From Hazard Analysis to Hazard Mitigation Planning: The Automated Driving Case
This addresses safety certification challenges for autonomous vehicle vendors, though it appears incremental as it builds on existing hazard analysis methods.
The paper tackles the problem of ensuring safety in highly automated vehicles by developing a framework for designing planners that can identify and mitigate hazards at runtime, with an application to a fail-operational controller based on a given architecture.
Vehicle safety depends on (a) the range of identified hazards and (b) the operational situations for which mitigations of these hazards are acceptably decreasing risk. Moreover, with an increasing degree of autonomy, risk ownership is likely to increase for vendors towards regulatory certification. Hence, highly automated vehicles have to be equipped with verified controllers capable of reliably identifying and mitigating hazards in all possible operational situations. To this end, available methods for the design and verification of automated vehicle controllers have to be supported by models for hazard analysis and mitigation. In this paper, we describe (1) a framework for the analysis and design of planners (i.e., high-level controllers) capable of run-time hazard identification and mitigation, (2) an incremental algorithm for constructing planning models from hazard analysis, and (3) an exemplary application to the design of a fail-operational controller based on a given control system architecture. Our approach equips the safety engineer with concepts and steps to (2a) elaborate scenarios of endangerment and (2b) design operational strategies for mitigating such scenarios.