�ݺ�ߣ

Autonomous Driving
provable safety and scalability design principles
Erez Dagan
SVP Advanced development and Strategy.
Mobileye, an intel company.

Automated Driving Group 2
Autonomous driving holds a promise of huge public safety and societal efficiency benefits.
However, our automated mobility solutions must be provably safe and economically-scalable to
deliver on that promise - a socially acceptable and marketable ‘drive-anywhere’ proposition.
Introduction

Introduction
Misdirected approaches to the problem may slow / altogether-risk broad adoption of AV.
Empirical safety assessment techniques are commonly used
& are inherently impractical :
• To assure societally acceptable fatality rates – one must empirically prove to well-outperform human driving.
This means collection of ~billion driving hours. (~50B KM..)
• Autonomous systems are closed-loop: Actions taken by the system - affect it’s input in the following step.
Hence, on any change of system version- all validation data must be recollected.
Brute force system design
lead to ‘ungraceful’ economical scaling of these solutions (at best).
• On-board compute requirements.
• HD maps construction methods.
• Assumed sensors requirements.

ScalabilitySafety
Driving Policy
Environment Sensing
Introduction
The following slides
1. Present a formal safety model (RSS) - enforceable on any AV driving policy module.
2. Deduce a formal disambiguation of safety-critical sensing errors from errors causing drive comfort issues.
3. Outline our architecture, leveraging RSS compliance into scalability.
RSS model
Blame semantics
1
Critical errors – safety
PAC system – comfort
Error semantics
2
Efficient Q
CV Sensing
Mapping/Fusion
action semantics
Env. model semantics
3
fused sensing system:
tractable validation
Efficient RSS compliance check

Responsibility Sensitive Safety Model
To formalize RSS , we formalize bottom up the term of “responsibility” or “Blame” - a formal description
of any (autonomous) agent safety liability.
corridor Safe longitudinal
distance
Cut in
Blame time
Blame
Exposure time
Fully visible multi-lane/agent road Occlusions (urban road )

We propose (and prove) that by applying a certain, temporally-local constraint on any policy -
It’s RSS adherence may be secured.
For that we further define :
– Default Emergency Policy (DEP) : well-specified default maneuver.
– Safe state - assures safe execution of DEP (up to our blame)
– Cautious command - if the next state it leads-to is a safe state.
And prove :
Any policy that
Secures it’s RSS into the future, accounting for any possible ‘butterfly effects’
Cautious command
Safe state
DEP
Blame
Any Policy
action
Execute action
Null?
Execute DEP
. Reject action
“Cautious”?
Estimated state
1. Executes only ‘cautious’ commands
2. Defaults to DEP when no ‘cautious’ command exist
Responsibility Sensitive Safety - put to practice

Sensing Errors : Drive Safely vs Drive Comfortably
The right measure to judge how well a sensing system approximates reality is by its impact on the policy.
We have established that any policy’s safety depends on :
(1) Rejecting non-cautious actions
(2) defaulting to DEP if no cautious action exists.
Hence, a sensing error is a defined to be safety critical - only if it leads to either:
(1) Approval of a non-cautious action. (‘miss’)
(2) Unnecessary DEP. (‘ghost’)
Sensing errors that lead to neither of the above - would merely compromise the drive-comfort.
[We further show that securing ‘semantic accuracy’ of a sensor - is sufficient for optimizing the drive comfort.]

ScalabilitySafety
Driving Policy
Environment Sensing
RSS model
Blame semantics
Error semantics
1
2
Efficient Q
action semantics
3
a
The RSS is applicable to any policy, & in particular –to ML policies.
- our efficient implementation of policies’ “cautiousness check” is publically available.
- We further share our design principle of a scalable policy.

Automated Driving Group
100,000 runs (8 agents placed randomly)
0% accidents
99.8% success
running time: 1msec per agent on EyeQ4
Double Lane Merge - ME Policy solution simulated
The double lane marge use-case very effectively captures the complexities of HW negotiations.
Our SRR-verified policy is applied – demonstrating absolute safety, and runtime efficiency

Driving policy – tackling the computational challenge
Driving policy is a choice of driving action given our perception of the environment.
At each point , the next action should be chosen by it’s long term effect.
 A computationally explosive problem, even under hard simplifying assumptions commonly used.
Common approaches to try to mitigate the problem include:
- Discretizing the actions space and simulating all possible options. STILL BIG
- Offline pre-calculation of discretized action/state combinations. STILL BIG
- Training a module to approximate the long-term effects (of each action, at each state). INHERENTLY HARD
Solution : We adopt human-like semantics:
Instead of geometric actions : “drive 13.7 meters at the current speed and then accelerate at a rate of 0.8 m/s2 ”
We formulate semantic actions: “follow the car in front of you” or “quickly overtake that car on your left”.
Our approach results in:
- Reduction of the computational complexity to a hard-upper bound, while covering the “geometric” actions-space.
- Successful learning of action impacts even further into the future.

Responsibility Sensitive Safety under occlusions
The results of applying the ‘blame’ extension to cases of occlusions induced by other vehicles.

CV Sensing
Mapping/Fusion
Env. model semantics
b
12
ScalabilitySafety
Driving Policy
Environment Sensing
RSS model Efficient Q
Blame semantics action semantics
Error semantics
1
2
3
Having Clearly identified what type of sensing errors are safety-critical ones, leads to:
- An effective & scalable perception architecture, not compromising safety aspects.
- Optimized fused-system ‘cautiousness’ check  tractable empirical validation.

Covering all Environment model elements :
1. Drivable area boundaries
2. Driving paths geometry
3. Movable obstacles
4. Semantics
Visual : Comprehensive Perception Space

Foreground Background
Appearance,
texture
Flow,
structure
visual inference redundancies
Visual : Comprehensive Perception Space

All products, computer systems, dates and figures specified are preliminary based on current expectations, and are subject to change without notice.
15
Multi sensor environment perception : safety and comfort
Camera covers:
1. Drivable area boundaries
2. Driving paths geometry
3. Road users
4. Semantics
The Perception of the environment is improved and robustified by other sensors :
a. Road users and (some) road boundaries may also be sensed by Radar and Lidar.
b. Only a dynamic updated map may faithfully convey road geometry and traffic semantics.
Any fusion of other sensors may now be designed to serve 2 well-disambiguated goals:
- “Improve” : Enhanced drive comfort
- “Robustify”: Reduction of safety critical errors
We start by reviewing our scalable mapping technology, and then discuss the fusion of map/radar/lidar.

All products, computer systems, dates and figures specified are preliminary based on current expectations, and are subject to change without notice.
1.Harvesting by Single-camera vehicles : vast device proliferation to assure extremely high refresh rates
REM: Crowd sourced mapping and localization

2.Map aggregation in the cloud : ingesting dynamic updates and auto-validation of the cured map

3.RB consumption through Self-localization

Localization and eHorizon under hard visibility
Environmental conditions - Rain

RSD
Summary
ME
cloud
1.Send Summary
2. Valuable - Yes/No?
3. Send RSD only if valuable
Summary GPS trace (one sample every 15 seconds) + metadata
(lighting conditions, visibility, speed etc.)
=
a mechanism for minimizing bandwidth costs.
Economically-aware harvesting: “data pulling” system

Road coverage rates/fleet size
A fleet of ~15K vehicles
will cover ~95% of the motorways
(road type 1) on an hourly basis.
A fleet of ~1000 vehicles
will cover ~98% of the motorways
(road type 1) on a daily basis.

Camera–REM Fusion
Producing a 3D model of the environment which preserves the natural semantic accuracy of the visual-space .

Optimizing (Fused) system safety/comfort levels
Formally disambiguating safety and comfort aspects - allows more decoupled & verifiable development.
Sensor fusion may now also be re-designed to serve 2 formally disambiguated objectives:
1. Enhanced drive comfort Improve the ‘comfort’ EM by versatile sensors synergies
2. Reduction of safety critical errors robustify the safety by redundant cautiousness-checks of the different sensors
In a Sensor Fusion setup , this disambiguation is further leveraged to make a fused system safety validation tractable :
We dramatically reduce (~square-root) the amount of data needed for reaching identical empirical safety assurances
by applying Majority function over cautiousness checks executed by 3 quasi-independent sensors.
As a result : We may assert socially acceptable levels of solution safety (1B hours MTBF) – by collection of ~100K driving hours.
Any Policy
action
Execute action
Estimated state Null?
Execute DEP
. Reject action
“Cautious”?
Cautious(camera)?
majority
Cautious(Radar)?
Cautious(Lidar)?
Estimated state - safety
comfort

• Range estimation : camera + road elevation model / depth sensors
• Road elevation model (2D3D) : optic-flow/Lidar-points on the road/ REM
•
Lane detection: camera / REM
• Free-space: camera (on-road delimiters) /depth sensors (floating objects)
Fusion synergies for drive comfort : Examples

ScalabilitySafety
Driving Policy
Environment Sensing
RSS model Efficient Q
CV Sensing
Mapping/Fusion
Blame semantics action semantics
Error semantics Env. model semantics
Summary
1. a formal safety model (RSS) - enforceable on any AV driving policy module.
2. a formal disambiguation of safety-critical sensing errors from errors causing drive comfort issues.
3. Outline of our architecture, leveraging its RSS compliance into scalability of both the sensing and the
driving policy systems.
1
2
3
https://arxiv.org/pdf/1708.06374.pdf

Autonomous Driving, provable safety and scalability design principles - Erez Dagan

�ݺ�ߣ

Autonomous Driving, provable safety and scalability design principles - Erez Dagan

Recommended

More Related Content

Similar to Autonomous Driving, provable safety and scalability design principles - Erez Dagan (20)

More from Euro NCAP (9)

Recently uploaded (20)

Autonomous Driving, provable safety and scalability design principles - Erez Dagan