Structured SOTIF Test Scenarios Based on a Driving Environment Model to Reduce the Safety Risk to an Acceptable Level

One of the most challenging aspects in the development of ADS is the sufficient testing that needs to be performed on an automated vehicle to assure safety. This level of testing is challenging due to the almost infinite number of scenarios that need to be taken into account. In this paper a model of the driving environment is proposed to reduce the number of scenarios to a manageable level. The proposed driving environment model (DEM) has been developed in the context of a System Theoretic Process Analysis (STPA) control structure identified in an earlier paper to structure an ADS including its relations to the user, the environment, and all other traffic actors. More specifically, it is shown how an analysis based on this model can be used to identify safe and unsafe control actions (UCAs) in known and unknown scenarios. A methodology is proposed to assure safety of an automated vehicle that is based on analysis of the DEM and an application of the STPA process to identify loss scenarios. The methodology has been applied to an automated vehicle project involving a highway pilot functionality and some results are presented.