Adaptive cruise control (ACC), a driver assistance system that controls longitudinal motion, has been introduced in consumer cars in 1995. A next milestone is highly automated driving (HAD), a system that automates both longitudinal and lateral motion. We investigated the effects of ACC and HAD on drivers' workload and situation awareness through a meta-analysis and narrative review of simulator and on-road studies. Based on a total of 32 studies, the unweighted mean self-reported workload was 43.5% for manual driving, 38.6% for ACC driving, and 22.7% for HAD (0% = minimum, 100 = maximum on the NASA Task Load Index or Rating Scale Mental Effort). Based on 12 studies, the number of tasks completed on an in-vehicle display relative to manual driving (100%) was 112% for ACC and 261% for HAD. Drivers of a highly automated car, and to a lesser extent ACC drivers, are likely to pick up tasks that are unrelated to driving. Both ACC and HAD can result in improved situation awareness compared to manual driving if drivers are motivated or instructed to detect objects in the environment. However, if drivers are engaged in non-driving tasks, situation awareness deteriorates for ACC and HAD compared to manual driving. The results of this review are consistent with the hypothesis that, from a Human Factors perspective, HAD is markedly different from ACC driving, because the driver of a highly automated car has the possibility, for better or worse, to divert attention to secondary tasks, whereas an ACC driver still has to attend to the roadway.

/pdf/effects-of-adaptive-cruise-control-and-highly-automated-zm9ko1q3vg.pdf

Effects of adaptive cruise control and highly automated driving on workload and situation awareness: A review of the empirical evidence

Design and Analysis ofFault-Tolerant Digital Systems: B. W. JOHNSON (Addison Wesley, 1989,577 pp., £41.35) The book provides an introduction to the important aspects of designing fault-tolerant systems, and an evaluation of how well the reliability goals have been achieved. The book is mainly oriented towards a final year undergraduate course on fault-tolerant computing, primarily with an implementation bias. In chapters 1 and 2, definitions and basic terminology are covered, which sets the stage for the remaining chapters, and provides the background and motivation for the remainder of the book. Chapter 3 provides a thorough analysis of fault-tolerance techniques and concepts. This chapter in particular is remarkably well written, covering the issues of hardware and information redundancy, which form the mainstay offault-tolerant computing. Subsequent chapters on the use and evaluation of the various approaches illustrate the principles as they have been put into practice. At the end of chapter 5, small projects that allow the reader to apply the material presented in the preceding chapters are included. The resurgence of interest in fault-tolerance with the emergence of VLSI is the theme of chapter 6, focussing on designing fault-tolerant systems in a VLSI environment. The problems and opportunities presented by VLSI are discussed and the use of redundancy techniques in order to enhance manufacturing yield and to provide in-service reliability are reviewed. The final chapter covers testing, design for testability and testability analysis, which must be considered during each phase of the design process to guarantee that resulting designs can be thoroughly tested. Each chapter is followed by a summary of the key issues and concepts presented therein, and a separate list of references, which makes it easily readable. In addition, there is a reading list with more comprehensive and specialised references devoted to each chapter. Overall, the book is well written, and contains a great deal of information in 577 pages. The book has a definite implementation bias, and draws considerably on the author's experience in industry, particularly reflected in the projects accompanying chapter 5. The book should be a useful addition to a library, and a suitable text to accompany a lecture course on fault-tolerant computing. R. RAMASWAMI, Department ofComputation, UMIST

Book Review: Design and Analysis of Fault-Tolerant Digital SystemsDesign and Analysis of Fault-Tolerant Digital Systems: JohnsonB. W. (Addison Wesley, 1989, 577 pp., £41.35)

The injection of faults has been widely used to evaluate fault tolerance mechanisms and to assess the impact of faults in computer systems. However, the injection of software faults is not as well understood as other classes of faults (e.g., hardware faults). In this paper, we analyze how software faults can be injected (emulated) in a source-code independent manner. We specifically address important emulation requirements such as fault representativeness and emulation accuracy. We start with the analysis of an extensive collection of real software faults. We observed that a large percentage of faults falls into well-defined classes and can be characterized in a very precise way, allowing accurate emulation of software faults through a small set of emulation operators. A new software fault injection technique (G-SWFIT) based on emulation operators derived from the field study is proposed. This technique consists of finding key programming structures at the machine code-level where high-level software faults can be emulated. The fault-emulation accuracy of this technique is shown. This work also includes a study on the key aspects that may impact the technique accuracy. The portability of the technique is also discussed and it is shown that a high degree of portability can be achieved

Emulation of Software Faults: A Field Data Study and a Practical Approach

Autonomous Vehicle technology is quickly expanding its market and has found in Silicon Valley, California, a strong foothold for preliminary testing on public roads. In an effort to promote safety and transparency to consumers, the California Department of Motor Vehicles has mandated that reports of accidents involving autonomous vehicles be drafted and made available to the public. The present work shows an in-depth analysis of the accident reports filed by different manufacturers that are testing autonomous vehicles in California (testing data from September 2014 to March 2017). The data provides important information on autonomous vehicles accidents' dynamics, related to the most frequent types of collisions and impacts, accident frequencies, and other contributing factors. The study also explores important implications related to future testing and validation of semi-autonomous vehicles, tracing the investigation back to current literature as well as to the current regulatory panorama.

/pdf/examining-accident-reports-involving-autonomous-vehicles-in-1gknz8ht0n.pdf

Examining accident reports involving autonomous vehicles in California.

| All drivers have habits behind the wheel. Different drivers vary in how they hit the gas and brake pedals, how they turn the steering wheel, and how much following distance they keep to follow a vehicle safely and comfortably. In this paper, we model such driving behaviors as car-following and pedal operation patterns. The relationship between following distance and velocity mapped into a two-dimensional space is modeled for each driver with an optimal velocity model approximated by a nonlinear function or with a statistical method of a Gaussian mixture model (GMM). Pedal operation patterns are also modeled with GMMs that represent the distributions of raw pedal operation signals or spectral features extracted through spectral analysis of the raw pedal operation signals. The driver models are evaluated in driver identification experiments using driving signals collected in a driving simulator and in a real vehicle. Experimental results show that the driver model based on the spectral features of pedal operation signals efficiently models driver individual differences and achieves an identification rate of 76.8% for a field test with 276 drivers, resulting in a relative error reduction of 55% over driver models that use raw pedal operation signals without spectral analysis.

Driver modeling based on driving behavior and its evaluation in driver identification : Analysis of car-pedal use and car-following habits may allow the help offered by intelligent driver assistance systems to be customized for individual drivers

We present a new fault injection tool called GOOFI (Generic Object-Oriented Fault Injection). GOOFI is designed to be adaptable to various target systems and different fault injection techniques. The tool is highly portable between different host platforms since it relies on the Java programming language and an SQL compatible database. The current version of the tool supports pre-runtime software implemented fault injection and scan-chain implemented fault injection.

/pdf/goofi-generic-object-oriented-fault-injection-tool-2odpkr5rpn.pdf

GOOFI: generic object-oriented fault injection tool

Fault injection is traditionally divided into simulation-based and physical techniques depending on whether faults are injected into hardware models, or into an actual physical system or prototype. Another classification is based on how fault injection mechanisms are implemented. Well known techniques are hardware-implemented fault injection (HIFI) and softwareimplemented fault injection (SWIFI). For safety analyses during model-based development, fault injection mechanisms can be added directly into models of hardware, models of software or models of systems. This approach is denoted by the authors as model-implemented fault injection. This paper presents the MODIFI (MODel-Implemented Fault Injection) tool. The tool is currently targeting behaviour models in Simulink. Fault models used by MODIFI are defined using XML according to a specific schema file and the fault injection algorithm uses the concept of minimal cut sets (MCS) generation. First, a user defined set of single faults are injected to see if the system is tolerant against single faults. Single faults leading to a failure, i.e. a safety requirement violation, are stored in a MCS list together with the corresponding counterexample. These faults are also removed from the fault space used for subsequent experiments. When all single faults have been injected, the effects of multiple faults are investigated, i.e. two or more faults are introduced at the same time. The complete list of MCS is finally used to automatically generate test cases for efficient fault injection on the target system.

MODIFI: a MODel-implemented fault injection tool

In this paper, we consider the problem of assessing when the control of a vehicle can be safely transferred from an automated driving system to the driver. We propose a method based on a description of the driver's capabilities to maneuver the vehicle, which is defined as a subset of the vehicle's state space and called the driver controllability set (DCS). Since drivers' capabilities vary among individuals, the DCS is updated online during manual driving. By identifying the limits of the individual driver's normal driving envelope, we find the estimated bounds of the DCS. Using a vehicle model and reachability analysis, we assess whether the states of the vehicle start and remain within the DCS during the transition to manual driving. Only if the states are within the DCS is the transition to manual driving classified as safe. We demonstrate the estimation of the DCS for four drivers based on the data collected with real vehicles in highway and city driving. Experiments on transitions to manual driving are also conducted with real vehicles. Results show that the proposed method can be implemented with a real system to classify transitions from automated to manual driving.

Safe Transitions From Automated to Manual Driving Using Driver Controllability Estimation

This paper describes a fully automated pre-injection analysis technique aimed at reducing the cost of fault injection campaigns. The technique optimizes the fault-space by utilizing assembly-level knowledge of the target system in order to place single bit-flips in registers and memory locations only immediately before these are read by the executed instructions. This way, faults (time-location pairs) that are overwritten or have identical impact on program execution are removed. Experimental results obtained by random sampling of the optimized fault-space and the complete (non-optimized) fault-space are compared for two different workloads running on a MPC565 microcontroller. The pre-injection analysis yields an increase of one order of magnitude in the effectiveness of faults, a reduction of the fault-space of two orders of magnitude in the case of CPU-registers and four to five orders of magnitude in the case of memory locations, while preserving a similar estimation of the error detection coverage.

/pdf/assembly-level-pre-injection-analysis-for-improving-fault-15flqweyt4.pdf

Assembly-Level pre-injection analysis for improving fault injection efficiency

This study explored how failures related to an adaptive cruise control (ACC) were handled by drivers and what the effects on safety can be. The experimental study included forty-eight subjects and was performed in a moving base driving simulator equipped with an ACC. Each subject experienced two different failures in separate scenarios. In total, the study included four different failures, i.e., Unwanted acceleration, Complete lack of deceleration, Partial lack of deceleration, and Speed limit violation. The outcome of each failure scenario has been categorized based on whether the driver managed to avoid a collision or not. For the outcomes where collisions were successfully avoided, the situations were analyzed in more detail and classified according to the strategy used by the driver. Besides showing that partial lack of deceleration caused more collisions than complete lack of deceleration (43% compared to 14% of the participants colliding), the results also indicate a preference among drivers to steer and change lane rather than to apply the brakes when faced with acceleration and deceleration failures. A trade off relationship was identified between allowing a failing ACC to stay operational and on the other hand disabling it when an error is detected. Keeping the system operational can cause confusion about the mode of the system but as the results of the study indicate it can also improve the situation by reducing impact speed.

https://publications.lib.chalmers.se/records/fulltext/185006/local_185006.pdf

Jonny Vinter

Papers

GOOFI: generic object-oriented fault injection tool

MODIFI: a MODel-implemented fault injection tool

Safe Transitions From Automated to Manual Driving Using Driver Controllability Estimation

Assembly-Level pre-injection analysis for improving fault injection efficiency

Driver performance in the presence of adaptive cruise control related failures: Implications for safety analysis and fault tolerance