Safety Monitor for Off-Road Planning with Uncertainty Bounded Bekker Costs

TL;DR

This work tackles the challenge of safe off-road autonomy under uncertain soil strength by introducing a runtime safety monitor that couples with any planner through an uncertainty-bounded Bekker-based traversal cost $C_{uc}$. The monitor enforces physical safety via maximum sinkage and rollover margins, switching to certified fallbacks (slower speed, increased standoff, or halt) when risk exceeds predefined limits. By bounding soil parameters with a margin $\delta$, the upper-cost $C_{uc}$ is computed analytically, and a deterministic rollover term $C_{roll}$ augments terrain risk, resulting in a transparent, physics-informed safety envelope that guides real-time interventions. Simulation experiments across loam to sand show that increasing $\delta$ reduces safety violations, at the cost of longer trajectories, with $\delta \approx 0.20$ offering a practical balance between safety and efficiency. The framework also informs vehicle design choices (powertrain, chassis, sensors) and supports certification through physics-based reliability metrics, while remaining lightweight enough for embedded deployment; future work includes hardware validation and adaptive uncertainty strategies.

Abstract

Reliable off-road autonomy requires operational constraints so that behavior stays predictable and safe when soil strength is uncertain. This paper presents a runtime assurance safety monitor that collaborates with any planner and uses a Bekker-based cost model with bounded uncertainty. The monitor builds an upper confidence traversal cost from a lightweight pressure sinkage model identified in field tests and checks each planned motion against two limits: maximum sinkage and rollover margin. If the risk of crossing either limit is too high, the monitor switches to a certified fallback that reduces vehicle speed, increases standoff from soft ground, or stops on firmer soil. This separation lets the planner focus on efficiency while the monitor keeps the vehicle within clear safety limits on board. Wheel geometry, wheel load estimate, and a soil raster serve as inputs, which tie safety directly to vehicle design and let the monitor set clear limits on speed, curvature, and stopping at run time. The method carries uncertainty analytically into the upper confidence cost and applies simple intervention rules. Tuning of the sinkage limit, rollover margin, and risk window trades efficiency for caution while keeping the monitor light enough for embedded processors. Results from a simulation environment spanning loam to sand include intervention rates, violation probability, and path efficiency relative to the nominal plan, and a benchtop static loading check provides initial empirical validation.

Figures (7)

• Figure 1: System overview showing integration of the Terrain Reliability Monitor (TRM) within the autonomous ground vehicle pipeline. The TRM observes perception, mapping, and planning outputs to detect unsafe terrain, apply $v_{min}$ velocity limits, pad high-cost regions, and trigger re-plans when necessary. Once stability is maintained for $N_s$ updates, the TRM returns to passive monitoring.
• Figure 2: Terrain and cost maps used in simulation. (A) Elevation used to compute $C_{roll}$ from slope. (B) Soil-type map assigning integer labels for Bekker parameter lookup. (C) Bounded Bekker cost $C_{uc}$ computed with $\delta = 0.2$. (D) Combined terrain cost $C_{total} = C_{uc} + \lambda C_{roll}$ with $\lambda = 2.5$.
• Figure 3: Runtime monitor intervention sequence. (A) True cost map revealed through sensing. (B) Detection of high-cost region. (C) Padded boundary based on vehicle escape distance. (D) Re-plan around unsafe region before timeout.
• Figure 4: Monitor slowdown behavior: high-cost detected, vehicle slows to $v_{min}=2$ m/s and restores nominal speed after $N_s=10$ safe updates.
• Figure 5: Re-plan within safe window: vehicle maintains low speed until new path is generated, then resumes nominal speed.