Use of external data to increase safety in the automated vehicle

However, the perspective of the considered highly automated vehicle, also called ego vehicle, is limited because the sensors capture the outside world mainly from the point of view of this vehicle. These sensors have inherent restrictions, e.g., weather conditions, complex traffic situations or potential malfunctions in form of SOTIF errors (Safety Of The Intended Functionality). Including data from close sources with different perspectives will very likely improve the accuracy of the environmental model.

In this context, it is important to differentiate between three different perception areas: Close range, mid range and the areas outside the sight lines.

• Close range:

The close range refers to objects that are in immediate vicinity of the ego vehicle. Detecting and capturing these objects in their entirety presents a particular challenge, as their size or shape extends beyond the direct field of view of the sensor in the vehicle. Therefore, improved high-precision object recognition at close range is an important goal for highly automated driving systems.

• Mid range and far range:

The objects in the mid and far range of the ego vehicle can be more easily recognized in their entirety by the sensor. Depending on the sensor technology, other problems can occur such as fake echoes or weather-related fuzziness. A local approach to minimize these effects is the sensor fusion of different sensor technologies within a vehicle.

• Outside the visible range:

The sensor technologies in the ego vehicle do not work on objects that are near but outside the visible range: Outside the visible range can mean that objects are located behind trucks or buses, behind corners of buildings or behind vegetation (e.g., median strip with shrubs), whereas, depending on the sensor type, differences in visibility can occur.

To address these problems, the exchange of sensor data between vehicles (V2V) as well as between vehicles and infrastructure (V2I) could be used. Still unsolved in this context is the question of reciprocal trust and the quality of data from these external sources.

Vehicle manufacturers are required to demonstrate the functional safety of their vehicles, the corresponding sensors/devices and the automated driving systems. Relying on external sensor data contradicts this requirement because the quality of the data, the circumstances of its collection and the devices or algorithms used are unknown to the receiving ego vehicle.

In this article, a method is suggested how to improve the environmental model of vehicles using external data without increasing the risk to the functional safety by inferior quality external data. First, the two concepts "Local Dynamic Map" as a form of the environment model and "Confidence Level" as a measure of trustworthiness are explained. Afterwards, the method is presented using these concepts.

The LDM is a data storage device in the vehicle that contains topographic, position and status information about objects in a geographic area around the vehicle. The LDM consists of static parts such as a high resolution map, semistatic parts such as road works or weather conditions and dynamic parts such as other vehicles, cyclists or pedestrians (ETSI EN 302 895 - Local Dynamic Map (LDM).

In the context of this article, we define the CL as the percentage of probability that the real object has the same properties as the corresponding representation in the LDM. Roughly sketched, this mechanism assigns a CL to each object in the LDM as a property. For example, a traffic light from the HD card could receive CL=90% if specified, while road works, the information about which is provided by local authorities, would receive CL=70%. The CL value of internal data could be derived from the Automotive Safety Integrity Level (ASIL) of the providing function. A trusted internal source could also provide a CL for a data object in which other conditions (e.g., weather) are considered.

Basically, a distinction can be made here between

• the confidence level of a source and
• the confidence level of received data.

For unknown sources, ASIL and data collection conditions are unknown. In the automotive industry, discussions about protocol extensions for properties describing the trustworthiness of exchanged data are still at an early stage. Such a protocol extension could include the CL for the external source and/or data.

Using data from external, unknown sources is a challenge for the ego vehicle. Classification of the information source helps to determine the initial CL:

• An authorized, static object such as a traffic light or sign: The source identifies itself as an official object and the properties of the source match the HD card, for example. Therefore, this source's reporting of the status of the traffic light or the current speed limit of an electronic sign could receive a high CL value of 90%.
• An authorized but more dynamic object such as a moving traffic light or sign, such as those used at road works, could receive a lower CL.
• Unknown sources such as other vehicles receive a very low CL.

By default, the ego vehicle classifies the data from the external source with the same CL as the source itself.

We recommend the following strategy when dealing with external data and differentiate the following instances:

• The external data corresponds to entries in the LDM: The object identified by an external source has the same properties as the corresponding object in the LDM of the ego vehicle (e.g., same position, same direction of motion etc.). On the one hand, the ego vehicle can assume that the external data is correct and has a certain quality. On the other hand, the external data confirm the properties of the already recognized object. This allows the ego vehicle to gain greater confidence in both its own and external data, which has the following implications:
  • The CL of the object in its own LDM is increased.
  • The CL of the external source is increased.
• The external data contradict entries in the LDM: The external data differs from the LDM of the ego vehicle in that either objects are displayed, which are not present in the LDM, or by the absence of objects, which should actually exist according to the LDM. From this, the vehicle will derive a lower trust in its own data and external data:
  • The CL of the object in its LDM is reduced (if it exists).
  • The entire CL of the external source will be downgraded, or the source will be excluded from the evaluation in the future.
• External data shows objects outside visible range: When external data identify objects outside the visible range of the ego vehicle, the CL for these objects is determined in accordance with the CL of the external source:
  • When the external source identified other objects, which match the LDM, the CL could be relatively high.
  • When different external sources display the same object outside the visible range, the CL is equally increased.
  • When the external data does not match the data of the LDM or data from other external sources, the CL value for the affected objects outside the visible range should be rather low or equal to zero.

With this strategy, the ego vehicle could use external data from source with low or unknown ASIL to improve its own LDM without compromising the functional safety of the system. The strategy allows external data to be classified either by application context (traffic lights) or by the degree to which it matches the LDM of the ego vehicle. The influence of a single external source on the LDM turns out to be small, but the reliability of the LDM increases enormously as soon as many external sources surround the ego vehicle.

The described strategy could also be used if data transfer protocols include properties to describe trustworthiness in the future. It enables the ego vehicle to detect misbehaviour of external sources so that it can take appropriate action.

The experts from msg specifically address your individual needs.

Our extensive know-how in systems engineering (architecture, safety, security) and testing of modern highly distributed vehicle architectures enables successful and comprehensive support in the area of cloud-based remote ADAS solutions as well as in designing and securing these functions for the realization of autonomous driving.

We bring our extensive machine learning and analytics expertise to bear on the analysis of the extensive data sets generated in the process to safeguard the driving functions.