It is easy to agree that an automated driving system shall be safe, but it is an on-going discussion what safe means. Several Risk Acceptance Criteria (RAC) candidates have been suggested, but a closer analysis indicates that not all of them are related to risk in a traffic safety sense and that perhaps they are better described as properties that an ADS should be designed to exhibit for other reasons.This paper discusses safety aspects of Automated Driving System (ADS) features and the different incentives and arguments that drive the design of an ADS. More precisely, this paper explores different design goals for safe automated driving and puts forward a combination of Risk Acceptance Criteria (RAC) for limiting the risk of harm. These criteria are motivated and contextualized using a simple real-world traffic example. Furthermore, it is also shown why run-time risk transfer is unavoidable in any system that makes tactical decisions under uncertainty and why this motivates avoiding thought-examples such as the trolley problem as basis for ADS design. 

Safety analysis on the level of a complete road vehicle can be an intricate task. Several methods and tools for safety analysishave been developed by the research community. One such tool developed to bridge the gap between research and industry isSemi-Markov Process (SMP) Tool. In this paper, two approaches for safety analysis utilizing SMP Tool are presented. Theholistic approach starts out with a quantitative safety target on a vehicle level to then finally argue whether a proposed systemdesign is safe enough. In the segmented approach, the idea is to follow the development steps of industrial standards, whileutilizing SMP Tool for specific tasks within the standard. Specifically the standard ISO 26262 will be under mostconsideration. Both approaches are applied to a case study of a battery management system for an electrified truck. Thesegmented approach can avoid some difficulties arising when following ISO 26262 conventionally while keeping theadvantage that the standard is utilized to find what qualitative tasks should be performed. The holistic approach has anadvantage in that it considers the safety from a vehicle perspective. Moreover, all ambiguity issues in ISO 26262 are avoided.

Connected automated vehicles (CAVs) are—compared conventional vehicles—expected to provide more efficient, accessible, and safer transport solutions in on-road use cases as well as confined areas such as mines, construction sites or harbours. As development of such vehicles has proved more difficult than anticipated, especially when it comes to ensuring safety, more cautious strategies for introduction are now being pursued. An approach where new automated features are initially released with more basic performance to enable successful safety assurance, followed by gradual expansion of performance and number of use-cases using an iterative development process as the confidence in the solution increases, e.g., due to more available field data, improved machine learning algorithms, or improved verification, is highly interesting. Hence a key research question targeted by the SALIENCE4CAV project was: How to ensure the safety of CAVs while enabling frequent updates for automated driving systems with their comprising elements? Today, many of the used methods and practices for safety analysis and safety assurance are not adequate for continuous deployment. In addition, the project has investigated several open questions raised by the predecessor project ESPLANADE and from needs identified by the industry partners; this includes how to handle safety assurance for machine learning components, use of quantitative risk acceptance criteria as a key part of the safety argument, safety for collaborative CAVs including use in mixed traffic environments, the role of minimal risk manoeuvres, and interaction with human operators.

Some key results are: investigation of safety assurance methods and gaps with regards to frequent updates and other challenges for CAV safety assurance; use of safety contracts as an enabler for continuous integration, continuous deployment and DevOps; a method for human interaction safety analysis; application of the principle of precautionary safety for meeting a quantitative risk norm and using field data for continuous improvements; definition of classes of cooperative and collaborative vehicles and their respective characteristics and definition of minimal risk manoeuvre and minimal risk condition strategies for individual, cooperative and collaborative vehicles; use of out-of-distribution detection for safety of machine learning; a simulation-aided approach for evaluating machine learning components; and methods for variational safety using high-dimensional safety contracts.

The SALIENCE4CAV project ran from January 2021 to December 2023 with the partners Agreat, Comentor, Epiroc Rock Drills, KTH Royal Institute of Technology, Qamcom Research and Technology, RISE Research Institutes of Sweden, Semcon Sweden, Veoneer (during the project acquired by Magna) and Zenseact. Coordination was done by RISE.

This final report is a summary of the project results and contains summaries of content from the project deliverables and publications.

Artificial Intelligence (AI) techniques through Learning-Enabled Components (LEC) are widely employed in Automated Driving Systems (ADS) to support operation perception and other driving tasks relating to planning and control. Therefore, the risk management plays a critical role in assuring the operational safety of ADS. However, the probabilistic and nondeterministic nature of LEC challenges the safety analysis. Especially, the impacts of their functional faults and incompatible external conditions are often difficult to identify. To address this issue, this article presents a simulation-aided approach as follows: 1) A simulation-aided operational data generation service with the operational parameters extracted from the corresponding system models and specifications; 2) A Fault Injection (FI) serviceaimed at high-dimensional sensor data to evaluate the robustness and residual risks of LEC. 3) A Variational Bayesian (VB) method for encoding the collected operational data and supporting an effective estimation of the likelihood of operational conditions. As a case study, the paper presents the results of one experiment, where the behaviour of an Autonomous Emergency Braking(AEB) system is simulated under various weather conditions based on the CARLA driving simulator. A set of fault types of cameras, including solid occlusion, water drop, salt and pepper, are modelled and injected into the perception module of the AEB system in different weather conditions. The results indicate that our framework enables to identify the critical faults under various operational conditions. To approximate the critical faults in undefined weather, we also propose Variational Autoencoder(VAE) to encode the pixel-level data and estimate the likelihood.

The emergence of Automated Driving Systems (ADSs) has transformed the landscape of safety assessment. ADSs, capable of controlling a vehicle without human intervention, represent a significant shift from traditional driver-centric approaches to vehicle safety. While traditional safety assessments rely on the assumption of a human driver in control, ADSs require a different approach that acknowledges the machine as the primary driver. Before market introduction, it is necessary to confirm the vehicle safety claimed by the manufacturer. The complexity of the systems necessitates a new comprehensive safety assessment that examines and validates the hazard identification and safety-by-design concepts and ensures that the ADS meets the relevant safety requirements throughout the vehicle lifecycle. The presented work aims to enhance the effectiveness of the assessment performed by a homologation service provider by using assessment templates based on refined requirement attributes that link to the operational design domain (ODD) and the use of Key Enabling Technologies (KETs), such as communication, positioning, and cybersecurity, in the implementation of ADSs. The refined requirement attributes can serve as safety-performance indicators to assist the evaluation of the design soundness of the ODD. The contributions of this paper are: (1) outlining a method for deriving assessment templates for use in future ADS assessments; (2) demonstrating the method by analysing three KETs with respect to such assessment templates; and (3) demonstrating the use of assessment templates on a use case, an unmanned (remotely assisted) truck in a limited ODD. By employing assessment templates tailored to the technology reliance of the identified use case, the evaluation process gained clarity through assessable attributes, assessment criteria, and functional scenarios linked to the ODD and KETs.

One vital safety aspect of advanced vehicle features is ensuring that the interaction with human users will not cause accidents. For remote driving, the human operator is physically removed from the vehicle, instead controlling it from a remote control station over a wireless network. This work presents a methodology to inject network disturbances into this communication and analyse the effects on vehicle manoeuvrability. A driving simulator, CARLA, was connected to a driving station to allow human-in-the-loop testing. NETEM was used to inject faults to emulate network disturbances. Time-To-Collison (TTC) and Steering Reversal Rate (SRR) were used as the main metrics to assess manoeuvrability. Clear negative effects on the ability to safely control the vehicle were observed on both TTC and SRR for 5% packet loss, and collision analysis shows that 50ms communication delay and 5% packet loss resulted in crashes for our test setup. The presented methodology can be used as part of a safety evaluation or in the design loop of remote driving or remote assistance vehicle features.

During the last decade, there has been significant increase in research focused on automated vehicles (AVs) and ensuring safe operation of these vehicles. However, challenges still remain, some involving the cooperation and collaboration of multiple AVs, including when and how to perform a minimal risk manoeuvre (MRM), leading to a minimal risk condition (MRC) when an AV within one of these systems is unable to complete its original goal. As most literature is focused on individual AVs, there is a need to adapt and extend the knowledge and techniques to these new contexts. Based on existing knowledge of individual AVs, this paper explores MRM strategies involving cooperative and collaborative AV systems with different capabilities. Specifically, collaborative systems have the potential to enact local MRCs, allowing continued productivity despite having one (or several) of its constituents encounter a fault. Definitions are provided for local and global MRCs, alongside discussions of their implications for MRMs. Illustrative examples are also presented for each type of system.

The automotive industry is moving towards increased automation, where features such as automated driving systems typically include machine learning (ML), e.g. in the perception system. [Question/Problem] Ensuring safety for systems partly relying on ML is challenging. Different approaches and frameworks have been proposed, typically where the developer must define quantitative and/or qualitative acceptance criteria, and ensure the criteria are fulfilled using different methods to improve e.g., design, robustness and error detection. However, there is still a knowledge gap between quality methods and metrics employed in the ML domain and how such methods can contribute to satisfying the vehicle level safety requirements. In this paper, we argue the need for connecting available ML quality methods and metrics to the safety lifecycle and explicitly show their contribution to safety. In particular, we analyse Out-of-Distribution (OoD) detection, e.g., the frequency of novelty detection, and show its potential for multiple safety-related purposes. I.e., as (a) an acceptance criterion contributing to the decision if the software fulfills the safety requirements and hence is ready-for-release, (b) in operational design domain selection and expansion by including novelty samples into the training/development loop, and (c) as a run-time measure, e.g., if there is a sequence of novel samples, the vehicle should consider reaching a minimal risk condition. [Contribution] This paper describes the possibility to use OoD detection as a safety measure, and the potential contributions in different stages of the safety lifecycle. © 2023, The Author(s)

The overarching goal of the ROADVIEW project is performance improvements in perception and decision-making subsystems for connected automated vehicles (CAVs) under harsh weather conditions such as rain, fog, or snow, which is necessary to enable the widespread use of automated vehicles. In support of this overarching goal, this deliverable (D2.1) describes complex environments—including levels of harsh weather conditions and density of heterogeneous traffic—to be used for the R&D activities and evaluations in WPs 3 – 8. The environment descriptions are in the form of operational design domain (ODD) definitions meant to be combined with the use cases defined in D2.2. The ODD definitions are specified by using and extending the ODD taxonomy defined in ISO 34503 [3], considering the needs of the ROADVIEW use cases, and the environmental conditions especially relevant for the sensor types investigated in the project. This deliverable first defines terminology related to driving automation systems, ODDs, and testing—where a key purpose is to verify that the CAV operates safely within its ODD. Then harsh weather conditions and the main sensor types intended to be used in the project are discussed. Sensors are investigated with respect to which weather conditions and which metrics for these conditions are relevant to perform verification against the defined ODD (e.g., rain metrics can be intensity specified in mm/h and droplet size distribution). Next follows a discussion on particularly relevant ODD attributes and why we have chosen certain metrics and classifications, and in some instances added new attributes not mentioned in ISO 34503. Finally, ODD definitions are developed for the different types of road environments, or drivable areas, defined in D2.2, i.e., highway, urban traffic, and rural road. D2.2 also defines several use cases for automated vehicles that are relevant for these drivable areas and will be used by the other WPs, together with the ODD definitions from this deliverable, to create test scenarios. Objectives The main objective of this deliverable is to create ODD definitions for the use cases investigated in the project, especially detailing harsh weather conditions with a focus on rain, fog, and snow. By combining these harsh conditions with use cases defined in D2.2, the project will have the basis for working on perception and decision-making improvements for such conditions, and for defining relevant test cases to apply in different test environments used in the project (simulation, x-in-the-Loop, weather test facilities, test tracks, and open-road tests). Together, D2.1 and D2.2 aim to fulfil ROADVIEW Objective 1: Define complex environmental conditions and use case specifications. Methodology and implementation Since the overarching goal of ROADVIEW is to improve performance for CAVs in harsh weather conditions, this deliverable aims to specify an ODD taxonomy specifically including (1) operational conditions relevant for harsh weather conditions with respect to the design and verification of advanced environmental sensors and decision-making systems, and (2) operational conditions relevant for the specific use-cases to be evaluated in the project. The methodology was to, as far as possible, make sure the project uses ODD taxonomy and other terminology from existing sources, in particular existing or soon-to-be-released standards [1][2][3][4][6], to make sure we use terms in a way already established in the automotive domain and avoid inventing new terms where there are already existing alternatives. Given this starting point, a group of experts in sensor technology, test environments, and the providers of use cases have collected and analysed what kind of harsh conditions should be included, and if there is a need to refine the existing ODD taxonomy with new or more detailed attributes or new metrics. Finally, an ODD definition is developed corresponding to each of the three types of drivable areas defined in D2.2. Outcomes This deliverable provides initial ODD definitions covering the drivable areas developed in deliverable D2.2—urban (city) traffic, (multi-lane) highway, and (single-lane) rural road, with and without infrastructure extensions—given our knowledge in the early phases of the ROADVIEW project. Refinements that may be necessary during the project will be described in later project deliverables. Next steps The use cases are further defined in deliverable D2.2. The further work towards the overarching goal performed in ROADVIEW WP 3-8 will use the ODD taxonomy and use case specifications as input for the evaluation and demonstration of the improvements developed in the project. Evaluation of the system prototypes used in the project is part of the integration and demonstration work package (WP8).

The SALIENCE4CAV project has done work on enabling continuous assurance, which aims to ensure safety is maintained throughout the entire lifecycle of a product, system, or service. One key technique is the use of safety contracts and modular assurance cases for systematically managing safety responsibilities and requirements across different stakeholders. This report summarizes outcomes from a workshop where discussions were held around this work. The participants were predominantly working in domains with high dependability requirements, such as automotive. Knowledge, tools, and organizational issues are seen as some key obstacles, but interest is high, and the community realizes the need for enabling continuous assurance.