The Safety Shell: A Multi-Channel Architecture for Enhanced Automated Driving

Automated Driving (AD) vehicles promise convenience and safety. However, their widespread adoption is stunted by concerns about how they will deal with unforeseen scenarios. Unforeseen scenarios may trigger Functional Insufficiencies (FIs) in e.g., the World Model (WM) or the Motion Planner (MP) functions which, in turn, lead to dangerous behavior. Despite best efforts to eliminate all FIs prior to vehicle release, the variation and the ever changing nature of public roads mean that, eventually, AD vehicles will encounter new and unknown FIs. The previously proposed methods to identify FIs during operation and mitigate their risks are limited in flexibility and effectiveness. This brings us to our first contribution, the Safety Shell, a heterogeneous multi-channel architecture. It uses a time- and risk-based arbitration strategy to assure safety while simultaneously enabling a high availability, defined as the AD vehicles ability to reach its intended destination in reasonable time. Scenario-based simulation studies show that the Safety Shell is on par or safer than alternative architectures, while while scoring 99-100% on availability if a channel is present that correctly sees the environment, as opposed to the 0-71% of alternative architectures. To show the Safety Shell's ability to deal with more complex and varied situations, more akin to public roads, we apply it with two open-source AD systems as AD channels in photorealistic simulation environments. The Safety Shell is able to use the two flawed AD systems to prevent all collisions in the executed tests, as opposed to the 15 to 95 collisions caused by the individually used open-source AD systems. In addition, the Safety Shell completes 99.9% of the routes, compared to 87.4% or 98.4% that individual channels achieve. Significant decisions that affect the feasibility of implementing a heterogeneous multi-channel architecture in an AD vehicle occur in the concept design phase. Choices are made on sensors, sensor post-processing and sensor fusion algorithms, without clear insight into the consequences of those choices. Therefore, we present a framework that provides an estimate of overall vehicle performance on safety and availability, using limited data on sensors and its intended operational design domain (ODD). We link sensors and sensor-fusion performance of the to-be-designed vehicle with encounters in the ODD, for both single- and multi-channel architectures. Next, we provide both fast analytical performance bounds and more accurate numerical estimations of vehicle performance. Finally, as AD vehicle limits are slowly loosened and their ODDs increase, chances that they will encounter unknown FIs similarly increase. Without an attentive driver to report AD vehicle misbehavior, AD developers need another way to detect potential FIs and identify probable causes. Therefore, we present our hazardous scenario identification framework, which uses Safety Performance Indicators (SPIs) to identify possible issues and uses their relations to identify probable causes. In a proof-of-concept implementation with the Safety Shell, this framework detects 86.8% of hazardous scenarios, providing a low-computational-cost, easy to use and insightful way to detect emergent issues. Throughout these works, we focused both on safety and practical implementation aspects. In doing so, the works presented in this thesis present a meaningful contribution to the state of the art, reflected by the peer-reviewed and accepted nature of various publications included herein.