Before designing a product for use, where and how it will be used needs to be fully understood. Each of the SAE autonomy levels have their own scope of use defined by their operating domain definitions. This article begins this conversation. What are the road types and what is the structure of transferring between these road types? What are the transition points between road types? How do other vehicles, pedal cyclists and pedestrians enter and exit each road type? What is the road grade access for entrance and exit? This article will set the stage for defining the scope and nature of active autonomy. The next article will compare each of NHTSA’s precrash scenarios to each representative road type as well as their transition points. The third article will link each of the vehicle level functions to each precrash scenario for each type of hazardous object (vehicles, pedal cyclist, and pedestrian).
Part 1 of 3: The HARA and Representative Road Segments
The risks of a road segment are defined by how vehicles, pedal cyclists and pedestrians engage with the critical zone surrounding the AV’s path. Road grade access is designed into every road segment and its most granular entrance is from residential driveways and its least granular is by entrance and exit ramps on controlled access roads. The most granular tends to have the lowest speed limits and the least granular tends to have the highest speed limits. Higher speeds mean that sensors must resolve objects to their deterministic realm at specific distances that allow for the latency of determination, and understanding HazOb relationships, event detection, motion constraints, and full stop or avoidance vehicle level commands. This topic will focus on road type classifications and their risks. The item definition has the operational domain definition which must identify which road types, in which part of a map, will be operational for an item’s activation. A future HARA topic will cover each NHTSA precrash scenario as compared with road classifications. The third and final HARA topic will cover how to link each hazard to each vehicle level function failure mode/fault state and will end with ASIL assignments and safety goals.
Terms:
AV: autonomous vehicle.
VLF: vehicle level function.
ASIL: automotive safety integrity level.
Harm: injury to a human.
Hazard: precrash scenario involving human exposure to harm.
HazOb: hazard objects are vehicles, pedestrians and pedal cyclists.
Animal: a precrash scenario that causes unplanned swerving which creates a hazard.
ODD: operational domain definition.
MAIS: maximum abbreviated injury scale.
Deterministic realm: a stable perception object categorization (a car is a category of car as is a human or a pedal cyclist).
Nondeterministic realm: unstable object categorization.
In selecting road segments to study in the HARA, focus on the correct vehicle level function that would honor the AV’s right of way at all times. Humans identify vehicles, pedestrians, and pedal cyclists and group them by their behavior. Humans develop reasonably rational expectations of what HazObs might do in their near term. This suggests that there are fairly common driving motives that will allow behavioral groups to be formed. The groups might explain 95% of the common and expected behavior. Some HazObs might be significantly outside normal behavior. 95% is a common level of confidence in designed experiments. A probability of 5% is considered a rare event. Every HazOb can be identified and tracked and their movements statistically modeled. When a HazOb behaves in a statistically different pattern, their choices fall outside of predictability. Yet, the choices are definable and tractable. They will change lanes more/less aggressively. They will change their in-lane left/right reactions with greater left/right changes. They will accelerate/decelerate more aggressively. Normal and abnormal behaviors need to be documented during the HARA. What a human notices as behavioral information needs to become sensing requirements, object identification, object attributes which include driving behavior (statistical variation about a path of travel: position, orientation, speed, acceleration), and so on. The majority of drivers follow the pattern and flow of traffic. Changes in driving behavior indicate a new motivation for the driver. What are the limited choices for the HazOb? Drivers following a slower driver for extended periods of time can become excessively aggressive and their near-term choices will be to pass the slow driver. The higher the driving congestion/constraints, the more aggressive some drivers will become. During the HARA, study the patterns and behavior of other HazObs. What information does a human use to understand patterns? How does a human predict HazOb behavior and future events? How much of this behavior can be translated into HazOb attributes detectible by perception? The AV needs to practice defensive driving and always be prepared for the reasonably expected. Document extreme risk behaviors and determine the cases where a crash might be created by another HazOb and the crash is impossible to avoid. This is where the HazOb has significantly encroached into the AV’s latency and its ability to identify, understand and produce a safe avoidance maneuver. Consider these expected but rarely occurring risks and see if there are sensors that might provide more time to understand the HazOb. For example, an imaging radar can see the vehicle in front of the AV’s lead vehicle. If the iRadar notices the HazOb of the vehicle in front of the lead vehicle aggressively slow down, the AV can aggressively slow down and likely respond faster than the AV’s lead vehicle. What would have been a crash has been avoided by using better technology. This is an ISO 26262 requirement. Use state of the art technology which can reduce risks. The same radar can see pedestrians and pedal cyclists in blind spots between vehicles. 100% of the iRadar’s EMF energy is never reflected fully back to the receiver and the next image is a ghost image that can be processed based upon a partial reflection at a further distance. Its mass might be uncertain but its shape might produce a match, position, trajectory, speed, acceleration and so on.
At any moment in time an AV or HazOb has nine choices to change their current state of travel. They can speed up, slow down, stop, speed up go right, go right, slow down go right, speed up and go left, go left, and slow down and go left. How the HazOb behaves will telegraph its intention to follow other HazObs or change its current state (position, orientation, and speed). At any moment a lane of traffic will have an average or expected speed. For example, a left-hand lane might have an average speed that is 9mph over the posted speed. Any vehicle that slows traffic to a lower average speed will create pressure to change the state of following drivers. Does this mean that the safest speed is that of relative traffic in an assigned lane? Should the AV follow at this faster speed? Should the AV maintain this speed if it becomes the lead vehicle? Does this mean that a Level 3-5 solution should fit within the expected behavior of surrounding traffic regardless of the posted speed? What should be the priorities of an autonomous vehicle? What if the left lane is on a limited access road and the average left lane speed is 9mph faster than the posted speed? What if it is 14mph faster than posted speeds? The point is that traffic that’s flowing more slowly than expected creates emotional pressure in other drivers and this can increase the suddenness of the change in state of those drivers. Some small percentage of drivers, call it 5-10%, place themselves under a lot of pressure to maintain their normal and desired driving posture. This small percentage
The longer this driver is forced to wait, the more agitated they become. Eventually, they will drive as aggressively as required to get past the slower driver. A level 3-5 solution needs to be able to model other drivers by their average differences and their variation within those differences. The solution needs to know which of nine choices are available to each HazOb. The solution needs to be able to assign each driver’s most likely intent based on their current driving behavior (speed up, slow down, go right, go left, follow traffic). Along with this, the AV can store the average distance between lane changes for all vehicles, and the average number of vehicles that enter/leave each segment. Each HazOb is an individual and independent object and can be modeled as an independent univariate variable. It can develop expected position, velocity, and acceleration. Its behavior can be modeled and unexpected variation identified unique to each HazOb. A fourth order polynomial equation can be used to model the current path of any HazOb as a function of time. Expected variation can be modeled for any path. A 95% confidence interval can be produced for any position, velocity, and acceleration for any HazOb. Consider the granularity of which each HazOb’s behavior might need to be understood. This creates requirements for relative/ground truth orientation, positions, speeds and accelerations. It creates GPU/CPU processing loads which produce latency of calculations/determinations estimates. It can require that road friction is dynamically calculated by the AV and compared with the historical reference road friction stored in Map.
The HARA compares the item definition and its vehicle level functions with the challenges of representative driving segments. Each road type can be broken into representative road segments, each with its own unique categories of risks. Each representative segment includes complexities that are uniquely different from other segments. How HazObs enter and exit the road segment are definable and tractable. The potential destinations of each HazOb through the road segments are definable and limited in number. Each HazOb will continue through the road segment, move into its turn position to exit the road segment, maneuver around slower traffic, or will start from a road grade access and enter the AV’s flow of traffic. When a HazOb enters the flow of traffic, they may be highly motivated to change positions quickly to a nearby flow exit point. Representative road segments include all the complexities of a road segment category or group. When the technical solution solves all driving complexities in the representative sample, all other segments in the group are also be solved. Representative sample must include all driving challenges for all roads in the category. There might be a few challenges at transition points that are specific to the transition. This means that there will be representative transition and road segment-specific challenges. If so, these will become specific transition risks and need to be studied with their own HARA. These would be unique transition challenges within a category or at the transition to a new representative road segment category. The combination of transition risks and representative road segment risks must cover the scope of the operating domain definition (ODD).
Vehicle level functions (VLF) are assessed potential failure modes/fault-states or inappropriate behaviors. An AV’s path must begin with the assumption of honoring all other HazOb rights of way. An AV’s path must prioritize all normal ways that HazObs will reasonably violate its right of way. All HazObs are expected to drive defensively and avoid being hit. All HazObs are humans who infrequently do something that they think is free from risk but is not. The HazOb’s focus and attention are inadequate for their moment in time. They violate the right of way of the HazOb. An inappropriate VLF meets all requirements but because of the driving environment creates precrash scenarios. This means the safety critical requirements were missed in the analysis. New requirements must be developed and the item definition must be improved and validated.
The creation of a precrash scenario can be caused by the AV or by the HazOb. Both are required to avoid causing a crash or being the target of a crash. Both are expected to respond to and avoid a crash. The VLFs that can directly cause harm are acceleration/deceleration, steering, braking, and hold position functions. VLFs that can influence a precrash scenario are headlights, bright lights, tail lights, break lights, horn, tun signals, and other lighting/communication strategies. Precrash scenarios consider crashes with vehicles, pedestrians, pedal cyclists and animals. Hitting an animal, by itself, is not a hazard as a hazard is placing a human in harm’s way. Hitting a vehicle, pedal cyclist or pedestrian as the result of an animal avoidance maneuver can create a hazardous precrash scenario. The third HARA topic will provide an analysis that links each VLF, their failure modes/fault states to hazards. Each driving segment will identify severity, exposure and controllability risks and these will produce Automotive Safety Integrity Level (ASIL) risks for each VLF. Representative road segments, risk transition points and specific unique risks will be studied to explain the physics of each precrash scenario. The risks that autonomy faces are structured into safety design requirements that will solve the challenges of the complex driving environment. This requires safe functions which are designed free from unreasonable risk and which can self-diagnose failure modes/faults and activate specific and appropriate safety mechanisms. This leads to the verification and validation of VLFs. Each precrash scenario will identify objects and relationships that must be captured by an appropriate sensor, and then be correctly classified and placed into appropriate relationships with the driving environment and the AV. This is required to determine the probability of events.
The HARA will classify the VLFs, their failure modes, precrash scenarios and HazObs. The classifications are based upon crash severity (S), probability of crash exposure (E), and controllability and avoidance (C) of a precrash scenario by a driver. Classifications are called Automotive Safety Integrity Levels (ASIL). ASIL levels are ASIL A, ASIL B, ASIL C and ASIL D. ASIL D represents the most stringent safety requirements. The HARA ends with the creation of one or more safety goals for each VLF. The safety goals become the starting requirements that the functional safety concept must address. When ASIL requirements are satisfied, they will prevent, avoid or mitigate hazardous events. Once satisfied, there will be an absence of unreasonable risk. Unreasonable risk is judged by society. If there is unreasonable risk, the design will cause injury to a human. The risk offered to society might be judged in a court of law. If the risk offered to society is found to be unreasonable, the company will lose the lawsuit against them. An absence of unreasonable risk means the design will win its court case.
Albert Einstein said, “If I had an hour to solve a problem, I’d spend 55 minutes thinking about the problem and five minutes thinking about solutions.” Take a lot of time to really understand the item and its functional safety requirements. Use the concept design description from the item definition and understand the operating modes and the VLFs associated with each operating mode. Identify the different representative driving segments of each road type within the operating domain definition. Perform a HARA analysis of all operating modes on each applicable representative driving segment. Relate the risk that each faulty VLF has to each of the potential precrash scenario. Design a functional safety concept that can satisfy all safety goals and avoid all precrash scenario within the ODD.
The risks are assigned to the design. The design risks are addressed by the functional safety concept. All functions have sequential time/temporal relationships that begin at sensors and end at vehicle level functions. The 7FM Functional Block Diagram defines the time sequence, interrelations and dependencies. The risks identified by the HARA will be addressed by improving the 7FM Functional Block Diagram. The function definitions will be improved. The function’s safety requirements will be refined. The specifications that apply to the function’s requirements will be assessed and improved. These improvements occur during the safety concept, which is the next topic after completing the HARA.
Study the item, its driving environment, how the system needs to interpret the environment, the hazard objects (HazObs) that are in each representative driving segment, the complexity of the relationships between HazObs and the AV, and finally the weather and degradations of the weather. A superficial analysis will lead to the inefficient design approach called “build-test-fix”. A build-test-fix design process requires that a design idea is built and tested to see if it meets a requirement. This means that a design can proactively be created by where all functions can be optimized to meet their requirements. Build-test-fix can create a design to be tested very quickly. The problem is that this is not based upon a full definition of interrelated design requirements. Build-test-fix requires a large number of problem solvers and project managers. Every large problem solved produces a new shining star hero for the company and the visibility is often very good. Employees are not promoted by avoiding the problems because there is no problem to contrast with the achievements. The extra problem-managing staff is often larger than the design team that follows the proactive design-build-validate process. Reactive design teams can create problems more quickly than they can be solved. Proactive methods identify and solve the 80% and more of the causes that are foreseeable and avoidable. Build-test-fix wastes 40-95% of investment money. The proactive 7FM Design for Functional Safety reduces design time by as much as 50% and eliminates most validation failures. The proactive design process is design, build and test. The design portion uses 7FM to identify and avoid over 80% of foreseeable and avoidable risks. In this approach all functions are studied. The requirements for all functions are defined. The failure modes of all functions are considered. The requirements that will not be satisfied (effects of a failure mode) are identified. The causes of the failure mode are identified and these are in the form of each specific function’s input requirements that are not met. This creates the need to develop more optimal design parameters. Design parameters control the quality of each function’s ability to directly satisfy specific requirements. The entire design is assessed through the theoretical cause and effect analysis provided by 7FM. This includes failure mode detection methods and their activation of safety mechanisms. Costly time delays caused by test failures are all but eliminated. The cost of making new test samples and their retesting is greatly reduced.
The end of the concept phase defines a theoretically perfect sequence of well-defined function that can meet documented design and safety requirements. The safety concept will produce functions that are self-monitoring, self-correcting and linked to safety mechanisms that will fail safely. They will avoid all harm with the exception of truly unusual scenarios. It takes time to sense, perceive and understand the environment (latency). It takes time to predict a safe plan (latency). It takes time to calculate a safe dynamic vehicle level command – ½MV2 (latency). The vehicle takes time to respond (latency).
The Pareto principle states that 20% of causes produce 80% of the effects, hazards or problems. The proactive 7FM methods will help prevent 80-95% of the causes. This means that it will be extremely unlikely that the design will cause harm. The 5-20% of the causes that are missed have the least amount of objective awareness which means very long mean time between failures. They rarely occur. When it comes to safety, the occurrence number related to causes is called the hazard rate. The 5-20% of causes that might be missed have extremely low hazard rates. When causes create faults/failure modes, they are detected by the system’s fault detection and an appropriate safety mechanism is activated. For the few causes which were not addressed, the failure modes will be detected and the system will fail safely. Nobody can find all causes and nobody can eliminate all causes. Energy and time will degrade all materials and designs. Design parameters can be optimized resulting in the smallest hazard rates. For example, energy consumes material over time. Energy changes material properties over time. It is impossible to produce 100% mechanical and electronic materials that have perfect material characteristics. This means latent failures are and always will be a reality. There are fewer latent failure mechanisms in 2023 than there were in 1970. This is because the body of knowledge and design guidelines have continued to be captured and refined by the many different professional societies. Fault detection and safety mechanisms are patient. All causes cannot be eliminated. All failure modes can be detected. All detected failure modes can activate an appropriate safety mechanism. All functions are knowable and all function failure modes can be identified.
Preventing 80% to 95% of causes is controlled by what is definable and knowable by the team members. Team members will remember causes that they have experienced. The shorter the mean time between failures, the better the memory. Team members will also remember design mistakes. There is a history of the causes. 7FM’s focus is on the functions, their failure modes/fault states and the precrash scenarios created. The causes of each fault state are usually very specific and few. If a team member has experience, all their memory will be activated. The system level causes are previous functions that are in a specific failure mode/fault state, E/E board fault states, hardware software interface (HSI) fault states, software interference, and random software errors that result from ambiguous sensor information. All causes have design parameters which control them. Design parameters are directional. One direction will create a failure mode. The other direction might minimize a failure mode. For example, a function might be “provide electrical current”. Another function might be “Transfer electrical current”. Connectors, electrical traces and wires “transfer electrical current”. When a connector experiences vibration, its surface experiences relative movement creating heat, material degradation, oxides, debris, and fretting corrosion. This produces unstable connections resulting in dirty electrical signals. The function “Transfer electrical current” becomes the failure mode/fault state “Erratically transfers current”.
Failure modes start when a function results in negative unintended results. For example, many functions relate to electrical current. By itself, electrical current it is a topic. Providing it purpose turns it into a function. A function is a verb-noun or an action created by a thing. If the function is “send [digital] information”, this would be “erratically send information” (an electrical current/potential function). Often “erratically send [digital] information” is the same as “does not send information” because incomplete information can mean no information. If current is used to power an E/E device, the function might be supply current and if it failed erratically, it would be “erratically supply current”. A vehicle level function might be “send brake command” with a failure mode of “erratically send brake commands.”
The result is a sequence of faults that will cause a VLF to violate its safety goals and functional safety requirements. The 7FM Functional Block Diagram becomes a fault state map that can be understood like mathematics.
Reducing risk means to lower the frequencies of the causes. Causes, are violations of a function’s input requirements (parameters). All input requirements are satisfied by one or more functions. These are used to create or are transformed into an output function. Functions produce results. Causes produce failure modes (a function fault state) and failure modes produce effects. Optimize design parameters and lower the frequency that they cause failure modes. Reducing the frequency of causes can reduce the frequency of failure modes/fault states to nearly zero.
This is optimizing each function’s input requirements such as, “All connector/wire designs must follow SAE connector and wire design guidelines which would end up supporting the hardware design phase”. To complete this thought, the connector design guideline will avoid relative motion and its resulting oxidation/spalling corrosion of connections. 7FM will help qualified engineers avoid 80% of the causes. Avoiding 80% of the causes will avoid 99.99%+ of the effects. Using function monitoring will ensure that when a function becomes problematic, a valid safety mechanism activates and avoids creating a precrash scenario. Qualified team members can produce a design free from unreasonable risks.
Initiation the HARA (6.4.1). The AV, Hazard Objects, Sensing, Processing and VLFs
The HARA is based upon an AV’s item definition and the operating risks that are contained within the ODD. A hazard is a precrash scenario that might harm a human. Precrash scenarios involve vehicles, pedestrians (walkers, hikers, skaters, runners, skateboard, etc.), and pedal cyclists of any configuration. Animals are included because drivers swerve to avoid animals and create precrash scenarios where humans are involved (a hazardous scenario).
A HARA assumes safety mechanisms are not present, even if they are planned. Fault detection can fail or fail safely. Safety mechanism can fail or fail safely. The risk is specific to a vehicle level function that is in a failure mode/fault state or is misbehaving. The results of a vehicle level function’s fault state directly produce the hazard to society. This is the hazard function.
Prepare for the situational analysis and hazard identification (6.4.2). Study the ODD and understand how the AV will interface with a driver and the driving environment. The ODD needs to be studied for the different road segments, risk transition points, driving environments and complexities.
Picking Representative Driving Segments: The item definition describes the ODD and operating AV operating states. To complete the HARA, the transition points and representative road segments need to be evaluated for misbehaving and inappropriate VLFs. The sample size of representative samples needs to be statistically significant. The worst traffic times of day/night need to be included in the analysis. Maps can be studied to identify the types of roads to be included and their interface or lack of interface with road grade use (Figure 1) e.g., driveways to homes, businesses, churches, sports venues, emergency vehicles, schools, etc.
Sample statistics are used to estimate population parameters (e.g., mean, standard deviation, proportion, distribution, arrivals, time between arrivals, etc.). The statistics will range from nominal, ordinal, interval and ratio, and each will have their own population parameters, sampling methods and test statistics. Pedestrians, pedal cyclists and vehicles are nominal statistics. Percent perception match is interval. Interval data has independent measurement calibration scales. Distance is ratio. Color is ordinal when observed by the human eye. It can be interval or ratio when electronic equipment is used (e.g., grey scale, brightness, RGB color). Ratio has an absolute zero. Interval might have a zero but it is relative. For example, water freezes at 32°F not 0°F. Zero is not linked to any specific scientific state. Ordinal data is ordered into groups (e.g., very small, small, average, large, very large). When the ordinal data has five or more ordered groups it provides the ability to develop an average and standard deviation (the Likert scale). The team might need to work with a statistician to understand the type of population to be studied and appropriate test statistics and sampling strategy.
Before this can be accomplished, the representative driving segments need to be determined. Then the HazObs need to be identified. AV/HazOb speeds need to be estimated and the required HazOb detection distances need to be considered. The road structure and road grade access need to be defined (e.g., parking on the side of the road, residential/apartment traffic, business entrance/exit, crosswalks, control devices, etc.). And the risks and constraints caused by HazOb-to-HazOb relationships need to be understood at least in their basic terms. The sample size for nominal data is extremely large (hundreds to thousands). Sample sizes for interval and ratio data can be much smaller (e.g. 3 to 30). When the item’s preliminary design is being used, it can gather a huge amount of information. However, the decisions that need to be made and the use of the data needs to be defined and designed into the software algorithms. Sensors and software can collect thousands to millions of observations in what is normally a reasonable amount of time.
How many representative road segments is enough? If the last segment provided a lot of new information, you need a few more. If the last representative road segment did not provide any more useful information, analyze one more road segment. If it also provides no more information, the representative road segment is studied well enough for the HARA. The goal is to produce a useful risk assessment. A perfect assessment does not exist. The simple way to select the sample size is to study each of the most complex driving segments within ODD. List the types such as interstate/freeway, principal artery, minor artery, non-arterial, major collector, minor collector and local driving segments. Include representative “high risk” transition points such as complex intersections, exchanges and exit and enter points. Study each segment of the route based upon transition point risks, which will be covered later in the material. Summarize each driving segment. Produce one summary that represents all driving segments. Each time a new segment is completed, add the new information to the summary. The study is completed when the last three segments produce no new risks.
Begin with a minimum seven samples for each type of driving segments and plan to increase most of them to 15 based upon new significant risks found in the last of the segments. Consider the scope of the ODD and include as necessary intersections, control device, specific maneuvers, signs, freeway exchanges, entrance/exit ramps, city driving, country driving, state driving, interstate driving, heavy freeway driving, heavy city driving, stop and go traffic, driving into the sunrise/sunset, and so on. Evaluate the segments at their worst time of day based upon the ODD. Increase the sample size as needed if significant new risks continue to be identified.
Representative road segments. Road segments are defined by transition points and the category of road. Transition points are where risks significantly increase or decrease. Each road category has its own risks. Each road category can be broken into more finite and tractable segments for study. For example, residential homes and farms have road grade access with state roads that connect one urban community with another. Even two-track (farm roads) access is direct to these roads. The nature of the road grade access is different in the deep country, near a city, transitioning into a city, and so on. Within a segment, the risks are considered to be homogeneous for the segment. Consider that most complex freeway driving involves intercity exchanges between freeways. Example: The AV enters to the right of the five lanes and exits from the left lane after 400m. Across all five lanes. This is not a homogeneous risk of all segments. It has a set of specific set of conditions/constraints. It is likely that only the most aggressive human driver would attempt to cross five lanes of traffic in 400m. This is a specific risk situation and it leads to determining the closest cross-lane transitions that can be safely transitioned by the AV. This would lead to solutions for crossing multiple lanes within a given distance. The map can store normal traffic patterns for different times of day for each specific segment. This would turn a static distance estimate into a traffic load variable distance relationship. Another specific point example is an old-style exit/entrance ramp with slow entry/exit speeds (e.g., 35mph). Lane reductions can cause complexities and sudden slow-downs during moderate traffic. During the analysis, the team might want to identify the best lane positioning for the AV to avoid complex constraints (e.g., insert position into the final lane well before it ends). Driving into a city from a county/state road increases the risks. Event and business parking/parking lots add risk. The first control device after a large number of miles with no control device is a higher risk. Leaving the city reduces risks. Each control device that is reached is a risk. Driveways are risks, and so on. Segments can be understood as rural freeway driving, freeway entering city, inner city freeway, freeway exchanges, old style entrance/exit ramps, county/state road hills, corners, corners on hills, shoulder/no shoulder, lane markers, no/poor lane lines, intersections, control devices at intersections, driveways, school zones, venue locations. Inner city includes city center, cars parked along the side of the road, bike paths along the road, parking lots, movie theaters, schools, events, churches, factories, large office buildings, fire stations, and so on. All segments can have road constructions, emergency vehicles, traffic control by humans, etc. All segments can be closed off to traffic using non-standard methods and signage.
Within any domain there might be 20-35 different representative intersection designs. Intersections are a transition risk and can be studied as individual representative road segments. Start with the most complex. Study at the highest traffic times of the sunrise/day/sunset/night. Fifteen will identify most HazObs, driving environment and sensor requirements. Keep adding segments until two segments in a row have no new risks.
Figure 3.4 shows the relationships of the roads. These are two-way relationships as vehicles drive to/from locations. Arterial connects to non-arterial and non-arterial connects to arterial.
This decision tree can be used to trace the routes from interstates to the most specific local roads and to any address. An example of tracing can be performed in the following city map of Phoenix (source: http://www.orangesmile.com/).
The reverse is also true. Starting from any address inside Phoenix, any other address or route out of the city can be identified. The same is true for any city, county, state or federal map. The starting and stopping locations define the granularity and nature of HazObs of the challenge. The specific risk transition points and representative road segments define the driving environments and challenges that must be solved. Is the system to be used only on controlled interstate, freeway and expressways? Is the system going to be used up through arterial roads? Is the system going to go to non-arterial roads from the interstate? For example, an L4 autonomous delivery might start at the interstate, transition to a principal arterial, to a minor arterial, and end at a delivery. The return would be the opposite direction to the freeway. Then the freeway risks can be determined until the defined pathway exits the freeway to the starting/ending point.
Principal arterial interstates are the highest classification of arterials, and were designed and constructed with mobility and long-distance travel in mind. Since their inception in the 1950s, the interstate system has provided a superior network of limited access, divided highways offering high levels of mobility while linking the major urban areas of the USA.
Principal arterial freeway/expressway of this functional classification category are similar to interstates. While there can be regional differences in the use of the terms ‘freeway’ and ‘expressway’, for the purpose of functional classification, the roads in this classification have directional travel lanes, are usually separated by some type of physical barrier, and their access and egress points are limited to on/off-ramp locations or a very limited number of at-grade intersections. Like interstates, these roadways are designed and constructed to maximize their mobility function, and abutting land uses are not directly served by them (no connection to home, farm, or commerce).
Principal arterial roadways serve major centers of metropolitan areas, provide a high degree of mobility and can also provide mobility through rural areas. Unlike their access-controlled counterparts, abutting land uses can be served directly. Forms of access for other principal arterial roadways include driveways to specific parcels and at-grade intersections with other roadways.
Minor arterials provide service for trips of moderate length, serve geographic areas that are smaller than their higher arterial counterparts and offer connectivity to the higher arterial system. In an urban context, they interconnect and augment the higher arterial system, provide intra-community continuity and may carry local bus routes. In a city, minor arterial streets are separated by 1/8 mile to 1/2 mile. Minor arterials in rural areas are typically designed to provide relatively high overall travel speeds, with minimum interference to through movement.
Major collector routes are longer in length; have lower connecting driveway densities; have higher speed limits; are spaced at greater intervals; have higher annual average traffic volumes; and may have more travel lanes than minor collectors. They penetrate into residential areas. In rural settings, they provide service to any county seat not on an arterial route.
Minor collectors collect residential traffic and provide access to major collectors. In rural settings, they connect smaller communities to major collectors.
Local roads account for the largest percentage of all roadways in terms of mileage. They are not intended for use in long distance travel, except at the origin or destination end of the trip, due to their provision of direct access to abutting land. Bus routes generally do not run on local roads. They are often designed to discourage through traffic.
The different road grade access to road segments defines where vehicles can join the flow of traffic, exit the flow of traffic, or wait until you pass. In a residential environment, toys that are kicked/thrown such as a frisbee or a ball, will have a human or an animal who will try to catch/intercept them. When pets run out into the road, it is common for a child/human to chase the pet. The road grade access defines the granularity from country roads, driveways, businesses, attractions and so on. Each will have potential destinations, starting points and relational risks.
Representative Road Segments – Planning Segments Level 1: To plan the Level 1 autonomy HARA, identify the system activation requirements that must be met. Then review the ODD and select representative driving segments that meet these requirements. The road segments must include variation between road segments.
The HARA will start at the point of activation and end at the destination or when the AV leaves the scope of the ODD. Study the Level 1 VLF within road segments. Study the transition points where risk changes. What are the changes in road markings between counties, states, road categories, and so on? What are the variations in the distinctness of the lane markings? How do older, faded, random or missing lane markings affect the vehicle? How do paved, gravel or no road shoulders affect the capability of the L1 solution?
Steering Level 1 Applications: Lane centering – two-way, two-way multi-lane, divided multilane rural, county, state, national and limited access roads.
Representative roads would have a full sampling of lane marking, road edge design, shoulder design, and no shoulder roads. It would include:
straight roads,
curved roads,
uphill curved roads,
downhill curved roads,
crowning or driving over the top of a hill,
turning over the top of the crown of a hill,
driving into the setting or rising sun.
Throttle Level 1 Applications: Adaptive cruise control (ACC) with following distance set by the driver – two-way, two-way multi-lane, divided multilane rural, county, state, national and limited access roads.
Representative roads would have a full sampling of lane marking, road edge design, shoulder design and no shoulder roads. ACC needs to identify that a lead vehicle is in its lane. It needs to distinguish basic lane assignments for in-lane following. The different vehicles (semi, truck, van, bus, motorcycle, etc.) and their perception requirements must be documented. It would include following a vehicle on:
straight roads, two-way, two-way multi-lane, two-way divided multi-lane,
curved roads,
uphill curved roads,
downhill curved roads,
crowning or driving over the top of a hill,
turning over the top of the crown of a hill,
driving into the setting or rising sun.
Deactivates when no human contact with the steering wheel is sensed and slows to an idle speed in lane.
Lead vehicle changes lanes,
New lead vehicle cuts in.
Braking Level 1 Applications: Forward crash avoidance, reverse crash avoidance, reverse road departure: field and distance of view, forward/reverse. Representative road sample selection and requirements for crash avoidance will determine when the system can be activated. Will crash avoidance be active for all driving surfaces, roads and speeds? Is it active in neutral below 3mph (e.g., car wash)? Is it active in neutral over 3mph (e.g., rolling down a hill)? Is it active for reverse? Is it active when the vehicle is running and no driver is in the seat (e.g., limit the speed to 0mph)? Does it sense only straight ahead or does it also see lateral directions and predict a forward/reverse collision? In other words, can it predict an intercept from a HazOb crossing or entering its path? Does it sense the object in the same path on a curve? Does it track the car that is forward in its lane and track the same car in a curve or turn?
Forward crash detection on all roads and segments;
Forward lateral detection for all intersections;
Forward and lateral detection for left/right turn across traffic;
All the road segments for lane-keeping and ACC.
Representative Road Segments – Planning Segments Level 2: The roads and road segments will be limited by the operating states, the ODD, and the item’s design requirements. When and where will the item be active?
All Level 1 road segments apply. Turning, throttle control and braking will be working together as maneuvers. They have interdependencies. They have statistically dependent energy interactions. These interactions have significant stability implications. The requirements are designed to work together to be more capable than the individual functions working separately. They are active at the same time. The common current applications are for different types of driving assist modes along with crash avoidance. Level 2 driving assist which involves lane centering/lane departure is based upon cameras and their ability to define road lines. It assumes the lane is defined by the AV’s current assignment. The driver is responsible for activating the system for assist. Adaptive cruise control, Level 1, can be applicable to the city. Lane centering might not be applicable to city driving. Cameras do not include maps with road parameters and the bare background structure, localization, with GPS/RTK and IMU. These functions are required as a minimum to support lane centering on city streets. They would help make a solution viable as a Level 2 application.
Identify all transition points on each road and turn them into road segments. Transition points are areas of new risks such as parked cars, a vehicle on the trouble lane on a freeway, road construction, approaching a stretch of roads with different use driveways, driving past a venue, entering a residential street, crossroads, entrance/exit ramps, freeway interchanges, leaving rural and entering city freeway driving, and so on. Analyze within segment risks (between transitions). Analyze transition risks. Road segments are the transition, and between transition road segments. By themselves, none of these are transition points. There needs to be an objective element of new and higher or lower risks.
Representative Road Segments – Planning Segments Level 3: The HARA for Level 3 is more involved than Levels 1 and 2. Level 1 and 2 solutions are generally closed loop control systems that are target/goal seeking mechanisms. They are not required to understand the driving environment. A Level 3 solution has the responsibility to analyze the driving environment, understand what it sees, know where it is on the road, and develop safe dynamic commands and safe vehicle level commands. It has the requirement to monitor system level functions and to activate minimum risk condition (safety mechanisms) when the system faults or degrades. The HARA has to consider the HazObs and their relationships to each other and the AV. It has to consider misbehaving functions. Misbehaving means that a motion constraint was missed or that it was misunderstood by the system. If it is misunderstood, a function would be produced and assumed to be correct but because of the missed relationship and motion constraint, a precrash scenario is created. Both missed and misunderstood driving environment risks are system failures. The HARA has to capture this information so the design can be improved before it moves to the systems design phase.
Driving segments are defined by the scope of activation of the system. It will include all risk transition points, within segment risks, city, rural, state, freeway and all other driving surfaces where the system is active. If it is a highway assist solution, the system can only be activated if it is on a limited access road. If it can accept a destination/exit number, it will deactivate when it nears its exit point. If it is a traffic jam assist, it is only activated for slow speeds and it might be limited to one lane of driving. It might not be able to manage complex freeway exchanges. Level 3 solutions can be an address-to-address solution. Level 3 is a “mind-off” driving solution. It needs to be able to determine when is becoming unable to command a safe solution. The sensing, object detection, object recognition, object attributes, object tracking, situational analysis and object predictions are extremely complex algorithms. The solution might have maximum object processing capabilities which means speed related maximum object management capabilities. They require significant graphic and digital processing volume. And then there are object constraints, object planning, dynamic controls and vehicle control algorithms that have complex interrelations. References are independent of the AV and are vehicle localization, map, and vehicle health and performance feedback, which in and of themselves can be complex interrelationships. This is to say that, normally, Level 3 solutions are more basic and are a limited common risk exposure and within road segment risk solutions. The simpler solutions are limited to their own lane or to solve a parking solution. More complex solutions can plan and execute safe change lanes through the driver’s use of a turn signal. Even more complex solutions can solve an optimization problem and change lanes on their own (e.g., freeway or any multilane road). An example application is from one city freeway exchange to the first freeway exchange after entering a new city. They are a continuous road driving segment solution. They do not have complex solution algorithms. When the system cannot resolve a solution, it demands a takeover by the driver. It needs to warn the driver in advance of the failure to resolve a solution. The driver has a maximum intervention time required to assume control. Failure of the driver to respond requires that the vehicle slows and safely stops off the driving surface without driver intervention if possible. The driver needs to have time to assess the environment and take over. Level 3 solutions have been involved in many failures and crashes on freeways. The crashes involve other vehicles/objects stopped in the road and with the L3 travelling at highway speeds. It does not attempt to avoid a crash until it is almost colliding with the obstruction. This is capability failure. This is a failure to identify an obstruction, a vehicle that is not oriented properly, a sudden and complex slowdown of traffic, a forward accident and other drivers taking evasive action. The evasive action might be outside the ability of the L3 system to understand and predict future positions of HazObs. It is a chaotic change from the ordered flow of traffic.
Different Level 3 autonomy are:
Traffic Jam Pilot with crash avoidance;
City Pilot with crash avoidance;
Freeway Pilot with crash avoidance;
Parking Assist: parallel, head in, and tail in parking.
The Chapter on item definition contains an example 7FM Functional Block Diagram for a Level 3 system. The 7FM Functional Block Diagram defines how the concept will analyze the driving environment and command vehicle level functions. The HARA details the risks that the functional safety concept must solve. The sensors view the driving environment. The 7FM Functional Block Diagram shows how sensor functions mature and interrelate with element functions and how VLFs are produced. It defines potential misbehaving functions and the limitations of the design. The 7FM Functional Block Diagram is redesigned to remove limitations before the Functional Safety Concept is created. The ASIL assignments are extremely easy to make against the elements and their functions. Nothing will be missed. The 7FM Functional Block Diagram design structure is the starting point for creating the 7FM System Level Functional Block Diagram.
All roads and road segments identified for Level 1 and 2 are applicable for Level 3. City and non-city roads are all applicable to Level 3 solutions. The driver drives to an active portion of the geofenced ODD and activates the Level 3 system.
Representative Road Segments – Planning Segments Level 4: The HARA for Level 4 is a tractable point to point analysis where 100% of the route can be evaluated. This includes alternate routes that might be used, safe off driving surface emergency parking, all intersections, control devices, turns, entrance/exit ramps to freeways, and potential HazObs.
Study the route from point to point in each direction or its circular route. Identify the method of placing the AV in autonomous mode and then activating the route. Split the route by road segments and risk transition points. Example: Segment 1 – maneuver out of parking lot to connector street. Right on a two-way city street, drive past industrial buildings and their driveways/parking lots to the first intersection (light control) and move into the right turn lane before reaching the light. Segment 2 – When the road is clear or when the light turns green, turn right onto a divided rode with two lanes in each direction. Follow the road through three RYG light-controlled intersections to freeway ramp. Maneuver to the left turn lane…and so on. Segment 3 would begin on the entrance ramp and likely be its own risk segment and will end with the successful insertion onto the freeway. Exit and entrance ramps on the freeway will be cumulative segments, even if the vehicle will not use them. Vehicles will cut in front of the AV to exit the freeway. Vehicles will need space when they enter the freeway. The AV will need to know if the relationship to a vehicle entering the freeway will intercept the AV. How is the AV supposed to respond? Does it speed up, slow down, or continue at its speed? If it is an intercept, does the AV force the vehicle entering the freeway to avoid the AV? Does the AV need to speed-up or slow-down to avoid a right-of-way conflict? Rural freeway driving might be a single 100+ mile segment. The entrance/exit ramp designs can be broken into a few representative groups that are similar and one solution can be applied to each of them. They are intersection solutions. The entire route is detailed. Every intersection that is risky is detailed. Every uniquely risky entrance/exit ramp on the freeway and every freeway exchange is analyzed. Exiting the freeway and driving to the destination is the reverse of driving to the freeway.
Representative Road Segments – Planning Segments Level 5: The HARA for Level 5 can be set up as a designed experiment. Pick 15-30 point-to-point routes that cross over every portion of the domain. Document the road segments using the same activity as the L4 solutions. However, intersections need to be grouped into similar designs and risks and each becomes its own representative segment (with samples). Intersections with and without signs, with and without control lights, with and without left turn control lights, and so on. Then, combine them into a single analysis of the many representative road segments. Each segment is its own HARA. Identify which intersections are strategically the same. Identify which turns are strategically the same. Identify which are uniquely different. Determine HazOb risks, parked car, pedestrian crossings, venues, city center, residential, shopping areas, theaters, school zones, college areas, and so on. Document all HazOb locations and challenges. Make sure that the representative sample routes cover every type of road and driving. After all representative road segment HARAs are completed, they can be collapsed into individual analysis groups (e.g., intersections, collector roads, artery roads, etc.). When the team thinks that the analysis is complete, analyze one more randomly selected point-to-point route across the domain. Look at VLFs, vehicles, pedestrians, pedal cyclists, animals, intersections, and so on. Did this last route identify any significantly new risks? If so, analyze the new risks. The risks that are not new are already addressed in other road segment HARAs. To be confident that the analysis is reasonably solid, analyze one more route. If no new risks are identified, the analysis can be closed. Otherwise, continue until there are no more significant findings.
A second approach is to
Identify all types of intersections and their control devices. Categorize them by the same types of lights and complexities (same intersection different location);
Identify all types of streets, roads, freeways and categorize them by the same types of surrounding risks;
Identify and document each type of road within the ODD (Figure 3.4).
Document all locations relative to:
- Parked cars;
- Driveways;
- City center;
- Stop and go;
- Sports/concert venue;
- Theater;
- Shopping area;
- Pedal cyclist path on edge of road;
- Pedestrian crossing;
- Pedal cyclist crossing;
- Residential;
- Cross city street;
- Freeway feeder street;
- School zone;
- Church zone;
- College zone;
Residential streets have different risks based upon parking and their width, children, animals, school buses, and so on.
All roads comprise commonalities that are part of basic VLFs and these are straight sections, curved sections, intersection, up-hill, down-hill, cresting the top of a hill, night, sunrise/sunset, day, heavy/light traffic, stop and go, and so on. These can be studied for risk together. They represent 80% or more of all driving.
The risks that need to be studied are the variations of driving caused by the dynamic nature of HazObs in the different dynamic driving environment.
Representative road segments help to define how HazObs interface with the driving environment and what the AV must be able to sense, understand and predict before it produces its vehicle level functions. How a human driver evaluates the world needs to be understood because algorithms/AI will need to be able to identify which HazObs will likely change their pattern of travel. How the changes will likely affect traffic need to be understood and predicted. This means that when the HazOb enters/leaves the flow of traffic, it will cause a rippling effect of surrounding HazObs. The ripple effect might develop into an event with a required safe response.
The relationships between the AV and HazObs can be understood by patterns of motion, likely destinations, time, distance, time-to-intercept, drivable surface, the rules that define and constrain motion, and so on. All relationships can be broken into time, path, position, velocity and acceleration. Which HazObs have statistically significant behavior patterns can be identified. This will be used to emulate how a human driver singles out the HazObs that will likely cause a driving constraint or threat.
Representative road segments contain all the technical challenges of each segment. Solving the most complex of the representative segments infers that all the risks of each segment has been defined and solved.