[Paper Review] Autonomous Vehicles Meet the Physical World: RSS, Variability, Uncertainty, and Proving Safety (Expanded Version)

Philip Koopman, Beth Osyk+1 more|arXiv (Cornell University)|Oct 31, 2019

Autonomous Vehicle Technology and Safety13 references4 citations

TL;DR

This paper extends the Responsibility-Sensitive Safety (RSS) model to address physical-world complexities in autonomous vehicles by incorporating variability, uncertainty, and dynamic changes during collision maneuvers. It introduces a Micro-Operational Design Domain (μODD) framework to subdivide operational space, enabling provable safety within defined boundaries and improving permissiveness while handling edge cases like mid-braking collisions.

ABSTRACT

The Responsibility-Sensitive Safety (RSS) model offers provable safety for vehicle behaviors such as minimum safe following distance. However, handling worst-case variability and uncertainty may significantly lower vehicle permissiveness, and in some situations safety cannot be guaranteed. Digging deeper into Newtonian mechanics, we identify complications that result from considering vehicle status, road geometry and environmental parameters. An especially challenging situation occurs if these parameters change during the course of a collision avoidance maneuver such as hard braking. As part of our analysis, we expand the original RSS following distance equation to account for edge cases involving potential collisions mid-way through a braking process. We additionally propose a Micro-Operational Design Domain (μODD) approach to subdividing the operational space as a way of improving permissiveness. Confining probabilistic aspects of safety to μODD transitions permits proving safety (when possible) under the assumption that the system has transitioned to the correct μODD for the situation. Each μODD can additionally be used to encode system fault responses, take credit for advisory information (e.g., from vehicle-to-vehicle communication), and anticipate likely emergent situations.

Motivation & Objective

• To address limitations in the RSS model when handling worst-case variability and uncertainty in real-world driving scenarios.
• To analyze how dynamic changes in vehicle status, road geometry, and environmental parameters affect collision avoidance, especially during braking.
• To extend the RSS following distance equation to account for mid-braking collision risks and edge cases.
• To propose a Micro-Operational Design Domain (μODD) framework that subdivides operational space to improve safety provability and permissiveness.
• To enable formal safety proofs by confining probabilistic uncertainties to μODD transitions and leveraging advisory data and fault responses.

Proposed method

• Extends the original RSS minimum following distance equation to include dynamic changes during braking, modeling deceleration variability and mid-maneuver collision risks.
• Introduces the Micro-Operational Design Domain (μODD) as a fine-grained subdivision of the operational design domain to isolate safety-critical conditions.
• Defines safety boundaries within each μODD, allowing formal safety proofs under the assumption of correct domain transition.
• Incorporates system fault responses, vehicle-to-vehicle (V2V) communication data, and predictive modeling of emergent situations within μODD definitions.
• Uses Newtonian mechanics to model physical interactions and identify failure modes under uncertainty and changing parameters.
• Applies a formal verification approach to ensure safety properties hold within each μODD, reducing over-conservatism in behavior.

Experimental results

Research questions

• RQ1 How can the RSS model be extended to handle worst-case variability and uncertainty during active collision avoidance maneuvers?
• RQ2 What are the physical and mechanical limitations of RSS when vehicle parameters change mid-braking, such as during hard braking?
• RQ3 How can operational space be subdivided to improve safety provability while maintaining permissiveness in autonomous vehicle behavior?
• RQ4 In what ways can μODDs be used to encapsulate probabilistic uncertainties, fault responses, and advisory data like V2V communication?
• RQ5 Can formal safety proofs be achieved under realistic assumptions by confining uncertainty to μODD transitions?

Key findings

• The extended RSS model successfully accounts for mid-braking collision risks by modifying the original following distance equation to include dynamic deceleration variability.
• The introduction of μODDs enables formal safety proofs within well-defined operational subdomains, reducing over-conservatism in vehicle behavior.
• By confining probabilistic uncertainties to μODD transitions, the framework allows for provable safety under realistic assumptions.
• The use of μODDs facilitates integration of advisory data (e.g., V2V) and fault response strategies into safety-critical decision-making.
• The analysis reveals that unmodeled parameter changes during braking can invalidate traditional RSS assumptions, necessitating dynamic modeling.
• The framework improves permissiveness by isolating complex uncertainty to domain boundaries, allowing more aggressive yet provably safe behaviors within each μODD.