# Analysis of Functional Insufficiencies and Triggering Conditions to Improve
the SOTIF of an MPC-based Trajectory Planner

Mirko Conrad***samoconsult GmbH, Französische Str. 13, 10117 Berlin, Germany,
Georg Schildbach†††University of Lübeck, Ratzeburger Allee 160, 23562 Lübeck,
Germany
corresponding author<EMAIL_ADDRESS>
## Abstract

Automated and autonomous driving has made a significant technological leap
over the past decade. In this process, the complexity of algorithms used for
vehicle control has grown significantly. Model Predictive Control (MPC) is a
prominent example, which has gained enormous popularity and is now widely used
for vehicle motion planning and control. However, safety concerns constrain
its practical application, especially since traditional procedures of
functional safety (FS), with its universal standard ISO 26262, reach their
limits. Concomitantly, the new aspect of safety-of-the-intended-function
(SOTIF) has moved into the center of attention, whose standard, ISO 21448, has
only been released in 2022. Thus, experience with SOTIF is low and few case
studies are available in industry and research. Hence this paper aims to make
two main contributions: (1) an analysis of the SOTIF for a generic MPC-based
trajectory planner and (2) an interpretation and concrete application of the
generic procedures described in ISO 21448 for determining functional
insufficiencies (FIs) and triggering conditions (TCs). Particular novelties of
the paper include an approach for the out-of-context development of SOTIF-
related elements (SOTIF-EooC), a compilation of important FIs and TCs for a
MPC-based trajectory planner, and an optimized safety concept based on the
identified FIs and TCs for the MPC-based trajectory planner.

## Keywords

Automated Driving System (ADS) , Autonomous Vehicles , Trajectory Planning ,
Model Predictive Control (MPC) , Functional Safety (FS) , Safety of the
Intended Functionality (SOTIF) , Functional Insufficiencies (FIs) , Triggering
Conditions (TCs) , SOTIF-related Element out of Context (SOTIF-EooC)

##  1 Introduction

Since the beginning of the 21st century, automated and autonomous vehicles
have become a major subject of research across the globe, in academia and
industry [1, 2, 3]. The technological progress is fueled by ever more powerful
hardware for computation, communication, and sensing. Another relevant factor
is the rapid advances in mathematical algorithms, especially in Artificial
Intelligence (AI), Machine Learning (ML), and Numerical Optimization (NO). A
plethora of new and powerful methods have been developed and successfully
demonstrated in actual vehicles on the road, among them _Model Predictive
Control (MPC)_.

MPC is a popular computer-based control method [4, 5] that has been frequently
tested in automated driving system (ADS) prototypes [6]. Thus far, however, it
has not been considered a viable option for series production. The main reason
is its relatively high complexity, causing relatively high efforts in the
development process and increasing the computational hardware requirements.
Arguably, an even bigger challenge results from safety concerns related to
MPC. These concerns are similar to other state-of-the-art methods of AI, ML,
and NO.

Due to the complexity of these methods, and the complexity of the
corresponding automated driving tasks, _Functional Safety (FS)_ , which is
concerned with safety in the presence of malfunctions, is no longer the single
most important aspect of safety. Instead, _Safety of the Intended Function
(SOTIF)_ , which is concerned with the safety of the nominal function even if
all system elements work as intended, becomes equally important. The intention
of this paper is hence to present a contribution towards a viable SOTIF
concept for an MPC-based motion planning module in automated driving systems
(ADSs).

###  1.1 Model Predictive Control

Over the past decades, MPC has developed into a mainstream approach for the
control of complex and safety-critical systems, including ADSs. The basic idea
is to formulate and solve a finite-horizon optimal control problem (FHOCP) as
a numerical optimization program in real time [7, 8, 9, 10]. The FHOCP
contains a model of the system and naturally integrates constraints on the
model states and control inputs. It can be used for _motion planning_ [11, 12]
and _trajectory tracking control_ [13, 14, 15], where feedback is introduced
by a receding-horizon implementation. It can also be used as a hybrid module,
covering some or all aspects of planning and tracking control [16]. It has
even been used to cover some aspects of tactical planning, such as lane change
decisions [17, 18].

The current trend is to use MPC as a motion planner, such as in the commercial
product ProDriver by Embotech [19]. The goal is to integrate as many aspects
as possible into the motion planning module, in order to slim down the module
interfaces. Interfaces always require additional engineering efforts and they
are a common source of functional, and thus also safety problems. The MPC
module should thus be capable of making tactical decisions, by introducing
integer variables, and ideally should also provide a basic level of vehicle
and actuator control.

Recent research in the context of MPC for ADSs has begun to focus on
interaction-aware motion planning [20]. The basic idea is to consider the
predictions of dynamic objects in the environment not as invariably fixed, but
as interdependent with the other objects and also dependent on the actions of
the ego vehicle. Hence the future trajectories of dynamic objects are included
in the model-based predictions in the MPC. The interactions themselves can be
modeled by different approaches, such as game theory [21] or neural networks
[22].

A common idea is to represent the intention of other drivers as modes [23,
24], corresponding to lane keeping or a lane change, for example. The
remaining uncertainty regarding the exact trajectory of the dynamic object can
be considered as stochastic noise. Another noteworthy approach is Branch MPC
[25, 26], where the modes of each dynamic object and the ego vehicle may
change at several specific instances over the prediction horizon.

###  1.2 Safety of the Intended Function (SOTIF)

SOTIF is a comparatively new branch of safety that is becoming increasingly
important for SAE driving automation levels 3 or higher. The first edition of
the applicable SOTIF standard ISO 21448 has only been published in 2022 [27].
Due to its relatively recent introduction, scientific literature on the
application of SOTIF to ADSs is still sparse. Zhu et. al. [28] emphasize that
the research on the SOTIF of automated and autonomous driving systems is still
in its infancy. Their paper focuses on safety analysis methods that could be
applied to SOTIF, but it does not cover specifically the topic of identifying
and analyzing functional insufficiencies (FIs) or triggering conditions (TCs).

Qidong et. al. [29] state that the identification and systematic analysis of
FIs and TCs remains a major challenge for the SOTIF. Using an Adaptive Cruise
Control (ACC) system as an example, the authors propose a scenario-based
analysis method of SOTIF triggering conditions. In this approach, the TCs are
analyzed according to elements of SOTIF scenarios that are formed in view of
FIs. The approach is then applied to the ’Sense’ portion of the ACC system.
The ’Plan’ part is not addressed in this paper.

Junfeng et. al. [30] apply the System-Theoretic Process Analysis (SPTA) method
to study the SOTIF of a Lane Keep Assistance (LKA) system. The study intends
to verify the feasibility of STPA as part of the SOTIF lifecycle. The paper
proposes a set of TCs for the LKA, but not all of them seem to be TCs in the
sense of ISO 21448. A subset of these TCs will be used as input for the SOTIF
analysis of the MPC-TP. In the analysis, there is also no specific focus on
the ’Plan’ part.

###  1.3 Content and Contributions

This paper describes a possible approach for the analysis of FIs and TCs, with
the goal of improving the SOTIF of a generic planning module for an ADS. The
trajectory planning module is based on the Model Predictive Control (MPC)
approach. It is assumed that the MPC-based trajectory planner (MPC-TP) can be
integrated into different vehicle-level functions and that it is re-usable for
different vehicles within a specified vehicle class. Hence it is treated as a
_SOTIF-related element out of Context (SOTIF-EooC)_ , which is a particular
novelty compared to the existing literature.

The main objective of this paper is to demonstrate how the framework of ISO
21448 [27] can be used for improving the SOTIF of a modern, state-of-the-art
planning algorithm. The system architecture and functional specifications are
outlined in Section 2 and the details of the MPC-TP are provided in Section 3.
The relevant SOTIF background is outlined in Section 4. The main part of this
paper is the SOTIF analysis in Section 5, which describes the application of
various methods and techniques from ISO 21448 [27] towards the identification
of FIs and TCs for the MPC-TP. The analysis leads to a refined specification
and design of the MPC-TP, as described in Section 6.1. The conclusions of this
work are presented in Section 7. The main contributions of this paper can be
summarized as follows:

  * •

Application of the abstract / generic framework of the new SOTIF standard ISO
21448 to a realistic case study, with a focus on early parts of the SOTIF
lifecycle;

  * •

Interpretation and application of generic methods in ISO 21448 for the
determination of FIs / TCs, in the context of a specific use case;

  * •

Derivation of a structured list of FIs / TCs as a consolidated result of the
SOTIF analysis (in a tabular format);

  * •

A refinement of the notion of an out-of-context development in the scope of
SOTIF.

##  2 Initial Concept for Vehicle Level Control System

The starting point for the design of the planning module as a SOTIF-SEooC are
assumptions about the encompassing vehicle control system into which the
module is to be embedded, as well as the related interfaces. Furthermore,
specifications are needed about the overall functionality and the operational
design domain (ODD).

###  2.1 Functional Architecture

The functional architecture of a generic ADS is shown in Figure 1. The MPC-TP
is shown in the middle (red). The task of the MPC-TP is to compute a reference
trajectory, which is then used by the trajectory controller (blue) and lower-
level modules to control the vehicle’s actuators. The actuators are an
integral part of the chassis, including, in particular, the drivetrain and
braking systems for longitudinal motion control and the steering system for
lateral motion control.

The MPC-TP receives information from centralized estimation modules (green),
which may serve also other functions and/or other modules in the architecture
[31]. The key point is that they are developed independently of the MPC-TP.
These modules provide a local map, including the topology and road geometry
and information about the infrastructure, such as traffic signs (Map Fusion).
They also include the relative position of the vehicle on the map, the
vehicle’s dynamic states, a list of relevant vehicle parameters, and
diagnostic information about the vehicle’s sensors and actuators (Ego Motion
Fusion). Furthermore, a list of relevant traffic objects in the vicinity of
the vehicle is provided, including their classification, position, speed, and
other states, as well as a situation analysis and prediction(s) about
(possible) future evolution of the situation (Object Fusion and Prediction).
The sensors also deliver important information about the environment, such as
ambient temperature or road surface (Environment Fusion). Finally, the MPC-TP
may receive high-level commands by the human driver or the ADS, such as the
reference speed, which lane or road to use, or where to take a turn (Tactical
Planner).

Figure 1: Overview of system architecture.

###  2.2 Encompassing Vehicle Control System

The MPC-TP is treated as a SOTIF-related element out of context (SOTIF-EooC),
as detailed in Section 4.3. Hence it shall be possible to integrate the MPC-TP
into different the SOTIF-related systems as well as different vehicle types.
For this paper, it is assumed that the MPC-TP can be used in the context of
the following systems for a given class of passenger cars:

  * F1)

_Energy Efficient Lane Centering and Adaptive Cruise Control (E 2LCACC)_:
E2LCACC is a SAE level 2 function that combines the classic Lane Centering
(LC) and Adaptive Cruise Control (ACC). It performs the lateral and
longitudinal control of the vehicle, in order to keep the vehicle on a
reference path in its lane and to follow the preceding vehicle. E2LCACC
contains AI-based elements for energy efficient driving, in particular to
determine the optimal speed profile.

  * F2)

_Active Lane Change Assist (ALCA)_ : ALCA is SAE level 2 or 3 function
designed to help drivers changing lanes safely by automatically steering the
vehicle into the adjacent lane. ALCA operates in combination with E2LCACC and
also provides longitudinal and lateral control of the vehicle during
overtaking. The driver can issue lane change requests to the left or the
right, e.g., by operating the indicator lever. The ALCA then checks whether a
safe lane change is possible within 10 seconds. If it is possible, it performs
the lane change; if it is not possible, it keeps the vehicle in the current
lane and continues with E2LCACC.

  * F3)

_Highway Pilot (HP)_ : The HP is a SAE level 4 function that takes full
control of the vehicle during highway driving. Only high level objectives are
provided by the user, such as the destination, the desired route, the targeted
arrival time, or the driving style. The driving itself, including all
decisions, is performed autonomously by the HP.

###  2.3 Operational Design Domain (ODD)

The vehicle-level functions F1, F2, F3 are only to be used within the
conditions and limits of the ODD (S01) specified in Table 1. The ODD documents
the specific conditions under which the ADS is designed to function [27]. Its
description is based on the structure provided in DOT HS 812 623 [32].

Physical Infrastructure |  Identi- fier
---|---
roadway types: |  German divided freeway (Autobahn) |  (S02.3a)
roadway surfaces: |  asphalt or concrete slabs |  (S02.3b)
roadway geometry: |  straightways or curves with bank angles $\leq 8^{\circ}$ (max. value permitted for German roads) |  (S02.3c)
Objects
roadway users - vehicles: |  all vehicles drive forward only |  (S02.3d)
non-roadway users - obstacles/objects: |  no pedestrians or bicycles |  (S02.3e)
Environmental Constraints
weather - temperature: |  ambient temperature within $[-20^{\circ}\mathrm{C},+50^{\circ}\mathrm{C}]$ |  (S02.3f)
weather - wind: |  wind speed ¡ $8\,\mathrm{bft}$ ($\approx 74\,\frac{\mathrm{km}}{\mathrm{h}}$) |  (S02.3g)
weather-induced roadway conditions - friction value: |  $\mu_{\min}=0.15$ , $\mu_{\max}=1.2$ |  (S02.3h)
Operational Constraints
speed limits - min. and max. speed limit: |  $v_{\min}=0\;\frac{\mathrm{km}}{\mathrm{h}}$ , $v_{\max}=130\;\frac{\mathrm{km}}{\mathrm{h}}$ |  (S02.3i)
Table 1: Initial ODD.

###  2.4 Assumptions about the Functionality and the Vehicle Class

Since the MPC-TP is considered as a SOTIF-EooC, specific assumptions are
required about its integration into the vehicle and the vehicle-level
functions F1, F2, F3, as well as its interfaces to other modules. An overview
of the upstream and downstream modules can be gathered from Figure 1. The
perception modules make use of appropriate sensors and communication
infrastructure. The control modules are connected with the relevant vehicle
actuators. It is beyond the scope of this paper to specify these modules here
in detail. A list of the most relevant specifications for the ego vehicle
(EgoV) and the module interfaces is provided below.

  * S02.3j)

The EgoV belongs to a specific class of passenger vehicles, consisting of a
finite number of vehicle types.

  * S02.3k)

All possible EgoV types are known at the time of the MPC-TP development
process, including their physical design and specifications, chassis and
suspension systems, and chassis control systems (Anti-lock Braking System,
Electronic Stability Control, etc.).

  * S02.3l)

Further parameters of EgoV (such as the vehicle mass, location of the center
of gravity, moments of inertia, and tire parameters) are known to be within
specified value ranges.

  * S02.3m)

The loads inside the EgoV are within the limits specified by the respective
vehicle type.

  * S02.3n)

There are no external loads attached to the EgoV, such as a trailers, roof
racks, or any type of load carriers.

##  3 Initial Concept of the MPC-TP

The specifications for the MPC-TP are based on the overall architecture in
Figure 1. The MPC-TP is (initially) given by the single block displayed in
Figure 2. The specifications concern the input signals, the output signals,
and the contents of the block itself, and they are presented along this
structure in the remainder of this section.

Figure 2: Initial, single-block MPC-TP architecture.

###  3.1 Input Interface / Perception

For the interface to the map fusion module, the _6 layers road model_
specified in ISO 34503 [33] is considered. See Figure 3 for an illustration.

Figure 3: Illustration of the layered road model in ISO 34503 [34].

  * S02)

Map Fusion: The MPC-TP receives a layered map every $50\,\mathrm{ms}$,
including

    * S0S02)a)

geometry and topology of the road, lane and road boundaries (layer 1),

    * S0S02)b)

traffic signs, speed limits, traffic guidance, construction barriers (layer
2),

    * S0S02)c)

temporal modifications, e.g., due to construction sites (layer 3).

For the sake of the SOTIF-EooC, it is assumed that all of this map data is
always fully accurate. The MPC-TP must plan its trajectories such that they
conform to the applicable traffic rules (e.g., speed limit, no passing zone).

  * S04)

Object Fusion and Prediction: The MPC-TP receives a complete list of dynamic
objects in its relevant vicinity every $50\,\mathrm{ms}$, including

    * S0S04)a)

other traffic participants (layer 4),

    * S0S04)b)

animals and other temporary obstacles, like dropped cargo, rocks, etc. (layer
4).

All dynamic objects include additional information about their classification
(vehicle, truck, motorcycle, pedestrian, animal type, obstacle, etc.),
position, velocity, and heading direction, if applicable. Furthermore, a
reliable prediction for all of these objects is provided over the next 6
seconds. The uncertainty in these predictions is accounted for by the use of
intervals (e.g., for the velocity) or bounding boxes (e.g., for the position).

No assumptions are made on specific sensors, their field-of-view, or their
operational status. All assumptions are based on the interfaces to the sensor
fusion modules. If the information flow on these interfaces cannot be
guaranteed, the vehicle-level function will hand over to the driver (SAE
levels 1,2,3) or transfer the vehicle to a safe state (SAE levels 4,5).

  * S06)

Ego Motion Fusion: The MPC-TP receives relevant information about the states
and parameters of the ego vehicle every $50\,\mathrm{ms}$, along with a with
maximum estimation error (marked with a “$\Delta$”):

    * S0S06)a)

the relative position of the ego vehicle on the map $x,y$ $(\Delta x,\Delta
y)$,

    * S0S06)b)

the ego vehicle velocity $v_{\mathrm{lon}},v_{\mathrm{lat}}$ $(\Delta
v_{\mathrm{lon}},\Delta v_{\mathrm{lat}})$,

    * S0S06)c)

the ego vehicle’s global heading angle $\psi$ $(\Delta\psi)$,

    * S0S06)d)

the ego vehicle’s acceleration $a_{\mathrm{lon}},a_{\mathrm{lat}}$ $(\Delta
a_{\mathrm{lon}},\Delta a_{\mathrm{lat}})$,

    * S0S06)e)

the vehicle’s mass $m$ ($\Delta m$),

    * S0S06)f)

the vehicle’s moment of inertia around the vertical axis $I_{z}$ ($\Delta
I_{z}$),

    * S0S06)g)

the position of the center of gravity relative to the midpoint of the rear
axle $x_{\mathrm{cog}}$, $y_{\mathrm{cog}}$, $z_{\mathrm{cog}}$ ($\Delta
x_{\mathrm{cog}}$, $\Delta y_{\mathrm{cog}}$, $\Delta z_{\mathrm{cog}}$),

    * S0S06)h)

the cornering stiffness of the front and the the rear tires
$C_{\alpha,\mathrm{f}}$, $C_{\alpha,\mathrm{r}}$ ($\Delta
C_{\alpha,\mathrm{f}}$, $\Delta C_{\alpha,\mathrm{r}}$).

  * S08)

Tracking Controller: Further information about the ego vehicle, in particular
about the states of the lower-level actuators, are provided to the MPC-TP
through the Tracking Controller every $50\,\mathrm{ms}$:

    * S0S08)a)

the front wheels’ steering angles $\delta_{\mathrm{f},\mathrm{l}}$,
$\delta_{\mathrm{f},\mathrm{r}}$,

    * S0S08)b)

the current engine torque $T_{\mathrm{eng}}$,

    * S0S08)c)

the total gear ratio $i_{\mathrm{gear}}$,

    * S0S08)d)

the effective brake torque $T_{\mathrm{brake}}$.

Actuator failures, controller failures or performance degradations are not
considered in this paper, as the focus is on SOTIF instead of functional
safety.

  * S10)

Environment Fusion: The MPC-TP receives accurate information about the
environmental conditions every $50\,\mathrm{ms}$, including

    * S0S10)a)

conditions of the road surface, in particular the friction coefficient $\mu$
($\Delta\mu$) (layer 1),

    * S0S10)b)

weather conditions and lighting conditions, in particular the side wind speed
$v_{\mathrm{wind}}$ ($\Delta v_{\mathrm{wind}}$) (layer 4).

In reality, environment parameters, such as the friction coefficient or the
side wind speed, are variable over space and/or time. For simplicity, however,
the architectures presumes the communication of constant values, which
characterize the entire drivable area of the ego vehicle over the relevant
prediction time, i.e., in this case 6 seconds. The tolerance thus includes the
measurement uncertainty as well as the true temporal and/or spacial
variations, if applicable.

  * S12)

Tactical Planner: The MPC-TP receives tactical choices from the Tactical
Planner every $50\,\mathrm{ms}$, containing

    * S0S12)a)

the desired _target lane_ (e.g., the current lane, the left or right lane),

    * S0S12)b)

a desired _reference speed_ (e.g., because the vehicle is about to leave the
highway on the next exit),

    * S0S12)c)

optional information about the desired lateral position on the target lane
(e.g., deviation from the lane center line),

    * S0S12)d)

optional information about desired distances to other vehicles or objects
(e.g., the desired gap to the leading or trailing vehicle).

All requests by the Tactical Planner are facultative. For example, if the
Tactical Planner requests a lane change, it is the task of the MPC-TP to
evaluate if this lane change is feasible and safe, given the dynamics of the
vehicle and the traffic situation (dynamic and static obstacles, traffic
rules, etc.). If it is not feasible or not safe, the MPC-TP resorts to a
trajectory that keeps the EgoV on its current lane. Similarly, the desired
distances in (S0S12)c,d) are for performance purposes only, and not required
for safety.

The tactical choices are generated by the active driving function. For
example, for the E2LCACC the unique command is always to keep the current
lane, for the ALCA the lane change commands are issued by the driver, and for
the HP the commands are issued by a dedicated software module.

###  3.2 Output Interface / Reference Trajectory

The main output of the MPC-TP is a _reference trajectory_ , as shown in the
architecture in Figure 1. The reference trajectory consists of (i) a
trajectory header and (ii) a trajectory body. The _trajectory header_ contains
a sequential number, the generation time, a validity time interval, and a
checksum.

  * S14)

Trajectory Body: The main part of the reference trajectory is the _trajectory
body_. It is represented by $N_{\mathrm{p}}-1$ linear segments, as illustrated
in Figure 4. Each segment, numbered with $i=1,\dots,N_{\mathrm{p}}-1$, carries
the following data:

    * S0S14)a)

$x_{i},y_{i}$: the planar coordinates of the starting point of the segment,

    * S0S14)b)

$\psi_{i}$: the heading angle of the segment,

    * S0S14)c)

$v_{i}$: the reference speed of the vehicle along the segment,

    * S0S14)d)

$\delta_{i}$: the reference steering angle along the segment,

    * S0S14)e)

$l_{i}$: the length of the segment.

    * S0S14)f)

In addition, the final point of the trajectory is given in terms of its planar
coordinates $x_{N_{\mathrm{p}}},y_{N_{\mathrm{p}}}$.

Note that the trajectory body data are partially redundant. This is mainly to
avoid unnecessary and mirrored re-calculations within the MPC-TP.

Figure 4: Illustration of the reference trajectory.

###  3.3 Specification and Design of the MPC-TP

This case study considers a trajectory planner based on Model Predictive
Control (MPC). A generic MPC formulation with a mainstream application to
highway driving is used, in order to make the SOTIF concept in this paper as
generally applicable as possible. It should be remarked, however, that
numerous variations of MPC-based planning algorithms have been proposed in the
recent literature [11, 35, 36, 37]. Moreover, commercial modules for
trajectory planning with MPC have been made available, such as the software
ProDriver by Embotech [19]. It assumes a similar functional architecture as
the MPC-TP in this paper, with a sampling time of $100\,\mathrm{ms}$.

The computations of the MPC-TP are based on an internal prediction model.
Following [14], a _dynamic bicycle model with a linear tire model_ (LDBM) is
selected and discretizes with an appropriate numerical integration method
(e.g., Runge-Kutta):

$\mathbf{x}_{t+1}=f(\mathbf{x}_{t},\mathbf{u}_{t})\;.$ (1)

The model is augmented with a suitable patch to circumvent the singularity of
the tire forces at the origin. Here $t=0,1,2,\dots$ denote the discrete time
steps, corresponding to multiples of the fundamental sampling time
$t_{\mathrm{s}}=50\,\mathrm{ms}$. The vector $\mathbf{x}_{t}\in\mathbb{R}^{6}$
includes the _(model) states_ at step $t$, namely

  * •

$s_{t},e_{t}$: coordinates of the vehicle’s reference point in road-aligned
(Frenét) coordinates,

  * •

$\psi_{t},\omega_{t}$: yaw angle and yaw rate of the vehicle,

  * •

$v_{t},u_{t}$: longitudinal and lateral velocity of the vehicle.

The vector $\mathbf{u}_{t}\in\mathbb{R}^{2}$ contains the _(control) inputs_
at step $t$, namely

  * •

$\delta_{t}$: the steering angle of the front wheel,

  * •

$M_{t}$: the torque of the drivetrain at the wheels, used to accelerate or
decelerate the vehicle.

Furthermore, a variable for the _reference lane_ $n_{t}$ is used to indicate
the lane decision for the vehicle at time $t$. It is assumed that the lanes
are numbered from right to left, starting with 1 and counting up to the total
number of lanes. The set of available lanes at step $t$ is denoted
$\mathbb{N}_{t}$.

Based on the prediction, the concept of the MPC-TP is to set up and solve the
following Optimal Control Problem (OCP) in each time step, using an
appropriate numerical optimization solver:

$\displaystyle\underset{n_{t},\mathbf{u}_{t},\mathbf{x}_{t}}{\mathrm{minimize}}\,\,\,$
$\displaystyle\ell_{\mathrm{s}}\bigl{(}s_{N_{\mathrm{p}}}\bigr{)}+\sum_{t=1}^{N_{\mathrm{p}}}\ell_{\mathrm{e}}\bigl{(}e_{t},n_{t}\bigr{)}+\ell_{\mathrm{o}}\bigl{(}s_{t},e_{t}\bigr{)}+\ell_{\mathrm{u}}\bigl{(}\delta_{t},M_{t}\bigr{)}\;,$
(2a) s.t.
$\displaystyle\mathbf{x}_{t+1}=f\bigl{(}\mathbf{x}_{t},\mathbf{u}_{t}\bigr{)}\qquad\forall\;t=0,1,\dots,N_{\mathrm{p}}-1\;,$
(2b) $\displaystyle\mathbf{x}_{0}=\bar{\mathbf{x}}_{0}\;,$ (2c)
$\displaystyle\mathbf{n}_{t}\in\mathbb{N}_{t}\qquad\forall\;t=1,2,\dots,N_{\mathrm{p}}\;,$
(2d)
$\displaystyle\mathbf{u}_{t}\in\mathbb{U}\qquad\forall\;t=0,1,\dots,N_{\mathrm{p}}-1\;,$
(2e)
$\displaystyle\mathbf{x}_{t}\in\mathbb{X}^{(\mathrm{s})}_{t}\;,\quad\mathbf{x}_{t}\in\mathbb{X}^{(\mathrm{t})}_{t}\qquad\forall\;t=1,2,\dots,N_{\mathrm{p}}-1\;,$
(2f) $\displaystyle\mathbf{x}_{N_{\mathrm{p}}}\in\mathbb{X}_{\mathrm{f}}\;.$
(2g)

The objective function (2a) comprises the following cost terms:

  * •

$\ell_{\mathrm{s}}\bigl{(}s_{N_{\mathrm{p}}}\bigr{)}$: rewards the progress
along the road made by the vehicle over the prediction horizon;

  * •

$\ell_{\mathrm{e}}\bigl{(}e_{t},n_{t}\bigr{)}$: penalizes the lateral
deviation of the vehicle from the center line of the corresponding reference
lane;

  * •

$\ell_{\mathrm{o}}\bigl{(}s_{t},e_{t}\bigr{)}$: repels the vehicle from static
and dynamic obstacles, e.g., by means of a potential field;

  * •

$\ell_{\mathrm{u}}\bigl{(}\delta_{t},M_{t}\bigr{)}$: favors a low input usage
and smooth changes in the inputs, e.g., for driver comfort and energy
efficient driving.

These cost terms are multiplied by individual tuning weights, which are
selected during the control design process.

The initial state $\bar{\mathbf{x}}_{0}$ of the LDBM (2b,c) is obtained from
the module for Ego Motion Fusion. The lane variables $n_{t}$ over the
prediction horizon in (2d) are either a decision variable of the OCP (as for
the HP), or they can be pre-determined before solving the OCP (as for E2LCACC
and ALCA). Equations (2e,f,g) represent the input constraints, state
constraints, and terminal constraints, respectively. The state constraints are
split into two sets:

  * •

The _safety constraints_ $\mathbb{X}^{(\mathrm{s})}_{t}$ avoid collisions of
the EgoV with static and dynamic objects, most importantly other vehicles,
called _target vehicles_ (TgtVs). Furthermore, the constraints ensure the
validity of the tire model, by restricting the tire forces to remain within
the admissible bounds of the linear tire regime (i.e., no slip in the tire-
road contact patch).

  * •

The _traffic rule and comfort constraints_ $\mathbb{X}^{(\mathrm{t})}_{t}$
represent the constraints from traffic rules (e.g., the EgoV must stay within
its lane, the EgoV must respect the speed limit) and passenger comfort (e.g.,
no excessive acceleration or jerk).

The safety constraints are essential and cannot be relaxed, whereas the
traffic rule and comfort constraints can be relaxed in emergency situations.
Furthermore, in emergency situations, the LDBM in (1) can be replaced with a
nonlinear dynamic bicycle model (NDBM), which uses a Pacejka tire model
instead of the linear tire model. By these modifications, the MPC-TP may
temporarily operate the vehicle close to its dynamic limits and against the
traffic rules, e.g., driving in between two lanes, or without considering
passenger comfort.

  * S16)

Further specifications related to the MPC formulation include the following:

    * S0S16)a)

The fundamental sampling time is $t_{\mathrm{s}}=50\,\mathrm{ms}$.

    * S0S16)b)

The planning horizon is $N_{\mathrm{p}}=120$ steps, which corresponds to a
prediction time of $T_{\mathrm{p}}=6\,\mathrm{s}$.

    * S0S16)c)

The input constraint set $\mathbb{U}$ represents all limits of the steering,
engine and braking systems, as well as the relevant limits of their rate-of-
change.

    * S0S16)d)

The state constraint sets $\mathbb{X}_{t}$ are time-dependent and prevent
collisions with static and dynamic obstacles, with the exception of vehicles
driving behind the ego vehicle on the same lane. Moreover, the state
constraints keep the vehicle away from its dynamic limits and ensure
satisfaction of the traffic rules, e.g., by preventing forbidden lane changes
or violation of the speed limit.

    * S0S16)e)

The terminal constraint $\mathbb{X}_{\mathrm{f}}$ corresponds to a safe state
of the vehicle in which it can remain indefinitely (e.g., at standstill), or
it represents a safe exit strategy (e.g., maximum deceleration until
standstill). Its purpose is to ensure the recursive feasibility of the OCP.

The numerical computations of the MPC-TP comprise two main steps:

  1. 1.

_setup_ of the OCP problem,

  2. 2.

_solution_ of the OCP problem.

Step 1 is to parse the OCP into the standard form of a nonlinear programming
problem, which is realized by handwritten code. Step 2 is to solve the
nonlinear program using a generic optimization solver, for which a generous
selection of software packages is available [38, 39, 40, 41].

  * S18)

Besides the optimal trajectory, the optimization solver returns an exit flag
$q_{\mathrm{exit}}$ in exactly one of four classes:

    * $q_{\mathrm{exit}}=1$:

A (local) minimum is found with an acceptable tolerance level.

    * $q_{\mathrm{exit}}=2$:

A feasible point is found, but without an optimality property (e.g., because
the gradient / search direction becomes too small or the solver has reached
the maximum number of iterations / solution time).

    * $q_{\mathrm{exit}}=3$:

The solver detects that no feasible point exists (‘certificate of
infeasibility’).

    * $q_{\mathrm{exit}}=4$:

A feasible point is not found, but without a certificate of infeasibility
(e.g., because the solver has reached the maximum number of iterations /
solution time), or an identified or unidentified solver error occurred (e.g.,
due to insufficient memory).

In reality, most solvers provide further diagnostics of the results, i.e.,
their exit flag is more detailed than the four classes above. The requirement
(S0S18)) states that it must be possible to map the true exit flag of the
solver uniquely to one of the indicated classes. Moreover, it is assumed that
the exit flag correctly characterizes the result of the solver. This can be
verified by a separate solution checker. Cases where the exit flag is
incorrect are not considered further as part of the SOTIF analysis. They
represent software fault and hence belong to the realm of FS.

###  3.4 Hazards at the Vehicle Level, Safety Goals, and SOTIF Requirements

For the SOTIF analysis in this paper, the following _hazards at the vehicle
level_ are considered:

  * Haz01)

The ego vehicle leaves the assigned lane.

  * Haz03)

The ego vehicle collides with other vehicles or obstacles.

These hazards lead directly to the specification of the following _safety
goals_ :

  * SG01)

The ego vehicle shall not leave the assigned lane(s).

  * SG03)

The ego vehicle shall not collide with other vehicles or obstacles.

As part of a top-down safety lifecycle, these safety goals would be broken
down recursively into more and more detailed safety requirements until one
arrives at safety requirements for the component in question. Safety
requirements for an ADS comprise both functional safety requirements and
SOTIF-related safety requirements (or SOTIF requirements in short). Such a
refinement of safety requirements does not take place when developing a SOTIF-
EooC. Instead, safety requirements must be assumed for the out-of-context
element under consideration. The SOTIF-SEooC’s fulfillment of these _assumed
safety requirements_ represents its contribution to achieving the original
safety goals. For the MPC-TP, we assume the following SOTIF-related safety
requirements:

  * Req01)

The MPC-TP shall provide a reference trajectory within
$t_{\mathrm{c}}=30\,\mathrm{ms}$.111The computation time is less than the
sampling time $t_{\mathrm{s}}=50\,\mathrm{ms}$, in order to account for
additional communication delays.

  * Req03)

The reference trajectory provided by the MPC-TP has to be _consistent_
regarding the redundant information in the trajectory body.

  * Req05)

The reference trajectory provided by the MPC-TP has to be _admissible_ , in
the sense that it must satisfy all relevant actuator constraints:

    * Req0Req05)a)

The minimum / maximum longitudinal acceleration of the vehicle is
$a_{\mathrm{lon},\min}=-10\,\frac{\mathrm{m}}{\mathrm{s}^{2}}$,
$a_{\mathrm{lon},\max}=+3\,\frac{\mathrm{m}}{\mathrm{s}^{2}}$.

    * Req0Req05)b)

The minimum / maximum velocity of the vehicle is
$v_{\min}=0\,\frac{\mathrm{km}}{\mathrm{h}}$,
$v_{\max}=130\,\frac{\mathrm{km}}{\mathrm{h}}$.222The minimum velocity
assumption means that the EgoV may not drive in reverse. A maximum velocity is
required by the limited forward view of the vehicle’s sensor suite.

    * Req0Req05)c)

The maximum front wheel steering angle of the vehicle (in each direction) is
$\delta_{\max}=34^{\circ}$.

    * Req0Req05)d)

The maximum front wheel steering rate (in each direction) is
$\gamma_{\max}=68^{\circ}\,\frac{1}{\mathrm{s}}$.

    * Req0Req05)e)

The maximum lateral acceleration of the vehicle (in each direction) is
$a_{\mathrm{lat},\max}=5\,\frac{\mathrm{m}}{\mathrm{s}^{2}}$.

Similar to the upstream perception modules, no detailed technical
specifications have made for the downstream Tracking Controller (TC). As it is
developed independently, responsibilities have to be clearly allocated and
distributed between the MPC-TP and the TC. Thus requirements have to be
specified for the interface, i.e., in this case, the reference trajectory. The
approach proposed in this case study is to require “drivability” based on a
nonlinear dynamic double-track model (NDDM):

  * Req07)

The reference trajectory provided by the MPC-TP shall be _drivable_ , i.e., it
must be possible to track it with a NDDM using some arbitrary controller, such
that all of the following conditions are satisfied:

    * Req0Req07)a)

The initial condition of the NDDM corresponds to the measured initial
condition of the vehicle.

    * Req0Req07)b)

The parameters of the NDDM correspond to those of the vehicle (mass $m$,
moment of inertia $I_{z}$, position of the center of gravity
$x_{\mathrm{cog}}$ and $y_{\mathrm{cog}}$, front and rear cornering stiffness
$C_{\alpha,\mathrm{f}}$ and $C_{\alpha,\mathrm{r}}$).

    * Req0Req07)c)

The tires of the NDDM do not saturate, i.e., there is no slip in the tire-road
contact patch, for the worst-case friction coeffient $\mu-\Delta\mu$. This
means that the tire forces remain inside the linear regime at all times.

    * Req0Req07)d)

The bank angle is between $\beta-\Delta\beta$ and $\beta+\Delta\beta$.

    * Req0Req07)e)

The side wind speed is between $v_{\mathrm{wind}}-\Delta v_{\mathrm{wind}}$
and $v_{\mathrm{wind}}+\Delta v_{\mathrm{wind}}$.

    * Req0Req07)f)

All existing actuator constraints are respected: communication delays,
actuator dynamics, actuator limits, and limits of the rates of change.

    * Req0Req07)g)

The maximum lateral offset from the reference trajectory is
$e_{\max}=5\,\mathrm{cm}$.

    * Req0Req07)h)

The length of each reference trajectory is such that it takes at least
$5\,\mathrm{s}$ to reach the end.

The set of all _consistent, admissible and drivable trajectories_ is denoted
as $\mathcal{T}$. Additionally, the trajectory should be such that it does not
lead to collisions of the vehicle.

  * Req09)

The trajectory shall be _collision-free_ , i.e., it must stay within the
boundaries of the road and it must avoid collisions with all dynamic
obstacles.

    * Req0Req09)a)

For lateral collsition avoidance, the MPC-TP may rely on a maximum lateral
offset $e_{\max}^{\mathrm{TC}}$ produced by the TC:

      * *

for $v\leq 30\,\frac{\mathrm{km}}{\mathrm{h}}$:
$e_{\max}^{\mathrm{TC}}=10\,\mathrm{cm}$,

      * *

for $v\leq 80\,\frac{\mathrm{km}}{\mathrm{h}}$:
$e_{\max}^{\mathrm{TC}}=15\,\mathrm{cm}$,

      * *

for $v\leq 130\,\frac{\mathrm{km}}{\mathrm{h}}$:
$e_{\max}^{\mathrm{TC}}=20\,\mathrm{cm}$.

    * Req0Req09)b)

The MPC-TP shall plan its trajectories such that it is always safe for the ego
vehicle to stay in its current lane, in particular by maintaining an
appropriate safety distance to the leading vehicle.

To this end, the MPC-TP may assume that all of the input information it
receives is up-to-date and fully correct.

Note that the scope of the paper is limited with regards to the considered
vehicle level hazards and SOTIF requirements. In reality, there may be further
hazards and derived requirements, which may involve also other aspects of the
lateral motion, a such as acceleration and jerk, as well as the longitudinal
motion of the vehicle, e.g., for overtaking maneuvers.

##  4 SOTIF Background

###  4.1 Aspects of Safety

The _safety_ of a technical system is commonly defined as the absence of
unreasonable risk for the health and life of humans [42]. A reasonable level
of risk has to account for the fact that most technological systems, including
ADSs, can never be entirely safe. Safety risks of E/E systems can be
categorized according to the source of potential hazards into

  * 1)

hazards that occur due to _malfunctioning behavior_ (Functional Safety),
addressed by the ISO 26262 [42] standard, and

  * 2)

hazards that occur due to _functional insufficiencies_ (Safety of the Intended
Functionality, SOTIF), addressed by the ISO 21448 [27] standard.

Functional safety and SOTIF are distinct and complementary aspects of safety
that both need to be accounted for in the development of an ADS [43]. The
exclusive focus of this paper, however, is SOTIF.

###  4.2 SOTIF

The international standard ISO 21448 ’Road vehicles - Safety of the intended
functionality’ published in 2022 defines SOTIF as the absence of unreasonable
risk due to hazards resulting from _functional insufficiencies_ of the
intended functionality, or its implementation [27]. As a basic framework, it
defines an iterative lifecycle with several activities that are deemed
adequate for developing an ADS that satisfies the SOTIF, as shown in Figure 5.

Figure 5: Overview of the SOTIF lifecycle [27] (Red frames indicate the
activities covered in this paper).

###  4.3 SOTIF-related Element out of Context (SOTIF-EooC)

As a consequence of the collaborative development typical for the automotive
industry, a supplier company often provides a component that will be
integrated by the OEM into a SOTIF-related system. Under this scenario, at the
time of developing the component, the the supplier may only know certain
aspects of the overarching system. One way of facilitating the achievement of
SOTIF in such a context is to treat the component as a _SOTIF-related Element
out of Context (SOTIF-EooC)_ , according to ISO 21448 [27, Clause 4.4.3].

For a component treated as a SOTIF-EooC, assumptions can be made regarding its
use within the whole system and its contribution to the intended
functionality. Based on this, assumptions about the SOTIF-related _functional
insufficiencies_ (FIs) and their allowed target rate of occurrence can be
derived. These assumptions need to be documented. They are used as inputs for
the subsequent development of the SOTIF-EooC by the supplier. For the SOTIF-
EooC, the identified _triggering conditions_ (TCs) of the component and their
resulting FIs are documented together with the assumptions of use for the
component (a.k.a. integration requirements). When the OEM integrates the
SOTIF-EooC, the validity of the assumptions or integration requirments is
established by SOTIF activities in the context of whole vehicle-level
functionalities, according to ISO 21448, Clause 4.4.3 [27].

In this paper, the MPC-TP is treated as a SOTIF-EooC. In fact, the MPC-TP may
be used as part of different driving automation systems, namely E2LCACC, ALCA,
and HP. Assumptions regarding the overall systems, the integration of the MPC-
TP and the contributions of the MPC-TP to the intended functionality have been
discussed in Sections 2 and 3. The identification of TCs of the MPC and their
resulting FIs are discussed in Section 5. Naturally, their analysis leads to
an improved architecture and refined specifications, which are presented in
Section 6.1.

###  4.4 Functional Insufficiencies

Figure 6: SOTIF scenario categories.

FIs lead to hazards only in specific (driving) scenarios, called the
_hazardous scenarios_ , as opposed to _non-hazardous scenarios_. Conceptually,
these scenarios are further sub-divided into _known_ and _unknown scenarios_.
This categorization of scenarios is illustrated in Figure 6. Hazardous
scenarios may be known or unknown at the start of the SOTIF analysis. The
overall goal of SOTIF is to improve the specification and the design of the
system, or the considered element, with respect to reducing the number of
(known and unknown) hazardous scenarios.

FIs may exist at the system level, e.g., the E2LCACC system, or at the element
level, e.g., the ’Sense’, ’Plan’, or ’Act’ parts of the system. Since FIs can
lead to hazardous behaviour, their identification and the evaluation of their
effects are key activities in the development of a SOTIF related item [27,
Clause 7]. ISO 21448 subdivides FIs into

  * •

_specification insufficiencies_ , which refer to a (possibly incomplete)
specification contributing to hazardous behavior, and

  * •

_performance insufficiencies_ , which refer to limitations of the technical
capabilities contributing to hazardous behavior [27].

Examples of specification insufficiencies include an incomplete specification
of the E2LCACC’s headway distance resulting in the ego vehicle not keeping a
safe distance to the vehicle in front or the inability of the HP to handle
uncommon freeway road signs that were not part of its specification and thus
cannot be processed appropriately by the system. Examples of performance
insufficiencies include limitations of technical capabilities of the ALCA such
as limited calculation performance, limited perception range of its front
radar sensor, or limited actuation capabilities of the foundational steering
system [27].

As this paper is concerned with an MPC-TP for different driving functions, the
focus is on FIs at element level, in this case, of a “Plan” component.

###  4.5 Triggering Conditions

Hazardous scenarios can be decomposed into the following elements: (1) A
_traffic scenario_ with a _triggering condition_ , (2) which leads to a
_hazardous behavior_ of the ego vehicle, (3) which may cause a _hazard_ in
combination with the surrounding traffic or environment. Hence a TC is defined
as a specific condition of a scenario that initiates a subsequent system
reaction contributing to hazardous behavior [27](simplified).

TCs and FIs are interrelated: A TC of a scenario activates a FI, which results
in a subsequent system reaction. Figure 7 illustrates the activation of FI at
the element level by a TC and the resulting hazardous behavior. In general,
the SOTIF standard also addresses reasonably foreseeable misuse. This aspect
however, remains outside the scope of this paper.

Figure 7: Causal chain for hazardous behavior on vehicle level.

For an example, assume an activated E2LCACC system that uses a radar sensor
with an insufficient field of view in cased of curved roads. The upper part of
Figure 8 shows a scenario without a TC. A FI is not being activated. The
E2LCACC system works as intended, i.e., the scenario is considered not
hazardous. The lower part of Figure 8 shows a second, hazardous scenario.
Here, the TC is a slower moving vehicle ahead in lane on a curved road. In
this case, the assumed FI at the sensor is activated, resulting in a late
detection of the leading vehicle. As a result, the system brakes too late,
resulting in a rear-end collision with the leading vehicle.

Figure 8: Scenarios with (bottom) and without (top) TC.

##  5 SOTIF Analysis for the MPC-TP

###  5.1 Identification and Evaluation of Functional Insufficiencies and
Triggering Conditions

ISO 21448 suggests a list of specific methods to analyze potential FIs and TCs
[27, Table 4]. Table 2 shows the list of methods that are selected as
appropriate to derive FIs and/or TCs of the MPC-TP, and the ones that are
considered further in the remainder of this paper.

Method |  Section
---|---
A) |  Analysis of requirements |
B) |  Analysis of the ODD, use cases, and scenarios | 5.2
D) |  Analysis of boundary values | 5.6
F) |  Analysis of functional dependencies | 5.4
G) |  Analysis of common triggering conditions | 5.7
H) |  Analysis of potential triggering conditions from field experience and lessons learnt |
I) |  Analysis of system architecture (including redundancies) | 5.3
K) |  Analysis of algorithms and their output or decisions | 5.5
N) |  Analysis of external and internal interfaces |
O) |  Analysis of design of the actuators and potential limitations |
Table 2: List of recommended methods in ISO 21448 to analyze FIs and TCs that
are deemed as relevant for the MPC-TP. Methods in gray are not considered
further in this case study.

For the analysis of the “Plan” component of a system, ISO 21448 [27, Section
7.3.2] provides an additional, specific list of methods that can be used for
finding FIs and TCs. This list is provided in Table 3. The categories
considered for the SOTIF analysis in this paper are shown in black, the ones
not considered further are shown in gray.

Method |  Section
---|---
Environment and location | 5.8
Road infrastructure |
Urban or rural infrastructure |
Highway infrastructure |
Driver or user behavior |
Potential behavior of other drivers or road users |
Driving scenario |
Known planning algorithm limitations |
Known insufficiencies of the specification of machine learning |
Known functional insufficiencies and functional improvements |
Table 3: List of recommended methods in ISO 21448 to analyze FIs and TCs
specifically for planning modules. Methods in gray are not considered further
in this case study.

This section describes the application of the selected analysis methods, and
the FIs and potential TCs that have been identified. Multiple methods may lead
to the same results, in which case the corresponding FIs and TCs are
identified with the same number.

###  5.2 Analysis of ODD, Use Cases, and Scenarios

This analysis method involves a close examination of the ODD specifications in
(S02.3), as well as predictable use cases and scenarios that may lead to
potential TCs and FIs of the MPC-TP. Using this approach, the following items
have been identified for our case study:

In congestion situations (TC00LABEL:TC:AOUCS01), the MPC-TP does not consider
the formation of a rescue alley for police or ambulances
(FI00LABEL:FI:AOUCS01). Conversely, the formation of a rescue alley by other
vehicles or the presence of police or ambulances in congestion situations may
lead the MPC-TP to perform unusual, illegal, counter-intuitive or even
dangerous maneuvers (FI00LABEL:FI:DangerousManeuver).

In obstacle avoidance scenarios (TC00LABEL:TC:AOUCS02), the MPC-TP does not
allow emergency maneuvers without a proper lane change. For example, it is not
possible to avoid an obstacle by driving in between two lanes or by using the
shoulder (FI00LABEL:FI:AOUCS02). Conversely, the emergency obstacle avoidance
by other vehicles may lead the MPC-TP to perform counter-intuitive or even
dangerous maneuvers (FI00LABEL:FI:DangerousManeuver).

There is no speed limit on certain sections of the Autobahn. Suppose there is
blocking obstacle on the road, such as the rear end of a congestion. If the
obstacle is at standstill shortly beyond the prediction horizon of the MPC-TP
(TC00LABEL:TC:AOUCS03) and an obstacle avoidance maneuver is not possible,
e.g., by performing a lane change. If the EgoV exceeds a certain speed
$v_{\max}$, this can lead to a rear-end collision because the prediction
horizon $N_{\mathrm{p}}$ is not long enough for the EgoV to come to a full
stop within it (FI00LABEL:FI:AOUCS03).

The design of the current MPC-TP is based on clearly defined traffic rules. It
assumes, that surrounding vehicles either have the right-of-way, and are thus
considered as obstacles, or they have to yield, and can thus be ignored.
However, there are situations where the right-of-way is unclear, such as at
the end of two merging lanes (TC00LABEL:TC:AOUCS04a). Without further
measures, this may lead to an overly conservative driving behavior
(FI00LABEL:FI:AOUCS04a), and even a complete deadlock for the EgoV
(FI00LABEL:FI:AOUCS04b).

On freeways, cars typically only drive forwards. However, in exceptional
situations, e.g., during congestion or due to police or ambulance operations,
it may be necessary to perform reverse maneuvers. Moreover, surrounding
vehicles may drive backwards (TC00LABEL:TC:AOUCS05), in which case the MPC-TP
may become infeasible (FI00LABEL:FI:Infeasible) if the EgoV is at rest or
slowly moving forwards.

In the case of a wrong way driver (TC00LABEL:TC:AOUCS06), the MPC-TP may be
unable to compute a feasible trajectory (FI00LABEL:FI:Infeasible). Or it may
lead the MPC-TP to perform counter-intuitive or even dangerous maneuvers
(FI00LABEL:FI:DangerousManeuver).

The MPC-TP shall be able handle situations with an unexpected, sudden change
of road conditions. Important examples include a dropping friction
coefficient, e.g., due to water / hydroplaning (TC00LABEL:TC:AOUCS07a), snow /
ice (TC00LABEL:TC:AOUCS07b), or oil (TC00LABEL:TC:AOUCS07c), or an irregular
surface, e.g., due to gravel or stones (TC00LABEL:TC:AOUCS08a), pot holes
(TC00LABEL:TC:AOUCS08b), or road bumps (TC00LABEL:TC:AOUCS08c). In such
situations, the trajectory generated by the MPC-TP may actually be not
drivable, in the sense of (Req0Req07)), e.g., because of the limitations of
the LDBM using a linear tire model (FI00LABEL:FI:Drivable).

###  5.3 Analysis of System Architecture (Including Redundancies)

This analysis is based on the system architecture, as depicted in Figure 1.
The goal is to identify potential FIs and TCs based on the overall behavior of
the entire system.

The receding-horizon implementation causes the MPC-TP to act also as a
feedback controller for the vehicle, which is a well-known feature of MPC [7,
44]. The interoperation of the MPC-TP with the tracking controller (TC) may
thus lead to undesired bahavior, such as oscillations (FI00LABEL:FI:ASA01), or
even instability of the EgoV motion. This may be triggered, for example, by
external disturbances such as a side wind gust, e.g., on a bridge deck
(TC00LABEL:TC:ASA01), or irregular, non-continuous lane markings, e.g., due to
suddenly disappearing (TC00LABEL:TC:ASA02a), dirty (TC00LABEL:TC:ASA02b),
broken (TC00LABEL:TC:ASA02c), or covered (TC00LABEL:TC:ASA02d) lane markings.

Difficulties may also appear in situations where the right-of-way is unclear
(TC00LABEL:TC:AOUCS04), or when other traffic participants do not strictly
adhere to the traffic rules (TC00LABEL:TC:ASA05). Their interaction with the
MPC-TP may then lead to an overly conservative behavior of the EgoV
(FI00LABEL:FI:AOUCS04), possibly resulting in a poor progress on the road
(FI00LABEL:FI:AOUCS04a), or even a deadlock (FI00LABEL:FI:AOUCS04b).

The cut-in of a faster TgtV in front of the EgoV (TC00LABEL:TC:ASA04) may lead
to a violation of the front safety distance, and hence the inability of the
MPC-TP to generate a feasible solution (FI00LABEL:FI:Infeasible). This can be
resolved by relaxing the minimum safety distance constraint in case of a
leading vehicle with a higher velocity. Even if the safety distance is not
violated, the cut-in of a faster TgtV (TC00LABEL:TC:ASA04) may still lead to
an overly conservative braking maneuver on behalf of the EgoV
(FI00LABEL:FI:AOUCS04c).

The MPC-TP does not consider a trailing vehicle driving closely behind the
EgoV in the same lane (TC00LABEL:TC:ASA06). According to (S0S16)d), even
though it is the responsibility of the trailing vehicle to keep a sufficient
safety distance, sudden braking maneuvers may lead to a collision with the
trailing vehicle and are thus unsafe (FI00LABEL:FI:ASA03).

###  5.4 Analysis of Functional Dependencies

In the context of this case study, functional dependencies are interpreted as
other modules that are actually or potentially connected with the MPC-TP, be
it upstream or downstream. The MPC-TP needs to cope with challenges arising
from the limitations of these modules. With this interpretation of functional
dependencies, TCs and FIs identified with this analysis method may overlap
with those identified by analyzing the system architecture (in Section 5.3),
in the context of the entire system.

Dynamic obstacles suddenly appearing in the field of view of the system
(TC00LABEL:TC:AFD01), may overwhelm the ability of the MPC-TP to solve the OCP
in order to compute a new trajectory in due time
(FI00LABEL:FI:InsufficientTime), violating (Req0Req01)), or to find a feasible
trajectory at all (FI00LABEL:FI:Infeasible), violating (Req0Req09)). Examples
of this group of FIs are a previously shadowed traffic participant
(TC00LABEL:TC:AFD01a), an object dropping from a bridge or a truck
(TC00LABEL:TC:AFD01b), or a large animal (e.g., a wild boar) crossing the
freeway (TC00LABEL:TC:AFD01c).

At points of sudden traffic rule changes (TC00LABEL:TC:AFD02), such as the
beginning of a speed limit area or a no passing zone, the MPC-TP may also
unable to compute a feasible trajectory (FI00LABEL:FI:Infeasible), or may be
unable to solve the OCP within the allotted time
(FI00LABEL:FI:InsufficientTime).

###  5.5 Analysis of Algorithms and Their Outputs or Decisions

In the context of the MPC-TP, this analysis pertains to the formulation of the
OCP (2) and the numerical optimization algorithm, the decisions taken by the
MPC-TP, as well as the reference trajectory and the exit flag as its outputs.

The OCP is based on the LDBM, whose linear tire model may represent a poor
approximation of a real vehicle if essential model assumptions are violated
(FI00LABEL:FI:AAOD01). The validity of the linear tire model is already
supported by corresponding constraints $\mathbb{X}^{(\mathrm{s})}_{t}$ (see
Section 3.3). The other main assumption of the LDBM is a non-negligible roll
motion of the vehicle. It can be violated by an extremely asymmetric load
(TC00LABEL:TC:AAOD01a), a highly dynamic cornering maneuver
(TC00LABEL:TC:AAOD01b), or a high position of the CoG (TC00LABEL:TC:AAOD01c).

Potential problems arising from the interoperation of the MPC-TP with the TC
and from the lack of interaction-awareness have already been discussed (see
Section 5.3). In addition, the MPC-TP may cause a lack of string stability in
a chain of vehicles (TC00LABEL:TC:StringStability). If the leading brakes
abruptly, this can lead to the build-up of an increasing wave of braking
maneuvers by all following vehicles. This string instability may be fostered
by the MPC-TP in the middle of a chain of human-driven or automated vehicle,
which may lead to collisions (FI00LABEL:FI:StringStability), if the MPC-TP is
not properly tuned.

The outputs of the MPC-TP include the reference trajectory and the solver exit
flag (see Figure 1).

Without software or hardware faults, the computed reference trajectory will be
consistent, admissible, drivable, and collision-free, if the set $\mathcal{T}$
of such trajectories is non-empty. However, due to the finite prediction time
of $T_{\mathrm{p}}=6\,\mathrm{s}$, the MPC-TP may lead the vehicle to an
(unsafe) situation that cannot be resolved by a future trajectory, i.e., where
$\mathcal{T}$ becomes empty. In MPC language, this is known as the lack of
_recursive feasibility_ (FI00LABEL:FI:RecursiveFeasibility). A possible TC is
the fast approach of a slowly driving TgtV in the front of the EgoV, where the
TgtV cannot be avoided by a lateral maneuver (TC00LABEL:TC:SlowLeadingTgtV).

The solver exit flag itself might provide an indication of a triggered FI. In
particular, all exit flag values $q_{\mathrm{exit}}\neq 1$ should be
considered carefully:

  * •

$q_{\mathrm{exit}}=2$ indicates that the MPC may exceed the allotted
computation time (FI00LABEL:FI:InsufficientTime), but produces a feasible
trajectory. This could be triggered by rapidly changing traffic situations
(TC00LABEL:TC:AAOD02) or by suddenly appearing obstacles (TC00LABEL:TC:AFD01).

  * •

$q_{\mathrm{exit}}=3$ means that the MPC-TP is unable to generate a feasible
(collision-free) trajectory for the given constraints, because $\mathcal{T}$
is empty (FI00LABEL:FI:Infeasible). For example, this can be triggered by
(TC00LABEL:TC:AOUCS05), (TC00LABEL:TC:AOUCS06), (TC00LABEL:TC:AOUCS07),
(TC00LABEL:TC:AOUCS08), (TC00LABEL:TC:ASA04),
(TC00LABEL:TC:AFD01),(TC00LABEL:TC:AFD02).

  * •

$q_{\mathrm{exit}}=4$ means that the solver is unable to find a solution
(FI00LABEL:FI:NoSolution), even though $\mathcal{T}$ may be non-empty. As
software and hardware faults are out of scope, this must be due to
unpredictable numerical problems (e.g., ill-conditioning, floating point
arithmetics). To the best of the authors’ knowledge, there are no known
specific triggering conditions for this case.

###  5.6 Analysis of Boundary Values

For the analysis of boundary values, the MPC-TP is examined in the context of
scenarios where relevant parameters take on extreme values. Parameters
considered in the analysis include

  * •

_ODD and road parameters_ , i.e., the road bank angle, the friction
coefficient $\mu$, the road curvature, the change of curvature, and the wind
speed;

  * •

_maneuver parameters_ , i.e., the reference velocity, maximum lateral motion
(e.g., due to a sudden lane change or obstacle avoidance), maximum
longitudinal motion (e.g., due to emergency braking or maximum acceleration);

  * •

_vehicle parameters_ , i.e., the vehicle mass ($m$), the moment of inertia
($I_{z}$), the position of the CoG ($x_{\mathrm{cog}}$, $y_{\mathrm{cog}}$,
$z_{\mathrm{cog}}$), the cornering stiffness of the front and the the rear
tires ($C_{\alpha,\mathrm{f}}$, $C_{\alpha,\mathrm{r}}$), and all chassis and
suspension parameters of the specified vehicle class.

The analysis is based on extensive simulations using a high-fidelity vehicle
model, e.g, in CarMaker. The simulations scenarios aim to cover possible
combinations of extreme values of the above parameters. The results are
checked against the requirements (Req0Req01)) - (Req0Req09)).

To this end, a database of artificial test scenarios covering _corner cases_ ,
is generated, based on different incarnations of the _maneuver parameters_.
Specifically for the reference velocity, scenarios are separated into _low-
speed_ ($v\leq v_{\mathrm{low}}=5\,\frac{\mathrm{km}}{\mathrm{h}}$), _medium-
speed_ ($v\leq v_{\mathrm{med}}=50\,\frac{\mathrm{km}}{\mathrm{h}}$), and
_high-speed_ ($v\leq v_{\mathrm{high}}=130\,\frac{\mathrm{km}}{\mathrm{h}}$)
categories. For road curvature and change of curvature, only scenarios that
(at least partially) involve maximum values are considered. The generation
process of corner cases can also be automated, as proposed in Lubiniecki et
al. [45].

The database of corner cases is then simulated for extreme values of the _ODD
and road parameters_ and the _vehicle parameters_. Due to the combinatorial
nature, the number of simulation scenarios thus becomes intractable. To regain
tractability, only _pairs_ of extreme parameter values are included in the
boundary value analysis, while all other parameters are set to their default
or regular values. For some parameters, such as the height of the CoG
$z_{\mathrm{cog}}$, instead of a default or regular values, it is more
reasonable to consider only the maximum value in all simulations. Critical
cases are expected to result from certain parameter combinations (in some or
all corner cases), such as

  * •

the maximum side wind speed $v_{\mathrm{wind},\max}=8\,\mathrm{bft}$ and the
maximum bank angle $\beta_{\max}=8^{\circ}$ (TC00LABEL:TC:CommonTrigger1),

  * •

the minimum friction value $\mu_{\min}=0.15$ and the minimum tire cornering
stiffness $C_{\alpha,\mathrm{f},\min}=60\,\frac{\mathrm{kN}}{\mathrm{rad}}$
(TC00LABEL:TC:CommonTrigger2),

  * •

maximum front tire cornering stiffness
$C_{\alpha,\mathrm{f},\max}=200\,\frac{\mathrm{kN}}{\mathrm{rad}}$ and the
minimum rear tire cornering stiffness
$C_{\alpha,\mathrm{r},\min}=60\,\frac{\mathrm{kN}}{\mathrm{rad}}$, and vice
versa (TC00LABEL:TC:CommonTrigger3).

These TCs may lead the MPC-TP to provide trajectories that are not drivable by
a specific vehicle model or configuration (FI00LABEL:FI:Drivable). However,
these are potential TCs and FIs, and their existence and relevance has to be
confirmed by actually performing a large-scale, high-fidelity simulation
study.

###  5.7 Analysis of Common Triggering Conditions

Generally, common TCs are collected from prior experiences with the
development of similar systems. They may be available, for example, by
internal reports, industry standards, or other publicly documents. The TCs
identified in this way may, of course, overlap with TCs identified using other
methods.

The authors are currently not aware of a database or any other source for
common TCs for a trajectory planner. However, applicable TCs for other ADSs
from the relevant literature have been taken into account in this case study.
In particular, selected TCs for a LKA system from [30] can analyzed with
respect to their ability to challenge the MPC-TP and to trigger potential FIs:

  * •

lane keeping / lane changing scenario with suddenly disappearing lane markings
(TC00LABEL:TC:ASA02a);

  * •

lane keeping / lane changing scenario with dirty, broken, or covered lane
markings (TC00LABEL:TC:ASA02b,c,d);

  * •

lane keeping / lane changing scenario with unrecognizable lane markings due to
direct sunlight or change of lighting conditions, e.g., when entering a tunnel
(TC00LABEL:TC:ACTC03a,b);

  * •

insufficient visibility of lane markings due to low visibility, e.g., due to
snow / ice or fog (TC00LABEL:TC:ACTC04a,b);

  * •

infrastructure items that could be misinterpreted as lane markings, e.g.,
curbs or dividers (TC00LABEL:TC:ACTC05a,b).

Other common TCs for a trajectory planner that can been identified from the
existing literature include

  * •

side wind gusts, e.g., on a bridge deck (TC00LABEL:TC:ASA01a),

  * •

an uneven road surface, due to potholes (TC00LABEL:TC:AOUCS08b) or road bumps
(TC00LABEL:TC:AOUCS08c),

  * •

a slippery road surface, e.g., due to a wet road with foilage
(TC00LABEL:TC:ACTC09a) or a snowy / icy road (TC00LABEL:TC:ACTC09b).

For many of the common TCs from literature it remains unclear however, whether
they activate FIs in the MCP-TP or elsewhere in the system. This needs to be
verified in simulations or real-world experiments.

###  5.8 Environment and Location

The systematic analysis of the environment and location aims to identify
relevant freeway scenarios and warning signs that may compromise the safety of
the MPC-TP. By means of brainstorming, the following scenarios in the ODD can
be identified as potential TCs in this context.

An increase or decrease in the number of lanes on the freeway may present a
particularly challenging situation for the MPC-TP, including:

  * •

entering the freeway from an on-ramp (TC00LABEL:TC:EAL01),

  * •

exiting the freeway via an off-ramp (TC00LABEL:TC:EAL02),

  * •

lane ending / lane merging situations (TC00LABEL:TC:AOUCS04a),

  * •

lane adding situations (TC00LABEL:TC:EAL04).

Similarly, situations with special vehicles or vehicles operating beyond
traffic rules may pose particular difficulties for the MPC-TP, such as:

  * •

a wrong way driver (TC00LABEL:TC:AOUCS06),

  * •

a reckless driver or person driving under-the-influence (TC00LABEL:TC:EAL08),

  * •

an approaching emergency vehicle (TC00LABEL:TC:EAL05),

  * •

a heavy transport or oversized vehicles (TC00LABEL:TC:EAL06),

  * •

a vehicle parking on the freeway shoulder (TC00LABEL:TC:EAL07).

Furthermore, rare situations and uncommon road signs on the German Autobahn
can be considered in the context of this analysis, leading to the following
list of TCs:

  * •

uneven road surface (road sign 112), e.g., due to ruts or blow-ups
(TC00LABEL:TC:AOUCS08d,e),

  * •

an invisible / indetectable substance is substantially lowering the friction
coefficient, e.g., due to an oil spillage (road sign 114)
(TC00LABEL:TC:AOUCS07c),

  * •

the freeway shoulder is not available (TC00LABEL:TC:EAL09) or the shoulder is
to be used as an additional lane (road signs 223.1, 223.2, 223.3)
(TC00LABEL:TC:EAL10),

  * •

end of the freeway (road sign 330.1) (TC00LABEL:TC:EAL11) or a freeway closure
(TC00LABEL:TC:EAL12),

  * •

an unusually steep slope (road signs 108, 110) (TC00LABEL:TC:EAL13) or an
usually high curvature (road signs 103-10, 103-20, 105-10, 105-20) of the road
(TC00LABEL:TC:EAL14),

  * •

dangerous side wind gusts (road sign 117) (TC00LABEL:TC:ASA01),

  * •

potentially unknown traffic scenarios or traffic signs in other European
countries (TC00LABEL:TC:EAL15).

All of the above TCs may affect the ability of the MPC-TP to solve the OCP and
compute a trajectory in due time (FI00LABEL:FI:InsufficientTime), or to find a
feasible (collision-free) trajectory at all (FI00LABEL:FI:Infeasible).
Furthermore, they may cause the MPC-TP to provide trajectories which are not
drivable and thus lead the EgoV to leave its assigned lane and/or collide with
other vehicles or obstacles (FI00LABEL:FI:Drivable) or which may cause the
vehicle to perform unusual, illegal, counter-intuitive or even dangerous
maneuvers (FI00LABEL:FI:DangerousManeuver).

###  5.9 Summary of Identified Triggering Conditions and Functional
Insuffciencies

Appendix Appendix A: Overview of TCs and FIs provides a table with an overview
of all triggering conditions and functional insuffciencies that have been
identified for the MPC-TP in this case study.

##  6 Refined Concept for the Vehicle Level Control System and the MPC-TP

As per the SOTIF lifecycle, the SOTIF-EooC analysis in Section 5 leads to a
revision of the overall concept of the vehicle level control system and the
MPC-TP, in particular. The results include a refinement of the MPC-TP
specifications and design as well as the ODD, as explained in Sections 6.1 and
6.2). As a further consequence, the integration requirements to the vehicle
level control system are updated, as detailed in Section 6.3. Some situations
that could not be (fully) resolved as part of this case study are described in
Sections and .

###  6.1 Refined Specification and Design of the MPC-TP

The refined system architecture based on the SOTIF analysis in Section 5 is
depicted in Figure 9. The particular refinements of the specification and the
design of the MPC-TP are discussed below.

Figure 9: Refined Architecture of the MPC-based trajectory planner.

####  6.1.1 Design Improvements

The SOTIF-EooC analysis has led to the following concepts to improve the
architecture and algorithmic design of the MPC-TP.

An overly conservative behavior of the EgoV (FI00LABEL:FI:AOUCS04c) may
result, e.g., due to the cut-in of a faster TgtV (TC00LABEL:TC:ASA04). This
potential issue can be mitigated by a proper tuning of the MPC-TP.

A trailing TgtV not keeping a proper safety distance to the EgoV
(TC00LABEL:TC:ASA06) may cause a collision in case of a sudden braking
maneuvers of the EgoV (FI00LABEL:FI:ASA03).

S20a*) Even though this lies within the responsibility of the TgtV, the EgoV
shall perform sudden braking maneuvers only when strictly necessary and only
to an appropriate extent. This can be accomplished by adding a strong penalty
on the usage of high braking inputs in the OCP.

S06.1.1b*) Furthermore, the distance to the trailing vehicle shall aslo be
included in the tuning of the MPC-TP.

The interaction with other traffic participants if the right-of-way is unclear
(TC00LABEL:TC:AOUCS04) or if they do not strictly adhere to the traffic rules
(TC00LABEL:TC:ASA05) may lead to an overly conservative behavior of the EgoV
(FI00LABEL:FI:AOUCS04).

S21*) This should be properly resolved by using an interaction-aware MPC
approach, which is the subject of ongoing research [23, 24, 25, 26]. For the
given architecture, the interaction-aware MPC also has to be designed in
coordination with the Tactical Planner.

Finally, a lack of string stability may be fostered by the MPC-TP in a chain
of human-driven or automated vehicles (TC00LABEL:TC:StringStability), which
may potentially lead to collisions (FI00LABEL:FI:StringStability). The
problem, however, is not MPC-specific and has been analyzed in the previous
literature, including ACC systems [46, 47]. It shall be resolved by a proper
tuning of the MPC-TP, which should be verified in extensive simulations and/or
on-road tests.

####  6.1.2 Adaptations to the Reference Trajectory

The interoperation of the MPC-TP with the lower-level TC may lead to
oscillations and even unstable behavior (FI00LABEL:FI:ASA01). S0S14)g*) As a
solution to this, the first $N_{\mathrm{r}}=4$ steps of the previously
computed trajectory remain unchanged, i.e., only the subsequent inputs are
newly computed. $N_{\mathrm{r}}$ is called the _reaction horizon_. The concept
is illustrated in Figure 10. The initial condition for the OCP in (2c) thus
becomes the predicted state $\hat{x}_{N_{\mathrm{r}}}$ from the previous OCP
solution.

Figure 10: Illustration of the reaction horizon.

As a negative consequence of this modification, the reaction time of the MPC-
TP is increased. This is relevant, for instance, if the EgoV has to react to
sudden events in its environment, such as in an emergency braking or obstacle
avoidance scenario. However, a reaction time of
$T_{\mathrm{d}}=N_{\mathrm{r}}t_{\mathrm{s}}=200\,\mathrm{ms}$ is still
superior to that of an average human driver, which is typically between
$600\,\mathrm{ms}$ and $1,000\,\mathrm{ms}$, according to recent studies [48].
Thus a reaction time of $200\,\mathrm{ms}$ is deemed to be sufficient for
common road traffic.

####  6.1.3 Potential Extension of Computation Time

The regular MPC is designed for a maximum computation time of
$t_{\mathrm{c}}=30\,\mathrm{ms}$. This is less than the given sampling time,
$t_{\mathrm{s}}=50\,\mathrm{ms}$, in order to account for additional
latencies, e.g., due to communication and actuation delays. Obviously, the
choice of $t_{\mathrm{c}}$ should be based on generous computational margins
and extensive testing. However, it is generally not possible to guarantee that
the solver always provides a definite answer within this allotted computation
time, i.e., that it finishes with an exit flag $q_{\mathrm{exit}}=1,2,3$ in
due time (FI00LABEL:FI:InsufficientTime). Several TCs have been identified as
part of the SOTIF analysis in Section 5 that may represent a potential cause
for an excess computation time, such as a suddenly appearing obstacle
(TC00LABEL:TC:AFD01), sudden changes of traffic rules (TC00LABEL:TC:AFD02), or
rapidly changing traffic situations (TC00LABEL:TC:AAOD02). A strategy to
remedy this issue may look as follows:

Due to the concept of the reaction horizon, introduced in Section 6.1.2, the
computation time can be extended by multiple (in this case:
$N_{\mathrm{r}}=4$) time steps. In occasional peaks, it can reach up to a
theoretical maximum time of
$\bar{t}_{\mathrm{c}}=t_{\mathrm{c}}+(N_{\mathrm{r}}-1)t_{\mathrm{s}}=180\,\mathrm{ms}$.
After that, a new trajectory must definitely be provided. If multiple time
steps are used to solve the OCP, the new decisions (shown in red in Figure 10)
comprise a corresponding number of time steps, which are now more than a
single one.

Furthermore, the solver settings are adjusted such that the iterations can be
halted after $t_{\mathrm{c}}$, if they have not terminated; or again after
each $t_{\mathrm{c}}+k\,t_{\mathrm{s}}$, for $k=1,2,\dots,N_{\mathrm{r}}-1$.
After each instance, the status of the current iterate can be checked. If the
current exit flag equals to $q_{\mathrm{exit}}=4$, the solver may continue its
computations from the current iterate, until finally the ultimate maximum
solver time $\bar{t}_{\mathrm{c}}$ is reached.

####  6.1.4 Backup MPC

The _Backup MPC_ (MPC-TP2) is a redundant implementation of the _Primary MPC_
(MPC-TP1), which has been discussed thus far. The Backup MPC has the same
inputs and outputs as the Primary MPC, as shown in Figure 9). It is designed
according to the same specifications and requirements, as described in
Sections 2 and 3, except for the following differences:

  * •

The Backup MPC is utilized for safety and not passenger comfort. It has the
ability to perform any maneuver that is physically possible. This means a
different tuning of the weight parameters in the cost function and the traffic
rule and comfort constraints $\mathbb{X}^{(\mathrm{t})}_{t}$ are removed from
the OCP in (2f).

  * •

Instead of a LDBM, which has a linear tire model, the Backup MPC shall include
a NDBM with a Pacejka tire model. The NDBM provides a higher fidelity for the
dynamics of the vehicle at the limits of handling, even though it may have a
longer solution time.

  * •

For additional redundancy, the Backup MPC shall apply a different numerical
solver (different algorithm and/or software implementation) and it shall be
running on an independent computational platform.

The Backup MPC is constantly running in a _shadow mode_. During normal
operation, when the Primary MPC is active, the solutions of the Backup MPC
solutions are simply discarded. The trajectories of the Backup MPC are
activated, or subsequently deactivated, according to a new module called
_Infeasibility Analysis_. Its logic is based on the exit flag of the Primary
MPC $q_{\mathrm{exit}}^{\mathrm{(P)}}$, the exit flag of the Backup MPC
$q_{\mathrm{exit}}^{\mathrm{(B)}}$, and various information from the
perception modules; see Section 6.1.5 for further details. In particular, the
Backup MPC shall be activated if the Primary MPC is unable to find a feasible
solution (FI00LABEL:FI:Infeasible) under the following circumstances:

  * •

The friction coefficient suddenly drops by a value of $\mu_{\mathrm{d}}>0$
within a specified time interval $t_{\mathrm{d}}>0$, due to water, snow / ice,
or oil (TC00LABEL:TC:AOUCS07), or an irregular surface, e.g., due to gravel or
stones, pot holes, or road bumps (TC00LABEL:TC:AOUCS08).

  * •

Static or dynamic obstacles suddenly appear close to the vehicle, e.g., due to
a previously shadowed traffic participant (TC00LABEL:TC:AFD01a), a lost cargo
or other object dropping from a bridge or a truck (TC00LABEL:TC:AFD01b), or a
large animal (e.g., a wild boar) crossing the freeway (TC00LABEL:TC:AFD01c).

  * •

There is a sudden change of traffic rules (TC00LABEL:TC:AFD02), such as the
beginning of a speed limit zone or a no passing zone.

The Backup MPC remains active until the Primary MPC produces a optimal
solution again (case $q_{\mathrm{exit}}=1$) _and_ it is safe to switch back.
For the latter condition, it is important to carefully avoid problems that may
arise from a possible periodic switching behavior between the two planners.

####  6.1.5 Infeasibility Analysis

The desirable outcome of the Primary MPC is a (local) minimum with an
acceptable tolerance ($q_{\mathrm{exit}}=1$). The SOTIF analysis in Section 5,
however, has revealed multiple scenarios where this may not be the case. Then
a new module called the _Infeasibility Analysis_ is activated. Its logic is
designed as follows:

If the Primary MPC has not converged to such a minimum and returns only a
feasible trajectory ($q_{\mathrm{exit}}=2$), the sub-optimal solution is
acceptable on an exceptional basis. Because the sub-optimal solution satisfies
also the terminal constraints, the recursive feasibility of the trajectory
planning is not jeopardized. However, situations where the solver detects the
definite infeasibility of the OCP ($q_{\mathrm{exit}}=3$) or where it is
unable to find a feasible solution ($q_{\mathrm{exit}}=4$) require further
attention. Here a switching logic, as presented in Table 4, is proposed as a
basis for the Infeasibility Analysis.

| Primary MPC (exit flag)
---|---
|  $q_{\mathrm{exit}}^{\mathrm{(P)}}=1$
at $k=0,1$ |  $q_{\mathrm{exit}}^{\mathrm{(P)}}=2$
at $k=0$ |  $q_{\mathrm{exit}}^{\mathrm{(P)}}=2$
at $k=1$ |  $q_{\mathrm{exit}}^{\mathrm{(P)}}=3$
at $k=1$ |  $q_{\mathrm{exit}}^{\mathrm{(P)}}=4$
at $k=1$
Backup MPC (exit flag) |  $q_{\mathrm{exit}}^{\mathrm{(B)}}=1$
at $k=1$ |  P |  P |  B
at $k=1$ |  B
at $k=1$ |  B
at $k=1$
$q_{\mathrm{exit}}^{\mathrm{(B)}}=2$
at $k=1$ |  P |  P |  P |  B
at $k=1$ |  B
at $k=1$
$q_{\mathrm{exit}}^{\mathrm{(B)}}=3$
at $k=1,2$ |  P |  P |  P |  EO
at $k=1$ |  SP
$q_{\mathrm{exit}}^{\mathrm{(B)}}=4$
at $k=1,2$ |  P |  P |  P |  SP |  SP
$q_{\mathrm{exit}}^{\mathrm{(B)}}=3,4$
at $k=3$ |  P |  P |  P |  EO
at $k=3$ |  EO
at $k=3$

Legend: P: continue with Primary MPC solution; B: switch to Backup MPC;
EO: switch to Emergency Operation; SP: use stored Primary MPC solution

Table 4: Partial illustration of the switching logic when the Primary MPC is
active.

Before even activating the switching logic, however, the Infeasibility
Analysis filters a few special situations that will obviously or possibly lead
to an infeasibility of the Primary MPC (FI00LABEL:FI:Infeasible). This
includes

  * •

(TC00LABEL:TC:AOUCS05) a leading TgtV driving in reverse, while the EgoV is at
rest or slowly moving forward;

  * •

(TC00LABEL:TC:ASA04) at higher speeds, the cut-in of a faster TgtV in front of
the EgoV leading to a violation of the safety distance in the present time
step.

For (TC00LABEL:TC:AOUCS05), a special planning mode shall be designed to check
if (a) the EgoV is driving with a speed less than or equal to some threshold
$v_{\mathrm{low}}$ (e.g.,
$v_{\mathrm{low}}=5\,\frac{\mathrm{km}}{\mathrm{h}}$) and (b) the minimum
safety distance to the leading TgtV is already violated at the current time
step. If this is the case, a stopping trajectory is automatically issued that
transitions the EgoV to, or keeps it in, a complete standstill. When the
Primary MPC becomes feasible again, the EgoV resumes its normal operation and
moves forward.

For (TC00LABEL:TC:ASA04), the situation can be resolved by an additional logic
that relaxes the minimum safety distance constraint to a leading TgtV in the
Primary MPC, if it has a higher velocity than the EgoV. Note that, even if the
safety distance is not violated, the cut-in of a faster TgtV
(TC00LABEL:TC:ASA04) may still lead to an overly conservative braking maneuver
on behalf of the EgoV (FI00LABEL:FI:AOUCS04c). This is a separate issue that
has to be resolved by a different measure.

In situations with a slippery road surface (TC00LABEL:TC:ACTC09) or a sudden
drop of the friction value $\mu$ within a time interval of $t_{d}$ for more
than $\mu_{d}$ (TC00LABEL:TC:AOUCS07), in a first step the linear tire regime
of the LDBM in (2b) shall be exchanged with a (nonlinear) Pacejka tire model.
This measure is taken pre-emptively in order to avoid a lack of drivability of
the computed trajectory (FI00LABEL:FI:Drivablea). The Pacejka tire model is
not used as the standard tire model of the Primary MPC because of its
additional computational complexity.

According to Table 4, if the Primary MPC does not produce a feasible solution
($q_{\mathrm{exit}}^{\mathrm{(P)}}=3,4$), the Backup MPC is activated already
after 2 steps. It should be remarked that this could be extended, if the
reaction horizon were increased beyond $N_{\mathrm{r}}=4$, which is used in
this paper. This may allow for further attempts to modify or update the
constraints of the OCP in an acceptable way, similar to the steps described
above. Or additional attempts may be taken to modify the algorithm or the
solver settings in order to achieve an optimal, or at least a feasible
solution, of the OCP.

####  6.1.6 MPC-TP Driving Modes

To adequately adapt to specific traffic or environmental situations, the MPC-
TP needs to introduce a switchable behavior. S22*) In particular, (at
least)the specialized driving modes listed in Table 5 shall be introduced.

Mode |  Description |  AddressedFIs / TCs
---|---|---
Obstacle Avoidance |  Situations where obstacles require an emergency evasive maneuver, e.g., within the current lane, by driving in between two lanes or by using the shoulder |  (TC00LABEL:TC:AOUCS02) i.c.w. (FI00LABEL:FI:AOUCS02)
Rescue Alley |  Situations that require the formation of a rescue alley, e.g., during a congestion or in the presence of an emergency vehicle |  (TC00LABEL:TC:AOUCS01) i.c.w. (FI00LABEL:FI:AOUCS01)
Oversized Vehicle / Heavy Transport |  Situations involving an oversized vehicle or a heavy duty transport in front of the EgoV, require careful driving, driving to one side of a lane or between two lanes, and passing restrictions |  (TC00LABEL:TC:EAL06) i.c.w. (FI00LABEL:FI:InsufficientTime), (FI00LABEL:FI:Infeasible), or (FI00LABEL:FI:DangerousManeuver)
Wrong Way Driver |  Potential encounter with a wrong-way driver, requiring slow driving on the outer right-hand lane without overtaking and keeping a generous safety distance |  (TC00LABEL:TC:AOUCS06) i.c.w. (FI00LABEL:FI:InsufficientTime), (FI00LABEL:FI:Infeasible), or (FI00LABEL:FI:DangerousManeuver)
Trafficable Hard Shoulder |  Situations where the freeway shoulder is open to traffic |  (TC00LABEL:TC:EAL10) i.c.w. (FI00LABEL:FI:InsufficientTime), (FI00LABEL:FI:Infeasible), or (FI00LABEL:FI:DangerousManeuver)
Obstacle on Hard Shoulder |  Situations where the freeway shoulder is blocked by an obstacle (e.g., by a damaged vehicle) or occupied with persons, requiring careful driving and ideally using the left lanes |  (TC00LABEL:TC:EAL07) i.c.w. (FI00LABEL:FI:InsufficientTime), (FI00LABEL:FI:Infeasible), or (FI00LABEL:FI:DangerousManeuver)
Defensive Driving |  General defensive driving (reduced speed, no overtaking, no lane changing, increase safety distances), e.g., due to dropped cargo or large animals crossing the freeway |  (TC00LABEL:TC:AFD01c) i.c.w. (FI00LABEL:FI:InsufficientTime), (FI00LABEL:FI:Infeasible), or (FI00LABEL:FI:DangerousManeuver)
Normal Driving |  All other driving situations |  N/A
Table 5: Specialized driving modes (i.c.w. = ‘in combination with’).

The proper driving mode needs to be selected by the overarching system and
provided to the primary as well as the back-up MPC-TP as additional mode
inputs. The MPC-TPs can then adjust their behaviors considering the detected
situation. This goes hand in hand with integration requirements to detect the
various driving modes.

###  6.2 Refined ODD

S02.3i*) To address issues, where the prediction horizon $N_{\mathrm{p}}$ of
the EgoV is not large enough for the EgoV to come to a full stop if needed
(cf. FI00LABEL:FI:AOUCS03 in combination with (TC00LABEL:TC:AOUCS03), we limit
the maximum permissible speed in the ODD:

$v_{\max}=N_{\mathrm{p}}\,a_{\mathrm{lon},\min}\,t_{\mathrm{s}}\;.$ (3)

As the prediction horizon $N_{\mathrm{p}}$ is static, $v_{\max}$ must be
chosen in accordance with the maximum deceleration $a_{\mathrm{lon},\min}$.
$a_{\mathrm{lon},\min}\leq 0$ is the worst-case (highest) deceleration,
depending on current road conditions. It depends on the worst-case values of
other ODD parameters, in particular the friction value $\mu$.

S02.3o*) To cope with (FI005) in combination with (TC015c) the ODD will be
limited to freeway sections with a game fence.

(S02.3f*,h*) To mitigate (FI00LABEL:FI:Infeasible) in combination with
(TC00LABEL:TC:AOUCS07), in particular with (TC00LABEL:TC:AOUCS07b), we propose
to limit the minimum ambient temperature to $+4^{\circ}\mathrm{C}$ (S02.3f*)
and the permissible minimum road friction value (S02.3h*). This will be
combined with an integration requirement to conservatively estimate the
friction value (IR0LABEL:IR:FrictionEstimation), cf. Section 6.3.

The refined ODD is provided in in Table 6.

Physical Infrastructure |  Identi- fier
---|---
roadway types: |  German divided freeway (Autobahn) |  (S02.3a)
roadway surfaces: |  asphalt or concrete slabs |  (S02.3b)
roadway geometry: |  straightways or curves with bank angles $\leq 8^{\circ}$ (max. value permitted for German roads) |  (S02.3c)
Objects
roadway users - vehicles: |  all vehicles drive forward only |  (S02.3d)
non-roadway users - obstacles/objects: |  no pedestrians or bicycles |  (S02.3e)
Operational Constraints
Speed limits - max. speed limit: |  $v_{\max}=N\,a_{\mathrm{lon},\min}\,t_{\mathrm{s}}$ |  (S02.3i*)
Environmental Constraints
weather - temperature: |  ambient temperature within $[+4^{\circ}\mathrm{C},+50^{\circ}\mathrm{C}]$ |  (S02.3f*)
weather - wind: |  wind speed below $8\,\mathrm{bft}$ ($\leq 74\,\frac{\mathrm{km}}{\mathrm{h}}$) |  (S02.3g)
weather-induced roadway conditions - friction value: |  $\mu>\mu_{\min}=0.15$ |  (S02.3h*)
Zones
Geo-fencing: |  Game fence needs to be present |  (S02.3o*)
Table 6: Refined ODD. (Changes to the original ODD are shown in blue.)

###  6.3 Integration Requirements

A key concept to facilitate the out-of-context development of SOTIF-related
elements are assumptions on the encompassing vehicle control system. As these
need to be ensured during the integration of the SOTIF-EooC into the ADS, they
shall be designated as integration requirements. The new integration
requirements of the SOTIF analysis are listed in Table 7.

Identifier |  Description |  AddressedFIs / TCs
---|---|---
(IR0LABEL:IR:RescueAlleya) |  Congestion situations requiring the formation of a rescue alley shall be detected by the encompassing system. |  (FI00LABEL:FI:AOUCS01) i.c.w. (TC00LABEL:TC:AOUCS01)
(IR0LABEL:IR:RescueAlleyb) |  In case of a detected congestion situation that requires the formation of a rescue alley, the encompassing system shall request the mode ’rescue alley’ from the MPC.
(IR0LABEL:IR:ObstAvoidancea) |  Obstacle avoidance situations shall be detected by the encompassing system. |  (FI00LABEL:FI:AOUCS02) i.c.w. (TC00LABEL:TC:AOUCS02)
(IR0LABEL:IR:RescueAlleyb) |  In case of a detected obstacle avoidance situation, the encompassing system shall request the mode ’obstacle avoidance’ from the MPC, in which the lane keeping constraints are relaxed, but the collision constraints remain intact.
(IR0LABEL:IR:WrongWayDriver) |  Situations with wrong way drivers shall be detected and handled by the encompassing system utilizing a dedicated emergency planner that is independent of the MPC-TP. |  (FI00LABEL:FI:Infeasible) i.c.w. (TC00LABEL:TC:AOUCS06)
(IR0LABEL:IR:FrictionEstimationa) |  The friction value $\mu$ shall be conservatively estimated for a prediction time $T_{\mathrm{p}}=6\,\mathrm{s}$. |  (FI00LABEL:FI:Infeasible) i.c.w. (TC00LABEL:TC:AOUCS07)
(IR0LABEL:IR:FrictionEstimationb) |  It shall be ensured that the actual friction value does not deviate from the actual friction value by more than a tolerance $\Delta\mu$. This will be combined with ODD restriction (S02.3h).
(IR0LABEL:IR:EmergencyOperationRequest) |  Situations where the MPC-TP requests an emergency operation shall be handled by the encompassing system utilizing a dedicated emergency planner that is independent of the MPC-TP. |
(IR0LABEL:IR:IrregularRoadSurface) |  Situations involving irregular road surfaces shall be detected and handled by the encompassing system utilizing the Tactical Planner. |  (FI00LABEL:FI:Infeasible) i.c.w. (TC00LABEL:TC:AOUCS08)
Table 7: Overview of integration requirements (i.c.w. = ‘in combination
with’).

Cases where neither the Primary MPC nor the Back-Up MPC is able to generate a
permissible trajectory shall be handled by the encompassing system as follows:
(IR0LABEL:IR:EmergencyOperationRequest) Situations where the MPC-TP requests
an emergency operation shall be handled by the encompassing system utilizing a
dedicated emergency planner that is independent of the MPC-TP.

Situations involving irregular road surfaces (TC00LABEL:TC:AOUCS08) where the
MPC-TP would be unable to generate a feasible (collision-free) trajectory
(FI00LABEL:FI:Infeasible) shall be identified and handled by the encompassing
system. Here, the Tactical Planner needs to decide what to in such cases,
e.g., depending on the size of the stones or potholes and provide an
appropriate tactical decision to the MPC-TP or handle the situation without
the MPC-TP. This leads to integration requirement
(IR0LABEL:IR:IrregularRoadSurface): Situations involving irregular road
surfaces shall be detected and handled by the encompassing system utilizing
the Tactical Planner.

###  6.4 Situations Requiring Further Analysis

(Further analysis required) The OCP is based on the LDBM, assuming a linear
tire model and no roll motion, which may represent a poor approximation of a
real vehicle if these assumptions are violated (FI00LABEL:FI:AAOD01). The non-
negligible roll motion may be violated by an extremely asymmetric load
(TC00LABEL:TC:AAOD01a), a highly dynamic cornering maneuver
(TC00LABEL:TC:AAOD01b), or a high position of the CoG (TC00LABEL:TC:AAOD01c).
A detailed simulation analysis is required to examine whether the LDBM is
sufficient for the targeted use cases (especially with respect to Req0Req07)),
or whether a two-track model is required instead.

Situations encompassing side wind gusts (TC00LABEL:TC:ASA01) are deemed as
adequately covered by the wind limitation in the ODD (S02.3g).

Potentially unknown traffic scenarios or traffic signs, e.g., due to deviating
regulations in other European countries, are potentially problematic as well
(TC00LABEL:TC:EAL15). However, the existing ODD restriction limits the
permissible roadway types to the German Autobahn (S02.3a) seems sufficient to
mitigate this concern.

###  6.5 Interaction-aware MPC

Particular combinations of TCs and FIs cannot be adressed without extending
the architecture of the encompassing vehicle, e.g. by adding additional senors
and/or capabilities. An example is the combination of (TC00LABEL:TC:AOUCS04a)
and (FI00LABEL:FI:AOUCS04). As per our analysis the OCP in (2) may lead to an
overly conservative behavior of the EgoV (FI00LABEL:FI:AOUCS04), possibly
leading to poor progress on the road (FI00LABEL:FI:AOUCS04a), or even a
deadlock (FI00LABEL:FI:AOUCS04b). The only safe way to reduce this
conservatively is to internalize the relevant TgtVs in the MPC predictions and
to reflect the interactions between the TgtVs and the EgoV by appropriate
behavioral models. Interaction-aware MPC approaches, however, are the subject
of ongoing and future research [23, 24, 25, 26] and are beyond the scope of
this paper.

##  7 Conclusion

In this paper, multiple aspects of the general SOTIF framework provided in ISO
21448 have been applied to a generic MPC-based trajectory planner, which is
part of an ADS. The generic MPC-TP is treated as an SOTIF-EooC, elaborating
this concept that is only sketched in the SOTIF standard. In a first step, the
initial concept of a generic MPC-TP has been analyzed in order to identify
relevant FIs and corresponding TCs. To this end, the analysis techniques that
are described in ISO 21448 only in very general terms have to be interpreted
and applied to the case study. In a second step, the resulting comprehensive
list of relevant FIs and TCs informed an SOTIF-optimized concept of the MPC-
TP. The revised safety architecture includes, in particular, an infeasibility
analysis as a component and a back-up trajectory planner, a switchable
behavior of the MPC-TP to support special driving modes, and adaptations to
the reference trajectory.

An important aspect of the results is the identification of important research
topics on MPC for path planning in the context of automated and autonomous
driving, from a safety perspective:

  * (i)

interaction-awareness with other (human) traffic participants;

  * (ii)

ability to avoid obstacles and drive safely even at low friction values;

  * (iii)

design of a recursively feasible MPC-based path planner with a reaction
horizon;

  * (iv)

string stability in a chain of vehicles;

  * (v)

examination of a safe switching logic between a Primary MPC and a Backup MPC.

In future work, an extensive simulation study would be beneficial for a more
detailed understanding of the potential shortcomings of the MPC approach
itself, or the respective vehicle model to be used for its predictions in
extreme driving situations.

## Acknowledgment

The research leading to these results was funded by the German Federal
Ministry for Economic Affairs and Climate Action (BMWK) through the project
EEMotion.

10cm(4.5cm,2cm)

## Appendix A: Overview of TCs and FIs

TC |  Triggered FI |  Notes
---|---|---
(TC001) traffic congestion |  (FI001) no capability to form a rescue alley for police or ambulances
(FI002) generation of trajectories representing unusual, illegal, counter-intuitive, or dangerous maneuvers |  (refined specification/design) introduce switchable behavior of the MPC (driving mode: Rescue Alley)
(integration requirement) congestion situations shall be detected and handled
by the encompassing system (IR01a,b)
(TC002) obstacle avoidance scenario |  (FI003) no capability to carry out emergency maneuvers without a proper lane change, driving in between two lanes, or by using the shoulder
(FI00LABEL:FI:DangerousManeuver) generation of trajectories representing unusual, illegal, counter-intuitive, or dangerous maneuvers |  (refined specification/design) introduce switchable behavior of the MPC (driving mode: Obstacle Avoidance)
(integration requirement) obstacle avoidance situations shall be detected and
handled by the encompassing system (IR02a,b)
(TC003) blocking obstacle shortly beyond the prediction horizon $N_{\mathrm{p}}$ of the MPC-TP and no obstacle avoidance is possible |  (FI004) prediction horizon $N_{\mathrm{p}}$ of the MPC-TP is too short to come to a full stop within it |  (ODD restriction) limit permissible max. speed to $v_{\max}=\left|N_{\mathrm{p}}\,a_{\mathrm{lon},\min}\,t_{\mathrm{s}}\right|$ (S02.3i*)
(TC004a) right-of-way is unclear: at the end of two merging lanes
(TC00LABEL:TC:AOUCS04b) right-of-way is unclear: special situations during general lane changes |  (FI005a) overly conservative behavior of the MPC-TP: inability to ensure sufficient progress on the road
(FI00LABEL:FI:AOUCS04b) overly conservative behavior of the MPC-TP: inability
to avoid deadlocks in certain situations
(FI00LABEL:FI:DangerousManeuver) generation of trajectories representing unusual, illegal, counter-intuitive, or dangerous maneuvers |  (Interaction-aware MPC) interaction-aware MPC approach, in coordination with the Tactical Planner (S06.1.1*)
(TC005) Leading TgtV driving in reverse, in combination with a stopping or slowly moving EgoV |  (FI006) inability to generate a feasible (collision-free) trajectory in certain situations |  (refined specification/design) infeasibility analysis: selection of stopping trajectory in situations with low speed and safety distance violated
(TC006) wrong way driver |  (FI00LABEL:FI:Infeasible) inability to generate a feasible (collision-free) trajectory in certain situations
(FI00LABEL:FI:DangerousManeuver) generation of trajectories representing unusual, illegal, counter-intuitive, or dangerous maneuvers |  (refined specification/design) introduce switchable behavior of the MPC (driving mode: Wrong Way Driver)
(integration requirement) if infeasibility still occurs, switch to emergency
operation of the encompassing system (IR03)
(integration requirement) situations with wrong way drivers shall be detected
and handled by dedicated mode of the encompassing system (IR04)
(TC007a) sudden drop of friction coefficient: water (hydroplaning)
(TC00LABEL:TC:AOUCS07b) sudden drop of friction coefficient: snow / ice
(TC00LABEL:TC:AOUCS07c) sudden drop of friction coefficient: oil spillage |  (FI00LABEL:FI:Infeasible) inability to generate a feasible (collision-free) trajectory in certain situations |  (ODD restriction) limit permissible minimum temperature to exclude snowy/icy conditions (S02.3f*)
(ODD restriction) limit permissible minimum friction value (S02.3h*)
(integration requirement) conservative estimation of the friction value
(IR05a)
(refined specification/design) avoid small areas filled with water by evasive
maneuvers within the lane boundaries
(TC00LABEL:TC:AOUCS07a) sudden drop of friction coefficient: water
(hydroplaning)
(TC00LABEL:TC:AOUCS07b) sudden drop of friction coefficient: snow, ice
(TC00LABEL:TC:AOUCS07c) sudden drop of friction coefficient: oil spillage |  (FI007a) inability to generate a drivable trajectory in certain situations: due to linear tire model in LDBM |  (refined specification/design) infeasibility analysis: temporarily relax the linear tire regime if the friction value drops by more than $\mu_{\mathrm{d}}$ within $t_{\mathrm{d}}$
(TC008a) irregular road surface: gravel or stones
(TC00LABEL:TC:AOUCS08b) irregular road surface: potholes
(TC00LABEL:TC:AOUCS08c) irregular road surface: road bumps |  (FI00LABEL:FI:Drivableb) inability to generate a drivable trajectory in certain situations: due to irregular road surface |  (integration requirement) situations with irregular road surface shall be detected and handled by the encompassing system in combination with the Tactical Planner (IR06)
(TC009a) side wind gusts: bridge deck
(TC00LABEL:TC:ASA02a) irregular lane markings: suddenly disappearing lane
markings
(TC010b) irregular lane markings: dirty lane markings
(TC00LABEL:TC:ASA02c) irregular lane markings: broken lane markings
(TC00LABEL:TC:ASA02d) irregular lane markings: covered lane markings |  (FI008) receding-horizon planning of the MPC-TP in combination with tracking controller could lead to oscillations, or even an unstable behavior of the EgoV |  (refined specification/design) MPC-TP to keep the first $N_{\mathrm{r}}=4$ steps (reaction horizon) of the trajectory unchanged (S0S14)g*)
(TC00LABEL:TC:AOUCS04) right-of-way is unclear
(TC011) other traffic participants not strictly adhering to the traffic rules |  (FI00LABEL:FI:AOUCS04a) overly conservative behavior of the MPC-TP: inability to ensure sufficient progress on the road
(FI00LABEL:FI:AOUCS04b) overly conservative behavior of the MPC-TP: inability
to avoid deadlocks in certain situations
(FI00LABEL:FI:DangerousManeuver) generation of trajectories representing unusual, illegal, counter-intuitive, or dangerous maneuvers |  (Interaction-aware MPC) interaction-aware MPC approach, in coordination with the Tactical Planner (S06.1.1*)
(TC012) cut-in of a faster TgtV in front of the EgoV |  (FI00LABEL:FI:AOUCS04c) overly conservative behavior of the MPC-TP: overly conservative braking in cut-in scenarios |  (refined specification/design) tuning of MPC-TP such that it avoids overly conservative braking to a leading TgtV with a positive relative velocity
(FI00LABEL:FI:Infeasible) inability to generate a feasible (collision-free) trajectory in certain situations |  (refined specification/design) infeasibility analysis: if TgtV cuts into the EgoV’s lane and is faster than EgoV, then temporarily relax linear minimum distance to this TgtV
(TC013) trailing vehicle driving closely behind the EgoV in the same lane, not keeping a proper safety distance |  (FI009) inability of the MPC-TP to consider trailing traffic in the lane of the EgoV, where a sudden braking maneuver of the EgoV may lead to a collision |  (refined specification/design) MPC-TP to brake only when strictly necessary and only to an appropriate extent (S06.1.1a*)
(refined specification/design) MPC-TP to account for distance to trailing
vehicle by means of tuning the weight of $\ell_{\mathrm{o}}(\cdot,\cdot)$ in
the cost function (S06.1.1b*)
(TC014a) suddenly appearing obstacle: previously shadowed traffic participant
(TC00LABEL:TC:AFD01b) suddenly appearing obstacle: object dropping from a
bridge or truck
(TC00LABEL:TC:AFD01c) suddenly appearing obstacle: large animal (e.g., wild boar) crossing the freeway |  (FI00LABEL:FI:Infeasible) inability to compute a feasible (collision-free) trajectory in certain situations
(FI010) insufficient time to solve the OCP, in order to compute a new trajectory |  (refined specification/design) infeasibility analysis
(refined specification/design) potential extension of computation time to
multiple time steps based on the concept of a reaction horizon
(FI00LABEL:FI:DangerousManeuver) generation of trajectories representing unusual, illegal, counter-intuitive, or dangerous maneuvers |  (ODD restriction) limit ODD to freeway sections with a game fence (S02.3o*)
(refined specification/design) introduce switchable behavior of the MPC
(driving mode: Defensive Driving)
(TC015a) sudden traffic rule change: start of a speed limit area
(TC00LABEL:TC:AFD02b) sudden traffic rule change: start of a no passing zone |  (FI00LABEL:FI:Infeasible) inability to generate a feasible (collision-free) trajectory in certain situations
(FI00LABEL:FI:InsufficientTime) insufficient time to solve the OCP, in order to compute a new trajectory |  (ODD restriction) limit permissible max. speed to $v_{\max}=\left|N_{\mathrm{p}}\,a_{\mathrm{lon},\min}\,t_{\mathrm{s}}\right|$ (S02.3i*)
(refined specification/design) infeasibility analysis
(refined specification/design) potential extension of computation time to
multiple time steps based on the concept of a reaction horizon
(TC016a) LDBM assumption violation: asymmetric load
(TC00LABEL:TC:AAOD01b) LDBM assumption violation: dynamic cornering
(TC00LABEL:TC:AAOD01c) LDBM assumption violation: high position of the CoG |  (FI011) poor approximation of real vehicle behavior by the LDBM in the OCP |  (further analysis required) experimental analysis: evaluate if MPC-TP behaves safely in these situations; otherwise consider usage of a more complex model (e.g., a two track model) in the OCP
(TC017) chain of vehicles, EgoV in the middle, first vehicle brakes suddenly |  (FI012) lack of string stability of MPC-TP in a chain of vehicles, potentially leading to collisions |  (refined specification/design) proper tuning of MPC-TP for string stability, to be verified in simulations and/or on-road tests
(TC018) fast approach of a slowly driving TgtV in the front of the EgoV, where the TgtV cannot be avoided by a lateral maneuver |  (FI00LABEL:FI:Infeasible) inability to generate a feasible (collision-free) trajectory in certain situations
(FI013) lack of recursive feasibility |  (refined specification/design) infeasibility analysis
(refined specification/design) if collision is unavoidable, activation of a
collision mitigation mode in the encompassing system
(TC019) rapidly changing traffic situations |  (FI00LABEL:FI:InsufficientTime) insufficient time to solve the OCP, in order to compute a new trajectory |  (refined specification/design) potential extension of computation time to multiple time steps based on the concept of a reaction horizon
no specific TCs known |  (FI014) inability to generate a solution in certain situations at all |  (refined specification/design) infeasibility analysis
Pairs of extreme parameter values in some or all corner cases:
(TC020) max. side wind speed $v_{\mathrm{wind},\max}=8\,\mathrm{bft}$ and max.
bank angle $\beta_{\max}=8^{\circ}$
(TC021) min. friction value $\mu_{\min}=0.15$ and min. tire cornering
stiffness $C_{\alpha,\mathrm{f},\min}=60\,\frac{\mathrm{kN}}{\mathrm{rad}}$
(TC022a) max. front tire cornering stiffness
$C_{\alpha,\mathrm{f},\max}=200\,\frac{\mathrm{kN}}{\mathrm{rad}}$ $\times$
and min. rear tire cornering stiffness
$C_{\alpha,\mathrm{r},\min}=60\,\frac{\mathrm{kN}}{\mathrm{rad}}$
(TC00LABEL:TC:CommonTrigger3b) min. front tire cornering stiffness
$C_{\alpha,\mathrm{f},\min}=60\,\frac{\mathrm{kN}}{\mathrm{rad}}$ $\times$ and
max. rear tire cornering stiffness
$C_{\alpha,\mathrm{r},\max}=200\,\frac{\mathrm{kN}}{\mathrm{rad}}$
… |  (FI00LABEL:FI:Drivablea) inability to generate a drivable trajectory in certain situations: due to linear tire model in LDBM
(FI00LABEL:FI:AAOD01) poor approximation of real vehicle behavior by the LDBM in the OCP |  (further analysis needed) experimental analysis for pairs of boundary values, conduct simulations to confirm/discard relevance of LDBM for MPC-TP; otherwise consider usage of a more complex model (e.g., a two track model) in the OCP
(TC00LABEL:TC:ASA02a) irregular lane markings: suddenly disappearing lane
markings
(TC00LABEL:TC:ASA02b) irregular lane markings: dirty lane markings
(TC00LABEL:TC:ASA02c) irregular lane markings: broken lane markings
(TC00LABEL:TC:ASA02d) irregular lane markings: covered lane markings |  |  (further analysis needed) common TCs, conduct simulations to confirm/discard relevance for MPC-TP
(TC023a) unrecognizable lane markings: direct sunlight
(TC00LABEL:TC:ACTC03b) unrecognizable lane markings: change of lighting conditions, e.g., when entering a tunnel |  |  (further analysis needed) common TCs, conduct simulations to confirm/discard relevance for MPC-TP
(TC024a) insufficient visibility of lane markings: snow / ice
(TC00LABEL:TC:ACTC04b) insufficient visibility of lane markings: fog |  |  (further analysis needed) common TCs, conduct simulations to confirm/discard relevance for MPC-TP
(TC025a) infrastructure items that could be misinterpreted as lane markings:
curbs
(TC00LABEL:TC:ACTC05b) infrastructure items that could be misinterpreted as lane markings: dividers |  |  (further analysis needed) common TCs, conduct simulations to confirm/discard relevance for MPC-TP
(TC00LABEL:TC:AOUCS08b) irregular road surface: potholes
(TC00LABEL:TC:AOUCS08c) irregular road surface: road bumps |  |  (further analysis needed) common TCs, conduct simulations to confirm/discard relevance for MPC-TP
(TC026a) slippery road surface: wet road with foilage
(TC00LABEL:TC:ACTC09b) slippery road surface: snowy / icy road |  (FI00LABEL:FI:Drivablea) inability to generate a drivable trajectory in certain situations: due to linear tire model in LDBM |  (ODD restriction) limit permissible minimum temperature to exclude snowy/icy conditions (S02.3f*)
(refined specification/design) infeasibility analysis: temporarily relax the
linear tire regime if the friction value drops by more than $\mu_{\mathrm{d}}$
within $t_{\mathrm{d}}$
(further analysis needed) common TCs, conduct simulations to confirm/discard
relevance for MPC-TP
(TC027) entering the freeway from an on-ramp
(TC028) exiting the freeway via an off-ramp
(TC029) lane adding situations |  (FI00LABEL:FI:InsufficientTime) insufficient time to solve the OCP, in order to compute a new trajectory
(FI00LABEL:FI:Infeasible) inability to generate a feasible (collision-free) trajectory in certain situations |  (refined specification/design) potential extension of computation time to multiple time steps based on the concept of a reaction horizon
(refined specification/design) infeasibility analysis
(FI00LABEL:FI:DangerousManeuver) generation of trajectories representing unusual, illegal, counter-intuitive, or dangerous maneuvers |  (further analysis needed) conduct simulations and/or real experiments
situations with special vehicles or vehicles operating beyond traffic rules:
(TC00LABEL:TC:AOUCS06) wrong way driver
(TC030) approaching emergency vehicle
(TC031) heavy transport or oversized vehicles
(TC032) vehicle parking on the freeway shoulder
(TC033) reckless driver / person driving under-the-influence |  (FI00LABEL:FI:DangerousManeuver) generation of trajectories representing unusual, illegal, counter-intuitive, or dangerous maneuvers |  (refined specification/design) introduce specialized driving modes for particular situations (S06.1.6*)
(further analysis needed) conduct simulations and/or real experiments
(FI00LABEL:FI:InsufficientTime) insufficient time to solve the OCP, in order
to compute a new trajectory
(FI00LABEL:FI:Infeasible) inability to generate a feasible (collision-free)
trajectory in certain situations
|  (refined specification/design) potential extension of computation time to
multiple time steps based on the concept of a reaction horizon
(refined specification/design) infeasibility analysis
(TC00LABEL:TC:AOUCS08d) irregular road surface: ruts
(TC00LABEL:TC:AOUCS08e) irregular road surface: blow-ups |  (FI00LABEL:FI:InsufficientTime) insufficient time to solve the OCP, in order to compute a new trajectory
(FI00LABEL:FI:Infeasible) inability to generate a feasible (collision-free) trajectory in certain situations |  (refined specification/design) potential extension of computation time to multiple time steps based on the concept of a reaction horizon
(refined specification/design) infeasibility analysis
(FI00LABEL:FI:DangerousManeuver) generation of trajectories representing unusual, illegal, counter-intuitive, or dangerous maneuvers |  (further analysis) extension of perception required
(TC034) freeway shoulder not available
(TC035) freeway shoulder to be used as additional lane |  (FI00LABEL:FI:DangerousManeuver) generation of trajectories representing unusual, illegal, counter-intuitive, or dangerous maneuvers |  (refined specification/design) introduce specialized driving modes for particular situations (S06.1.6*)
(further analysis needed) conduct simulations and/or real experiments
(TC036) end of freeway
(TC037) freeway closure |  (FI00LABEL:FI:DangerousManeuver) generation of trajectories representing unusual, illegal, counter-intuitive, or dangerous maneuvers |  (further analysis needed) conduct simulations and/or real experiments
(TC038) steep road slope
(TC039) high road curvature |  (FI00LABEL:FI:Drivablea) inability to generate a drivable trajectory in certain situations: due to linear tire model in LDBM
(FI00LABEL:FI:AAOD01) poor approximation of real vehicle behavior by the LDBM in the OCP |  (further analysis required) experimental analysis: evaluate if MPC-TP behaves safely in these situations; otherwise consider usage of a more complex model (e.g., a two track model) in the OCP
(TC00LABEL:TC:ASA01) side wind gusts |  (FI00LABEL:FI:DangerousManeuver) generation of trajectories representing unusual, illegal, counter-intuitive, or dangerous maneuvers
(FI00LABEL:FI:Infeasible) inability to generate a feasible (collision-free)
trajectory in certain situations
(FI00LABEL:FI:InsufficientTime) insufficient time to solve the OCP, in order to compute a new trajectory |  (no change needed) covered by wind limitation in the ODD (S02.3g)
(TC040) potentially unknown traffic scenarios / traffic signs in other European countries |  (FI00LABEL:FI:DangerousManeuver) generation of trajectories representing unusual, illegal, counter-intuitive, or dangerous maneuvers
(FI00LABEL:FI:Infeasible) inability to generate a feasible (collision-free)
trajectory in certain situations
(FI00LABEL:FI:InsufficientTime) insufficient time to solve the OCP, in order to compute a new trajectory |  (no change needed) covered by permissible road type restriction in the ODD (S02.3a)

## References

  * [1] M. Montemerlo, et al., Stanley: The robot that won the DARPA Grand Challenge, Journal of Field Robotics 23 (9) (2006) 661–692.  doi:10.1002/rob.20147.
  * [2] M. Montemerlo, et al., Junior: The Stanford entry in the urban challenge, Journal of Field Robotics 25 (9) (2008) 569–597.
  * [3] A. Bacha, C. Bauman, R. Faruque, M. Fleming, C. Terwelp, C. Reinholtz, D. Hong, A. Wicks, T. Alberi, D. Anderson, S. Cacciola, P. Currier, A. Dalton, J. Farmer, J. Hurdus, S. Kimmel, P. King, A. Taylor, D. V. Covern, M. Webster, Odin: Team VictorTango?s entry in the DARPA Urban Challenge, Journal of Field Robotics 25 (8) (2003) 467–492.  doi:10.1177/02783649030227008.
  * [4] B. Paden, M. Čáp, S. Z. Yong, D. Yershov, E. Frazzoli, A survey of motion planning and control techniques for self-driving urban vehicles, IEEE Transactions on Intelligent Vehicles 1 (2016) 33–55.  doi:10.1109/TIV.2016.2578706.
  * [5] S. Dixit, U. Montanaro, M. Dianati, D. Oxtoby, T. Mizutani, A. Mouzakitis, S. Fallah, Trajectory planning for autonomous high-speed overtaking in structured environments using Robust MPC, IEEE Transactions on Intelligent Transportation Systems 21 (6) (2020) 2310–2323.  doi:10.1109/TITS.2019.2916354.
  * [6] A. Musa, M. Pipicelli, M. Spano, F. Tufano, F. De Nola, G. Di Blasio, A. Gimelli, D. A. Misul, G. Toscano, A review of Model Predictive Controls applied to advanced driver-assistance systems, Energies 14 (23) (2021) 7974–7997.  doi:10.3390/en14237974.
  * [7] D. Q. Mayne, J. B. Rawlings, C. Rao, P. O. Scokaert, Constrained model predictive control: Stability and optimality, Automatica 36 (6) (2000) 789–814.
  * [8] L. Grüne, J. Pannek, Nonlinear Model Predictive Control, Springer, London et al., 2011.
  * [9] F. Borrelli, A. Bemporad, M. Morari, Predictive Control for Linear and Hybrid Systems, Cambridge University Press, Cambridge, United Kingdom, 2017.  doi:10.1017/978-1-139-06175-9.
  * [10] J. B. Rawlings, D. Q. Mayne, M. M. Diehl, Model Predictive Control: Theory, Computation, and Design, 2nd Edition, Nob Hill Publishing, Madison (WI), United States, 2018.
  * [11] C. Götte, M. Keller, C. Haß, T. Bertram, Model predictive planning and control applied to critical traffic situations, ATZ Worldwide 118 (9) (2016) 64–69.
  * [12] G. Franzè, W. Lucia, A receding horizon control strategy for autonomous vehicles in dynamic environments, IEEE Transactions on Control Systems Technology 24 (2016) 695–702.  doi:10.1109/TCST.2015.2440999.
  * [13] J. V. Frasch, A. Gray, M. Zanon, H.-J. Ferreau, S. Sager, F. Borrelli, M. Diehl, An auto-generated nonlinear MPC algorithm for real-time obstacle avoidance of ground vehicles, in: European Control Conference, Zurich, Switzerland, 2013, pp. 4136–4141.
  * [14] J. Kong, M. Pfeiffer, G. Schildbach, F. Borrelli, Kinematic and dynamic vehicle models for autonomous driving control design, in: IEEE Intelligent Vehicles Symposium, Seoul, Korea, 2015, pp. 1094–1099.
  * [15] B. Gutjahr, L. Gröll, M. Werling, Lateral vehicle trajectory optimization using constrained linear time-varying MPC, IEEE Transactions on Intelligent Transportation Systems 18 (6) (2017) 1586–1595.  doi:10.1109/TITS.2016.2614705.
  * [16] A. Carvalho, Predictive control under uncertainty for safe autonomous driving: Integrating data-driven forecasts with control design, Ph.D. dissertation, University of California Berkeley, Berkeley (CA), United States (2016).
  * [17] G. Schildbach, F. Borrelli, Scenario model predictive control for lane change assistance on highways, in: IEEE Intelligent Vehicles Symposium, Seoul, South Korea, 2015, pp. 611–616.
  * [18] G. Cesari, A. Carvalho, G. Schildbach, F. Borrelli, Scenario model predictive control for lane change assistance and autonomous driving on highways, IEEE Intelligent Transportation Systems Magazine 9 (3) (2017) 23–35.
  * [19] S. Longo, Virtual driver for autonomous vehicles, https://www.embotech.com/products/prodriver/overview, accessed: 2023-08-06.
  * [20] A. Carvalho, S. Lefèvre, G. Schildbach, J. Kong, F. Borrelli, Automated driving, the role of forecasts and uncertainty – a control perspective, European Journal of Control 24 (2015) 14–32.
  * [21] K. Liu, N. Li, H. E. Tseng, I. Kolmanovsky, A. Girard, Interaction-aware trajectory prediction and planning for autonomous vehicles in forced merge scenarios, IEEE Transactions on Intelligent Transportation Systems 24 (1) (2023) 474–488.  doi:10.1109/TITS.2022.3216792.
  * [22] P. Gupta, D. Isele, D. Lee, S. Bae, Interaction-aware trajectory planning for autonomous vehicles with analytic integration of Neural Networks into Model Predictive Control, arXiv Preprint (2023) 1–7doi:10.48550/arXiv.2301.05393.
  * [23] S. H. Nair, V. Govindarajan, T. Lin, Y. Wang, E. H. Tseng, F. Borrelli, Stochastic MPC with dual control for autonomous driving with multi-modal interaction-aware predictions, in: 15th International Symposium on Advanced Vehicle Control, Kanagawa, Japan, 2022.
  * [24] T. Benciolini, D. Wollherr, M. Leibold, Non-conservative trajectory planning for automated vehicles by estimating intentions of dynamic obstacles, IEEE Transactions on Intelligent Vehicles 8 (3) (2023) 2463–2481.  doi:10.1109/TIV.2023.3234163.
  * [25] Y. Chen, U. Rosolia, W. Ubellacker, N. Csomay-Shanklin, Aaron D. Ames, Interactive multi-modal motion planning with Branch Model Predictive Control, IEEE Robotics and Automation Letters 7 (2) (2022) 5365–5372.  doi:10.1109/LRA.2022.3156648.
  * [26] R. Oliveira, S. H. Nair, B. Wahlberg, Interaction and decision making-aware motion planning using Branch Model Predictive Control, arXiv Preprint (2023) 1–8doi:10.48550/arXiv.2302.00060.
  * [27] ISO 21448:2022 Road vehicles – Safety of the intended functionality, International standard, International Organization for Standardization, Geneva, CH (Jun. 2022).
  * [28] R. Zhu, A. Gu, Z. Wu, B. Liu, M. Yu, Research on sotif of automatic driving system, in: 2022 14th International Conference on Measuring Technology and Mechatronics Automation (ICMTMA), 2022, pp. 228–231.  doi:10.1109/ICMTMA54903.2022.00051.
  * [29] Z. Qidong, Z. Tong, Z. Yunshuang, C. Chao, Z. Qingyu, Z. Shuai, D. Zhibin, The research on the identification of acc sotif triggering conditions based on scenario analysis, in: 2022 IEEE International Conference on Real-time Computing and Robotics (RCAR), 2022, pp. 263–266.  doi:10.1109/RCAR54675.2022.9872207.
  * [30] L. Junfeng, Z. Yunshuang, Z. Shuai, C. Chao, D. Zhibin, A research on sotif of lka based on stpa, in: 2022 IEEE International Conference on Real-time Computing and Robotics (RCAR), 2022, pp. 396–400.  doi:10.1109/RCAR54675.2022.9872242.
  * [31] M. Baer, M. E. Bouzouraa, C. Demiral, U. Hofmann, S. Gies, K. Diepold, Egomaster: A central ego motion estimation for driver assist systems, in: IEEE International Conference on Control and Automation, Christchurch, New Zealand, 2009, pp. 1708–1715.  doi:10.1109/ICCA.2009.5410518.
  * [32] E. Thorn, M. Kimmel, Shawn C.and Chaka, A framework for automated driving system testable cases and scenarios (rep. no dot hs 812 623), Tech. rep., National Highway Traffic Safety Administration, Washington, DC (2018).
  * [33] ISO 34503: Road Vehicles – Test scenarios for automated driving systems – Specification for operational design domain, International standard, International Organization for Standardization, Geneva, Switzerland (2023).
  * [34] PEGASUS method – an overview, Project report, German Aerospace Center, Braunschweig, Germany (2019).
  * [35] C. Liu, S. Lee, S. Varnhagen, H. E. Tseng, Path planning for autonomous vehicles using Model Predictive Control, in: IEEE Intelligent Vehicles Symposium, Redondo Beach (CA), United States, 2017, pp. 174–179.  doi:10.1109/IVS.2017.7995716.
  * [36] S. Yu, M. Hirche, Y. Huang, H. Chen, F. Allgöwer, Model Predictive Control for autonomous ground vehicles: A review, Autonomous Intelligent Systems 1 (4) (2021) 1–17.  doi:10.1007/s43684-021-00005-z.
  * [37] F. Micheli, M. Bersani, S. Arrigoni, F. Braghin, F. Cheli, NMPC trajectory planner for urban autonomous driving, Vehicle System Dynamics 0 (0) (2022) 1–23.  doi:10.1080/00423114.2022.2081220.
  * [38] A. Wächter, Introduction to IPOPT: A tutorial for downloading, installing, and using IPOPT, Technical report, IBM T.J. Watson Research Center, Yorktown Heights (NY), United States, available at http://web.mit.edu/ipopt_v3.8/doc/documentation.pdf (2010).
  * [39] G. Schildbach, A new nonlinear model predictive control algorithm for vehicle path tracking, in: Symposium on Advanced Vehicle Control, Munich, Germany, 2016, pp. 139–144.
  * [40] T. Englert, A. Völz, F. Mesmer, S. Rhein, K. Graichen, A software framework for embedded Nonlinear Model Predictive Control using a gradient-based augmented Lagrangian approach (GRAMPC), Optimization and Engineering 20 (2019) 769–809.  doi:10.1007/s11081-018-9417-2.
  * [41] A. Zanelli, A. Domahidi, J. L. Jerez, M. Morari, FORCES NLP: An efficient implementation of interior-point methods for multistage nonlinear nonconvex programs, International Journal of Control 93 (1) (2020) 13–29.  doi:10.1080/00207179.2017.1316017.
  * [42] ISO 26262:2018 Road vehicles – Functional safety, International standard, International Organization for Standardization, Geneva, CH (Dec. 2018).
  * [43] M. Conrad, Automated driving: Challenges in the interplay between functional safety and safety of the intended functionality, presented at SAE Automated Vehicle Security and Safety Technology Forum (SAE-AWC 2018), Shenzen, CH (2018).
URL https://vipread.com/library/topic/2054

  * [44] M. Werling, Ein neues Konzept für die Trajektoriengenerierung und -stabilisierung in zeitkritische Verkehrsszenarien, Ph.D. dissertation, Karlsruher Institut für Technologie, Karlsruhe, Germany (2011).
  * [45] T. Lubiniecki, S. Beer, A. Meisinger, F. Sellmann, P. Spannaus, G. Schildbach, Concept and implementation of an optimization-based safety verification strategy for a trajectory following controller, in: T. Bertram (Ed.), Automatisiertes Fahren 2020, Springer Vieweg, Wiesbaden, Germany, 2021, pp. 111–124.  doi:10.1007/978-3-658-34752-9_10.
  * [46] D. Swaroop, J. K. Hedrick, String stability of interconnected systems, IEEE Transactions on Automatic Control 41 (3) (1996) 349–357.  doi:10.1109/9.486636.
  * [47] E. Shaw, J. K. Hedrick, String stability analysis for heterogeneous vehicle strings, in: American Control Conference, New York (NY), United States, 2007, pp. 3118–3125.  doi:10.1109/ACC.2007.4282789.
  * [48] B. Wolfe, B. Seppelt, B. Mehler, B. Reimer, R. Rosenholtz, Rapid holistic perception and evasion of road hazards, Journal of Experimental Psychology: General 149 (3) (2020) 490–500.  doi:10.1037/xge0000665.