Safety Assessment of Autonomous Driving Functions: Fault Injection Simulation Testing

How to Know, How Can One Not Know

Article from: Ranyun Automobile (ID: BC-Auto2018)

As we entered 2018, the autonomous driving industry began to focus on commercialization issues. The application of any new technology, including autonomous driving, must meet two conditions: (1) a business model that creates value; (2) sufficient technological maturity.

Regarding the first point, there is little doubt in the industry, so the focus is on technological maturity.

There are many technical indicators for evaluating autonomous vehicles, with the most attention currently on safety, cost, and operational scope (the ODD in the L1-L5 classification). These three indicators are interrelated; for example, a smaller operational scope often means simpler application scenarios, lower costs, and higher safety, and vice versa. Therefore, the competitive focus is on who can provide safer and lower-cost solutions over a larger operational range or provide the core components that support such solutions.

Currently, autonomous driving technology in parks or indoor environments has become increasingly mature, while fully autonomous driving technology on open roads, especially in urban environments, is still in the research and testing phases. There are indeed perception-level issues; the current sensors still need improvement in detecting pedestrians, animals, and other targets on open roads. However, another easily overlooked issue is the difficulty of positioning. Within a small, fixed area, positioning issues can be resolved through infrastructure modifications and SLAM technology; indoors, UWB positioning can achieve centimeter-level accuracy. However, designing a vehicle that can autonomously drive over a larger range presents a challenge for high-precision positioning.

For an autonomous vehicle, high-precision positioning has two meanings:

(1) obtaining the relative position between the vehicle and the surrounding environment, i.e., relative positioning; (2) obtaining the precise latitude and longitude of the vehicle, i.e., absolute positioning.

At this point, many people’s first reaction is that when they drive, they never know their latitude and longitude. Why must autonomous vehicles achieve absolute positioning? The essential reason lies in the differences in environmental perception capabilities. Humans can accurately determine the drivable areas, road boundaries, lane markings, obstacles, and traffic rules using just their eyes (and some memory and knowledge), thus safely controlling the vehicle. However, the sensors and post-processing algorithms designed by humans currently cannot achieve the same level of performance. Therefore, autonomous vehicles require the assistance of technologies such as high-precision maps and joint perception to understand their surrounding environment. High-precision maps can inform vehicles of road information described by latitude and longitude, collected in advance by mapping vehicles, while all vehicles can broadcast real-time perceived dynamic obstacle information, also described by latitude and longitude, to surrounding vehicles. The combination of these two technologies can significantly enhance the safety of autonomous vehicles, thus expanding their operational range. The reason for using latitude and longitude to describe this information is that different vehicles, including mapping vehicles that collect high-precision maps, must use the same observational coordinate system to share observational information, and the most universally used observational coordinate system in the world is defined by latitude and longitude, which is where the demand for absolute positioning arises.

As we know, GPS can provide vehicles with meter-level absolute positioning accuracy, while differential GPS or RTK GPS can provide centimeter-level absolute positioning accuracy. However, not all road sections can receive good GPS signals at all times. Therefore, in the field of autonomous driving, the output of RTK GPS generally needs to be fused with IMU and the vehicle’s own sensors (such as wheel speed sensors, steering angle sensors, etc.). Here, IMU stands for Inertial Measurement Unit, which typically consists of gyroscopes, accelerometers, and algorithm processing units, measuring acceleration and rotation angles to derive the vehicle’s motion trajectory. The system that combines traditional IMU with algorithms that fuse information from the vehicle body, GPS, and other sources is referred to as a generalized IMU for autonomous driving.

Safety Assessment of Autonomous Driving Functions: Fault Injection Simulation Testing

Figure: One installation method of IMU in autonomous vehicles

Strictly speaking, IMU only provides relative positioning information, which is the motion trajectory and posture of the vehicle relative to a starting position from a certain moment. However, by fusing the relative positioning of IMU with the absolute positioning of RTK GPS, two irreplaceable advantages emerge:

(1) IMU can verify the internal consistency of RTK GPS results and filter and correct absolute positioning data that cannot be consistent. A simple example is that if the RTK GPS outputs a significant change in the vehicle’s absolute position in a short time, it indicates that the vehicle has a large acceleration. If the IMU detects that the vehicle does not exhibit such acceleration, it indicates that there is an issue with the RTK GPS positioning, and the IMU should take over the absolute positioning system; (2) IMU can still provide sub-meter-level positioning accuracy for several seconds after the RTK GPS signal disappears, giving autonomous vehicles valuable time for anomaly handling. Similarly, if relative positioning fails, IMU can perform trajectory extrapolation to maintain relative positioning accuracy for a period; for example, if the lane marking recognition module fails, based on the road information perceived before the failure and the IMU’s trajectory extrapolation, the vehicle can continue to drive within the lane.

Safety Assessment of Autonomous Driving Functions: Fault Injection Simulation Testing

Figure: The role of IMU in absolute positioning

In this figure, the autonomous vehicle enters an area with tall buildings and loses satellite signals, unable to obtain absolute positioning from GPS. At this point, IMU can perform its role in maintaining absolute positioning, providing the vehicle with absolute positioning information in areas without GPS signals, including the vehicle’s real-time latitude, longitude, and altitude.

Safety Assessment of Autonomous Driving Functions: Fault Injection Simulation Testing

Figure: The role of IMU in relative positioning

In this figure, the autonomous vehicle ensures it is driving on the road through lane marking recognition. When encountering intense sunlight, the lane marking recognition function fails. At this point, IMU can maintain relative positioning by using historical road curvature and the vehicle’s historical position relative to the lane boundary, ensuring the vehicle continues to drive within the lane for a period.

Currently, there is not much discussion about the behavior of autonomous driving systems when certain functional units fail, but a basic consensus is that slow failure of functional units is safer than sudden failure, and warned failure is safer than unconscious failure. When used in conjunction with other relative or absolute positioning systems, IMU ensures that even if the positioning system fails, it is a slow, predictable process.

Here is a specific example to illustrate the importance of slow and warned failure of functional units. Suppose an autonomous vehicle is driving on a road with lane markings, and its determination of the road boundary is obtained through the fusion of high-precision maps and lane marking recognition systems, where high-precision maps must be used in conjunction with high-precision positioning (we temporarily do not consider high-precision maps with road fingerprints). The vehicle then enters an area with tall buildings, losing GPS signal, and the IMU takes over absolute positioning while providing relative positioning for that time and place. The lane marking recognition system has a 1% probability of completely failing to detect any lane markings or road boundaries. In 99% of normal cases, the vehicle can switch to lane-keeping or ACC mode for safe driving. In the 1% corner case, the vehicle can safely decelerate or stop based on the IMU’s relative and absolute positioning information, combined with previously perceived lane marking information and high-precision maps, and prompt human intervention for driving, ensuring safety throughout the process. Conversely, if the vehicle did not have the IMU, there would be a 1% probability of not obtaining the vehicle’s position relative to the lane markings and road boundaries, and the vehicle would become a blind driver at high speed, with a risk of collision even during emergency braking. In practical systems, high-precision maps can provide absolute positioning through signs, road fingerprints, etc., and lane marking recognition can be based on various sensors, which significantly reduces that 1% collision probability by several orders of magnitude. However, this is still far from sufficient for passenger and commercial vehicles in high-speed scenarios. Regardless of how low this probability is, a technology is needed to handle extreme conditions under this probability, meaning there must be a final safety defense line.

Why is the final defense line in the field of positioning for autonomous driving systems the IMU, rather than other technologies? There are three main reasons. First, the IMU’s derivation of relative and absolute positions has no external dependencies and is a complete system similar to a black box; in contrast, GPS-based absolute positioning relies on satellite signal coverage, and high-precision map-based absolute positioning relies on the quality of perception and algorithm performance, which is subject to weather conditions and has certain uncertainties. Second, because the IMU does not require any external signals, it can be installed in non-exposed areas of the vehicle chassis, making it resistant to external electronic or mechanical attacks. In contrast, visual, laser, and millimeter-wave sensors that provide relative or absolute positioning must receive electromagnetic or light signals from outside the vehicle, making them vulnerable to interference from attackers’ electromagnetic waves or strong light signals, and susceptible to damage from stones, scrapes, and other accidents. Third, the measurements of angular velocity and acceleration by the IMU inherently have a certain redundancy, and combined with redundant information from wheel speed sensors and steering angle sensors, the confidence level of its output results is much higher than that of other sensors providing absolute or relative positioning results.

Of course, the IMU also has its limitations, mainly being expensive. Currently, the mainstream IMUs capable of providing lane-level positioning within 10 seconds after GPS loss are priced around 200,000 yuan and are all imported, becoming another cost bottleneck for autonomous vehicles besides lidar. Fortunately, domestic startups are already working on developing IMUs with independent intellectual property rights specifically for autonomous driving, with hopes of reducing costs to below 10,000 yuan while maintaining accuracy.

When the era of autonomous driving arrives, high-precision maps and high-precision positioning will become important configurations for high-level intelligent connected vehicles, and high-precision IMUs will grow into a market worth hundreds of billions.

In the complex and unpredictable conditions of autonomous driving, the IMU, with its extremely high confidence, complete independence from external dependencies, and strong anti-interference capabilities, serves as a stabilizing force, providing the last line of safety assurance for the positioning system of autonomous driving.

Notify(Click the image for details)

Safety Assessment of Autonomous Driving Functions: Fault Injection Simulation Testing

Safety Assessment of Autonomous Driving Functions: Fault Injection Simulation Testing

Automotive Technology New Media Matrix

Knowledge of Cars · Knowledge of New Energy Vehicles

Knowledge of Automotive HR · Knowledge of Autonomous Driving

Knowledge of Automotive Finance · Knowledge of Automotive Lightweighting

Safety Assessment of Autonomous Driving Functions: Fault Injection Simulation Testing

| News | Knowledge | Experience |

Long press the QR code to follow

Leave a Comment