An Automated Vehicle Safety Concept Based on Runtime Restriction of the Operational Design Domain

Automated vehicles need to operate safely in a wide range of environments and hazards. The complex systems that make up an automated vehicle must also ensure safety in the event of system failures. This paper proposes an approach and architectural design for achieving maximum functionality in the case of system failures. The Operational Design Domain (ODD) defines the domain over which the automated vehicle can operate safely. We propose modifying a runtime representation of the ODD based on current system capabilities. This enables the system to react with context-appropriate responses depending on the remaining degraded functionality. In addition to proposing an architectural design, we have implemented the approach to prove its viability. The proof of concept has shown promising directions for future work and moved our automated vehicle research platform closer to achieving level 4 automation.

I. Introduction

Due to the inherent difficulty of solving the “self-driving car problem”, Automated Driving Systems (ADS) require complex software and hardware system architectures [1] [2]. These systems are expected to operate safely even in the event of system failures or hazardous external conditions such as poor weather. An ADS must be able to achieve a minimal risk condition (such as pulling to the side of the road) if it detects any issues with its own functionality or external conditions that prevent further safe operation. We propose a safety concept and architectural design that integrates functional degradation and functional boundary monitoring to maintain a runtime representation of the functional boundary based on current system capabilities.