Simulation-Based Application of Safety of The Intended Functionality to Mitigate Foreseeable Misuse in Automated Driving Systems

TL;DR

This work frames Foreseeable Misuse (FM) within the Safety of the Intended Functionality (SOTIF) standard and develops a simulation-based testing procedure to mitigate FM in Automated Driving Systems (ADS). Building on prior simulation work, it defines test requirements, evaluation criteria, and an evaluation approach that leverages Conditional Probability Analysis (CPA) and a Foreseeable Misuse Evaluation Metric (FMEM) to quantify mitigation effectiveness. A concrete case study and workstation setup using CarMaker and a driving-sim environment illustrate how to derive FM scenarios, execute test-case series, and extract timing and control signals (TO, DelTO, H, H_t3, SWA) relevant to FM. Key findings indicate that delaying takeover can reduce Misjudgment (MJ) probability but may leave False Recognition (FR) high, underscoring the need for robust FM mitigation measures and real-world validation. Overall, the paper provides a structured, quantitative framework to assess and improve FM prevention strategies in ADS deployments.

Abstract

The development of Automated Driving Systems (ADS) has the potential to revolutionise the transportation industry, but it also presents significant safety challenges. One of the key challenges is ensuring that the ADS is safe in the event of Foreseeable Misuse (FM) by the human driver. To address this challenge, a case study on simulation-based testing to mitigate FM by the driver using the driving simulator is presented. FM by the human driver refers to potential driving scenarios where the driver misinterprets the intended functionality of ADS, leading to hazardous behaviour. Safety of the Intended Functionality (SOTIF) focuses on ensuring the absence of unreasonable risk resulting from hazardous behaviours related to functional insufficiencies caused by FM and performance limitations of sensors and machine learning-based algorithms for ADS. The simulation-based application of SOTIF to mitigate FM in ADS entails determining potential misuse scenarios, conducting simulation-based testing, and evaluating the effectiveness of measures dedicated to preventing or mitigating FM. The major contribution includes defining (i) test requirements for performing simulation-based testing of a potential misuse scenario, (ii) evaluation criteria in accordance with SOTIF requirements for implementing measures dedicated to preventing or mitigating FM, and (iii) approach to evaluate the effectiveness of the measures dedicated to preventing or mitigating FM. In conclusion, an exemplary case study incorporating driver-vehicle interface and driver interactions with ADS forming the basis for understanding the factors and causes contributing to FM is investigated. Furthermore, the test procedure for evaluating the effectiveness of the measures dedicated to preventing or mitigating FM by the driver is developed in this work.

Figures (2)

• Figure 1: Representation of a workstation setup to perform simulation-based testing of foreseeable misuse by the driver
• Figure 2: Probability Tree Diagram for Misjudgment (MJ) and False Recognition (FR)