More safety in automated vehicles

Limited perspectives of the ego vehicle

However, the perspective of the considered highly automated vehicle, also called ego vehicle, is limited because the sensors capture the outside world mainly from the point of view of this vehicle. These sensors have inherent restrictions, e.g., weather conditions, complex traffic situations or potential malfunctions in form of SOTIF errors (Safety Of The Intended Functionality). Including data from close sources with different perspectives will very likely improve the accuracy of the environmental model.

In this context, it is important to differentiate between three different perception areas: Close range, mid range and the areas outside the sight lines.

• Close range:

The close range refers to objects that are in immediate vicinity of the ego vehicle. Detecting and capturing these objects in their entirety presents a particular challenge, as their size or shape extends beyond the direct field of view of the sensor in the vehicle.  Therefore, improved high-precision object recognition at close range is an important goal for highly automated driving systems.

• Mid range and far range:

The objects in the mid and far range of the ego vehicle can be more easily recognized in their entirety by the sensor. Depending on the sensor technology, other problems can occur such as fake echoes or weather-related fuzziness. A local approach to minimize these effects is the sensor fusion of different sensor technologies within a vehicle.

• Outside the visible range:

The sensor technologies in the ego vehicle do not work on objects that are near but outside the visible range: Outside the visible range can mean that objects are located behind trucks or buses, behind corners of buildings or behind vegetation (e.g., median strip with shrubs), whereas, depending on the sensor type, differences in visibility can occur.

Improved environmental models thanks to external data

To address these problems, the exchange of sensor data between vehicles (V2V) as well as between vehicles and infrastructure (V2I) could be used. Still unsolved in this context is the question of reciprocal trust and the quality of data from these external sources.

Vehicle manufacturers are required to demonstrate the functional safety of their vehicles, the corresponding sensors/devices and the automated driving systems. Relying on external sensor data contradicts this requirement because the quality of the data, the circumstances of its collection and the devices or algorithms used are unknown to the receiving ego vehicle.

In this article, a method is suggested how to improve the environmental model of vehicles using external data without increasing the risk to the functional safety by inferior quality external data. First, the two concepts "Local Dynamic Map" as a form of the environment model and "Confidence Level" as a measure of trustworthiness are explained.  Afterwards, the method is presented using these concepts.

Assignment of the CL to external data sources

Using data from external, unknown sources is a challenge for the ego vehicle. Classification of the information source helps to determine the initial CL:

• An authorized, static object such as a traffic light or sign: The source identifies itself as an official object and the properties of the source match the HD card, for example. Therefore, this source's reporting of the status of the traffic light or the current speed limit of an electronic sign could receive a high CL value of 90%.
• An authorized but more dynamic object such as a moving traffic light or sign, such as those used at road works, could receive a lower CL.
• Unknown sources such as other vehicles receive a very low CL.

By default, the ego vehicle classifies the data from the external source with the same CL as the source itself.

Processing external data

We recommend the following strategy when dealing with external data and differentiate the following instances:

• The external data corresponds to entries in the LDM: The object identified by an external source has the same properties as the corresponding object in the LDM of the ego vehicle (e.g., same position, same direction of motion etc.). On the one hand, the ego vehicle can assume that the external data is correct and has a certain quality. On the other hand, the external data confirm the properties of the already recognized object. This allows the ego vehicle to gain greater confidence in both its own and external data, which has the following implications:
  • The CL of the object in its own LDM is increased.
  • The CL of the external source is increased.
• The external data contradict entries in the LDM: The external data differs from the LDM of the ego vehicle in that either objects are displayed, which are not present in the LDM, or by the absence of objects, which should actually exist according to the LDM. From this, the vehicle will derive a lower trust in its own data and external data:
  • The CL of the object in its LDM is reduced (if it exists).
  • The entire CL of the external source will be downgraded, or the source will be excluded from the evaluation in the future.
• External data shows objects outside visible range: When external data identify objects outside the visible range of the ego vehicle, the CL for these objects is determined in accordance with the CL of the external source:
  • When the external source identified other objects, which match the LDM, the CL could be relatively high.
  • When different external sources display the same object outside the visible range, the CL is equally increased.
  • When the external data does not match the data of the LDM or data from other external sources, the CL value for the affected objects outside the visible range should be rather low or equal to zero.

With this strategy, the ego vehicle could use external data from source with low or unknown ASIL to improve its own LDM without compromising the functional safety of the system. The strategy allows external data to be classified either by application context (traffic lights) or by the degree to which it matches the LDM of the ego vehicle. The influence of a single external source on the LDM turns out to be small, but the reliability of the LDM increases enormously as soon as many external sources surround the ego vehicle.

The described strategy could also be used if data transfer protocols include properties to describe trustworthiness in the future. It enables the ego vehicle to detect malfunction of external sources so that it can take appropriate action.