A Formally Verified Fail-Operational Safety Concept for Automated Driving
This addresses safety and reliability issues for automated driving systems, offering a novel approach to handle multi-point failures, though it appears incremental as it builds on existing formal methods.
The paper tackles the challenge of ensuring resilience to multi-point failures in highly complex automated driving systems by presenting a holistic safety concept that unifies advanced safety measures. They verified the approach by developing an executable model in mCRL2, formalizing five safety requirements in modal mu-calculus, and proving them against the model, which is intractable with traditional methods.
Modern Automated Driving (AD) systems rely on safety measures to handle faults and to bring vehicle to a safe state. To eradicate lethal road accidents, car manufacturers are constantly introducing new perception as well as control systems. Contemporary automotive design and safety engineering best practices are suitable for analyzing system components in isolation, whereas today's highly complex and interdependent AD systems require novel approach to ensure resilience to multi-point failures. We present a holistic safety concept unifying advanced safety measures for handling multiple-point faults. Our proposed approach enables designers to focus on more pressing issues such as handling fault-free hazardous behavior associated with system performance limitations. To verify our approach, we developed an executable model of the safety concept in the formal specification language mCRL2. The model behavior is governed by a four-mode degradation policy controlling distributed processors, redundant communication networks, and virtual machines. To keep the vehicle as safe as possible our degradation policy can reduce driving comfort or AD system's availability using additional low-cost driving channels. We formalized five safety requirements in the modal mu-calculus and proved them against our mCRL2 model, which is intractable to accomplish exhaustively using traditional road tests or simulation techniques. In conclusion, our formally proven safety concept defines a holistic design pattern for designing AD systems.