![\"Functional](\"https:\/\/www.jamasoftware.com\/media\/2021\/06\/2021-06-08_implementing-fuctional-safety-part-3-Freytag_1024x512.jpg\")
<\/p>\n<\/p>\n
This post on functional safety for autonomous driving is Part III in our three-part series with automotive expert Patrick Freytag. If you haven’t already, please go back and read Part I<\/a>, which talks about how the automotive sector is changing \u2013 and Part II<\/a>, which discusses ways to address functional safety.<\/p>\n Since functional safety has a product lifecycle approach, it has a wide impact on all processes in a company. As a newcomer to functional safety, it’s challenging to focus on the most important aspects, especially for new entrants in the knowledge-intensive automotive sector. Here are best practices based on my observations and experience.<\/p>\n Executive Management Team: Pay Attention to Functional Safety<\/span><\/b>\u00a0<\/span><\/p>\n Product safety should be at topic of conversation for the Executive Management Team (EMT) because of the legal responsibilities placed upon the company by deploying a vehicle to customers. The EMT should understand that it needs dedicated resources to achieve product safety. One of the most important tasks of the EMT is to implement a Safety Engineering Management<\/span> and to assure that roles and responsibilities for quality and safety are defined and communicated in the company. Members of the safety team need a specific skill set, so it is important to invest in functional safety education and qualification. It is important to foster a quality and safety culture in the company. For that reason, quality and safety should be part of goal agreement and performance evaluation. Quality and safety have to be recognized as a core responsibility and a performance indicator for employees. <\/span>\u00a0<\/span><\/p>\n Project Management: Plan and Track Functional Safety<\/span><\/b>\u00a0<\/span><\/p>\n Project management has to incorporate functional safety in the product concept and development plan. The Project Manager (PM) should consider the additional time and cost in the project plan and the project budget. Product development plans must include quality and safety milestones and the related work products. What should be done if the PM doesn’t receive proof that quality and safety milestones are reached at the gate reviews, for example? Well, that’s for sure a red flag. Situations like these may point to deeper rooted issues, and should not be brushed under the rug. The PM should start a GAP analysis and request an action plan. I recommend escalating the issue to the executive team ASAP in case there is missing proof of product safety. It won’t get better without commitment and planned actions, the longer you wait the worse the situation will get. Since safety considerations most typically permeate several layers of system design, it is not an attribute that can be tagged on shortly before the start of production, it has to be implemented from the beginning.<\/span>\u00a0<\/span><\/p>\n Development & Functional Safety Team: Implement and Validate Functional Safety<\/span><\/b>\u00a0<\/span><\/p>\n Industry experience shows that functional safety is not a topic you can assign to one responsible person. For example, a technical safety concept is created by a team of software, hardware, and system-level experts and moderated by a systems architect in collaboration with functional safety engineers. This means that the functional safety manager is a role that is played a few times in a company, while the role of a safety engineer can be assigned to even an entire team. As mentioned, functional safety requires specific domain knowledge and safety engineering expertise. But what can be done if this expertise is missing in-house? My recommendation is to compensate it with external resources as an interim solution. Start functional safety education and qualification as a long-term solution. Safety must be addressed in product development with adequate engineering methods and domain knowledge to define safety requirements. These safety requirements have to be implemented, tracked, managed, verified, and validated to make sure that risk reduction is realized, and the product is safe. <\/span>\u00a0<\/span><\/p>\n The functional safety focus is on avoiding and mitigating failures in E\/E systems. That also works well for Advanced Driver Assistance Systems (ADAS).<\/a> When a failure is detected, the driver gets alerted, and mitigation measures are performed to reach a safe state. These systems are called fail-safe. Let’s take Adaptive Cruise Control (ACC) as an example. When a failure is detected, a warning will be displayed in the Instrument Cluster. This visual warning is typically combined with an acoustical warning to get\u00a0the attention of the driver. The ACC function will be switched off, and the driver is in charge to control the vehicle’s speed and keep a safe distance again.\u00a0<\/span>\u00a0<\/span><\/p>\n The ADAS safety mechanism described above will not be sufficient for a fully autonomous vehicle. It’s not possible to switch off the automated driving system because there is no driver in the loop to take over. An Autonomous Vehicle (AV) has to work under all (failure) conditions, it has to be fail-operational. An AV without a driver in the loop also needs situational awareness, understand the surrounding world, decide, and act. This situational awareness is created by data fusion from a variety of complex sensor systems based on lidars, cameras, and radars. The combined data is then interpreted to plan and take action. This interpretation and planning are achieved by complex algorithms, driven by Artificial Intelligence (AI) and Machine Learning (ML). <\/span>\u00a0<\/span><\/p>\n Today, many connected and ADAS-equipped cars are already available. Connectivity features and information sharing are increasingly used for updating vehicle features, maintenance-related diagnostics, and traffic services. This development will also increase the attractiveness of an attack on vehicles by hackers with different motivations and it introduces additional risks for vehicle cybersecurity. <\/span>\u00a0<\/span><\/p>\n What happens if an automated driving system has no system failure but doesn’t work as intended? Unsafe behavior could be triggered by limitations in the sensor systems, extreme conditions, or unforeseen situations. In addition, misuse could confuse the AI algorithms and result in unsafe behavior too. <\/span>\u00a0<\/span><\/p>\n An example of misuse of an ADAS was showed by Consumer Reports.\u00a0<\/span>Consumer Reports<\/span><\/a> reported in April 2021 that it was able to trick a Tesla into driving in autopilot mode with no one at the wheel. Real-life proof followed in May \u2013 <\/span>Police arrested Tesla driver for operating his car from the back seat<\/span><\/a>\u00a0while traveling on a San Francisco Bay Area freeway. The officer confirmed the sole occupant was in the backseat, so he took action to stop the car and saw\u00a0the occupant move to the driver’s seat before the car stopped. In response, Tesla<\/span>\u00a0activated the c<\/span>abin camera<\/span><\/a> with a software update to detect and alert driver inattentiveness while autopilot is engaged for Model 3 and Model Y end of May.<\/span>\u00a0<\/span>\u00a0<\/span><\/p>\n
\nFunctional Safety for Autonomous Driving \u2013 Best Practices for New Market Entrants<\/span><\/b>\u00a0<\/span><\/h2>\n
T<\/span><\/b>he Evolution of Functional Safety for Autonomous Driving<\/span><\/b>\u00a0<\/span><\/h3>\n
Additional Safety Considerations for Autonomous Driving<\/span><\/b>\u00a0<\/span><\/h4>\n
Safety Concerns Due to System Limitations and Misuse<\/span><\/b>\u00a0<\/span><\/h4>\n