Crash-Prone Fault Combination Identification for Over-Actuated Vehicles During Evasive Maneuvers

Throughout a vehicle’s lifecycle, systems may fail during operation, requiring effective fault management by the vehicle controller. Various system faults affect vehicle handling differently. Additionally, vehicle velocity and road friction directly impact handling and stability. Thus, it is essential to investigate relevant factors, such as actuator faults, vehicle velocity, road friction, and their combinations, before developing a fault-tolerant controller to mitigate potential critical situations. Our work thus focuses on identifying faults and fault combinations that might lead to crashes for over-actuated vehicles during evasive maneuvers and those impacting comfort parameters. We employ a state-of-the-art vehicle controller optimized for evasive lane changes for over-actuated vehicles. The driving scenario encompasses critical conditions defined in ISO 26262 with ASIL-D, including velocities up to 130 km/h and requiring steering away from obstacles. Failure Mode and Effects Analysis, Design of Experiments, and statistical tools are used to determine fault combinations most likely to lead to crashes during evasive maneuvers. Our results indicate that the vehicle controller successfully handled the maneuver in over 53% of investigated cases, reaching up to 75.1% on dry surfaces. Road friction emerges as the most critical parameter for collision avoidance and comfort. Brake faults exhibit a higher influence on vehicle handling than other actuator faults, while single motor faults do not significantly impact vehicle parameters. Regarding two-factor interactions, brake actuators dominate, followed by steering and motor. These findings provide valuable insights for developing fault-tolerant controllers for over-actuated vehicles, guiding decisions on addressing specific faults to enhance safety and comfort parameters.


I. INTRODUCTION
Autonomous vehicles (AVs) are in constant development.Whereas conditional self-driving vehicles are currently available on the market, fully autonomous vehicles are expected after 2035 [1], [2].The AVs development concerns not only making the vehicle independent of human commands The associate editor coordinating the review of this manuscript and approving it for publication was Salman Ahmed .but also how to mechanically design these vehicles to increase comfort and safety.Research institutes and car manufacturers have been investigating over-actuated design, in which there are more actuators than degrees of freedom to define the vehicle motion [3].The over-actuated design leads to increased drivability and vehicle stability at high velocities [3], [4].
four-wheel drive, four-wheel brake (4WS-4WD-4WB), and four-wheel independent steering, four-wheel independent drive, and four-wheel independent brake (4WIS-4WID-4WIB), as depicted in Figure 1.Whereas in 4WIS each steering actuator can be controlled independently, in 4WS the steering actuators have some correlation with each other, with steering configurations defined as [4] FWIS: δ fl , δ fr , δ rl = δ rr = 0, 4WS: δ fl = δ fr , δ rl = δ rr , 4WIS: δ fl , δ fr , δ rl , δ rr , where δ i is the individual steering angle values on each wheel, with i = fl for front-left, fr front-right, rl rear-left, and rr rear-right.Regarding drive actuators, whereas 4WD might include up to two motors with torque distribution to the front and rear wheels, 4WID comprises an individual drive actuator on each wheel [6], [7].A similar concept applies to brake actuation.
Although over-actuated vehicles benefit from enhanced drivability and stability, an increase in the number of actuators on the vehicle leads to an increase in the probability of actuators' faults in the vehicle's life span [8].In this context, fault-tolerant controllers (FTC) have been developed to handle the vehicle under failure or faulty actuators.Failure is defined as the inability of the system to perform its original function, becoming non-operational.Fault is defined as a system with degraded performance but still operational [9].
FTC to handle electric motors failures and faults have been proposed in [10], [11], [12], [13], and [14].The authors in [10] designed an FTC combined with a sliding mode control (SMC) strategy for a 4WID vehicle.The controller was evaluated in Carsim for a vehicle driving with a sinusoidal steering actuation and low lateral accelerations.The faults considered were partial motor loss of effectiveness and a motor failing to deliver torque.The controller kept the vehicle on track for velocities up to 140 km/h with a path deviation of fewer than ten centimeters.In [11], a passive FTC with model predictive control (MPC) and SMC strategy was proposed to enhance path following at high velocities and low road friction coefficient under partial motor faults.As a passive system, the controller did not have fault detection and diagnosis, but it was robust if a fault occurred.The controller was evaluated in Carsim and successfully handled the vehicle in a double-lane change at 72 km/h with road friction of 0.3.None of the FTC controllers, however, were designed for evasive maneuvers.
FTC for steering failure and faults have been proposed in [15], [16], and [17].The authors in [15] presented an FTC to handle one steering failure at a time.The controller allocator was responsible for redistributing the drive motor torques and manipulating the remaining healthy steering actuators.At a double-lane change in a non-evasive situation, the controller handled the maneuver up to 60 km/h on a dry surface.The approch in [17] presented an active MPC-FTC, with controller parameter reconfiguration in case of single actuator failure or fault.The test scenarios consisted of, firstly, a vehicle at 50 km/h performing a single-lane change of 60 meters and, secondly, driving up to 80 km/h in a single-lane change of 60 meters followed by deceleration.Simulation results showed the controller handling the vehicle with path error tracking less than 20 centimeters when driving at 50 km/h with steering faults.However, at 80 km/h and lateral acceleration up to 5.2 m/s 2 , the controller overshoots the road boundary in the presence of a front-left steering failure.With a front-right steering failure, the controller handled the maneuver without overshooting.
As failure and faults might happen in multiple actuators simultaneously, FTC for combined failure and faults have been proposed in [18] and [19].The authors in [18] designed a SMC-FTC for up to two concurrent steering actuator faults.In a single-lane change in a non-evasive scenario at 80 km/h, simulation results show that the controller handled the vehicle with ± 3 km/h error in longitudinal velocity and kept the vehicle on track.Faults, however, would last only 0.5 seconds, after which the actuator would be considered healthy again.In [19] MPC-FTC was proposed to handle up to two concurrent steering faults.A simulation was performed in IPG-CarMaker ® for a double-lane change at 55 km/h and faults at the rear left and right steering actuators.Once the fault occurred, the actuators were continuously kept under fault conditions.The controller kept the vehicle on track by adapting the front wheel steering actuators.The lane change took 100 meters and did not consider an evasive request.
In the design of an FTC, the first step is to perform a system fault detection, isolation, and identification.Detection concerns determining if a fault has occurred, isolation concerns distinguishing which components have failed, and identification to determine the type of fault and magnitude [9].Whereas the studies in [10], [11], [12], [13], [14], [15], [16], [17], [18], and [19] have considered the vehicle with a pre-defined actuator failure and fault, researches have also given focus on fault detection, isolation, and identification prior to the development of an FTC itself [20], [21], [22].In [20], the authors proposed a fault diagnostic based on support vector machine (SVM) classification.The machine learning (ML) classification was trained to diagnose faulty steering actuators, including stuck actuators, loss of effectiveness, and bias values.The model accurately identified the fault by 80% in the case of a stuck actuator, 67% for loss of effectiveness, and 97% for bias values.The authors in [22] designed a model-based method to detect and identify sensors, steering, and electric motor faults.Simulation results in IPG-CarMaker ® showed an accuracy of more than 90% for sensors and actuators failures and faults.The scenario considered the vehicle driving at comfortable driving conditions with velocities up to 25 km/h.
Whereas comfort driving conditions limit the vehicle lateral and longitudinal acceleration to up to 3.6 m/s 2 , aggressive driving might bring the vehicle to the handling limits up to 11.8 m/s 2 depending on the road friction condition [5].An evasive maneuver is an aggressive driving condition in which the vehicle has to perform an action to avoid a crash in a short window and distance.The research in [5] and [23] proposed controllers to handle the vehicle up to handling limits with healthy actuators.Whereas [23] designed an MPC for crash avoidance up to 100 km/h, the study in [5] proposed a SMC controller that successfully avoided crashes in an evasive lane change up to 130 km/h in dry surface.
Whereas some researches develop FTC to deal with faults, and others develop fault diagnostics strategies, a gap exists in understanding the consequences of faults in the vehicle behavior during aggressive maneuvers before the development of an FTC.A thorough comprehension of how each fault affects the vehicle handling and the consequences of fault leads to a better understanding of situations in which the vehicle controller should be optimized or an FTC should be developed.To date, no solution is available to identify which faults might lead to a crash for an over-actuated vehicle in an evasive maneuver.Compared to previous studies, the main research contributions of this paper are: • filling out the gap in the literature by identifying fault, fault combinations, and faults combined with road friction and vehicle velocity that lead to a crash and describing the consequences of faults for an over-actuated vehicle during an evasive maneuver.
• proposing a methodology to identify the most critical factors (faults, road friction, vehicle velocity) for an over-actuated vehicle during an evasive maneuver.
• answering a research gap on which factors (faults, road friction, vehicle velocity) are more critical in evasive maneuvering.This paper is organized as follows: Section II presents the proposed methodology to identify factors (faults, road friction, vehicle velocity) that lead to crashes for an overactuated vehicle.The section includes the definition of the evasive scenario, the vehicle systems that might fail, and the types of faults.Moreover, the design and use of failure-mode effective analysis (FMEA) and the design of experiments (DOE) are described, followed by the factorial design strategy.The results are given in Section III, and the conclusion in Section V.

II. METHODOLOGY
Investigating the factors (faults, road friction, vehicle velocity) that lead to a crash and their consequences involves five distinct steps, as depicted in Figure 2. The initial step (A) involves selecting and using a state-of-the-art controller for over-actuated vehicles capable of performing aggressive driving maneuvers.The second step (B) involves defining the driving scenario under consideration.The third step (C) specifies the possible faults in the vehicle's systems and how they occur.In the fourth step (D), the faults are classified using Failure Mode Effectiveness Analysis (FMEA), whereby a risk priority number (RPN) is assigned to each fault category, forming the basis for the subsequent design of the experiment (DOE).In the fifth step (E), the different experiments to be conducted to identify the influencing factors on the system behavior are defined.The experiments comprise combinations of faults, road friction, and vehicle velocities.Via statistical analysis, by using analysis of variance (ANOVA), the single and combined factors influencing the vehicle behavior are identified.In the last step (F), ANOVA heatmaps are constructed.The heatmap intersections between factors and quantities of interest are used to depict the most influencing factors in terms of safety, handling, and comfort.

A. VEHICLE CONTROLLER
The selected controller to handle the vehicle in evasive maneuvering was proposed in [5].The authors designed an over-actuated vehicle controller to deal with evasive maneuver up to the vehicle's handling limits using sliding mode control (SMC) strategy.Sliding mode control is among the most efficient robust control strategies, and it also acts as a pivotal approach to control uncertain systems, especially those that are sensitive to disturbances [24].The complete controller architecture is depicted in Figure 3.

FIGURE 3.
Over-actuated vehicle controller system architecture with upper and lower level design from [5].
The motion planning is a controller input and consists of the road path information and the desired vehicle velocity.On the upper-level controller, the path preview calculates and outputs a quantity to describe how well the vehicle drives in the desired path, which is then used by the lateral controller's section.The slip controller is designed via a slip-based tire monitoring approach, in which the gas and brake values are corrected depending on the i tire slip ratio κ i and side slip angle α i .The slip controller outputs are forwarded to the longitudinal and lower-level controller parts.
The coupling between longitudinal and lateral vehicle motion occurs via the SMC strategy design.The vehicle's lateral motion is described via the vehicle steering angle δ, with δ = δ e + δ rb .In which δ e and δ rb are the controller's equivalent and robust parts.The equivalent section represents the control law that keeps the chosen state variables on the sliding surface, and the robust part is responsible for driving the state variable toward the sliding surface.The sliding surface for the controller in [5] is defined as σ with where y represents the difference between the vehicle's center of mass (CoM) and the reference path in the lateral direction y in the vehicle's coordinate system (see Figure 4); ẏ represents the relative lateral velocity between the center of mass and the reference path; k yd , k yv ,k r ∈ R [25] are the gradient coefficients.r is the deviation between the actual yaw rate r and the desired one r d , which is obtained in terms of longitudinal velocity u in the vehicle coordinate system, vehicle characteristics, tire characteristics, and steering angle [26] as with m the total vehicle mass, l f and l r are the distance from CoM to the front and rear axle, with L = l f + l r , and C f and C r as the tire cornering stiffness.The equivalent steering angle δ e given as in which d l represents the look-ahead projection distance from the vehicle's front, and o p is the look-ahead offset.ÿ is the relative lateral acceleration and ṙ the derivative of yaw rate difference.P is defined as a function of vehicle and tire characteristics as and T described in terms of state space representation values as with the vehicle's state space represented as in which v is the lateral velocity of the vehicle's center of mass, and I z is the yaw moment of inertia.The robust steering equation δ rb is given as where is a boundary layer introduced around the sliding surface σ , with ∈ R + [27].The controller parametrization and the steering angle for each independent wheel are given in [5].It is assumed δ = δ f , with δ f the front wheel steering angle.The relation between front δ f and the rear wheel steering angle δ r is given by ξ as Note that the controller used in this study and developed in [5] reached precise control to keep the vehicle on the desired path by developing a lateral controller as a function of a path-following strategy based on look-ahead areas projected in front of the vehicle.The path following strategy computes an error between the current and the desired path, given as o p , which is then fed to the steering angle equation (4).Further information on the calculation of the look-ahead areas is outside the scope of this study and can be found in detail in [5].Moreover, the vehicle stability has been proven by using the Lyapunov stability function.Further information on stability analysis is available in [5].

B. EVASIVE SCENARIO
The analysis of how system faults, road friction, and velocity influence vehicle behavior is investigated for an evasive maneuver.In the critical scenario, the ego vehicle executes a single-lane change maneuver [5], [23].While traveling at a consistent velocity, the ego vehicle detects a stationary preceding vehicle at a distance D d of 30 meters, depicted in Figure 5. Upon detection, the controller performs a metric assessment to evaluate if a lane change is necessary or if only a brake application is enough for crash avoidance.In case of a lane change, the vehicle performs the maneuver and simultaneously applies the brakes to bring the vehicle to a halt.The lane's width, denoted as L w , measures 3.0 meters.The scenario assumes the absence of incoming or outgoing vehicles in the adjacent lane.The metrics to assess the need for a lane change in a rear-end collision are the time-tocollision (TTC) and time-to-brake (TTB) [5], and are defined as with a max = µ a g the maximum deceleration value.µ a is the road adhesion coefficient and g is the gratitational acceleration.An evasive lane change is required when the time to brake (TTB) exceeds the time to collision (TTC).
The driving scenario used in this work lies in ASIL-D classification from ISO 26262 [28], as in terms of exposure reaches level four as it involves lane change situation, for controllability reaches level three as it involves steering away from an object, and in terms of severity, it reaches level three, as the scenario involves velocities of up to 130 km/h in a rear-end crash if the vehicle does not steer to avoid the collision.

C. FAULTS SYSTEM DEFINITION
The standard components of current electric automated and autonomous vehicles include sensors, actuators, and embedded systems [29].The sensors collect data from various parts of the vehicle and forward the information to different systems.Sensors are part of different functions as [29], [30], and [31]: ▶ Advanced drive assistance systems (ADAS): functions that support the driver to operate the vehicle, e.g., lane keep assistance (LKA).Include sensors such as cameras, radars, and lidars.▶ Navigation: responsible for identifying the geographical location of the vehicle.▶ Vehicle dynamics: controllers developed to increase safety and comfort for the occupants, e.g., stability control.Sensors include inertial measurement unit (IMU) and steering angle sensors.▶ Braking and traction control: responsible for anti-lock wheels during braking and optimizing driving torque during the acceleration phase.Include sensors to, e.g., measure wheel rotation and brake pressure.
▶ Battery management: accountable for optimizing the battery use to increase the electric vehicle range.Actuators are associated with energy conversion, often from electrical to mechanical.Some vehicle actuators directly or indirectly generate the forces to move the vehicle, and include [32]: ▶ Electric motor: converts electric to mechanical energy.▶ Inverters: convert direct current (DC) from batteries to alternate current (AC) to supply the electric motors.▶ Steering actuators: for steering the vehicle's wheels.▶ Brake actuators: mounted on the wheel carriers with the primary function to transform the motion energy into heat or electric energy to reduce the vehicle velocity.▶ Suspension actuators: responsible for adjusting the vehicle's height.▶ HVAC: actuators responsible for heating, ventilation, and air cooling.Embedded systems are computer hardware and software that perform a specific or a set of functions that support the appropriate operation of the vehicle.The hardware in which the software runs is named the Electronic Control Unit (ECU).A vehicle might have more than 100 ECUs for different tasks, from lights to motor control.Some ECUs in a vehicle include [33], [34], [35]: ▶ Transmission control unit (TCU): responsible for controlling automatic transmission and supporting the vehicle's optimal energy use management.▶ Engine control module (ECM): responsible for defining the best torque and speed for combustion engines.
For electric motors, it is named Motor Control Unit (MCU) and includes energy management to increase the vehicle's drive range.▶ Brake control module (BCM): computes the optimum strategy to apply and release the brakes such that the wheels do not lock.▶ Body control module (BCMo): responsible for vehicle internal and external lamps, radio, door locks, tire pressure, wiper controls, and other electronic components.Only the sensors and actuators directly influencing the vehicle response are considered to evaluate the controller performance in an evasive maneuver with concurrent faults.Therefore, battery sensors and HVAC actuators are not included in the further investigation.Furthermore, this study focuses exclusively on a single vehicle's behavior.It does not account for Vehicle-to-Vehicle (V2V) communication, Vehicle-to-Infrastructure (V2X) interactions, or the role of localization systems in V2X communication [36], [37], [38], [39], [40], [41].The embedded system considered in this study is the MicroAutoBox III (MAB), capable of performing all the required vehicle functions and commonly used in testing platforms [42], [43].Figure 6 depicts the sensors, embedded systems, and actuators considered as part of the vehicle structure for this study.

D. FAILURE MODE EFFECTIVE ANALYSIS (FMEA)
Failure mode effective analysis (FMEA) is an engineering technique to define and identify potential failures, faults, and errors that might affect a system's functionality [44].It supports system engineering by correlating which faults might occur and with which criticality, occurrence, and detection risk.Therefore, FMEA is used to identify the system's problems, ideally before they reach the user.It can be used to make the system robust against failures, faults, and errors, where error is the difference between desired and observed values [45].FMEA is widely used in the automotive industry, e.g., from classifying passenger vehicle recalls to risk assessment of electric vehicle batteries, brakes, motors, steering systems, and sensors [12], [46], [47], [48], [49].
In FMEA, a risk priority number (RPN) is calculated to quantify the risk of every failure, fault, and error.The higher the RPN value, the greater the risk for the system operation [44].Therefore, via RPN analysis, it is possible to identify the system components that seek more attention when designing, e.g., a vehicle controller for automated and autonomous vehicles.RPN is calculated as where S ev is the severity of the failure or fault in the system operation, O cc is the occurrence frequency of failures or faults per unit of time, and D et is the likelihood to detect the failure or fault before it happens.The FMEA ratings are given in  FMEA rating for failure and fault occurrence [50].
to eliminate or reduce the consequences of a fault in the system operation.Mitigation actions can be implemented during the system's design phase or during the operation itself [50].Table 4 depicts the RPN for the primary vehicle components considered in this study, with failure mode, effects, causes, mitigation, and respective rankings based on [51], [52], [53], [54], [55], [56], [57], [58], [59], [60], [61], [62], [63], [64], [65], [66], and [67].The RPN analysis reveals that the highest values occur for the vehicle actuators, subsequently by the vehicle sensors, and lastly by the embedded system.Therefore, during the design of the vehicle itself or by designing a vehicle controller, it is crucial to first consider the faults in the actuators because they significantly impact the vehicle's operation.This study considers an over-actuated vehicle with four motors, four brakes, and four steerings, hence, the likelihood of actuator faults increases, leading to a higher value for O cc compared to vehicles with single actuators.
Although essential for the vehicle's correct function, an embedded system has the lowest RPN value mainly due to the possible causes and the likelihood of detecting the fault before it happens.The main fault related to MAB is due to power supply issues, which can be easily solved by measuring the battery level, e.g., bringing the vehicle to a charge station when batteries are below a minimum level.
While some fault mitigation can be easily implemented before a fault occurs, like in the case of MAB, other faults require mitigation during the system operation, which is the worst-case scenario for a fault to happen.In case, e.g., an abrupt steering actuator is blocked in a fixed position while the vehicle is in movement, a strategy has to be implemented to avoid the vehicle coming into a crash due to the fault.The most common strategy is controller redundancy, meaning the vehicle controller should have implemented strategies to handle the vehicle if an actuator fault occurs.Therefore, there is a need to develop robust and fault-tolerant controllers.
Whereas some faults during vehicle operation decrease driving performance, such as corrupted GPS information, the faults on the actuators can lead to a catastrophic situation because the actuators are responsible for generating the forces on the road to keep the vehicle on track.Therefore, to simplify the analysis of the fault consequences on the vehicle operation, in the next phase of the methodology process, only the actuator faults are considered since they are the only ones that can lead to an imminent crash when a fault occurs.

E. DESIGN OF EXPERIMENTS (DOE)
The design of experiments (DOE) consists of a series of runs in which the system's variables are varied, and the effect is observed.The experiment design consists of efficient techniques to select the correct choice of experiments that result in a global overview of the system performance under different variable changes [68].The general steps of the DOE performed in this study consists of six steps as [69]:

1) DEFINE THE OBJECTIVE OF THE DOE ANALYSIS
The goal of the DOE in this study is to evaluate the vehicle behavior and safety under the influence of different factors (faults, road friction, vehicle velocity) in an evasive single-lane change maneuver as in [5].

2) IDENTIFY THE INFLUENCYING VARIABLES IN THE SYSTEM'S RESPONSE AND DEFINE THE LEVEL OF EACH FACTOR
With the help of the FMEA analysis in section II-D, it was defined that the most relevant variables for vehicle behavior were the ones related to actuator faults.Therefore, the faults considered for this study can occur in electric motors, steering, and brake actuators.Moreover, it is considered that: ▶ For the evasive scenario, a road friction change is considered to cover dry, wet, and ice road surfaces.▶ The vehicle velocity is considered from 75 km/h to 130 km/h.▶ The faults can take place at the front-left, front-right, rear-left, and rear-right wheels.▶ The maximum number of concurrent faults is two.▶ No concurrent fault shall take place at the same wheel.Road friction is critical as it directly limits the forces generated at the tire-road interface, significantly affecting vehicle response in longitudinal and lateral dynamics.Similarly, vehicle velocity impacts performance and stability; an increase in velocity increases the vehicle's kinetic energy, thereby affecting its steering and braking capabilities [70].Additionally, faults in actuators have a direct impact on the vehicle's maneuverability.4. Risk priority number (RPN) for vehicle components (actuators, sensors, and embedded system) [51], [52], [53], [54], [55], [56], [57], [58], [59], [60], [61], [62], [63], [64], [65], [66], [67].The overview of the influencing actuator fault variables and the respective levels are given in table 5.For the steering, three levels are considered: no fault, double steering angle as requested by the vehicle controller, or the steering actuator locked in a straight angle position.The brake actuator is considered a no-fault, zero brake torque application and full brake appliance leading to a fully locked wheel.Motor actuators are considered no-fault, zero motor torque, and partial loss (with 50% from controller request).Three levels are considered for road friction, from dry to ice surface, as indicated in table 6.As in table 7, seven levels are considered for vehicle velocity.Therefore, considering the above DOE strategy, there are a total of 14 factors under study: one meaning the velocity, one meaning road friction, four for steering since there are four wheels and steering faults might take place in any of them, and similarly four factors for brakes and four factors for motors.

3) DEFINE THE QUANTITIES OF INTEREST
The quantities of interest (QoI) are parameters to describe the system response.Nevertheless, the brake distance B d is an important parameter as the vehicle must stop at the shortest distance possible in critical situations.Similar occurs for L d,max , which depicts the maximum lateral deviation from the driving path.Two jerk parameters, J y,max and J x,max , are commonly used to address vehicle comfort.Although an evasive lane change is aggressive, addressing the level of comfort or discomfort is appropriate in all driving situations.The other 13 QoIs are related to other vehicle handling parameters.Fz i,abs is the absolute load difference on the i-th wheel between the load with the vehicle standing still and the maximum or minimum load on the wheel during the maneuver.

4) SELECT AN EXPERIMENTAL DESIGN
Although it is outside the scope of this study to discuss in detail all the DOE techniques, a brief overview of commonly used techniques is provided, including randomized block design, full factorial, and fractional factorial [68], [69].

▶ Randomized block design (RBD): It is a technique used
when the main focus is understanding how one single factor affects the system's behavior.It is assumed that one single factor significantly influences the system, whereas the other factors have negligible effect.Let X m be the major factor with L m levels, and X n1  usually not used when the number of factors and levels are relatively large (β > 5 and γ > 3).▶ Fractional factorial design (FD): The FD technique is applied to reduce the number of experiments performed while keeping an accurate analysis of the influence of the system's parameters on the system behavior.It consists of basically running a subset of the FDD experiments.
An FDD method would lead to more than eleven million experiments for the current study case with fourteen factors, thirteen of which have three levels and one with seven levels.This study uses the FD method to reduce the computational effort.Considering the constraints in section II-E2, 5061 experiments are necessary to describe the vehicle behavior under actuator faults, road friction variation, and different vehicle velocities.Besides the scenarios with only a single fault, scenarios with up to two concurrent faults are considered as defined in section II-E2.For each experiment, up to four factors were varied simultaneously, comprising up to two faults with road friction and velocity change.The factors' nomenclature is given in table 9. Depicting the complete list of the 5061 experiments is outside the scope of this study.

5) PERFORM THE EXPERIMENTS DICTATED BY THE DOE
We performed the 5061 experiments in a simulation tool.As in [5], the vehicle controller was implemented in Matlab/Simulink with IPG CarMaker ® .We use a high-fidelity Renault Megane vehicle model, with main properties indicated in table 10, with T w the vehicle's track width and t r the tire effective rolling radius.The vehicle drive, steering, and brake system are designed as in [5].For every simulation, the QoIs are recorded for post-processing.

6) STATISTICAL ANALYSIS
Post-processing involves using mathematical and statistical models to describe the correlation between each factor and the system's response, with factors defined in section II-E2 and the response given by the quantities of interest (QoI) in table 8. Statistical software is commonly used to calculate the correlations and includes, e.g., Matlab, Minitab, R, JMP, and SAS [69].Identifying how the system is affected by each factor and the interaction of factors is possible via analysis of variance (ANOVA) [69], [71], [72].
ANOVA is a common technique used to analyze a given dataset.The data (or observations) are categorized into groups, and the means of each group are compared to each other to identify if there is a statistically significance difference between them.By ANOVA test, a null (H null ) and an alternative hypothesis (H a ) are formulated for each QoI as [71] H null,QoI : where φ is the group mean, and τ to the total number of groups.If all groups have equal mean values, the null hypothesis is accepted.Otherwise, H null is rejected in favor of H a , meaning there is a statistically significant difference between at least two groups.
The core ANOVA calculation for deciding on the hypotheses is based on the F value,J ,QoI and P value,J ,QoI .If F value,J ,QoI > F critic,QoI , the null hypothesis is rejected.F critic,QoI is a threshold to accept or reject the null hypothesis for the QoI under study and depends on the level of statistical significance α, the total number of observations ρ, and the degrees of freedom associated with factor J .The P value,J ,QoI is associated with F value,J ,QoI and gives the statistical probability α in the percentage of incorrectly discarding the null hypothesis.A common practice is to use α < 5%.P value,J ,QoI , F value,J ,QoI and F critic,QoI are calculated and given by statistical softwares.With F value,J ,QoI for the factor J and a given QoI defined as [69], [71], and [72] where MS J ,QoI is the mean sum of the square of J -factor, and MS e,QoI is the mean error sum of squares of the total number of observations ρ.In case, as part of DOE design, there is more than one factor under study, and these interact with each other, the F value,QoI is calculated for all intersections, e.g., for the factors J 1 and J 2 as where MS J 1J 2,QoI is the mean sum of the square of the interaction between J 1 and J 2 factor.If three or more factors interact with each other, the F value,QoI calculation follows the same concept.Therefore, the calculation of ANOVA parameters depends on the number of factors and the number of interactions between factors.
The ANOVA can be classified as one-way, two-way, and multiple-way depending on the number of factors [69], [72].Generally, for DOE designs that include multiple factors, two common strategies to evaluate the influence of each factor in the system's behavior include: (1) organizing the dataset into clusters with up to three factors and performing separate ANOVAs, as in [72], and (2) performing a general linear model (GLM), as in [73].The GLM is an ANOVA that uses the least square regression approach to determine the dependent variable response as a linear function of the system's factors.Therefore, GLM assumes a linear relationship between the dependent variable (QoI) and each factor on the regression model [71], [74].
The basic assumption for an ANOVA analysis is that the residuals follow a normal distribution, and the variance of the dependent variable has the same value for different groups (levels) [75].Residual is the difference between the observed dependent variable value and the predicted value from the GLM approach.The coefficient of determination R 2 is used to evaluate how well the GLM approach can represent the predicted dependent variable (QoI) as a function of system factors.The closer R 2 to 1, the better the model representation.R 2 for a specific QoI is given as [ with SS e,QoI the residual sum of squares and SS T ,QoI the total sum of squares.Since in the current study we considered fourteen factors, we used a GLM approach carried out via Minitab software.We focused solely on examining the main effects and two-order interactions between factors to simplify the analysis and reduce complexity.The description of the statistical calculation on the ANOVA parameters (SS e,QoI ,SS T ,QoI , MS J 1J 2,QoI , MS e,QoI , P value,J ,QoI , F value,J ,QoI ) is outside the scope of this study.It can be found in the literature as in [69], [71], [72], and [75].

F. ANOVA HEATMAP
From the ANOVA results in section II-E6, heatmaps are generated to depict how each factor and combination of factors influences each quantity of interest by presenting the intersections between factor and QoI.Heatmaps are commonly used when a considerable number of factors influence the system's behavior and/or a considerable number of QoIs are under investigation, as in [76].Therefore, a heatmap can be used to identify, e.g., how the front-left steering fault might influence collision, accelerations, and the other QoIs.We use heatmap data to evaluate how each factor group influences vehicle behavior.Any single or combined faults related to steering are categorized as a steering group.Similar categorization occurs for brake, motor, road friction, and vehicle velocity.The groups are depicted in table 11.Group faults are abbreviated as G w , with w = S for steering, w = B for brake, w = m for motor, w = R for road friction, and w = V for vehicle velocity.From the heatmap intersections, we calculate the percentage of the total intersections for the group w over the total possible number of intersections for the group w as where P Gw is intersection percentage for group w.I w the sum of intersections and I pw the total number of possible intersections for w.The parameter P Gw supports understanding which group factors have a greater influence on vehicle behavior by integrating all the QoIs into one common parameter.Therefore, P Gw is used to categorize the relevance of each group factor.If, for example, the P GR = 100%, the road friction or any parameters combined with road friction influences all the QoIs under study.If 0%, it would mean no influence of road friction in any QoI.The P Gw is calculated for the main effects and two-order interactions between factors.

III. SIMULATION RESULTS
The experiments that are discussed in section II-E were performed using the vehicle controller from [5] as described in section II-A.The influence of each factor in the vehicle behavior was evaluated in Minitab.This section explains the results by presenting the vehicle performance in the single-lane change scenario, followed by the influence of main-factor and two-factor interactions.the crash is by performing a lane change combined with full braking.Below 75 km/h and depending on the road friction, braking is sufficient to avoid a crash.

A. LANE CHANGE PERFORMANCE
For the majority of the experiments (53.5%), the ego vehicle collided with the preceding vehicle, and for 6.9%, the vehicle left the road without colliding.The results show that the vehicle controller was not capable of handling the lane change at the same time that some faults were present and/or the road had low-friction values, which is an expected result since the deployed controller is optimized to evasive lane change considering non-faulty actuators and dry surface.
Considering only the scenarios with dry road surface (1687 experiments), the controller successfully handled the maneuver for 75.1% of the experiments, as depicted in Figure 9.For 24.9%, the ego vehicle collided or left the road exclusively due to actuator faults.Therefore, by comparing the results from Figures 8 and 9, the influence of road friction during an evasive lane change maneuver is notorious.Via ANOVA, it is possible to statistically identify how road friction and the other 13 factors influence vehicle behavior.
The influence of faults is evident when comparing the outcomes of this study with those reported in [5].In scenarios without faults, the controller in [5] successfully managed the vehicle at velocities of up to 130 km/h on dry surfaces without any collision incidents or leaving the road.However, on lower friction values, the controller's effectiveness was limited to velocities up to 80 km/h, beyond which the ego vehicle collided with the preceding vehicle, highlighting the influence of road friction on vehicle safety.Further information on evasive vehicle handling in a fault-free situation can be found in [5].

B. MAIN FACTORS INFLUENCE
This section describes the ANOVA results for the single effects (main factors).Table 12 shows the ANOVA results for the QoI collision (C oll ), with following hypothesis: H null : the factor J do not influence Collision, H a : the factor J do influence Collision. ( 37266 VOLUME 12, 2024 Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.The factor Road Friction has a P value of 0.018.Therefore, with a minimum of 95% accuracy, the null hypothesis can be discarded in favor of the alternative hypothesis, meaning that a change in the road friction coefficient impacts vehicle behavior and tends to lead to a collision with the preceding vehicle.An increase in the vehicle velocity alone from 75 km/h to 130 km/h has a statistical significance in collision terms.By depicting the scenarios only with dry road surfaces, it is possible to observe the controller performance from 75 km/h to 130 km/h with actuator faults.Figure 10 shows the percentage of lane change successfully performed for each velocity.With the increment of velocity, there is a tendency to decrease the lane change performance from 94.2% at 75 km/h to 58.9% at 130 km/h, matching the ANOVA results regarding vehicle velocity influence in the maneuver performance.The actuator's faults alone have no statistical influence on the vehicle collision.It means that a single fault has no statistical significance and can not be assumed it tends to cause the ego vehicle to collide with the preceding vehicle. Figure 11 depicts the ANOVA heatmap for each factor and the quantities of interest.The factors that have statistical significance in a given QoI are marked with blue color.The level of significance is highlighted from 95% to 99.9%, e.g., a fault in the front-left brake (FLB) influences the vertical load on the front-left wheel (Fz fl ) with 95% accuracy.In contrast, a road friction change influences lateral acceleration with 99.9% accuracy.The influencing factors that have alone a statistical significance on collision are the road friction and the vehicle velocity.The vehicle tends to leave the road if a road friction change, velocity change, or a front-right brake fault occurs.Motor faults alone do not influence any of the quantities of interest.The maximum yaw angle r max is the only QoI not influenced by any factor.The only influencing factor on the yaw angle at the end of the maneuver r end is the rear-right brake fault (RRB).Therefore, although a brake fault in the rear-right wheel does not statistically lead to a collision or the vehicle leaving the road, it does influence the vehicle's heading at the end of the maneuver.In case only RRB fault is present, the vehicle can be expected to come to a halt in a free crash situation but not facing a straight position on the adjacent lane.The vertical loads on the wheels (Fz i ) aid comprehending if a given factor leads to a significantly high load or the wheel losing contact with the ground as in [5].Varying the vehicle velocity is neither statistically significant on maximum lateral a y,max or longitudinal a x,max accelerations.It comes from the fact that either at 75 km/h or at 130 km/h, the vehicle is brought to the handling limits, and the maximum accelerations reach similar values independent from the initial velocity; therefore, via ANOVA, no significance is detected for velocity against maximum accelerations.
In terms of QoIs for critical handling and safety (C oll and L ev ), the main factors that have significant influence are road friction, velocity, and front-right brake fault (FRB).Therefore, considering a main factor, vehicle controllers for evasive lane change developed specially for fault handling must focus on one of those three factors since they directly influence the collision or leaving road behavior.
Figure 12 depicts the percentage of intersections for each group of actuator faults, road friction, and velocity, as defined in section II-F.The heatmap alone is an important source to investigate each individual factor's influence on each QoI.On the other hand, via Figure 12, it is possible to evaluate how each factor group influences the overall quantities of interest under investigation, contemplating QoIs for safety (C oll and L ev ), comfort driving and vehicle handling.
Within the heatmap, road friction has a statistically significant role in 15 of the 17 possible intersections for the road friction group.This finding indicates that road friction is the most relevant factor under investigation since it influences 88% (15 over 17) of all possible intersections within the friction group, as illustrated in Figure 12.Road friction influences both safety QoIs and the overwhelming majority of the QoIs related to comfort and vehicle handling.
The brake fault group is the second most important fault factor regarding vehicle safety and handling.From 64 possible intersections (4 factors times 17 QoIs), brake faults have a total of 23 intersections or 33% of all possible combinations.Velocity is the third most relevant factor, accounting for 23% of group intersections, followed by the  steering group with 15%.Since motors have no significance in any QoI, it has 0% intersections.Note that the sum of the percentages in Figure 12 is not 100% since the calculations do not account for the total of intersections on the heat map, but the total within each fault group, as described in section II-F.
Therefore, both the heatmap from Figure 11 and the intersection percentages in Figure 12 support the findings in this study on what are the most important factors influencing vehicle safety, handling, and behavior when in an evasive single-lane change maneuver.Considering only the main factors at a time, as indicated in Figure 12, controller designers must first consider the road friction influence to optimize the vehicle controller to handle the car under wet and iced conditions.Tackling road friction is the most prominent solution to decreasing the number of collisions, leaving the road, and, in case of focus on vehicle comfort, trying to make the ride more pleasant for the driver and passengers.Tackling brake faults is the second prominent solution to increase safety, followed by addressing controllers capable of handling the vehicle at higher velocities and steering faults.

C. TWO-FACTOR INFLUENCE
This section describes the ANOVA results for the effects of interactions between factors, e.g., the effects of a vehicle facing a front-left steering fault with the rear-right brake fault.The ANOVA hypothesis for, e.g., QoI Collision becomes: with a similar hypothesis for the other QoIs under study.The ANOVA results for collision are depicted in table 13.Due to the extension of two-factor combinations, only the interactions statistically influencing collision are shown.A total These are FLS-FLS, FLS-FRB, and FLS-RLB.Therefore, by observing the results from 1-factor and 2-factor interactions, respectively, tables 12 and 13, one can observe that, e.g., a front-left steering fault alone does not bring the vehicle to a collision.However, when a front-left steering fault occurs with an increased vehicle velocity (FLS-Velocity), the ego vehicle tends with statistical significance to a collision with the preceding vehicle.A similar observation occurs for FRS, where occurring alone does not have statistical significance to the collision.However, when a simultaneous fault occurs in front-left and front-right steering (FLS-FRS), the combination leads to a collision.The interactions of factors are fundamental to understanding the critical actuator's combination and how the actuator faults with velocity and road friction might interfere with vehicle safety and comfort.
Figure 13 depicts the ANOVA heatmap for two-factor interactions and the quantities of interest under study.A total of 48 two-factor interactions have at least one influencing QoI.If an interaction combination is not shown, it does not have statistical significance in any of the QoIs under study, e.g., FLS-RRM.
The interaction between road friction and vehicle velocity influences all the quantities of interest with statistical significance, with most of it with accuracy above 99%.In other words, combining an increase in the vehicle velocity with a decrease in the road friction leads to statistical significance to the vehicle either colliding or leaving the road, as well as strongly influencing the vehicle handling Intersection percentage of each actuator fault, road friction, velocity influencing the vehicle behavior in the single-lane change maneuver for scenarios with two-factor interactions.
and behavior from acceleration in longitudinal and lateral directions, to excessively high or low vertical loads in all the wheels.The interaction FLB-Road Friction similarly influences all the quantities of interest.From Figure 13, it is possible to observe that most of the intersections with accuracy above 99% (dark color) are related to road friction change, as for FLS-Fric., FRS-Fric., FLB-Fric., FRB-Fric., RRB-Fric., RRM-Fric., and Fric.-Vel.
Figure 14 depicts the percentage of intersections from the heatmap for each group of actuator faults, road friction, and velocity, as defined in section II-F.Road friction represents 13 of 48 two-factor interactions depicted on the heatmap.Therefore, road friction had a possible total of 221 intersections (13 times 17 QoIs).From this total, road friction combined with other J factors accounted for 150 intersections, or 67% (150 / 221) of total combinations for the group.The second most prominent group in terms of heatmap intersections is the brake fault group, influencing 49% of the total possible intersections for the group (180 over 374 possible intersections).The third, fourth, and fifth most relevant groups are, respectively, steering group (41%), velocity group (35%), and motor group (31%).
Figures 13 and 14 support this study's findings by highlighting the statistical significance factors in vehicle safety, comfort, and behavior.From two-factor interactions, it can be reported that road friction combined with any other factor is the most relevant type of scenario since when a road friction change occurs, it influences the majority of the QoIs under study.This finding is similar to when road friction is the only independent factor in the scenario, as described in section III-B.
The brake fault group is the second most important group regarding safety and handling, as it is also found when only one factor is considered (section III-B).The third group for two-factor interactions is the steering fault group, followed by the velocity and motor fault group.Therefore, motor faults are the less prominent group when evaluating vehicle safety and comfort in evasive scenarios with faults, similar to the findings for 1-factor (section III-B).
From the point of view of actuator faults, an important measure is to identify the combinations of faults that are more relevant.As depicted in Figure 15, from 180 intersections in the heatmap for the brake group, 31% occurs when brake fault is combined with road friction change, 25% with steering, 18% with a second brake fault in another wheel, 18% with velocity, and 8% with a motor fault.Therefore, Figure 15 supports the findings on identifying and classifying the most relevant brake to J factor combinations for vehicle safety, handling, and comfort.When considering a scenario in which a brake fault occurs combined with a k factor, the most relevant combination is brake -friction, and the less prominent are brake -motor faults.
Figure 16 depicts the percentage of intersections from the heatmap related to the steering fault group.As for the brake group, fault combinations with motor result in only 5% of the steering group intersections.Most intersections are related to

17.
Percentage of intersections for the motor group resulting from combinations of the motor faults with another factor.
steering -friction and steering -brake faults.In the case of analyzing the motor fault group, as depicted in Figure 17, the majority of intersections of motor fault take place for the combination motor -friction.Two motors with fault at the same time (motor -motor) only describe 8% the motor group's total heatmap intersections.

D. COEFFICIENT OF DETERMINATION
The coefficient of determination R 2 , as defined in section II-E6, defines how well the independent variable of the system (factors) can describe the variability of the dependent variable (QoI).The GLM approach for the maximum vehicle accelerations a x,max and a y,max have the highest coefficient value, with 0.98 and 0.97, respectively, as indicated in table 14.Therefore, the independent variables used in this model can explain the variability for acceleration extremely well.The safety QoIs (L ev and C oll ) have coefficient R 2 in the range from 0.87 to 0.94.Therefore, the chosen factors in the model can accurately explain the comportment of the safety QoI terms.The lower coefficient of determination is accounted for r end , r max , and ṙmax , in the range from 0.71 to 0.75.Therefore, the selected system factors can explain most of the comportment for r end , r max , and ṙmax .The most important QoI under study are the ones related to vehicle safety since they directly depict if the driver and passenger can be kept in a free-crash situation, leading to no injuries or deaths.Moreover, of 17 QoI under study, 13 have R 2 above 0.82.Therefore, the approach used in this study is adequate to describe vehicle safety, comfort, and handling.

IV. DISCUSSION
Numerous researchers have introduced novel fault detection, isolation, and identification strategies for autonomous vehicles to determine which systems are faulty, the nature of the faults, and their extent, however, they did not address how the system should manage the faults [20], [21], [22].Several other studies developed controllers that can handle faults related to actuators, positioning systems, object detection systems, other systems [10], [11], [12], [13], [14], [15], [16], [17], [18], [19].However, the area of quantifying the impact of actuator faults on vehicle behavior, especially for autonomous vehicles, has been relatively unexplored, only a few studies in the direction of this topic, as in [77] and [78].The study in [77] focused on creating a fault classification method related to the ISO 26262 controllability scale.The authors focused on non-emergency maneuvers with scenarios considering the vehicle in straight-line driving and steady-state cornering with acceleration up to 4 m/s 2 .The fault analysis included steering, brake, and motor faults.The classification of controllability was based on three parameters related to vehicle longitudinal, lateral, and yaw motion.The results indicated that the fault's controllability did not show any trend.In short, the study in [77] focused only on creating a classification method to determine how controllable the fault is.It did not indicate which faults were more critical than others or how each fault influenced the vehicle parameters.The study in [77] did not consider emergency maneuvers or over-actuated vehicles.Moreover, the methodology designed in [77] does not apply to our case.Our scenario falls in the most severe controllability level (C3) of ISO 26262 since it involves steering away from an object in the driving lane.Therefore, for all the faults investigated in this study, the methodology from [77] would classify all cases as C3.Therefore, our methodology goes beyond only controllability classification.
Another study in the area of actuator faults for autonomous vehicles focused on steering faults only, considering a scenario in which an ego vehicle makes a right turn and a fault takes place [78].The scenario considered an ego vehicle and another object at low velocity.The results indicate that the time to collision tends to reduce with a fault injection.The study, however, did not investigate brake and electric motors, the interaction of actuator faults, emergency maneuvers at high velocities, over-actuated vehicles, and how the faults influence different vehicle parameters.Therefore, to the best of our knowledge, our study is the first work that has approached the issue of quantifying the impact of faults on steering, brake, and motor actuators at the same time and evaluated their correlation with safety and different vehicle parameters.Additionally, our study has considered the interactions of faults and investigated the influence of fault with different vehicle velocities and road friction for an over-actuated vehicle performing an emergency maneuver up to 130 km/h.In this section, we discuss in detail our achievements and significant contributions to the development of fault-torelant controllers for over-actuated vehicles.
Given the complexity of futuristic autonomous vehicles comprising numerous systems, designing a fail-safe vehicle controller for every conceivable situation is nearly impractical.Hence, the significance of our study lies in its ability to determine which faults and combinations thereof are most critical to address.Our results guide the faults that upcoming robust and fault-tolerant controllers for overactuated vehicles should prioritize.
Although our study primarily focuses on a single-lane change scenario, our methodology offers detailed insights into how to investigate and ascertain the impact of system faults in various scenarios and across different vehicle types.While our focus has been on actuator faults, the methodology is versatile enough to be applied to broader system faults and modes, such as evaluating the influence of positioning system faults on automated vehicles, which are crucial for their proper operation.Recent research have proposed various methodologies for monitoring positioning information, with evaluations of vehicle behavior under positioning faults conducted under normal driving conditions in [55].A fundamental question in developing robust and fault-tolerant controllers is justifying the relevance of the focused faults, which our methodology enables.
Most existing research on vehicle controllers has been centered around normal driving conditions, often neglecting the critical aspect of emergency response.However, as fully autonomous vehicles are engineered to manage any conceivable scenario ideally, including evasive maneuvers in their operational capabilities is necessary.This study's investigation into the effects of system faults on controller performance during evasive maneuvers introduces a novel aspect to the field, moving beyond the traditional focus and addressing a required gap in autonomous vehicle research.
Evasive maneuvers are considered the last alternative to actively prevent a crash.Our study aimed to determine how a controller designed for evasive maneuvers would perform under system faults.Prior to our results, the available literature did not provide a clear understanding of which actuator faults were most significant or how they would affect a vehicle's behavior in an emergency scenario.Our findings show how road friction, vehicle velocity, and actuator fault interact with each other and influence safety and comfort parameters.
With the rise of electric vehicles, evaluating the impact of electric motor faults on vehicle behavior becomes increasingly relevant.Our results reveal an interesting observation regarding the considered fault modes: A motor fault alone does not statistically lead to a crash, leave the road, or significant changes in vehicle parameters, indicating, therefore, that the controller in [5] managed the vehicle effectively and coped well with motor faults.Among the main factors, only a brake fault led to a statistical significance on the term related to the vehicle leaving the road.
As vehicle velocity increases and road friction decreases, the criticality of maneuvers escalates due to the shortened time available for maneuvering over a fixed distance and the reduced forces at the tire-road interface.Moreover, when combined with either an increase in velocity or a decrease in road friction, the presence of actuator faults directly affects vehicle safety, handling, and comfort, as observed by comparing the heatmaps of main and two-factor interactions, Figures 11 and 13.Our findings conclusively demonstrate that road friction is the predominant factor, necessitating further scientific examination despite being intuitively evident.
In summary, any actuator faults associated with changes in friction or velocity tend to bring the vehicle to a more critical state.Moreover, our findings indicate that when two actuator faults occur simultaneously, such as faults in the front left and front right steering, the likelihood of a collision or leaving the road increases.This study enhances the understanding that single and combined faults affect vehicle behavior and safety differently.
Beyond identifying the most critical actuator faults, this study elucidates which combinations of faults significantly impact vehicle behavior, as shown in Figure 13.These insights can aid controller designers in prioritizing which faults to address based on their consequences on vehicle behavior.For instance, as Figures 14 and 15 suggest, interactions involving the brake with any other factor, particularly brake-friction and brake-steering combinations, dominate in terms of actuators' influence on vehicle parameters.Therefore, brake-friction and brake-steering combinations should be prioritized in fault-tolerant controller solutions over, for example, brake-motor interactions.We do not infer that brake-motor problems should not be addressed in faulttolerant controllers, but they are less prominent than other system faults related to brakes.The analysis of steering and motor interaction with other factors have been depicted in 16 and 17 and supports determining the most relevant fault combinations related to these actuators.
An important consideration is that despite being engineered to handle a wide range of scenarios, state-ofthe-art vehicle controllers may still experience emergency situations beyond their capability.Consequently, to maximize the benefits for society, it is necessary that advancements in active safety, such as state-of-the-art controllers, are complemented by improved passive safety systems, including restraint systems for occupants [79].Integrating active and passive strategies is essential for ensuring comprehensive protection for all road users towards zero road deaths, as the Vision Zero program aims [80].

V. CONCLUSION
In this research, we have investigated the key factors and their combinations that significantly impact the performance of an over-actuated vehicle during an evasive maneuver.These critical factors include actuator faults, specifically in the steering, electric motor, and braking systems, along with variations in road friction and vehicle velocity.Specifically, our analysis comprises scenarios with up to two concurrent actuator faults using a method designed for this purpose.
Our initial step has been involved in selecting a state-ofthe-art vehicle controller engineered to handle the vehicle at its handling limits during evasive maneuvers.It is important to note that the development of the deployed controller initially assumed that the vehicle's actuators were faultfree.The decision to investigate actuator faults came from indexing standard vehicle components and then employing failure mode effective analysis to identify those vehicle system faults most likely to lead to a high-risk priority number, which was, in turn, associated with actuators.
Aiming for vehicle actuators, we have identified the most significant actuator faults affecting vehicle performance regarding safety, comfort, and handling.The vehicle's performance was evaluated using a single-lane change maneuver in a scenario where the vehicle had to avoid a collision with a preceding vehicle within a short distance.The evaluated vehicle velocities ranged from 75 km/h to 130 km/h, and road friction from 0.3 to 1.0 (from ice to dry road conditions).The investigated scenarios fall in ISO 26262 ASIL-D, representing the highest safety integrity level.
The next step was to utilize General Linear Models (GLM) and ANOVA heatmaps to determine the impact of various factors and their interactions on vehicle performance.These tools helped us determine the influence of individual factors and their combinations on safety, comfort, and general handling.Our analysis has revealed that road friction variation is the most influential main factor, considerably affecting the vehicle's performance in all assessed areas.Consequently, this emphasizes the critical role of road friction in developing advanced vehicle controllers to enhance safety.
Among actuator faults, those affecting the braking system were found to lead to the most significant influence on the vehicle, surpassing those related to steering and the electric motor.Electric motor faults alone did not significantly impact any assessed aspect of vehicle parameters.
When factors were analyzed in combination, such as a steering fault with reduced road friction, our findings reiterated the dominant influence of road friction.Any concurrent fault significantly affected the vehicle's performance parameters in lower friction scenarios.In two-factor interactions, combinations involving brake faults emerged as particularly impactful, followed by those involving steering, velocity, and motor faults.
Our analysis of actuator faults and two-factor interactions has revealed that brake-related faults, especially when combined with reduced friction or steering faults, are most critical.Steering faults, combined with reduced friction, represent one of the most adverse scenarios for a vehicle executing an evasive lane change.This study's insights are particularly relevant in the context of future vehicle development, which increasingly tends towards over-actuated and autonomous vehicle designs.By identifying the worst-case scenarios a vehicle might encounter, including the interaction between road friction, vehicle velocity, and actuator faults, our research contributes to ranking which faults should be addressed first in developing robust and fault-tolerant controllers.These robust and fault-tolerant controllers are aimed to manage the most critical faults and their combinations, enhancing vehicle safety and handling in real-world conditions.
Our future work will focus on extending the controller used in this study and presented in [5].The aim will be to create an extension using reinforcement learning to address the faults where the original controller cannot keep the vehicle in a safe maneuver.Future research includes determining how the reinforcement learning method can be combined with classical models, such as the sliding mode control used to develop the controller in [5].In reinforcement learning, the goal is to establish an agent that takes specific actions to control the vehicle.The actions and how they are interconnected with the SMC controller's functions will be addressed in future work.The controller extension using reinforcement learning will first address the most critical fault and fault combinations described in this study.
Furthermore, future work will expand the fault analysis conducted in this study to include additional vehicle systems beyond actuators, as well as incorporating a wider variety of actuator fault types.Challenges associated with this expansion include the increased number of simulations required and the management of a significantly larger data volume.Moreover, the extension of system fault analysis will necessitate the enhancement of heatmaps to accommodate the inclusion of faults from other systems.Despite these challenges, future studies will build upon the methodology established in the current research, which itself represented a significant challenge of this work.

FIGURE 2 .
FIGURE 2. Methodology steps to identify the influence of system failures on evasive maneuvers.

FIGURE 4 .
FIGURE 4. A vehicle traveling tangentially along a circular path, with a look-ahead projection distance of d l ahead of the vehicle [5].

FIGURE 5 .
FIGURE 5. Single-lane change maneuver with the ego vehicle detecting the preceding vehicle at a distance of D d with lane width L w [5].

FIGURE 6 .
FIGURE 6. Main vehicle components, comprising sensors, embedded system and actuators.

FIGURE 7 .
FIGURE 7. Vehicle driving zones divided into: leave road, collide, and safe zone around the reference path.

FIGURE 8 .
FIGURE 8. Overall vehicle performance during an evasive lane change with an emergency evasive vehicle controller.

Figure 8
Figure 8 shows the overall vehicle performance during an evasive single-lane change for the 5061 experiments.The vehicle controller accomplished the lane change for 2005 experiments (39.6%).The controller detected the preceding vehicle at a distance of 30 meters.The TTC and TTB were accessed at the detection point, and the maneuver decision was taken following the strategy presented in section II-B.For all the velocities investigated in this study (equal to or above 75 km/h), the only possibility to avoid

FIGURE 9 .
FIGURE 9. Overall vehicle performance during an evasive lane change with an emergency evasive vehicle controller on a dry surface (µ = 1.0).

FIGURE 10 .
FIGURE 10.Lane change performance as a function of vehicle velocity on a dry surface (µ = 1.0).

FIGURE 11 .
FIGURE 11.Heatmap for the main factors vs. the quantities of interest.

FIGURE 12 .
FIGURE 12. Intersection percentage of each actuator fault, road friction, and velocity influencing the vehicle behavior in the single-lane change maneuver.

TABLE 13 .
ANOVA results for two-factor interactions for the quantity of interest (QoI) Collision.

FIGURE 13 .
FIGURE 13.Heatmap for the two-factor interactions vs. the quantities of interest.

FIGURE 15 .
FIGURE 15.Percentage of intersections for the brake group resulting from combinations of the brake faults with another factor.

FIGURE 16 .
FIGURE 16.Percentage of intersections for the steering group resulting combinations of the steering faults with another factor.

TABLE 5 .
Actuator faults and levels.

TABLE 6 .
Road friction and levels.

TABLE 7 .
Ego vehicle velocity and levels.
The selected parameters for the vehicle handling behavior are indicated in table 8.There are 17 variables as QoI.Four QoIs are related to vehicle safety, namelly C oll , L ev , B d and L d,max .Two areas of interest are ..X nβ be the negligible factors with L n1 . . .L nβ levels with β the number of factors.The total number of experiments to perform is given by N = L m L n1 . . .L nβ .▶ Full factorial design (FFD): In many cases, there are more influencing factors than one, so the RDB method can not be applied.Other techniques, such as full factorial design, allow for considering multiple influencing factors with the same degree of importance.
FFD leads to the highest number of experiments among all DOE designs.The number of experiments is given by N = γ β , with γ the number of levels per factor.FFD is

TABLE 9 .
Abbreviation for the faults in the vehicle's actuators.

TABLE 12 .
ANOVA main effects results for the quantity of interest (QoI) Collision.

TABLE 14 .
Coefficient of determination R 2 for the quantities of interest (QoI) under study.