From Hazard Analysis to Hazard Mitigation Planning: The Automated Driving Case

TL;DR

This paper presents a framework for hazard analysis and mitigation planning in automated vehicles, enabling reliable hazard identification and mitigation through high-level controllers and incremental model construction.

Contribution

It introduces a novel framework and algorithm for designing planners that perform run-time hazard mitigation, tailored for highly automated vehicle controllers.

Findings

Framework supports hazard scenario elaboration and mitigation strategy design.

Incremental algorithm constructs planning models from hazard analysis.

Application demonstrates a fail-operational controller design.

Abstract

Vehicle safety depends on (a) the range of identified hazards and (b) the operational situations for which mitigations of these hazards are acceptably decreasing risk. Moreover, with an increasing degree of autonomy, risk ownership is likely to increase for vendors towards regulatory certification. Hence, highly automated vehicles have to be equipped with verified controllers capable of reliably identifying and mitigating hazards in all possible operational situations. To this end, available methods for the design and verification of automated vehicle controllers have to be supported by models for hazard analysis and mitigation. In this paper, we describe (1) a framework for the analysis and design of planners (i.e., high-level controllers) capable of run-time hazard identification and mitigation, (2) an incremental algorithm for constructing planning models from hazard analysis, and (3) an exemplary application to the design of a fail-operational controller based on a given control system architecture. Our approach equips the safety engineer with concepts and steps to (2a) elaborate scenarios of endangerment and (2b) design operational strategies for mitigating such scenarios.