Risk Structures: Concepts, Purpose, and the Causality Problem Mario Gleirscher University of York, UK June 26, 2019 Shonan, JP
Part I Risk-aware Systems: Abstraction by Example 4.0 / Gleirscher / Shonan, JP/ June 26, 2019 52
Example: Air-traffjc Collision Avoidance System (TCAS) Example: Safe Autonomous Vehicle (SAV) 4.0 / Gleirscher / Shonan, JP/ June 26, 2019 53
Risk Mitigation / Intervention / Enforcement Monitor 4.0 / Gleirscher / Shonan, JP/ June 26, 2019 / Which abstraction? / What do we need to verify? RQ: How to build a mitigation monitor? / Which model to use? to conforms from synthesised Approach: Active abstracts Process Monitored tation Implemen from Active Risk safety monitors, enforcement monitors model System/ Process Model MDP, LTS, HA 56 Active Test Structure Monitor / s a e b s s s i e n t c y f g r r t r a o o r o c e c m f t e n p s r e o r p
Example: Air-traffjc Collision Avoidance System (TCAS)
Example: Traffjc Collision Avoidance System (TCAS) p 3 2 Risk Factors before 0 ncoll start ncoll near-collision p 1 Ego p 2 p 4 coll p 5 p 6 mov a 2 (TCAS move) tmov a 4 Risk Space 4.0 / Gleirscher / Shonan, JP/ June 26, 2019 collision start start 1 Risk Factor Process Model P abstracts from p 1 p 6 mov p 4 57 0 coll t ✘✘ ✘ ncoll , coll t ✘✘ tmov { e ncoll u { u e coll m o v e coll e ncoll t p 1 , p 3 , Risk Model R t p 2 , p 5 u t p 4 u t p 1 , p 6 u p 4 , p 6 u ✘ t ✘✘ ě m tmov { fin u t u ? ncoll , 0 coll 0 ncoll , coll ✚ Σ zt mov { fin u l e n l o ✚ c c m ncoll Σ zt tmov { fin u o Σ zt mov { e coll u l l e t Σ zt tmov { e ncoll u m m “ o ✚ ✚ “ v { f mov { fin 0 ncoll , 0 coll i n r l 4 , u 4 q Λ 4 : e coll 1 ` severity e.g. red ” 1 ` benefit ą c r l , u q Λ 5 : e ncoll Λ : coll Λ 2 : e ncoll r l 5 , u 5 q Λ 6 : fin ´ 1 1 ´ Λ 2 : fin a 3 Λ : fj a 1 n a 5
Example: Traffjc Collision Avoidance System (TCAS) p 3 2 Risk Factors before 0 ncoll start ncoll near-collision p 1 Ego p 2 p 4 coll p 5 p 6 mov a 2 (TCAS move) tmov a 4 Risk Space 4.0 / Gleirscher / Shonan, JP/ June 26, 2019 collision start start 1 Risk Factor Process Model P abstracts from p 1 p 6 mov p 4 58 0 coll t ✘✘ ✘ ncoll , coll t ✘✘ tmov { e ncoll u { u e coll m o v e coll e ncoll t p 1 , p 3 , Risk Model R t p 2 , p 5 u t p 4 u t p 1 , p 6 u p 4 , p 6 u ✘ t ✘✘ ě m tmov { fin u t u ? ncoll , 0 coll 0 ncoll , coll ✚ Σ zt mov { fin u l e n l o ✚ c c m ncoll Σ zt tmov { fin u o Σ zt mov { e coll u l l e t Σ zt tmov { e ncoll u m m “ o ✚ ✚ “ v { f mov { fin 0 ncoll , 0 coll i n r l 4 , u 4 q Λ 4 : e coll 1 ` severity e.g. red ” 1 ` benefit ą c r l , u q Λ 5 : e ncoll Λ : coll Λ 2 : e ncoll r l 5 , u 5 q Λ 6 : fin ´ 1 1 ´ Λ 2 : fin a 3 Λ : fj a 1 n a 5
Example: Traffjc Collision Avoidance System (TCAS) p 3 2 Risk Factors before 0 ncoll start ncoll near-collision p 1 Ego p 2 p 4 coll p 5 p 6 mov a 2 (TCAS move) tmov a 4 Risk Space 4.0 / Gleirscher / Shonan, JP/ June 26, 2019 collision start start 1 Risk Factor Process Model P abstracts from p 1 p 6 mov p 4 58 0 coll t ✘✘ ✘ ncoll , coll t ✘✘ tmov { e ncoll u { u e coll m o v e coll e ncoll t p 1 , p 3 , Risk Model R t p 2 , p 5 u t p 4 u t p 1 , p 6 u p 4 , p 6 u ✘ t ✘✘ ě m tmov { fin u t u ? ncoll , 0 coll 0 ncoll , coll ✚ Σ zt mov { fin u l e n l o ✚ c c m ncoll Σ zt tmov { fin u o Σ zt mov { e coll u l l e t Σ zt tmov { e ncoll u m m “ o ✚ ✚ “ v { f mov { fin 0 ncoll , 0 coll i n r l 4 , u 4 q Λ 4 : e coll 1 ` severity e.g. red ” 1 ` benefit ą c r l , u q Λ 5 : e ncoll Λ : coll Λ 2 : e ncoll r l 5 , u 5 q Λ 6 : fin ´ 1 1 ´ Λ 2 : fin a 3 Λ : fj a 1 n a 5
Example: Safe Autonomous Vehicle (SAV)
Risk Mitigation / Intervention / Enforcement Monitor 4.0 / Gleirscher / Shonan, JP/ June 26, 2019 / Which abstraction? / What do we need to verify? RQ: How to build a mitigation monitor? / Which model to use? to conforms from synthesised Approach: Active abstracts Process Monitored tation Implemen from Active Risk safety monitors, enforcement monitors model System/ Process Model MDP, LTS, HA 62 Active Test Structure Monitor / s a e b s s s i e n t c y f g r r t r a o o r o c e c m f t e n p s r e o r p
SAV: Low Level Vehicle Dynamics move decel v = l v = 0 start neutral turn left straight drive at turn right Longitudinal dynamics LoD Lateral dynamics LaD (relative to route segment) Overall low-level dynamics: 4.0 / Gleirscher / Shonan, JP/ June 26, 2019 max speed 63 start accel halt r 9 α “ f s r 9 r 9 p “ v , p “ v , ^ | v | ą 0 y ą 0 y ą 0 ^ | v | ą 0 0 ă y ă 5 9 v “ a s 9 v “ 0 s α “ 0 9 0 ă v ă l v “ l α “ 0 ^ α ‰ 0 ^ α “ 0 9 ^ a ą 0 ^ a “ 0 a ą 0 r 9 α “ 0 s r 9 α “ 0 s a ą 0 a ă 0 a ď 0 α ‰ 0 α “ 0 r 9 p “ 0 , r 9 p “ v , α “ 0 ^ 9 α “ 0 ^ α ‰ 0 9 α “ 0 9 v “ 0 s v “ a s 9 ^ | v | ą 0 y ă 0 � 0 0 ă ą 0 ă v ă l v “ 0 | r 9 α “ f s y | v ^ a “ 0 ^ a ď 0 ^ ´ 5 ă y ă 0 drive accel turn left drive at max halt move speed neutral straight decel turn right drive � LaD
SAV: Situational Perspective of Urban Driving Mode model of the driving activity: 4.0 / Gleirscher / Shonan, JP/ June 26, 2019 verify contract: In each mode, dynamics: low level Integration with 64 basic || supplyPower drive driveAtL4 || requestTakeOverByDr driveAtL1 || operateVehicle driveThroughCrossing exitTunnel manuallyOvertake driveAtL4Generic inv ^ pre ñ autoOvertake driveAtL1Generic halt wp p drive � LaD , inv ^ post q driveAtLowSpeed steerThroughTrafficJam parkWithRemote manuallyPark autoLeaveParkingLot leaveParkingLot start
SAV: Risk Identifjcation and Assessment Knowledge sources for risk/hazard identifjcation, e.g. • accident reports • domain experts • local dynamics model • control system architecture • control software Analysis techniques , e.g. • hazard identifjcation: FHA, PHL, … • causal reasoning: ETA, FMEA, FTA, Bowties, … 4.0 / Gleirscher / Shonan, JP/ June 26, 2019 65 • situation/activity model • process/scenario analysis: HazOp, LOPA, BA, STPA, …
SAV: Situational Perspective of Urban Driving ; CR alias "increased collision risk" ; 7 CC alias "on collision course" ; 9 ICS alias "inevitable collision state" 11 ; Coll alias "actual collision" ; 13 ES alias "perception system fault" ; 15 } 4.0 / Gleirscher / Shonan, JP/ June 26, 2019 5 course" Mode model of the driving activity: (Yap script): OC alias "on occupied Risk factors 66 1 { 3 HazardModel for "drive" basic || supplyPower drive driveAtL4 || requestTakeOverByDr driveAtL1 || operateVehicle driveThroughCrossing exitTunnel manuallyOvertake driveAtL4Generic autoOvertake driveAtL1Generic halt driveAtLowSpeed steerThroughTrafficJam parkWithRemote manuallyPark autoLeaveParkingLot leaveParkingLot start
Recommend
More recommend
