As autonomous vehicles begin to move towards full autonomy, the controllers and software within them are becoming incredibly more complex to deal with any plausible scenario. Automotive manufacturers must balance the need for safety with the customers' desire for performance and features. A robust set of tools is a necessity to develop vehicle control protocols and navigation strategies. Vehicle to everything communication protocols and path planning are two aspects of autonomous vehicles that need a large amount of development effort. The MathWorks has put a great amount of effort in developing a robust simulation tool for autonomous vehicles. However, it currently lacks a method to develop V2X communication and path routing. In this thesis, I developed an extension for the Mathworks Simulink autonomous driving toolbox to incorporate graph-based path planning and vehicle to vehicle communication. The navigation system models each road using standard civil engineering techniques, to calculate the intersection points and bounding areas for regions of interest. Based on these regions, a directed graph is created to aid in calculating the shortest path. The navigation system also provides a redundant method for path planning for poorly marked areas and intersections. The vehicle to vehicle communication system emulates the 802.11p protocol and deals with practical challenges such as latency to provide developers with a realistic environment in which to develop vehicle communication protocols. The final result is a simulation where multiple vehicles drive safely and efficiently throughout a city network, sending messages at regions of interest and follow computed paths to their desired destinations. / Thesis / Master of Applied Science (MASc) / Vehicle to Everything communication protocols and path planning are two aspects of autonomous vehicles that need a robust framework to aid in their development. I developed an extension for the Mathworks Simulink autonomous driving toolbox to incorporate graph-based path planning and vehicle to vehicle communication. The navigation system models each road using standard civil engineering techniques, to calculate the intersection points and bounding areas for regions of interest. Based on these regions, a directed graph is created to aid in calculating the shortest path. The navigation system also provides a redundant method for path planning for poorly marked areas and intersections. The vehicle to vehicle communication system emulates the 802.11p protocol and realistic effects such as latency to provide developers with a realistic environment to develop vehicle communication protocols. The final result is a simulation where multiple vehicles drive throughout a city network, sending messages at regions of interest and follow a computed path to their desired destination.

We are currently in the midst of significant changes in the road transport system, including the transformation to fossil-free propulsion and the shift to higher levels of automation. The next level in automation is soon upon us and is encompassed by the broader term Connected, Cooperative and Automated Mobility (CCAM) which is relevant for the entire transportation system. The introduction of CCAM has the potential to contribute significantly to crucial UN Sustainable Development Goals. For the automotive domain, the term Automated Driving Systems (ADS) is often used for highly automated vehicles. Notwithstanding the expected positive effects and the extraordinary efforts, highly automated driving systems are still not publicly available except in pilot programs. The increased complexity in the higher automation levels can be ascribed to the shift from fail-safe operator support to fail-operational systems that assume the operator's role, utilising new sensors and algorithms for perception and the reliance on connectivity to solve the problem task. Here the solution is also the problem, i.e. complex systems. The complexity of the systems and difficulties in capturing a complete practical description of the environment where the systems are intended to operate pose difficulties in defining validation procedures for ADS technologies' safety, security, and trustworthiness. Parallel to traditional safety issues, there is now a need to consider the quality of cybersecurity, e.g. due to external communication and environmental sensors being susceptible to remote attacks. A security problem may enable a hacker to incapacitate or fool an ADS resulting in unsafe behaviour. In addition to malicious misuse, the development of environment sensing has to consider functional insufficiencies of the employed sensor technologies. Therefore, both safety and security and their interplay must be addressed in developing the solutions. The first step in gaining public confidence in the technologies involved is to raise user awareness. Therefore there is a need to be transparent and explicit on the evaluation targets and the associated supporting evidence of safe and secure ADS. An assessment of safety and security properties performed by an independent organisation can be an essential step towards establishing trust in ADS solutions, bridging the gap between the marketing portrayal and the actual performance of such systems in operating conditions. This licentiate thesis contributes towards the overall goal of improving the assessment target and the associated supporting evidence of a safe and secure ADS in the automotive domain by (1) assessing requirements for safety, security and their interplay on key enabling technologies, (2) introducing an argument pattern enabling safety, security and interaction overlap to be jointly addressed, (3) proposing a method that enables assessment of security informed safety an independent agency.

Yes / ISO 26262, titled Road Vehicles–Functional Safety, is the new automotive functional safety standard for passenger vehicle industry. In order to accomplish the goal of designing and developing dependable automotive systems, ISO 26262 uses the concept of Automotive Safety Integrity Levels (ASILs), the adaptation of Safety Integrity Levels. ASILs are allocated to the components and subsystems that can cause system failure and malfunctions that lead to hazards. ASILs allocation is a hard problem consists of finding the optimal allocation of safety levels to the system architecture which must guarantee that the highest safety requirements are met while development cost of the automotive system is kept minimum. There were many successful attempts to solve this problem using different techniques. However, it is worth pointing out that there is an absence of a review that provides an in-depth study of all the existing methods and highlights their merits and demerits. This paper presents an overview of different approaches that were used to solve ASILs allocation problem. The review provides an overview of safety requirements including the related standards followed by a study of the resolution methods of the existing approaches. The study of each approach provides a detailed explanation of the used methodology and a discussion of its strength and weaknesses including the main open challenges.

The development of Automated Driving Systems (ADS) has been ongoing for decades in varying levels of sophistication. Levels of automation are defined by Society of American Engineers (SAE) as 0 through 5, with 0 being full human control and 5 being full automation control. Another way to describe levels of automation is through concepts of Functional Safety (FuSa) and Operational Safety (OpSa). These terms of FuSa and OpSa are important, because ADS testing relies on both. Current recommendations for ADS testing include both OpSa and FuSa requirements. However, an examination of ADS safety requirements (e.g., industry reports, post-crash analysis reports, etc.) reveals that ADS safety arguments, in practice, depend almost completely on well-trained human operators, referred to in the industry as in vehicle fallback test drivers (IFTD). To date, the industry has never fielded a truly SAE L4 ADS on public roads due to this persistent hurdle of needing a human operator for Operational Safety. There is a tendency in ADS testing to reference International Standards Organization (ISOs) for validated vehicles for vehicles that are still in development (i.e., unvalidated). To be clear, ISOs for ADS end products are not necessarily applicable to ADS in development. With this in mind, there is a clear gap in the industry for unvalidated ADS literature. Because of this gap, ADS testing for unvalidated vehicles often relies on safety requirements for validated vehicles. This issue remains a significant challenge for ADS testing. Recognizing this gap in on-road, in-development vehicle safety, there is a need for the ADS industry to develop a clear strategy for transitioning from an IFTD (Operational Safety) to an ADS (Functional Safety). Therefore, the purpose of this thesis is to present a framework for transitioning from Operational Safety to Functional Safety. The framework makes this possible through an inductive analysis of available definitions of onroad safety to arrive at a definition that leverages Functional and Operational Safety along a continuum. Ultimately, the framework aims to contribute to onroad safety testing for the ADS industry. / Master of Science / The development of Self-Driving Cars has been ongoing for decades in varying levels of sophistication. Levels of automation are defined by Society of American Engineers (SAE) as 0 through 5, with 0 being full human control and 5 being full automation control. Another way to describe levels of automation is through concepts of Robotic Control and Human Control. If a vehicle relies completely on Human Control, a human operator is responsible for all on-road safety. On the other hand, a fully autonomous would be considered fully in Robotic Control. These terms of Robotic Control and Human Control are important, because Self-Driving Car testing relies on both. Current recommendations for Self-Driving Car testing include both Robotic Control and Human Control requirements. However, an examination of Self-Driving Cars documentation (e.g., industry reports, post-crash analysis reports, etc.) reveals that Self-Driving Car safety arguments, in practice, depend almost completely on well-trained human operators. To date, the industry has never fielded a truly SAE L4 Self-Driving Car on public roads due to this persistent hurdle of needing a human operator for Human Control. There is a tendency in Self-Driving Car testing to reference standars for validated vehicles for vehicles that are still in development (i.e., unvalidated). To be clear, standards for Self-Driving Car end products are not necessarily applicable to Self-Driving Cars in development. With this in mind, there is a clear gap in the industry for unvalidated Self-Driving Car literature. Because of this gap, Self-Driving Car testing for unvalidated vehicles often relies on documentation for validated vehicles. This issue remains a significant challenge for Self-Driving Car testing. Recognizing this gap in on-road, in-development vehicle safety, there is a need for the Self-Driving industry to develop a clear strategy for transitioning from Human Control to Robot Control. Therefore, the purpose of this thesis is to present a framework for transitioning from Human to Robot Control. The framework makes this possible through an inductive analysis of available definitions of onroad safety to arrive at a definition that leverages all definitions of Safety along a continuum. Ultimately, the framework aims to contribute to onroad safety testing for the Self-Driving industry.

Modern vehicles have electrical architectures whose complexity grows year after year due to feature growth corresponding to customer expectations. The latest of the expectations, automation of the dynamic driving task however, is poised to bring about some of the largest changes seen so far. In one fell swoop, not only does required functionality for automated driving drastically increase the system complexity, it also removes the fall-back of the human driver who is usually relied upon to handle unanticipated failures after the fact. The need to architect thus requires a greater rigour than ever before, to maintain the level of safety that has been associated with the automotive industry. The work that is part of this thesis has been conducted, in close collaboration with our industrial partner Scania CV AB, within the Vinnova FFI funded project ARCHER. This thesis aims to provide a methodology for architecting during the concept phase of development, using industrial practices and principles including those from safety standards such as ISO 26262. The main contributions of the thesis are in two areas. The first area i.e. Part A contributes, (i) an analysis of the challenges of architecting automated driving, and serves as a motivation for the approach taken in the rest of this thesis, i.e. Part B where the contributions include, (ii) a definition of a viewpoint for functional safety according to the definitions of ISO 42010, (iii) a method to systematically extract information from legacy components and (iv) a process to use legacy information and architect in the presence of uncertainty to provide a work product, the Preliminary Architectural Assumptions (PAA), as required by ISO 26262. The contributions of Part B together comprise a methodology to architect the PAA.   A significant challenge in working with the industry is finding the right fit between idealized principles and practical utility. The methodology in Part B has been judged fit for purpose by different parts of the organization at Scania and multiple case studies have been conducted to assess its usefulness in collaboration with senior architects. The methodology was found to be conducive in both, generating the PAA of a quality that was deemed suitable to the organization and, to find inadequacies in the architecture that had not been found earlier using the previous non-systematic methods. The benefits have led to a commissioning of a prototype tool to support the methodology that has begun to be used in projects related to automation at Scania. The methodology will be refined as the projects progress towards completion using the experiences gained. A further impact of the work is seen in two patent filings that have originated from work on the case studies in Part B. Emanating from needs discovered during the application of the methods, these filed patents (with no prior publications) outline the future directions of research into reference architectures augmented with safety policies, that are safe in the presence of detectable faults and failures. To aid verification of these ideas, work has begun on identifying critical scenarios and their elements in automated driving, and a flexible simulation platform is being designed and developed at KTH to test the chosen critical scenarios. / Efterfrågan på nya funktioner leder till en ständigt ökande komplexitet i moderna fordon, speciellt i de inbyggda datorsystemen. Införande av autonoma fordon utgör inte bara det mest aktuella exemplet på detta, utan medför också en av de största förändringar som fordonsbranschen sett. Föraren, som ”back-up” för att hantera oväntade situationer och fel, finns inte längre där vid höggradig automation, och motsvarande funktioner måste realiseras i de inbyggda system vilket ger en drastisk komplexitetsökning. Detta ställer systemarkitekter för stora utmaningar för att se till att nuvarande nivå av funktionssäkerhet bibehålls. Detta forskningsarbete har utförts i nära samarbete med Scania CV AB i det Vinnova (FFI)-finansierade projektet ARCHER. Denna licentiatavhandling har som mål att ta fram en metodik för konceptutveckling av arkitekturer, förankrat i industriell praxis och principer, omfattande bl.a. de som beskrivs i funktionssäkerhetsstandards som ISO 26262. Avhandlingen presenterar resultat inom två områden. Det första området, del A, redovisar, (i) en analys av utmaningar inom arkitekturutveckling för autonoma fordon, vilket också ger en motivering för resterande del av avhandlingen. Det andra området, del B, redovisar, (ii) en definition av en ”perspektivmodell” (en s.k. ”viewpoint” enligt ISO 42010) för funktionssäkerhet, (iii) en metod för att systematiskt utvinna information från existerande komponenter, och (iv) en process som tar fram en arbetsprodukt för ISO 26262 – Preliminära Arkitektur-Antaganden (PAA). Denna process använder sig av information från existerande komponenter – resultat (iii) och förenklar hantering av avsaknad/osäker information under arkitekturarbetet. Resultaten från del B utgör tillsammans en metodik för att ta fram en PAA. En utmaning i forskning är att finna en balans mellan idealisering och praktisk tillämpbarhet. Metodiken i del B har utvärderats i flertalet industriella fallstudier på Scania i samverkan med seniora arkitekter från industrin, och har av dessa bedömts som relevant och praktiskt tillämpningsbar. Erfarenheterna visar att metodiken stödjer framtagandet av PAA’s av   lämplig kvalitet och ger ett systematiskt sätt att hantera osäkerhet under arkitekturutvecklingen. Specifikt så gjorde metoden det möjligt att identifiera komponent-felmoder där arkitekturen inte var tillräcklig för åstadkomma önskad riskreducering, begränsningar som inte hade upptäckts med tidigare metoder. Ett prototypverktyg för att stödja metodiken har utvecklats och börjat användas på Scania i projekt relaterade till autonoma fordon. Metodiken kommer sannolikt att kunna förfinas ytterligare när dessa projekt går mot sitt slut och mer erfarenheter finns tillgängliga. Arbetet i del B har vidare lett till två patentansökningar avseende koncept som framkommit genom fallstudierna. Dessa koncept relaterar till referensarkitekturer som utökats med policies för personsäkerhet (Eng. ”safety”) för att hantera detekterbara felfall, och pekar ut en riktning för framtida forskning. För att stödja verifiering av dessa koncept har arbete inletts för att identifiera kritiska scenarios för autonom körning. En flexibel simuleringsplattform håller också på att designas för att kunna testa kritiska scenarios. / Vinnova-FFI funded Project ARCHER

The article identifies the challenges during the system and specifically the software development process for safety critical electro-hydraulic control systems by using the example of the hydrostatic driveline with a four speed transmission of a feeder mixer. An optimized development approach for mobile machinery has to fulfill all the requirements according to the Machinery Directive 2006/42/EC, considering functional safety, documentation and testing requirements from the beginning and throughout the entire machine life cycle. The functionality of the drive line control could be verified in advance of the availability of a prototype by using a “software-in-the-loop” development approach, based on a MATLAB/SIMULINK model of the drive line in connection with the embedded software.

FACTS - Founded in July 2008 - Meanwhile about to 250 employees. The team structure is characterized by a big number of very experienced engineers - AVL Software and Functions GmbH creates prototyping and serial solutions (software and hardware) for different applications in the fields of for example passenger cars, racing, two wheelers, light and heavy duty vehicles - AVL Software and Functions is the globally responsible competence center for software development inside theAVL group. - 100% integrated into the worldwide AVL network

This master’s thesis is focused on a design of test stand for servodrives loading. The theoretical part analyses state of art of load testing systems and describes main parts of workplaces. In the practical part is design of mechanical construction of workplace and electrical parts of machine. Master’s thesis also includes verification of properties of mechanical assembly and safety functionality verification.

This master’s thesis deals with the security machinery using available technologies. It contains a description to assess and reduce the risk of machine design of security measures and their application. In each section are provides descriptions of the standards, using the CIP Safety communication technology, design and implementation security measures of machine at two demonstration learning tasks.

FACTS - Founded in July 2008 - Meanwhile about to 250 employees. The team structure is characterized by a big number of very experienced engineers - AVL Software and Functions GmbH creates prototyping and serial solutions (software and hardware) for different applications in the fields of for example passenger cars, racing, two wheelers, light and heavy duty vehicles - AVL Software and Functions is the globally responsible competence center for software development inside theAVL group. - 100% integrated into the worldwide AVL network