The Missing Link: Developing a Safety Case for Perception Components in Automated Driving

Abstract

<div class="section abstract"><div class="htmlview paragraph">Safety assurance is a central concern for the development and societal acceptance of automated driving (AD) systems. Perception is a key aspect of AD that relies heavily on Machine Learning (ML). Despite the known challenges with the safety assurance of ML-based components, proposals have recently emerged for unit-level safety cases addressing these components. Unfortunately, AD safety cases express safety requirements at the system level and these efforts are missing the critical linking argument needed to integrate safety requirements at the system level with component performance requirements at the unit level. In this paper, we propose the Integration Safety Case for Perception (<b>ISCaP</b>), a generic template for such a linking safety argument specifically tailored for perception components. The template takes a deductive and formal approach to define strong traceability between levels. We demonstrate the applicability of ISCaP with a detailed case study and discuss its use as a tool to support incremental development of perception components.</div></div>

A Safety Assurable Human-Inspired Perception Architecture

“…We assume that the safety requirements of an object classification subsystem are refined from system level (e.g., ADS) safety requirements (see (Salay et al 2022(Salay et al , doi:10.4271/2022 for a schema of such a refinement). This refinement identifies specific performance requirements of the subsystem needed to address different potential hazard scenarios.…”

“…Can this fact be exploited to produce a stronger risk consistency requirement? In an assurance case, a fine-grained analysis of hazardous patterns of misperceptions relevant in different driving scenarios can provide a correspondingly fine-grained and risk-aware set of performance requirements for the Type 1 classifiers (Salay et al 2022(Salay et al , doi:10.4271/2022. Such a set of requirements identify the kinds of images that are more likely to cause hazardous actions if misclassified, thus the training of Type 1 classifiers can focus more on these.…”

“…Second, comparisons should be risk-awareperformance differences in a context that is not safety relevant are not important. One way to achieve this is to define specialized perception performance metrics for different hazardous driving scenarios (Salay et al 2022(Salay et al , doi:10.4271/2022. Finally, because generic metrics average performance over many trials, an AIP may obtain the same value as a human on the metric but still make, what to humans seem like unjustifiable errors (e.g., adversarial examples), undermining the assurance argument.…”