Jung, Rolf
Refine
Document Type
Publication reviewed
- begutachtet (23)
- nicht begutachtet (6)
Keywords
- SOTIF (5)
- ADS (3)
- Functional Safety (3)
- HADF (3)
- Highly Automated Driving (3)
- CarMaker (2)
- Cybersecurity Management System (2)
- DIN EN ISO 13849 (2)
- FuSa (2)
- HAD (2)
Institute
The development of Automated Driving Systems (ADS) has the potential to revolutionize the transportation industry, but it also presents significant safety challenges. One of the key challenges is ensuring that the ADS is safe in the event of Foreseeable Misuse (FM) by the human driver. To address this challenge, a case study on simulation-based testing to mitigate FM by the driver using the driving simulator is presented. FM by the human driver refers to potential driving scenarios where the driver misinterprets the intended functionality of ADS, leading to hazardous behavior. Safety of the Intended Functionality (SOTIF) focuses on ensuring the absence of unreasonable risk resulting from hazardous behaviors related to functional insufficiencies caused by FM and performance limitations of sensors and machine learning-based algorithms for ADS. The simulation-based application of SOTIF to mitigate FM in ADS entails determining potential misuse scenarios, conducting simulation-based testing, and evaluating the effectiveness of measures dedicated to preventing or mitigating FM. The major contribution includes defining (i) test requirements for performing simulation-based testing of a potential misuse scenario, (ii) evaluation criteria in accordance with SOTIF requirements for implementing measures dedicated to preventing or mitigating FM, and (iii) approach to evaluate the effectiveness of the measures dedicated to preventing or mitigating FM. In conclusion, an exemplary case study incorporating driver-vehicle interface and driver interactions with ADS forming the basis for understanding the factors and causes contributing to FM is investigated. Furthermore, the test procedure for evaluating the effectiveness of the measures dedicated to preventing or mitigating FM by the driver is developed in this work.
Safety of the Intended Functionality (SOTIF) addresses sensor performance limitations and deep learning-based object detection insufficiencies to ensure the intended functionality of Automated Driving Systems (ADS). This paper presents a methodology examining the adaptability and performance evaluation of the 3D object detection methods on a LiDAR point cloud dataset generated by simulating a SOTIF-related Use Case. The major contributions of this paper include defining and modeling a SOTIF-related Use Case with 21 diverse weather conditions and generating a LiDAR point cloud dataset suitable for application of 3D object detection methods. The dataset consists of 547 frames, encompassing clear, cloudy, rainy weather conditions, corresponding to different times of the day, including noon, sunset, and night. Employing MMDetection3D and OpenPCDET toolkits, the performance of State-of-the-Art (SOTA) 3D object detection methods is evaluated and compared by testing the pre-trained Deep Lea rning (DL) models on the generated dataset using Average Precision (AP) and Recall metrics.
Safe Scenario Boundaries Determination by Parameter Variation for an Automated Driving System
(2023)
An expanding area of research interest is the scenario-based testing and development of Automated Driving Systems (ADS). In scenario-based testing, a system is examined in a set of pre-defined scenarios to inspect its behavior. Scenarios are described by a set of parameters, such as velocities and distances. For a safety-related system, identifying the parameter limits for safe operation is essential to reduce harm. Hence, there is a need to determine safe boundaries considering the assumed parameter set in a scenario to support the Verification and Validation (V&V) of an ADS. This paper presents a systematic approach to determining safe boundaries of parameters by scenario-based testing. The contributions of this work are: (i) performing scenariobased parameter variation to detect collisions, (ii) identifying safe boundaries of each single parameter from a specific Operation Design Domain (ODD) and (iii) providing safety-related evidence to identify safe boundaries from defined ODD. The results of this work can assist scenario reduction techniques to derive nothazardous scenarios and hazardous scenarios and support the V&V Processes of ADS.
The development of Automated Driving Systems (ADS) has the potential to revolutionize the transportation industry, but it also presents significant safety challenges. One of the key challenges is ensuring that the ADS is safe in the event of Foreseeable Misuse (FM) by the human driver. To address this challenge, a case study on simulation-based testing to mitigate FM by the driver using the driving simulator is presented. FM by the human driver refers to potential driving scenarios where the driver misinterprets the intended functionality of ADS, leading to hazardous behavior. Safety of the Intended Functionality (SOTIF) focuses on ensuring the absence of unreasonable risk resulting from hazardous behaviors related to functional insufficiencies caused by FM and performance limitations of sensors and machine learning-based algorithms for ADS. The simulation-based application of SOTIF to mitigate FM in ADS entails determining potential misuse scenarios, conducting simulation-based testing, and evaluating the effectiveness of measures dedicated to preventing or mitigating FM. The major contribution includes defining (i) test requirements for performing simulation-based testing of a potential misuse scenario, (ii) evaluation criteria in accordance with SOTIF requirements for implementing measures dedicated to preventing or mitigating FM, and (iii) approach to evaluate the effectiveness of the measures dedicated to preventing or mitigating FM. In conclusion, an exemplary case study incorporating driver-vehicle interface and driver interactions with ADS forming the basis for understanding the factors and causes contributing to FM is investigated. Furthermore, the test procedure for evaluating the effectiveness of the measures dedicated to preventing or mitigating FM by the driver is developed in this work.
Scenario-based testing is essential for Highly Automated Driving (HAD) vehicles to determine the safety-related input parameters and their boundaries. The increasing complexity, vehicle functions, and operational design pose new challenges for scenario-based testing, as the number of scenarios is enormous. Therefore, an efficient and systematic process is required in the various stages of scenario-based testing. The contribution of this study is to provide sensitivity information of safety related parameters and support logical scenario reduction. This paper presents an approach that supports to optimize the safety-related parameters boundary towards logical scenario reduction. Additionally, sensitivity analysis is applied by computing Variance- Based Sensitivity Analysis (VBSA) indices and prioritize the input parameters. Two datasets are investigated by VBSA based on the input parameters. One dataset is based on the samples from realworld scenarios and other dataset is derived from the samples considering statistic distributions with a specific parameter range. Moreover, the proposed approach is applied to an exemplary use case and the outcomes are demonstrated.
Simulation-Based Testing of Foreseeable Misuse by the Driver Applicable for Highly Automated Driving
(2024)
With highly automated driving (HAD), the driver can engage in non-driving-related tasks. In the event of a system failure, the driver is expected to reasonably regain control of the automated vehicle (AV). Incorrect system understanding may provoke misuse by the driver and can lead to vehicle-level hazards. ISO 21448, referred to as the standard for safety of the intended functionality (SOTIF), defines misuse as usage of the system by the driver in a way not intended by the system’s manufacturer. Foreseeable misuse (FM) implies anticipated system misuse based on the best knowledge about the system’s design and the driver’s behavior. This is the underlying motivation to propose simulation-based testing of FM. The vital challenge is to perform a simulation-based testing for a SOTIF-related misuse scenario. Transverse guidance assist system (TGAS) is modeled for HAD. In the context of this publication, TGAS is referred to as the “system”, and the driver is the human operator of the system. This publication focuses on implementing the driver-vehicle interface (DVI) that permits the interactions between the driver and the system. The implementation and testing of a derived misuse scenario using the driving simulator ensure reasonable usage of the system by supporting the driver with unambiguous information on system functions and states so that the driver can conveniently perceive, comprehend, and act upon the information.
To ensure the safety and security of Automated Vehicles (Avs), the interaction between the Functional Safety (FuSa) and the Cybersecurity (CS) domains needs to be managed systematically. There is a demand to develop effective and structured management systems to support the homologation process. From this motivation, identifying the interaction between the Safety Management System (SMS) and the Cybersecurity Management System (CSMS) is a fundamental aspect and needs to be improved for HAD systems. Hence, the classical Decision Making Trial and Evaluation Laboratory (DEMATEL) method and fuzzy DEMATEL are applied to evaluate the influential factors that can impact the safety and security of the HAD systems. This paper proposes a list of influencing factors focusing on the interaction between SMS and CSMS for HAD systems. Additionally, the results of an anonymously conducted survey among experts from industry and research are presented and used as inputs for the methods. This work helps to understand the relationship between influencing factors and provides a simplified, easy-to-visualized, and valuable guide for developing HAD systems. The result of this study shows that the most important influential factor is F13. Moreover, the cause and effect of the factors are illustrated numerically and graphically. The influential factors F1 to F7 are identified as the cause and F8 to F13 are reasoned to effect. Finally, a circular representation of the influential factors and their interaction is presented in this paper.
Functional safety and cybersecurity are essential parts of the development of automated vehicles to ensure vehicle safety. Highly automated driving (HAD) vehicles require safe and secure development and communication processes that have to be monitored, maintained and improved through management processes. Hence, interface management systems are required to confirm HAD vehicle safety. The acceptance level of the interface between functional safety and cybersecurity in management systems is crucial for the development of Highly Automated Driving (HAD) vehicles. The Safety Management System (SMS) needs to consider the aspect of cybersecurity to ensure the overall safety of the vehicles or vice-versa. However, the interface methods of SMS and Cybersecurity Management System (CSMS) is challenging given the complexity of the system development and constraints from the company culture. The objective of this study is to present an interface approach in between management systems with a set of interface specifications including communication adaption processes. The main contributions of the paper are, (i) Illustrating the interface areas of the SMS and CSMS by identifying the management factors, (ii) Presenting the degree of influence of the management factors based on the survey results, and (iii) Providing a support to deal with SMS and CSMS interface for HAD vehicle development. A list of interface-related management factors is presented in this paper based on the literature study and findings from other disciplines. Additionally, the degree of influence of the management factors is presented as a result of this research based on the survey results from functional safety and cybersecurity experts.
Was für die sogenannte weiße Ware passt, muss sich auch für andere
Anwendungen in der Industrie eignen. Überzeugt von diesem Ansatz, kooperieren die Hochschule Kempten und ein Unternehmen für drahtlose Sensorsysteme eng miteinander, um ein kabelloses Sensorsystem weiterzuentwickeln.
Ziel des gemeinsam von Pro-micron und der Hochschule Kempten durchgeführten Projekts ist die Weiterentwicklung eines kabellosen Sensorsystems, das seit Jahren im automatisierten Garprozess in der weissen Ware zum Einsatz kommt. Das System dient zur Messung der Rotortemperatur von Elektromotoren in Großserienanwendungen. Denkbar sind somit nicht nur Anwendungen in Konvektomaten, sondern in sämtlichen Bereichen, in denen eine ausgeklügelte Temperaturmessung zu besseren Antriebseigenschaften führt. Somit liegt der Mehrwert entsprechender Temperatursignale zur Steuerung elektrischer Maschinen auf der Hand und kann erhebliche Vorteile aufweisen. Auslastung, Effizienz und Drehmomentengenauigkeit sowie ein zuverlässiger Übertemperaturschutz sind nur einige Beispiele für die Vielzahl von Vorzügen, welche sich aus der Rotortemperaturmessung ergeben.
The development of Highly Automated Driving (HAD) systems is necessary for automated vehicles in termsof various complex functionalities. HAD systems consist of complex structures containing different types ofsensors. The functionality of HAD systems needs be tested to ensure the overall safety of automated vehicles.Methods such as real-world testing require a large number of driving miles and are enormously expensive andtime-consuming. Therefore, simulation-based testing is widely accepted and applicable in the development ofHAD systems, including sensor performance improvement. In order to identify the functional insufficiencyof such sensors that affect the safety of HAD systems, it is critical to test these sensors extensively under avariety of conditions such as, road types, environment and traffic situations. Based on this motivation, the maincontributions of this paper are as follows: First, a simulation-based test concept of radar sensors with methodsfor the Safety Of the Intended Functionality (SOTIF) use case is presented. Second, a specific radar effect isevaluated through simulation-based testing of two different radar models to support and realize the sensor’sfunctional insufficiency. Finally, the development of a filter is proposed to improve the sensor performanceconsidering the radar specific multipath propagation effects.
Scenario-based collision detection using machine learning for highly automated driving systems
(2023)
Highly Automated Driving (HAD) systems implement new features to improve the performance, safety and comfort of partially or fully automated vehicles. The identification of safety parameters by means of complex systems and the driving environment is a fundamental aspect that require great attention. Therefore, much research has been conducted in the field of collision detection in the development of automated vehicles. However, the development of HAD systems faces the challenge of ensuring zero accidents. For this reason, collision detection in the safety-related concept phase as hazard identification is one of the key research points in HAD system. In this paper, a systematic approach to detect potential collisions for scenario-based hazard analysis of HAD systems is presented by using Multilayer Perceptron (MLP) as a Machine Learning (ML) technique. Moreover, the proposed approach assists in reducing the number of observed scenarios for hazard analysis and risk assessment. Additionally, two simulation-based scenario datasets are examined in the ML model to identify potential hazard scenarios. The results of this study show that MLP can support to detect the collision at safety-related concept phase. Furthermore, this paper contributes to providing arguments and evidence for ML techniques in HAD systems safety by selecting relevant use cases.
To ensure safety and security of highly automated driving systems one shall make sure all risks are reduced to a reasonable level and an all potential cyberattacks are addressed with necessary protection. Because of the complexity of such vehicle systems, systematic and structured management approaches are vital to maintaining safety via cybersecurity (CS). The interface of Safety Management System (SMS) with Cybersecurity Management System (CSMS) is one of the key aspects to ensuring that potential safety issues are addressed. Both management systems include planning, concepts, and process development, with significant areas of overlapping management systems is required. Regarding the management systems interface and distribution, it is still a challenge that Highly Automated Driving (HAD) vehicles needs to overcome by means of effective implementation and strategies with continuous improvement and a reduction of miscommunication. From that motivation, a set of engineering risk management framework are proposed in this paper. Subsequently, introducing the interface areas between the safety and the cybersecurity domain is one of the focus areas of this paper, together with the representation of the interface management activities with exemplary interaction template. Additionally, mapping in between safety and cybersecurity related standards in terms of evidence and management systems is represented partially to support both safety case and security assurance.
Simulation-Based Testing of Foreseeable Misuse by the Driver Applicable for Highly Automated Driving
(2022)
With Highly Automated Driving (HAD), the driver can engage in non-driving-related tasks. In the event of a system failure, the driver is expected to reasonably regain control of the Automated Vehicle (AV). Incorrect system understanding may provoke misuse by the driver and can lead to vehicle-level hazards. ISO 21448, referred to as the standard for Safety of the Intended Functionality (SOTIF), defines misuse as the usage of the system by the driver in a way not intended by the system’s manufacturer. Foreseeable Misuse (FM) implies anticipated system misuse based on the best knowledge about the system’s design and the driver’s behavior. This is the underlying motivation to propose simulation-based testing of FM. The vital challenge is to perform simulation-based testing for a SOTIF-related misuse scenario. Transverse Guidance Assist System (TGAS) is modeled for HAD. In the context of this publication, TGAS is referred to as the “system,” and the driver is the human operator of the system. This publication focuses on implementing the Driver-Vehicle Interface (DVI) that permits the interactions between the driver and the system. The implementation and testing of a derived misuse scenario using the driving simulator ensure reasonable usage of the system by supporting the driver with unambiguous information on system functions and states so that the driver can conveniently perceive, comprehend, and act upon the information.
Scenario analysis is essential for the validation of highly automated driving (HAD) systems. The complexity of overall system safety is increasing in terms of Functional Safety (FuSa) and Safety of Intended Functionality (SOTIF). However, field testing of all possible safety-critical scenarios is hardly possible for automated vehicles. Therefore, scenario simulation is necessary for HAD to support the validation process and has gained acceptance in recent years. However, scenariobased analysis leads to an explosion of scenarios, so a scenario database is required at the beginning of the development phase. Hence, scenario reduction approaches need to be integrated in the conceptual phase to reduce the scenario modeling and testing effort. The contribution of this paper is to present simulation-based testing approaches for determining a reduced set of collision scenarios, taking into account the sensitivity of safety-critical parameters. Furthermore, a set of application scenarios is simulated to demonstrate the scenario reduction approaches by considering the detected collisions under a specific or restricted Operational Design Domain (ODD). In addition, this study supports the provision of a safety argument with evidence by introducing a variance-based sensitivity analysis and a scenario database that can be used as an input data set for an artificial intelligence system.
Modeling and simulation techniques are a necessity to solve the problems and aid the automated driving verification and validation process. The scenario-based analysis like hazard analysis and risk assessment is counting as an essential method not only to understand the system behavior in the field of an automated vehicle but also to reduce the development and communication gaps. In terms of functional safety and safety of the intended functionality the number of hazardous scenarios increases that need to be reduced. Scenario reduction is a challenge that yet needs to be solved. Therefore, this paper proposes a probability approach like the Monte Carlo method at the logical scenario level. Additionally, the safety-critical vehicle parameter range has been optimized based on collision detection. Furthermore, the result realized by the Monte Carlo experiment has been used to model the concrete scenarios in CarMaker in a time-efficient manner. The approach of modeling for a specific function like transverse guidance can be utilized to build a full scenario database for the highly automated driving vehicle.
To allow a vehicle with highly automated driving functions to operate on the road the overall safety (safe functionalities, functional insufficiencies including cybersecurity) of the driving system must be guaranteed. Therefore, a generic Safety Management System (SMS), that includes all useful and necessary regulations should be applied. The given specifications regarding the safety of driving systems shall be understood and considered in order to define an acceptable SMS for the Highly Automated Driving Function (HADF). Derived from the generic SMS a specific management system has to be developed to guide the development and deployment of the HADF. The research presented in this paper investigates the currently available SMS in different sectors like aviation, marine, and railway to propose a new set of components and elements that are useful and modified for a HADF’s SMS. Moreover, the paper provides a systematic approach to how the new set of components and elements can be applied for a HADF SMS. Additionally, well established hazard identification methods (scenario-based HARA and STPA) are compared and integrated into the safety concept phase. The complexity of scenarios is unique for a HADF. Since the SMS is going to be complicated for automotive HADFs and a constantly developing process, methods for evaluation and continuous improvement are needed. This paper gives insight into the structure of the SMS and to guarantee its applicability the use of a helpful software tool is considered. Furthermore, the proposed SMS approach can be adjusted as a groundwork for research concerns like validation for homologation and assess the safety of a HADF.
One of the fundamental tasks of autonomous driving is safe trajectory planning, the task of deciding where the vehicle needs to drive, while avoiding obstacles, obeying safety rules, and respecting the fundamental limits of road. Real-world application of such a method involves consideration of surrounding environment conditions and movements such as Lane Change, collision avoidance, and lane merge. The focus of the paper is to develop and implement safe collision free highway Lane Change trajectory using high order polynomial for Highly Automated Driving Function (HADF). Planning is often considered as a higher-level process than control. Behavior Planning Module (BPM) is designed that plans the high-level driving actions like Lane Change maneuver to safely achieve the functionality of transverse guidance ensuring safety of the vehicle using motion planning in a scenario including environmental situation. Based on the recommendation received from the (BPM), the function will generate a desire corresponding trajectory. The proposed planning system is situation specific with polynomial based algorithm for same direction two lane highway scenario. To support the trajectory system polynomial curve can be used to reduces overall complexity and thereby allows rapid computation. The proposed Lane Change scenario is modeled, and results has been analyzed (verified and validate) through the MATLAB simulation environment. The method proposed in this paper has achieved a significant improvement in safety and stability of Lane Changing maneuver.
For a safe operation of highly automated driving (HAD) systems on the road, the overall safety (functional safety (FS) and the safety of the intended functionality (SOTIF)) including cybersecurity must be guaranteed. Within these terms, the application of a Safety Management System (SMS) is becoming essential for HAD systems. Meanwhile, the cybersecurity for HAD systems is handled separately, familiar as Cybersecurity Management System (CSMS). To provide seamless safety and cybersecurity for highly automated vehicles on the road the two Management Systems should be linked with each other and therefore the interfaces from the SMS to cybersecurity must be defined. Furthermore, the communication flow from SMS to CSMS shall be specified to ensure that no information is lost in between. However, the development phases (SMS and CSMS) will also seemingly pomp the interface areas to industrial sectors like IEC TR 63069 [1], with UN Regulation No.155 [2] and others. The research aspects presented in this paper focus on:
(1) identifying the management related adaption topics for HAD-Safety and cybersecurity considering ISO 26262 (FS), ISO/PAS 21448 (SOTIF), UL4600 (safety for evaluation), SAE J3061 (cybersecurity guidebook) and upcoming ISO 21434 (cybersecurity) [3], [4] [5], [6] and [7].
(2) the novelty in interfaces of SMS and CSMS in risk management of HAD systems.
Moreover, provides a brief systematic approach to sort the collected data during the SMS processes into safety, cybersecurity, or both domains. Safety considers the functional insufficiencies (SOTIF) for hazard analysis and cybersecurity contemplates the threat analysis which can have the potential to occur a hazardous situation for HAD vehicles. Safety considers the SOTIF aspect which deals with environmental and misuse aspects but cybersecurity covers a vast area of consideration. Derived from the proposed approach a general structure for SMS interfaces to cybersecurity is created.
Advanced Driver Assistance System (ADAS) is playing a vital role in the development of human life. Understanding and identifying the necessity of Functional Safety (FuSa) for automated driving systems (ADS) is the focus of this presentation.
Several assist systems like ACC, LDW is now in demand from vehicle user because of comfort and safety. Since current standards focus on systems that are controlled by humans it is very important to clarify which of the given regulations are appropriate to define a common safety management system for automated vehicles. Besides, it is necessary to point out the gaps and missing topics that have to be recorded in specifications to provide a safe operation of tomorrow's vehicles.
Highly automated driving systems perceive the necessity of implementing safety and security features. In the presentation, Automation level 3 or higher is considered for implementing safety including security. Additionally, the necessity of the FuSa for ADAS/ADS is established and gives a glimpse of the research aspect in this area.
The development of a safety case for an automated driving system (ADS) with highly automated driving (HAD) functions is a flourishing area of research. One of the research sections is considering ethics commission (EC) rules with Functional Safety (FuSa), Safety Of The Intended Functionality (SOTIF) and Cybersecurity for ADS. A new Method should be able to provide the evidence to build confidence and ensure the robustness of ADS. Pegasus has already presented an approach for the representation of the logical structure of safety argumentation but has fallen short of applying it by actually modelling the ethic rules (or other safety princples like NHTSA, UL4600, etc) into the structure and connecting them with a concrete ADS safety case. Moreover, the representation of atomic consideration of design principles and their interrelation with ethical rules is incapacitated. Therefore, an elaborate approach will be presented (based on the Pegasus method), to show the relation of Safety (FuSa, SOTIF, cybersecurity and others) with ethical aspects in the development of ADS vehicle and support to build a strong safety argumentation for an ADS safety case.
Firstly, a set of atomic claims from both ethical rules and ADS design and safety principles is generated. Secondly, based on goal structuring notation (GSN), a subsequent safety argumentation and evidence is demonstrated from the generated claims for a dedicated HAD transverse guidance funtion from the ethical aspect. Finally, it is shown how consulted claims reflect safety and how safety can fulfil the ethical goals for ADS.
In recent decades, research in both academic and industry has focused on the area of highly automated driving systems and is expected to do so in the near future. The scenario-based analysis is widely used in automated vehicles that requires simulation-based vehicle control estimation. One of the assist system is transverse guidance that is inescapable for highly automated driving system. The transverse guidance assist system deals with the longitudinal and lateral behavior of the vehicle. For a specific use case, merging functions like adaptive cruise control and lane keeping assist system are considered. The paper is focused on the development of transverse guidance that forms the combined lateral and longitudinal control of highly automated driving system like Lane Change maneuver planning in highway scenario. Moreover, the parameters are demonstrated for the model and performance of the model has been shown for the use case scenario. The proposed approach is then evaluated for a scenario in a simulation environment modeled using MATLAB/Simulink.
A new, precise, scalable multi-purpose gripper system for academic research purposes is proposed. The multi-purpose gripper is intended to be easily adapted to different tasks and object sizes. The gripper system is driven by two separate motor-gear-lead spindle units, operated by a small CNC control. Software running on the CNC unit is completely open source. A novelty for a gripper in this constellation is an interlock-line that may for example be used for a safety door, allowing to stop movement of the gripper fingers and thus being capable to avoid the bruise of an operator’s finger or arm part. This paper describes the steps mechanical parts were designed and simulated to allow a lightweight concept leaving some payload even for relatively small industrial robots used in academic research. Stability of the gripper fingers was tested by pressing the gripper finger towards each other by hand while “blocking” the movement with a finger showing no visible bending effect of the gripper parts. To test the concept of the gripper system, a first prototype is under construction. Parts of the gripper system were simulated, 3D-printed with poly-lactic-acid (PLA) and mounted to a small laboratory robot. The CNC-gripping function will be furthermore optimized and tested at the prototype.
More and more old machines have the problem that their control electronics’ lifecycle comes to its intended end of life, whilst the mechanics itself and process capability is still in very good condition. This article shows an example of a reactive ion etcher originally built in 1988, which was refitted with a new control concept. The original control unit was repaired several times based on manufacturer’s obsolescence management. At start of the retrofit project the integrated circuits were no longer available for further repair of the original control unit. Safety, repeatability and stability of the process were greatly improved.
A new, freely programmable, scalable control system for academic research purposes was developed. The intention was, to have a control unit capable of handling multiple PT1000 temperature sensors at reasonable accuracy and temperature range, as well as digital input signals and providing more powerful output signals at 230V AC than conventional control units. To take full advantage of the system, control-loops are run in real time. The whole system runs independently of a personal computer. The two on-board RS232 connectors allow to connect further units to use more sensors or actuators or to connect other laboratory equipment, as required. To allow usage for long-time experiments, systematically electronic components with low failure-in-time (FIT) rate have been chosen in order to achieve high life expectancy. This paper describes the third prototype, which now provides stable measurements, and an improvement in accuracy compared to the previous designs. A rough estimation about the expected mean time between failures is given. As test case, a thermal solar system to produce hot tap water and assist heating in a single-family house was implemented. The solar fluid pump was power-controlled and several temperatures at different points in the hydraulic system were measured and used in the control algorithms. The hardware design proved suitable to test several different control strategies and their corresponding algorithms for the thermal solar system.
A new, freely programmable, scalable control system for academic research purposes was developed. The intention was, to have a control unit capable of handling multiple PT1000 temperature sensors at reasonable accuracy and temperature range, as well as digital input signals and providing powerful output signals. To take full advantage of the system, control-loops are run in real time. The whole eight bit system with very limited memory runs independently of a personal computer. The two on board RS232 connectors allow to connect further units or to connect other equipment, as required in real time. This paper describes the software architecture for the third prototype that now provides stable measurements and an improvement in accuracy compared to the previous designs. As test case a thermal solar system to produce hot tap water and assist heating in a single-family house was implemented. The solar fluid pump was power-controlled and several temperatures at different points in the hydraulic system were measured and used in the control algorithms. The software architecture proved suitable to test several different control strategies and their corresponding algorithms for the thermal solar system.
In “concept for a new precise academic gripper” the mechanical aspects of the new gripper were presented [3]. In this paper, the idea is improved and expanded towards a clever control part. This paper mainly focuses on the functional ideas and the state of research concerning the imaging tasks. Experiment and intermediate results of the imaging process are discussed. Different approaches of skin colour detection in diverse colour spaces have been tested. Skin colour detection is investigated whether skin colour can be monitored to improve work safety in terms of functional safety. To enhance versatility, several ideas are combined to form a clever gripping device.
This paper investigates the scenario catalog generation and scenario reduction approaches for a complete Highly Automated Driving Function (HADF). Such approaches focus on the clustering and/or grouping of scenarios by applying a simple stochastic process at an early stage of development. Dealing with an enormous number of scenarios considering Functional Safety (FuSa), Safety Of The Intended Functionality (SOTIF)including cybersecurity desires intelligent approaches for HADF’s scenario reduction. The reduction of scenarios in HADF is a challenge for automotive researchers since it relates to a large number of parameters (like environmental aspects). The main contributions of the scenario generation and reduction approach proposed in this work are the following: (1) contribution to a complete scenario catalog for a dedicated HADF, (2) logical scenario optimization with parameter distribution, and (3) optimize discretization step for finding semiconcrete scenarios that can be executed. Furthermore, the optimization method incorporating the Monte-Carlo(MC) experiment with the CarMaker simulation yields a systematic approach to modeling reduced scenarios without redundancy to support safety.
To provide overall safety to the automotive domain both vehicle safety and security need to be considered. Cybersecurity is a key to define the quality of the autonomous vehicle by introducing safe and secure development and risk assessment. The implementation of the Over-The-Air (OTA) updates in the automotive industry brought many facilities to the drier and the Original Equipment Manufacturer (OEM). The amount of cost-saving from OTA for OEMs is assumed over several billion. So, research is essential for safe and secure OTA updates in the autonomous vehicle. However, Highly Automated Driving Functions (HADFs) have already raised the necessity of secure development because a threat can lead to harm in certain scenarios including the functional insufficiencies as mentioned in Safety Of The Intended Functionality (SOTIF) of the system. Scenario-based Hazard Analysis and Risk Assessment (HARA) is extensively used in automated vehicle systems and can support for further development of scenario-based threat analysis for OTA updates. Additionally, the scenario-based analysis represents the alliance of safety and security during product development. Therefore, this paper illustrates the scenario-based analysis and assessment of threats including the OTA feature. Furthermore, demonstrates the processes step-by-step to perform Threat Analysis and Risk Assessment (TARA) against potential vulnerabilities to obtain a set of cybersecurity goals for a HADF.
Scenario-based Hazard Analysis and Risk Assessment (HARA) is an effective and realistic way in terms of vehicle automation capability identification (e.g. SAE/NHTSA automation level). For autonomous driving where the system heavily interacts with its environment by means of sensor (fusion) and actuators, hazard consideration has to be expanded from E/E system malfunctioning behavior to also cover Safety Of The Intended Functionality (SOTIF) including cybersecurity. Scenario-based HARA can capture how to analyze hazards considering Functional Safety (FuSa) and SOTIF, but their relation and inter dependencies need to be represented in a systematic way. Moreover, powerful methods like System Theoretic Process Analysis (STPA) are used to identify, define, and analyze hazards but not risk assessments. Therefore, we investigate state-of-the-art on scenario-based HARA and propose an extended HARA that combines FuSa and SOTIF. In particular, we consider (a) functional scenario representation and selection of scenarios (e.g. drawing basic and accident scenarios in HARA) and (b) methods to find the relation and interactions of FuSa and SOTIF at once for each HAD function. Moreover, we execute a scenario-based HARA method with extension by means of demonstrating the process in an applicable case i.e. a transverse guidance assist system and disclose outcome.