Toward a Framework for Highly Automated Vehicle Safety Validation

<div class="section abstract"><div class="htmlview paragraph">The VUSIL program has developed a concept for the integration of unmanned aircraft systems (UAS) into non-segregated airspace, which is also used by manned civil aviation. For the integration of UAS it is necessary for the Unmanned Aircraft (UA) pilot to be aware of the surrounding traffic in order to recognise and resolve possible conflicts. Therefore the surrounding traffic was displayed in the pilot ground control station (GCS) based on Radar data provided by DFS Deutsche Flugsicherung GmbH (DFS). The pilot was supported in detecting potential conflicts by means of a “Sense and Avoid” tool provided by ESG GmbH. This tool shows conflicts and possible avoidance manoeuvres on a separate display. To validate the concept, two flight campaigns with two different UAS (LUNA by EMT GmbH and NEO by Swiss UAV) and several intruders were conducted. In the first flight campaign, the intruders for the real flying UAS were simulated. In the second flight campaign the intruder was a manned helicopter supplied and flown by the German Federal Police. The proof of concept has been validated by the results of both flight campaigns.</div><div class="htmlview paragraph">Additionally, a safety analysis was conducted, aiming at demonstration of safe integration of UAS. Especially the equivalent level of safety (ELOS) of “See and Avoid” in manned aviation and “Sense and Avoid” as developed in the VUSIL program was addressed. Based on the results of the flight trials, workshops with aviation experts and relevant literature, under some conditions and assumptions, ELOS of VUSIL's integration concept has been shown.</div><div class="htmlview paragraph">Collecting the ability requirements of unmanned aircraft pilots was also part of the program. To this end, the UA pilots filled in a job analysis questionnaire to gather first information about the required abilities. The results were compared with the results from air traffic controllers and pilots.</div></div>

<div class="section abstract"><div class="htmlview paragraph">This paper presents a new methodology for the safety assessment of complex software intensive systems such as is envisioned for the coming major upgrade of the air traffic management system known as NextGen. This methodology is based on a new, more inclusive model of accident causation called Systems Theoretic Accident Model and Process (STAMP) [<span class="xref">1</span>]. STAMP includes not just the standard component failure mechanisms but also the new ways that software and humans contribute to accidents in complex systems. A new hazard analysis method, called Systems Theoretic Process Analysis (STPA), is built on this theoretical foundation. The STPA is based on systems theory rather than reliability theory; it treats safety as a control problem rather than a failure problem with interactive and possibly nested control loops that may include humans. In this methodology, safety is assured by closed loop control of safety parameters.</div><div class="htmlview paragraph">In the NextGen Concept of Operations, [<span class="xref">2</span>] many diverse ground and air systems will be tightly coupled leading to a greatly increased potential for the occurrence of safety critical events. The process described in this paper provides a rigorous, integrated and traceable safety analysis that improves upon the present somewhat ad-hoc multi-layered approach commonly used today. This process also improves upon the human-system interaction aspect of safety assessment, a topic that is not well covered in present certification practice.</div><div class="htmlview paragraph">We illustrate the effectiveness of this new methodology by an analysis of the NextGen “In-Trail Procedure in Oceanic Airspace” (ITP) that is specified in RTCA DO-312 [<span class="xref">3</span>]. We show how STPA derives some additional safety requirements beyond those in the Operational Safety Analysis (OSA) of DO-312.</div></div>

<div class="section abstract"><div class="htmlview paragraph">In today’s market, faster product development without compromising durability is essential. Durability assessment ensures a vehicle maintains structural integrity under normal and extreme conditions. Achieving this requires effective Road Load Data Acquisition, integrated with robust design practices and efficient validation processes. However, physical RLDA is time-consuming and costly, as it depends on prototype vehicles that are often available only in the later development stages. Failures identified during these late-stage tests can delay the product launch significantly.</div><div class="htmlview paragraph">This study presents a full digital methodology of fatigue life estimation for suspension aggregates. A study has been demonstrated on Rear Twist Beam component of rear suspension. The approach integrates the digital RLDA methodology presented in literature and finite element analysis simulation process, enabling durability assessments entirely within the virtual domain. This approach demonstrates how digital RLDA-derived loads, combined with finite element analysis simulations, can accelerate the product development life cycle by avoiding dependency on physical RLDA loads for durability assessments. This allows for proactive durability assessments without extensive dependency on Rig Level component testing, aggregate level testing, physical prototypes and RLDA loads.</div><div class="htmlview paragraph">The proposed digital framework is validated against experimental results and shows strong correlation with actual fatigue behavior. It provides a reliable and efficient tool for early design phase fatigue assessment, supporting faster design iterations, reducing Computer-Aided Engineering loops and thereby minimizing development time and costs. This paper describes the advantages of a fully digital approach to the product development lifecycle using Digital RLDA and finite element analysis simulations over the traditional approach of vehicle validation.</div></div>

<div class="htmlview paragraph">The objective of this paper is to introduce a web-clamp concept which can be adapted to emergency locking retractors (ELR's) or entirely replace these current seat belt locking devices in order to enhance the safety of car passengers in collision-accidents.</div> <div class="htmlview paragraph">Different types of web-clamp systems which demonstrate the discussed clamping concept are demonstrated and evaluated in comparison with the current ELR, as well as the pyrotechnically pre-loaded ELR system.</div> <div class="htmlview paragraph">The theory of the clamping concept as developed here, as well as different designs with correlating performance data (safety, comfort), will be discussed.</div> <div class="htmlview paragraph">It will be shown that a well-adjusted restraint system based on this web-clamp concept can reach a safety and comfort level close to pyrotechnically pre-loaded ELR systems.</div>

<div class="section abstract"><div class="htmlview paragraph">For high-level autonomous vehicles, under many circumstances, accidents are not caused by functional failures, but by system performance limitations and human misuses. ISO 21448 defines this kind of safety issue as safety of the intended functionality (SOTIF). However, most of SOTIF-related researches focus on hazard identification and risk evaluation, as well as verification and validation. There is still lack of public systematic identification method for triggering events. Therefore, this paper proposes an identification framework for triggering events which are related to system performance limitations and human misuses. In the aspect of system performance limitations, there are four steps, which are the specification of the research target, the analysis of influencing factors, the identification of triggering events, and the verification test. In the aspect of human misuses, triggering events can be identified based on the guide words for human error. Furthermore, based on the identification of triggering events, a safety analysis and verification framework for both high-level and low-level autonomous vehicles is proposed. The proposed framework contains five steps, which are hazard identification and risk evaluation, the identification of triggering events, the generation of test cases, test and results analysis, and the derivation of functional safety requirements. Besides, a SAE L3 autonomous vehicle is analyzed and corresponding tests are conducted. Two tests are illustrated in detail in this paper, which involve triggering events related to system performance limitations and human misuses, respectively. And the results show that the two triggering events could both lead to effective hazardous events, which proves the feasibility of the proposed framework.</div></div>

<div class="section abstract"> <div class="htmlview paragraph">This SAE Recommended Practice establishes the test procedure, environment, and instrumentation to be used for measuring the exterior exhaust sound level for passenger cars, multipurpose vehicles, and light trucks under stationary conditions providing a continuous measure of exhaust system sound level over a range of engine speeds.</div> <div class="htmlview paragraph">This sound level measurement procedure has been developed for use in engineering evaluation of the sound level performance of passenger car and light truck exhaust systems. It provides the means for detecting exhaust system resonances with the potential to affect both exterior and interior sound quality.</div> <div class="htmlview paragraph">This document incorporates certain provisions of ISO 5130-1982-02-15, for measuring the sound level of exhaust systems. (See <span class="xref">Appendix A</span>.)</div></div>

<div class="section abstract"><div class="htmlview paragraph">Now-a-days, Advanced driver-assistance systems (ADAS) is equipping cars and drivers with advance information and technology to make them become aware of the environment and handle potential situations in better way semi-autonomously. High-quality training and test data is essential in the development and validation of ADAS systems which lay the foundation for autonomous driving technology.</div><div class="htmlview paragraph">ADAS uses the technology like radar, vision and combinations of various sensors including LIDAR to automatize dynamic driving tasks like steering, braking, and acceleration of vehicle for controlled and safe driving. And to integrate these advance technologies, the ADAS needs labeled data to train the algorithm to detect the various objects and moments of driver. Image annotation is one the well-known service to create such training data for computer vision.</div><div class="htmlview paragraph">There are number of open source annotated datasets available viz. COCO, KITTI etc. But these datasets are limited to either US or European road environment scenarios. There is hardly any dataset available for Indian Specific road conditions. In order to capture all the India Specific objects on road, we are capturing data through various environmental conditions, road conditions and annotating objects on the collected camera images. 2-D bounding boxes are being used to annotate objects in an image.</div><div class="htmlview paragraph">These annotated images will then be used to train a machine learning model. Finally this trained model will be then used to detect Indian specific objects with real time data acquired through camera sensors mounted on the vehicle. Object detection is one of the prime aspects for ADAS functionality. The complete process will demonstrate end to end solution for object detection techniques from data generation to real-time object identification and recognition.</div></div>

<div class="htmlview paragraph">This paper is the second of two that describe the effects of low-lubricity fuels on diesel injection pump performance. The first paper describes the primary failure mechanisms and wear processes in a number of failed pumps removed from both military and civilian vehicles that had been operated on Jet A-1 and diesel fuels. However, the multitude of unregulated parameters in practical operation renders quantitative comparison between different fuels and pump combinations impractical. This paper describes the degradation in pump performance and the wear processes associated with fuels of varying lubricity in the well-defined environment of a pump test stand. The test methodology concentrates on those areas previously demonstrated to be most susceptible to wear. The results indicate that pump durability is reduced by highly refined low-viscosity fuels, but may be successfully counteracted by either improved metallurgy or lubricity additives. The measured wear rate from the full-scale pump stand tests is compared with results from a lubricity measurement technique commonly used in aviation. Based on this comparison, initial criteria for the minimum fuel lubricity requirements of the injection system are suggested.</div> <div class="htmlview paragraph">MANY FUELS PROVIDE a limited range of contact conditions in which successful lubrication is possible. Fuel systems are designed to reflect these needs; however, seemingly minor changes in fuel composition or equipment design may significantly alter component durability. The Part I Field Performance paper (<span class="xref">1</span>)<span class="xref">*</span> described post-failure disassembly and examination of failed pumps returned from the field. However, in many instances ultimate failure was promoted by a number of causes, and the effects of fuel lubricity could not be isolated.</div> <div class="htmlview paragraph">The surface protection provided by a fuel is not a unique characteristic, but rather is highly dependent on the test environment and mechanical configuration. The selection of a laboratory test to accurately, yet rapidly, simulate field conditions is necessarily a compromise among competing variables. The fuel pump and injection components perform under a variety of contact geometries, pressures, and velocities to cover lubrication conditions from boundary to fully developed hydrodynamic film. However, preliminary tests and calculations reported in <span class="xref">Reference 1</span> indicated that pump seizure was not primarily due to the decreased viscosity of the aviation fuels. As a result, the test series was designed to highlight the effects of oxidative/corrosive wear.</div>

<div class="htmlview paragraph">Two diesel engines representative of the four-stroke cycle and two-stroke cycle main propulsion units installed in U.S. Coast Guard WPB class vessels were operated in a test environment in an attempt to demonstrate significant fuel savings associated with water-in-fuel emulsions. A prototype fuel system was assembled that would supply unstabilized emulsions for which the water concentration could range from zero to 25% of the total volume of liquid supplied to the engine as fuel.</div> <div class="htmlview paragraph">The test results for the four-stroke cycle engine indicated that an average diesel fuel savings of about 2.5% could be obtained at the most frequently encountered operating conditions using water concentrations of 15-25%. For the two-stroke cycle engine, no significant reduction in fuel consumption could be identified.</div> <div class="htmlview paragraph">Based upon the results obtained, it was concluded that water-in-fuel emulsions of the type utilized did not offer an advantage to USCG cutter operations.</div>

<div class="section abstract"><div class="htmlview paragraph">The P<span class="small-caps">hylog</span> project aims at offering a model-based software-aided certification framework for aeronautical systems based on multi/many-core architectures. Certifying such platforms will entail fulfilling the high level objectives of the MCP-CRI / CAST-32A position paper. Among those, two types of analysis are required: interference and safety analyses. Because of the large size of the platforms and their complexity, those analyses can lead to combinatorial explosion and to some misinterpretation. To tackle these issues, we explore a service-based modelling approach that leads to a simplification of the analyses and to the highlighting of salient properties, making the adaptation of the certification argumentation efficient.</div></div>

<div class="htmlview paragraph">ExoMars is the first mission in ESA's Aurora Exploration Programme. ExoMars will pursue important science and technology objectives aimed at extending Europe's capabilities in planetary exploration. ExoMars will deploy a Rover carrying a suite of instruments dedicated to exobiology and geology research. The Rover will travel several kilometres searching for traces of past and present signs of life, collecting and analysing samples from within surface rocks and from the subsurface, down to a depth of 2 metres.</div> <div class="htmlview paragraph">The planetary protection policy of the Committee on Space Research (COSPAR) and the particular sensitivity of the life detection investigations establish stringent contamination control constraints for the ExoMars mission. Particulate, molecular and bioburden contamination control beyond the level of standard spacecraft is required for the flight system as well as for the assembly, test, and launch environment.</div> <div class="htmlview paragraph">As a result of the project phase B2, this paper will describe the technical implementation of the planetary protection and cleanliness and contamination requirements proposed by the Prime Contractor for the ExoMars mission.</div>

<div class="section abstract"><div class="htmlview paragraph">A variable air path on diesel engines offers further potentials to manage the challenges of engine development - such as reduction of emissions and fuel consumption, as well as performance increase. The Miller cycle is one of the possibilities, which is well known as an effective way to reduce process temperatures and so NO<sub>X</sub> emissions. The present paper discusses the potentials of this strategy for heavy duty diesel engines by identifying and analyzing the effects caused.</div><div class="htmlview paragraph">The investigations were carried out in the upper load range. First the isolated effect of the Miller cycle was analyzed. The results show reduced NO<sub>X</sub> emissions, although increased PM and CO emissions were measured. Further, the Miller cycle caused a reduction in peak cylinder pressure. This pressure reserve can be used to combine the Miller cycle with further measures while maintaining the maximum cylinder pressure of the reference operation point. On the one hand, a performance increase of about 10% was achieved. On the other hand, the combination of Miller cycle and increased boost pressure showed great potential to optimize the NO<sub>X</sub>-PM trade-off and led to an efficiency rise. To understand the effects caused, the losses of the process were separated and compared with the reference operation point.</div><div class="htmlview paragraph">The experimental tests were carried out on a single cylinder heavy duty test engine equipped with an in-house developed camless valve actuation system, and operated in a flexible test environment.</div></div>

<div class="section abstract"><div class="htmlview paragraph">In the view point of driving safety, the crosswind sensitivity of a vehicle becomes more important, as the driving speed in highway gets higher in these days. The sensitivity of a vehicle to crosswind depends on many factors, including the design of the suspension and aerodynamics of the body, etc. However, the knowledge about this phenomenon has still to be improved, in order to develop vehicle with optimum characteristics for crosswind stability.</div><div class="htmlview paragraph">In this research, the physics behind the sensitivity of a vehicle is discussed in detail through various kinds of virtual test using computer aided engineering (CAE) simulation scheme. In the first, a reliable simulation model for vehicle, driver, wind generator and interactions among them is built. This simulation model is verified by comparison with test results of real vehicle. Then, the sensitivity analysis is carried out to find out the most influential design parameters. Finally, an automated design optimization process is carried out based on sensitivity analysis results by connecting virtual test environment to process integration & design optimization (PIDO) tool.</div><div class="htmlview paragraph">With this procedure, both deep understanding of interaction among vehicle, driver and crosswind, and optimized set of design parameter to make a vehicle robust against the disturbance by crosswind can be achieved.</div></div>

<div class="section abstract"><div class="htmlview paragraph">Body-on-frame vehicles are well-regarded for their durability and off-road capabilities, but their structural design often makes them more vulnerable to noise, vibration, and harshness (NVH) issues. Vibrations originating from uneven roads are transmitted through the suspension and steering assemblies, sometimes resulting in rattles or other disturbances. These vibrations can be amplified by the inherent flexibility in the body-to-frame mounting system. In such vehicles, the steering system plays a critical role in driver comfort and is highly sensitive to vibrational inputs from the road surface, especially on coarse or uneven terrain.</div><div class="htmlview paragraph">Occasionally, these inputs result in subtle rattle noises that are perceptible only to the driver and may not be detected under controlled testing environments. This poses a challenge for engineers trying to isolate and resolve such intermittent NVH phenomena. Identifying the source requires a combination of real-world driving evaluations, structural analysis, and vibration measurement techniques.</div><div class="htmlview paragraph">This paper presents a case study of an intermittent steering-related rattle noise in a body-on-frame D-SUV with a column EPS steering system. A systematic investigation using on-road testing and accelerometer-based diagnostics was conducted. Through targeted design enhancements focused on improving system stiffness and connection integrity, the issue was resolved effectively. The approach outlined offers a replicable methodology for diagnosing and mitigating similar NVH concerns in other vehicle platforms, thereby contributing to improved driver comfort and product refinement.</div></div>

<div class="htmlview paragraph"><b>DURING the last year studies by subsidiaries of United Aircraft Corp. on cowls for radial air-cooled engines have been continued in the wind tunnel and in flight. Model tests comparing the performance of fixed cowls under various conditions are reported, and further research on flapped cowls for controlled cooling is described.</b></div> <div class="htmlview paragraph"><b>Tests were made over a wide range of flap angles to show the possibilities of this type of cooling regulation, and a new form of cowl with flaps located well behind the engine at the fuselage firewall was studied. Flight tests with such a cowl showed that the qualitative variations indicated in the wind tunnel adequately represent full-scale conditions. The results of these flight tests are described in some detail.</b></div> <div class="htmlview paragraph"><b>An attempt is made to reduce the various wind-tunnel results to a form suitable for estimation of cowl characteristics for design purposes, and the results of this work are correlated with information obtained in flight.</b></div> <div class="htmlview paragraph"><b>The paper then discusses the structural design of flapped cowls and includes data relative to the air loads on flaps and to the resulting flap-hinge moments. A powerplant installation with flapped cowl is described in detail. It incorporates a novel operating linkage to control flaps located at the firewall. No inner or wrapper cowl is included, but an exhaust-manifold shroud prevents overheating of the accessory compartment and provides a supply of hot air for the carburetor.</b></div>