Search

Co-working and interaction of automated systems and humans in a warehouse is a significant challenge of progressing industrial systems’ autonomy. Especially, blind corners pose a critical scenario, in which infrastructure-based sensors can provide more safety. The automation of vehicles is usually tied to an argument on improved safety. However, current standards still rely on the awareness of humans to avoid collisions, which is limited at corners with occlusion. Based on the examination of blind corner scenarios in a warehouse, we derive the relevant critical situations. We propose an architecture that uses infrastructure sensors to prevent human-robot collisions at blind corners with respect to automated forklifts. This includes a safety critical function using wireless communication, which sporadically might be unavailable or disturbed. Therefore, the proposed architecture is able to mitigate these faults and gracefully degrades performance if required. Within our extensive evaluation, we use a warehouse simulation to verify our approach and to estimate the impact on an automated forklift’s performance.

Rising automation levels in the automotive domain demand a shift from the fail-safe to the fail-operational paradigm. Fail-operational architectures and behaviors are inherently more complex and thus require special diligence from a safety engineering point of view. In this work, we present how we tailored and applied a methodology that facilitates the design of fail-operational architectures from early design stages on by enabling informed judgment regarding the gradually evolved architecture's fitness for purpose. The method specifically considers resilience regarding dynamic changes in environmental conditions, including V2X aspects and internal capabilities. In this paper, we summarize our experiences in applying the methodology in a highway pilot case study. Furthermore, we present essential extensions of the methodology for modeling and evaluating the operational design domain.

An autonomous driving system requires the safety and availability of automated driving. For example, an autonomous driving system with automation level 3 requires the functions to request the driver to take over driving and to sustain safe automated driving until the driver accepts the request if a hardware failure occurs. However, there is a demand to continue automated driving if the system maintains sufficient performance for automated driving after the failure occurs. Therefore, we propose a graceful degradation design process to improve the automated driving continuation rate by defining degradation functions against performance limitation and hardware failure. The process integrates and extends ISO/PAS 21448 and ISO26262 and carries out these tasks in the order of system-level, ECU-level, and microcontroller-level degradation design. Furthermore, we propose a framework to calculate worst-case mode switch time (WCMST), which means the time duration from failure detection to degradation processing, by utilizing degradation design results. To evaluate the proposed process and framework, we applied them to the prototype system with automation level 3. The evaluation results showed that the designed system can sustain automated driving against 86.1% of performance degradation factors and that the framework can improve the calculation accuracy of WCMST by 35.3%.

Highly automated and autonomous driving is a major trend and vast amounts of effort and resources are presently being invested in the development of corresponding solutions. However, safety assurance is a concern, as established safety engineering standards and methodologies are not sufficient in this context. In this paper, we elaborate the fundamental safety engineering steps that are necessary to create safe vehicles of higher automation levels. Furthermore, we map these steps to the guidance presently available in existing (e.g., ISO26262) and upcoming (e.g., ISO PAS 21448) standards and point out open gaps. We then outline an approach for overcoming the identified deficiencies by integrating three different safety engineering disciplines. This includes (1) creating a safe nominal behavior specification; (2) dealing with functional insufficiencies, and (3) assuring the related performance wrt. functional safety. We exemplify our proposed methodology with a case study from industry.