, assuming all of the remaining agents act adversarially, in which case safety is hard to attain, if at all possible. Several frameworks have been developed between these two extremes to capture various notions of coordination, collaboration, or contracts [5,6,9,14,17,23,25,28].…”

Autonomous Convoying: A Survey on Current Research and Development

“…As such, an autonomous vehicle needs to consider vehicles coming in the opposite direction. Road conventions are also required while overtaking other vehicles or allowing overtaking by other vehicles [61], [62].…”

Formal Certification Methods for Automated Vehicle Safety Assessment

“…Form of Reachability Analysis Type of Guarantee [87], [88] maxFRS + minBRS guarantees collision if no solution for "anticipated reachable set" is found [89] FRS of controlled dynamics predicts unavoidable collision within control policy [90] overapproximated maxFRS, maxFRT all possible forward motions are included [81] inaccuracy around trajectory-planned vehicle checks probability of collision within the inaccuracy model bounds [91] minBRT guarantees collision free in horizon [72] maxBRS for partially-controlled & uncontrolled vehicle conservative collision-free guarantee for non-extreme driving [92] overapproximated maxFRI guarantee "not-at-fault" safety by checking potential collision in time intervals leading to end of time horizon [93] maxBRT guarantees safe interoperability: possibly safe human takeover from autonomous driving system [94] maxFRS of uncontrolled dynamics guarantees collision free in horizon [95] funnel (a variant of FRT for controlled vehicle) guarantees collision-free if a funnel can be found to stay clear of obstacles at all times [96], [97], [98] maxFRS implemented by Flow* [99] guarantees safety of deep neural network (DNN) controlled close-loop system [100] maxFRS of (possibly) occluded vehicle guarantees collision-free with possibly occluded vehicle(s) [101] maxFRS of each agent communicated through a decentralized network real-time collision-free guarantee for a group of autonomous agents [102] maxFRS + collision state pruning + maxBRS guarantees collision-free and successful reach of target state if "controller contract" (state constraint tubes) are honored [86] maxFRT + pedestrian intent prediction guarantees safety within a high probability bound of pedestrian motion collision frequency [53], a vital quantity in determining automotive safety integritity level (ASIL) in ISO26262 [48]. If the vehicle is indeed in such a state, an impact preparation should be executed (usually with extensive use of braking to slow down [104], or by following not-at-fault trajectories [92].)…”