How to Address the Approval Trap for Autonomous Vehicles A survey - - PowerPoint PPT Presentation

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

How to Address the Approval Trap for Autonomous Vehicles

A survey of the challenge on safety validation and releasing the autonomous vehicle

• Prof. Dr. rer. nat. Hermann Winner

Maren Graupner, M.Sc. Dipl.-Ing. Walther Wachenfeld

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

2

The Approval Trap

Assumption:

• The development of autonomously driving vehicles has been finished.

Safety requirement:

• The risk with autonomous driving should not exceed the risk of

conventional driving.

For release this vehicle has to get an approval (by authorities and/or company internal sign off).

• A validation that the safety level complies to the requirement above has to

be done before the release.

• How can we validate that the risk does not exceed the current risk level?

Research Development Production Usage

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

3

Statistical Data for Risk Reference

Num umbe bers for

• r Ger

ermany 2013 2013 Total Autobahn Distance travelled/109 km 724 225 Total number of accidents/106 2.42 0.15 With personal injury/103 291 18.4 Distance between two accidents/106 km: All accidents 0.34 1.67 Involving personal injury 2.5 12 Involving serious casualties >11 >40 Involving fatalities >200 660

Reference distances as a function of the area of use and the consequences of accidents (Source: [Statistisches Bundesamt, German Federal Statistical Office, 2014]) Note:

• Regarding information on seriously injured casualties and fatalities, the figures refer to distance per person.

However, as more than one person per accident is affected in the category, the given value is a lower estimate.

• Only non-urban highways

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

4

Risk Figures for Human Drivers

1 Person drives 55 years independently, each year 14,000 km = 770,000 km/lifetime ≈ 15,000 h (at average speed 50 km/h)

• The average driver is involved every 340,000 km into a reported accident,

and self caused by 60%.

• The average driver is involved every 210 mio. km into an accident with

fatalities.

• In average 1.4 accidents are caused by one human in his/her lifetime and

1:450 fatalities/lifetime.

Although human drivers make millions of mistakes very, very few severe accidents occur as a consequence.

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

5

Known Approval Strategies

Endurance driving test

• Proof of relative risk to drive a specific distance

in which the expected event (crash) is statistically occurring multiple times.

• State-of-the-Art for ADAS:

1 … 10 millions km

• Driver is still responsible and ADAS is designed

for controlability

What are the necessary travel distances for an approval of autonomous driving?

Source: KFZTicker.de

(Source: [Fach, M., Baumann, F., Breuer, J., May, A.: Bewertung der Beherrschbarkeit von Aktiven Sicherheits- und Fahrerassistenzsystemen an den Funktionsgrenzen. In: 26. VDI/VW-Gemeinschaftstagung Fahrerassistenz und Integrierte Sicherheit, 6./7. Oktober 2010 in Wolfsburg (2010)], [Daimler AG: Mercedes-Benz präsentiert in Genf Limousine und Coupé der neuen E-Klasse (2009)])

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

6

Statistical Considerations (I)

Poisson Distribution (independent random process) for the probability, that k events occur in case of an expected value of λ:

• λ = ratio between observed test kilometers

and system performance

• The system performance describes the expected travel distance between

two events

Wachenfeld, W., Winner, H.: Die Freigabe des autonomen Fahrens. In: Maurer, M., Gerdes, J.C., Lenz, B., Winner, H. (Hrsg.) Autonomes Fahren, pp. 439-464. Springer Berlin Heidelberg (2015)

perf test

s s = λ

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

7

Statistical Considerations (II)

Poisson Distribution (independent random process) for the probability, that k events occur in case of an expected value of λ:

• Distance factor
• Performance factor

How big is the distance factor at a confidence level of 95%?

Wachenfeld, W., Winner, H.: Die Freigabe des autonomen Fahrens. In: Maurer, M., Gerdes, J.C., Lenz, B., Winner, H. (Hrsg.) Autonomes Fahren,

• pp. 439-464. Springer Berlin Heidelberg (2015)

test d

s a s = ⋅

perf perf

s a s = ⋅

perf test

s s = λ

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

8

Statistical Considerations (III)

For a success probability of 50% and a confidence level of 95% results:

• A 3 times higher travel distance is

sufficient to (statistically) validate that autonomous driving is at least as safe as humans.

• In order to get this with 50% probability

the expected value for travel distance has to be about 4 times higher.

• If the system is just as twice as good about

10 times more travel distances are needed.

Depending on reference accident class testing distances would exceed 100 millions km up to 10 billion km. Even Google didn‘t drive this distance yet (less than 1% of it).

Wachenfeld, W., Winner, H.: Die Freigabe des autonomen

• Fahrens. In: Maurer, M., Gerdes, J.C., Lenz, B., Winner, H.

(Hrsg.) Autonomes Fahren, pp. 439-464. Springer Berlin Heidelberg (2015)

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

9

STOP!!!!!

For today’s vehicles (and more extreme for aircrafts) there is not any requirement for such high milage, why here? Is there a fundamental difference?

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

10

Differences between conventional and automated vehicles

Vehicle Longitudinal - and Lateraldyn. Driver Navigation Guidance/ Conducting Stabilization Selected route Time schedule Desired speed and trajectory Steering Accelerating Vehicle motion Environment Road network Traffic situation Road surface Alternative routes Range of safe motion states Actual trajectory and speed Transport mission

(according to [Rasmussen, J.: Skills, Rules, and Knowledge; Signals, Signs, and Symbols, and Other Distinctions in Human Performance Models. IEEE Transactions On Systems, Man, and Cybernetics SMC- 13(3), 257–266 (1983)] and according to [Donges, E.: Fahrerverhaltensmodelle. In: Winner, Hakuli, Wolf (eds.) Handbuch Fahrerassistenzsysteme, pp. 15–23 (2011)])

Knowledge-based Behavior Rule-based Behavior Skill-based Behavior Sensory Input

Driving robot and vehicle

Current approval of vehicle doesn‘t cover the yellow area

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

11

Autonomous Driving

Approval Trap

With today´s method and approaches, the approval of autonomous vehicles is not imaginable!

?

What next?

• Abandon the development of autonomous vehicles?
• Find ways out; disarm the trap!

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

12

Lack of Testing Knowledge for Driving Function

We do not know …

• the representative worst case test cases,
• the metrics for identification of critical situations,
• the environmental influence on perception,
• how the behavior can be tested as robust and

safe,

• whether the simulation models for MiL, SiL, HiL,

ViL are valid and how to validate,

• how representative the simulation has to be for

approval purpose.

How can we gain that missing knowledge?

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

13

Evoluationary Approach to Gain Testing Knowledge based on Functional Evolution

Functional evolution

• Predecessor function gains testing knowledge for successor function
• Data bases of situations, remarkable road parts, of sensor raw signals
• Establishing test cases (for real and virtual tests)
• Virtual Assessment of Automation in Field Operation (VAAFO) can

evaluate emulated behavior without danger. (Source [Wachenfeld, W., Winner, H.: Virtual Assessment of Automation in

Field Operation – A New Runtime Validation Method, FAS Workshop in Walting 2015])

• Makes simulation models more realistic.
• Generates statistical data for risk assessment

How does the functional evolution look like?

• It depends on the Use Case of Autonomous Driving (Source [Wachenfeld, W., Winner, H., Gerdes, C., Lenz, B.,

Maurer, M., Beiker, S.A., Fraedrich, E., Winkle, T.: Use-Cases des autonomen Fahrens. In: Maurer, M., Gerdes, J.C., Lenz, B., Winner, H. (eds.) Autonomes Fahren, pp. 9-37. Springer Berlin Heidelberg (2015)])

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

14

From ADAS to Autonomous Driving

Risk Speed

The Evolution Triangle towards Autonomous Driving

ACC: Adaptive Cruise Control LKS: Lane Keeping Support L²A: Longitudinal & Lateral Assist. FSR-ACC: Full-Speed-Range-ACC AVP: Autonomous Valet-Parking AP: Automated Parking PSA: Park Steering Assist Em-A: Emergency Assist CA-E: Collision Avoidance by Evading CA-B: Collision Avoidance by Braking CM-B: Collision Mitigation by Braking

(Source [Winner, H.: Quo vadis, FAS? In: Winner, H., Hakuli, S., Lotz, F., Singer, C. (eds.) Handbuch Fahrerassistenzsysteme, 3rd edn. Vieweg-Teubner-Verlag (2015)]

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

15

Evoluationary Approach to Gain Testing Knowledge based on Use Case Extension

Use case extension

• Functional start with full driverless automation
• Limitation of operation area
• From few routes to new driving area (incremental extension of potential

risk).

• At first, there is no comparable benchmark for the risk.
• Field experience will make the autonomous driving more and more

mature.

• The operation is supervised (e.g. by a provider) and can be controlled

(including shut down).

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

16

Functional Evolution vs. Use Case Extension

Functional Evolution

• Area of operation does not

change much

• Field data generation by

predecessor function (can be used for ViL, HiL, SiL tests)

• Virtual Assessment of

Automation in Field Operation is able to extend the testing travel distance by series vehicles (can be coupled with upgrade process)

• Comparison safety level from

accident statistics will be applied as safety criteria.

Use Case Extension

• Extended area of operation is

well known from previous tests

• r previous releases.
• Focusing on target function, so

no need for interim functions

• At beginning no comparison

figure for human safety =>

• ther safety criteria can be

used

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

17

Virtualization of Tests for Approval

Enabling of efficient test tools

• Virtual testing has potential to accelerate approval, but with virtualization

always simplification takes place  Validation of model?

• Different ways of combinating virtuality and realitiy exist and can be used
• Sensor simulation for SiL and sensor stimulation for HiL/ViL is needed

Wachenfeld, W., Winner, H.: Die Freigabe des autonomen Fahrens. In: Maurer, M., Gerdes, J.C., Lenz, B., Winner, H. (Hrsg.) Autonomes Fahren, pp. 439-464. Springer Berlin Heidelberg (2015)

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

18

Virtual Approval

Principle:

• Running tests by many paralleled systems (ViL, HiL, SiL) equivalent to

billions of km (109 km approx. 20 million hours = 2280 years)

• Validation of simulation models
• component models (e.g. sensors) by component testing systems
• environment conditions from test drives recording
• vehicle dynamics by test maneuvers
• Situation creation by permutation or stochastics (Monte Carlo approach).
• Challenge: Validation of behavior models of other traffic participants.

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

19

Virtual Approval

Problem due to the manifold of situational combinations

• Many sceneries and circumstances
• Many constellations of traffic partners
• Various environment conditions (e.g. rain, fog, pavement condition, light

brightness and direction, …)

Permutation of all influence parameters will overload any computer cluster

• Evaluation of safety in simulation just by counting occurred virtual

accidents needs the full combination of all variables

• How can we come to a feasible virtual approval?

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

20

Decomposition Approach for Test Case Reduction

Decomposing the entity vehicle into several layers

• Clustering of test cases (experimental as well as in simulation) related to

the layer Situation Umgebung (dyn.) Situation Umgebung (dyn.)

Situation subject vehicle

1: Information access 2: Information reception 3: Information processing 4: Decision (behavioral) 5: Action

Situation environment (dyn.) Situation statical

Object under test Test environment

1: Information access 2: Information reception 3: Information processing 4: Decision (behavioral) 5: Action

Layer after: Graab et al.: Analyse von Verkehrsunfällen hinsichtlich unterschiedlicher Fahrerpopulationen und daraus ableitbarer Ergebnisse für die Entwicklung adaptiver Fahrerassistenzsysteme

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

21

Decomposition Approach for Test Case Reduction

Decomposition may lead to reduction of test effort by

• Modularisation of tests and no or less re-test in case of unchanged

functional modules

• Reduction of redundant tests within the same layer

Pre-requite:

• Pass/fail criteria (metrics) depending on decomposing layer

Open promise:

• Metrics for comparison on safety performance human vs. machine

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

22

Virtual Approval

But: How can we be convinced that the test case set is sufficient?

• Check whether all situations of reconstructed accidents are part of the

test set does help just a little bit, because driving robot behavior has intentionally to differ from human driving.

• And nobody knows how the behavior of human would change when they

were confronted with autonomous driving.

Conclusion on virtual approval

• Simulation will be a very important part of the approval process, but it will

not help to overcome the approval trap due to the lack of validity for modeling and test case set in the beginning.

• A virtual approval should be future objective for methodological and

economical reasons.

• So, the other test methods have to improve the model validity and the test

catalogue.

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

23

Approval by Worst Case Testing

Systematical reduction of test cases

• Identify critical situations only
• Assumption: If all critical situations could be handled, every less critical

situation can be handled, too.

• Need of a validated metric for criticality in situations
• Even with only checking critical situations a huge variety of these critical

situation must be tested (e.g. various weather conditions, brightness,…).

• Challenge of reduction and virtualization

Real world Relevant world Artificial/virtual tests Real driving

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

24

The new Role of Driving Tests

Driving tests for model validation

• Comparison of behavior between simulated and real situations
• Driving tests for environment representation validation and behavior

pattern of other traffic participants

Driving tests for test catalogue

• Situational statistics for importance ranking of test cases
• Making the test case catalogue complete (for both virtual and real tests)

Only real drives are able to assess the validity of model and test catalogue.

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

25

The new Role of Driving Tests

By the rate of “surprises” of new driving tests a careful extrapolation how valid the models are and how complete the current test catalogue might be possible.

Surprising/ New events Number of counted new events per distance

• Approx. trend line

Extrapolation 1 10 100 1000 1000 100 10

1

Driven test kilometers 103

⋅

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

26

Conclusion Approval Trap

The critical path in introducing autonomous vehicles is not determined by technology but by the development of a methodology allowing the approval!

Approval Trap

Virtual Approval Evaluation Metric

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

27

Remaining Problem

Prognosis:

• For the first Autonomous Driving application the pre-requisites for an

approval for general and unlimited introduction will not be given (like a chicken & egg-problem).

• The Approval Trap might be filled up to some extend by the methological

work before, but not sufficient.

Do we have any alternative?

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

28

Strategy: Risk limited Introduction

Risk limitation based on statistical figures

• 1. Testing travel distance with the recorded mean value of accidents gives

an estimate for the expected accident value (depending on a given error probability one can calculate a best and a worst case factor).

• 2. Taking the worst case factor one can calculate the maximum expected

risk for a given number of autonomous vehicles in the field.

• 3. Whether this worst case risk is below a detection limit in a statistical

sense the vehicles can be introduced in order to record additional data helping the release for the next higher number of autonomous vehicles.

• 4. The driven travel distance increase the statistical basis and the fleet in

traffic can be increased recursively.

Wachenfeld, W.; Winner, H.: The new role of road testing for the safety validation of automated vehicles. In Horn, M.; Watzenig, D. (eds.): Automated Driving – Safer and more efficient future driving; Springer International Publishing AG (to be published in early 2016)

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

29

Risk limited Introduction

Autonome Entscheidung !?

Approval Trap

e

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

30

Conclusion

The Approval Trap is still existing. There are different promising approaches

• Virtual Approval,
• Virtual Assessment of Automation in Field Operation (VAAFO),
• Decomposition, and
• Worst Case Testing
• vercoming the trap,

but they need pre-requisites which are far from today state-of-the-art.

How to Address the Approval Trap for Autonomous Vehicles | Prof. H. Winner| Dagstuhl | November 2015

31

Conclusion

Functional evolution or use case extension are strategies to get sufficient data. But there are still some doubts whether the quality of the methods for validation will be then sufficient. Test drives will play the key role for risk assessment and for development of all alternative test methodologies. A limiting risk introduction strategy is still an alternative introduction strategy in order to “tunnel” the barrier or to skip the trap for the first systems.