Safety Assessment of Automated Vehicle Functions Using Simulation-Based Fault Injection

Abstract: With the development of automated vehicles, ensuring vehicle safety in the event of faults has become increasingly important. This article proposes a simulation-based fault injection method (Sabotage) to complement traditional safety analysis methods at the concept phase of ISO 26262, obtaining failure impacts based on test data and refining safety objectives and safety requirements. This method is then applied to the safety analysis of the lateral control system of automated vehicles, deriving the impacts of faults that occur in its model, obtaining the fault tolerant time interval (Fault Tolerant Time Interval, FTTI) based on maximum lateral error and steering saturation*, and deducing safety objectives and safety requirements.

*Steering saturation: refers to the inability to continue turning once the steering control reaches saturation.

1. Control Architecture of Automated Vehicles

• Behavior planning: selecting the best path based on vehicle behavior (such as lane keeping, lane changing, or obstacle avoidance).

• Trajectory control: calculating and maintaining the vehicle on the correct trajectory through control algorithms.

• Steering: controlling the steering wheel to ensure the vehicle follows the planned path, with inputs from the trajectory control module’s correction values.

Figure 1: Sabotage: Simulation-based Fault Injection Framework

Step 1: Identify failure modes. First, the main functions and failure types of the relevant items must be known. Then, correctly identify functional failure modes to obtain data regarding their impacts (at the system/vehicle level). This means that if these failure modes are defined at the system level, their impacts will be reflected at the vehicle level. These faults/failure modes are associated with general fault models (Omission, Frozen, Delay, Invert, Oscillation, Random) stored in a common fault model library. These general fault models are preset and are specific fault models for simulating any component/system functional failure modes.

Step 2: Configure fault injection tests. After preliminary analysis of the system, fault injection tests must be configured as part of the workload generator, which includes setting up tests and driving scenarios, as well as generating a list of faults:

• Objective: Where to inject faults?

• Fault model: What is the best fault model representing the functional failure mode?

• Trigger: How to trigger the fault in the system?

• What are the observation points for fault impacts?

• How to define the conditions under which the vehicle loses its controllability?

For each fault the user wants to inject, the fault list must clearly specify the involved fault model, target signal (fault localization), fault trigger conditions based on time or path position coordinates (X,Y), and fault duration. This information forms the basis for generating the fault injector (Saboteur). The fault injector is a component added to the system behavior model for fault injection. Each time a target signal is generated, a fault is injected.

The test configuration includes the selection of the vehicle and the definition of operational situations:

• Location: highway, city;

• Road conditions: uphill, curve;

• Environmental conditions: good, heavy rain;

• Traffic conditions: smooth;

• Vehicle speed;

• Behavior: stopping, overtaking, lane keeping;

• Potential risk participants: driver, passengers, pedestrians;

The test scenarios are selected by the scenario configurator based on previously defined operational conditions to load the best driving scenarios into the Dynacar platform (a real-time vehicle dynamics simulation system).

Step 3: Create the Faulty System Under Test. For this, the fault injector module creates fault generator code based on the information from the fault list and general fault model templates. This process can be automated based on data from libraries and lists.

Step 4: Compare the simulation results of the faulty system with those of the fault-free system, analyze the fault impacts, and derive appropriate safety objectives and safety requirements.

Figure 2: Fault-Error-Failure Chain and Definition of FTTI

3. Safety Assessment of the Lateral Control System

1. Obtaining impact data for specific faults at the vehicle and relevant item levels based on fault injection simulation results.

2. Completing safety analysis: determining safety objectives (including FTTI values and safety states), functional safety requirements, and safety concepts.

As stated in Chapter 2, the application premise of the method proposed in this article is to clarify the functions and failure types of relevant items in the definition process of ISO 26262: lateral control relevant items can be decomposed into multiple functions and sub-functions, with failures including: steering (Omission, Commission), trajectory control (Omission or Commission), behavior planner (unnecessary local planning, unnecessary perception, unnecessary decision-making).

The FI simulation test conducted in this study involved a vehicle traveling at a constant speed of 45 km/h with the lane-keeping function activated in a smoothly flowing urban environment. When the vehicle was navigating a curve, faults were triggered, replicating functional failure modes related to differential GPS (DGPS) and the steering system. The fault list set in the experiment is shown in Table 1.

Table 1: Example Fault List*

Following the steps outlined in Chapter 2, the fault generator automatically injects faults based on the previously established fault list. To generate the most severe impact, these faults are triggered at several curve points to achieve the most significant effect. Since the primary objective of our simulation is to calculate the FTTI value for lateral control, the observed signals are lateral error and steering saturation. Figure 3 depicts the calculation principle of FTTI for steering control.

Figure 3: Calculation Principle of FTTI

The maximum lateral error, defined by the following formula, serves as the standard for system loss of control:

Table 2 describes the hazard identification information obtained from the FI-based simulation results. Using general fault models to model failures at different relevant item levels, we can measure their impacts at the vehicle level and the resulting hazardous behavior.

Table 2: Impact of Vehicle-Level Failures

Based on Table 2 and simulation test data, partial results of the hazard analysis and risk assessment can be derived, as shown in Table 3, which includes the most severe failure modes (represented as fault models) for specific functions calculated based on Figures 2 and 3. The fault duration is the time taken to handle the fault appropriately (transitioning to a safe state). For example, failures related to the trajectory controller can exist in the system for 400 ms before a hazard event occurs: 240 ms for detection and reaction, and 160 ms for controlling the fault, thus not violating safety objectives. The specific safety objective definitions in Table 3 are shown in Table 4.

Table 5: Safety Requirements

4. Conclusion

This article introduced a simulation-based fault injection method for assessing the safety of automated vehicle functions and applied this method to a case of urban vehicles embedded with automated lateral control functions. The focus was on determining the FTTI values of permanent faults based on maximum lateral error and steering saturation. One of the main advantages of the proposed method is that it can serve as a supplementary safety analysis method, achieving an ISO 26262 compliant safety assessment process.