[Paper Review] Kayotee: A Fault Injection-based System to Assess the Safety and Reliability of Autonomous Vehicles to Faults and Errors

Saurabh Jha, Timothy Tsai+5 more|arXiv (Cornell University)|Jul 1, 2019

Autonomous Vehicle Technology and Safety14 references33 citations

TL;DR

Kayotee is a fault-injection tool and ontology that systematically injects hardware and software faults into autonomous driving software stacks to study fault propagation, masking, and safety impacts in a closed-loop ADS environment.

ABSTRACT

Fully autonomous vehicles (AVs), i.e., AVs with autonomy level 5, are expected to dominate road transportation in the near-future and contribute trillions of dollars to the global economy. The general public, government organizations, and manufacturers all have significant concern regarding resiliency and safety standards of the autonomous driving system (ADS) of AVs . In this work, we proposed and developed (a) `Kayotee' - a fault injection-based tool to systematically inject faults into software and hardware components of the ADS to assess the safety and reliability of AVs to faults and errors, and (b) an ontology model to characterize errors and safety violations impacting reliability and safety of AVs. Kayotee is capable of characterizing fault propagation and resiliency at different levels - (a) hardware, (b) software, (c) vehicle dynamics, and (d) traffic resilience. We used Kayotee to study a proprietary ADS technology built by Nvidia corporation and are currently applying Kayotee to other open-source ADS systems.

Motivation & Objective

• Motivate safety and reliability concerns for autonomous vehicles and the need to study compute-stack resiliency beyond ML models.
• Develop Kayotee to inject transient faults into both software and hardware components of an ADS and observe safety outcomes.
• Characterize fault propagation and masking across hardware, software, vehicle dynamics, and traffic contexts.
• Provide a methodology and ontology to quantify resilience and safety violations in ADS under fault conditions.

Proposed method

• Fault injection tool (Kayotee) that can inject hardware faults (GPU/CPU architectural state) and software state errors (SLI) into ADS modules.
• Campaign manager driven by an XML configuration to select fault sites, fault types, and scenarios, plus deterministic event-driven synchronization for repeatable closed-loop runs.
• GPU fault models: bit-flips in architectural state of executing instructions, targeting registers and stored values, modeled after SASSIFI.
• SLI fault models: random, fixed, scale, disappear applied to selected ADS outputs such as object perception, lane coordinates, and control commands.
• Scenario-rich evaluation using a DriveSim-based simulation to generate and compare fault-free (golden) vs injected outputs in terms of vehicle dynamics and actuation commands.
• An ontology and IQR-based outlier labeling to distinguish activated faults, DUEs, SD Cs, and actuation-errors, connected to safety metrics such as collision-distance and stopping distance.

Experimental results

Research questions

• RQ1 Which software modules in the ADS are most vulnerable to faults/errors (e.g., object perception, localization, planning)?
• RQ2 Do errors in the ADS contribute more to degradation in safety/reliability than inherent data quality/ML inaccuracies?
• RQ3 Is there a statistical relationship between safety/resilience and input traffic characteristics under fault conditions?
• RQ4 Is there a statistical difference in error susceptibility between CPUs and GPUs?

Key findings

• Kayotee enables characterization of error propagation and masking at hardware, software, vehicle dynamics, and traffic levels.
• The framework supports injecting bit flips into GPU/CPU architectural state and corrupting ADS inputs/outputs to study resilience.
• Kayotee was demonstrated on Nvidia DriveWorks, with plans to extend to Apollo/OpenPilot and CARLA for broader applicability.
• An ontology ties fault manifestations to safety outcomes, including DUEs, SD Cs, and actuation-errors, and uses scenario-agnostic safety metrics like safety envelope breaches and lane-centering breaches.
• The authors compare Kayotee’s capabilities to prior work (e.g., AVFI) and emphasize the closed-loop, end-to-end evaluation of fault effects on ADS safety.